One day, tired of having to open ports and more ports for everything I wanted to do with the Linux server I have at home, I decided to do something to be able to connect directly to that machine and have all services available to me without having to create one by one. The solution was clear, establish a VPN to the server and automatically have access to all available services. The main problem when establishing virtual network was that it had to be simple, quick to create and, above all, do not need additional software as well could use it from any computer at any location. Moreover, if I rode well have a perfect system to provide remote support to my sisters via VNC without having to open up these ports
.
By default all Windows computers come standard with a VPN client that can contectarse virtual private networks, but not of any kind, only PPTP . We could have chosen another system based on IPsec or OpenVPN , but would need additional software cerfied well at both ends of the VPN, which does not meet the requirements that we had imposed. PPTP is a protocol developed by Microsoft (hence comes standard Windows) and, because of that, has been slow to be a customer (and even a server) that works under Linux. Not the most secure VPN protocols
but let it discharges its functions.
The idea is, therefore, set up a PPTP server on Linux. Once we see how to connect server both Linux and Windows. Although the idea of this article is a domestic environment is fully applicable to small businesses who need remote access to their employees without complicating their lives and make large outlays dedicated routers or on a Windows server (understanding this as a machine with a Windows Server
.
PPTP Server on Linux
Let enrevesar a little more our server. For more versatility will give the user authentication is performed via a server Radius can subsequently be used to authenticate any other service you can think of (ftp, email, wireless hotspot ...).
I think it is too simple, we complicate it further. The Radius server authenticate, likewise, against a database MySQL , which have a very easy to manage without having to be touching text files to create new users. The scenario is therefore Radius PPTP + + MySQL.
As software we use:
- Linux Server, Centos 5.2 in my case.
- PopTop, PPTP server under Linux.
- PPTP Client , PPTP client under Linux.
- FreeRadius as Radius server.
- Radiusclient as Radius client, that can query the server PopTop Radius.
To install the software, in my case, nothing simpler. First, install the yum repository PopTop:
- rpm-Uvh http://poptop.sourceforge.net/yum/stable/fc7/pptp-release-current.noarch.rpm
And you can install all the software:
- freeradius freeradius-mysql radiusclient pptp pptpd yum - enablerepo = poptop-stable install freeradius-mysql freeradius pptp pptpd radiusclient
I think that that would be enough and would have everything you need. We assume, of course, you already have MySQL installed.
Formerly it was more complicated than installing PopTop and had to patch the kernel, but today, if your core is higher than 2.6.15 (if not, what are you waiting for update?), Do not need this step. Anyway, if you had to do it, is completely safe, I did it myself for a long time. On the website of PopTop have the instructions for it.
Assuming you've installed all the software correctly without any problem, and we just set each and every one of the steps that make up our VPN server.
Configuring PopTop
The first thing to do is decide that you will use in your VPN address. In my case I have one independent of everything else (192.168.3.0), so I can manage it at will, allowing or denying what I can think of a simple way. The following configuration files indicated to tinker and as I have mine.
/ Etc / pptpd.conf
- # cat /etc/pptpd.conf [Osus @ server ~] # cat / etc / pptpd.conf
- option / etc / ppp / options.pptpd
- 192.168 localip -5 .3 .1
- remoteip 192,168 .3 .6 -10
The parameter localip have IP's that use your local server and each time you get a connection while in remoteip you will indicate which will give clients dynamically. 'll Have to put a wide enough range to cover possible simultaneous connections you may have.
/ Etc / ppp / options.pptpd
- # cat /etc/ppp/options.pptpd [Osus @ server ~] # cat / etc / ppp / options.pptpd
- name pptpd
- refuse-pap
- refuse-chap
- refuse-mschap
- require-mschap-v2
- -128 mppe require-
- proxyarp
- lock
- nobsdcomp
- novj
- novjccomp
- nologfd
- radius.so plugin
It is recommended that consultases man pages to find out what each parameter does.
As you can see the end of all indicate the PPTP server using the pluggin for Radius, so we configure everything on Radius.
Configuring FreeRadius
/ Etc / raddb / clients.conf
- # cat /etc/raddb/clients.conf [Osus @ server ~] # cat / etc / raddb / clients.conf
- client .0 .1 127.0 {
- secret = TUCLAVESECRETA
- shortname = localhost
- }
We indicate, for each radius server we have, a connection key and name. The key customers will use to query the server radius. Normally in an environment like ours is that the Radius server is the same VPN server resides.
The following file is the most important because it tells requests FreeRadius to authenticate against a MySQL server. As long put only the relevant parts:
/ Etc / raddb / radiusd.conf
- mschap {
- authtype = MS-CHAP
- use_mppe = yes
- require_strong = yes
- }
- authorize {
- preprocess
- mschap
- suffix
- eap
- sql
- }
- authenticate {
- Auth-Type MS-CHAP {
- mschap
- }
- eap
- }
- preacct {
- preprocess
- suffix
- files
- }
- accounting {
- detail
- acct_unique
- sql
- }
- session {
- sql
- }
In / etc / raddb / sql.conf must properly configure access to your MySQL database, server, user, password and database that we will see a little later.
Configuring RADIUS client
/ Etc / radiusclient / servers
- # cat /etc/radiusclient/servers [Osus @ server ~] # cat / etc / radiusclient / servers
- localhost TUCLAVESECRETA
Where the key is the same as that put in / etc / raddb / localhost clients.conf and your address if different server that has the pptpd.
In / etc / radiusclient dictionary.microsoft you have the file. I remember I had some problems with it, just in case I leave the one I have now is not coming by default.
In / etc / radiusclient / radiusclient.conf sure you have the following parameters pointing to the IP of your Radius server if not the same VPN server resides:
- authserver localhost
- acctserver localhost
If they are different to localhost, do not forget to configure here.
Creating the MySQL database
We got to the last step.
Create a new database (create database radius) and a user with permissions to it. Remember now configure / etc / raddb / sql.conf with these data.
Now create the structure of the database. With FreeRadius package is the structure you need.
- radius mysql </ usr / share / doc / freeradius -1.1 0.3 / examples / mysql.sql
The step that follows always ignore it when someone explains how to configure FreeRadius with MySQL and believe me it is not intuitive.
How to fill the tables of authentication?
Good question Manel
.
- Table radcheck: user accounts maintained with the following fields:
- UserName: username.
- Categories: Password (literally, not the key but the word User Password).
- op: == (two equal signs).
- Value: User key.
- Table radreply: contains initialization parameters that connect customers. Here I set up the IP's that mean to certain customers for reasons of convenience. I also indicated that only allow simultaneous connection with the same user.
- UserName: user name you are configuring (as introduced in Table radcheck).
- Attribute: the word Framed-IP-Address or Simultaneous-Use, as you indicate the IP assigned to that user or the maximum number of sessions with the same name.
- op: = (single equal sign)
- Value: 192.168.3.99 (the IP you want) or the maximum number of simultaneous connections to the same user.
- Table usergroup, grouping users into groups.
- UserName: user name
- GroupName: group name.
RadAct table contains the server activity log, sessions initiated, duration, etc..
Last steps
Remember to open in your router and / or firewall port 1723 for allowing incoming connections as it is used by the PPTP protocol.
Although as discussed below can audit the Radius server connections (and therefore the VPN server) can be interesting to have a warning mechanism that a client is connected. One way is to view the network interfaces available on the server (ifconfig), there will be many pppX as active users. But there is another method that allows you to receive, for example by email, a notice each time a user connects or disconnects.
Every time you get ppp interface runs the script / etc / ppp / ip-up.local with all parameters relating to that connection, remote IP, local, interface ... also when disconnected launches / etc / ppp / ip -down.local. should only adapt this script to our needs. These scripts are all required parameters to identify the user. We would do something, for example to ip-up.local.
- # / Bin / sh
- "$5" == "192.168.3.10" ] if ["$ 5" == "192.168.3.10"]
- then
- client = "pepito"
- fi
- echo "VPN Connection
- Interface: $ 1
- Local VPN: $ 4
- VPN Remote: $ 5
- Remote IP: $ 6
- 1: $ 1
- 2: $ 2
- 3: $ 3
- 4: $ 4
- 5: $ 5
- 6: $ 6
- <a href= "mailto:osus@osusnet.com" >osus@tudominio.com</a> "| Mail-s" VPN Connection - $ client "<a href= "mailto:osus@osusnet.com"> osus@tudominio.com </ a>
Thus you would receive an email every time a user picks up a VPN tunnel to your server and you'd know what IP is the user and if you've given a fixed IP address in the RADIUS configuration, you will know which user is, in this case "pepito ".
With IP-down.local such a script would only instead of VPN connection in an email subject would put Disconnecting VPN. Parameters are exactly the same.
These scripts can also use them to create / modify / delete routes based certain tunnels created.
The package itself will be installed pptpd startup script necessary in my case / etc / init.d / pptpd. I just have to add it to the boot runlevel automatically from my server and the service is always available.
In theory, all the vpn's made against routing server have each other, meaning you could get from one client to another through the server without fiddling around. I say theoretically because that is the function of the parameter proxyarp we configured earlier. This routing may not be enough and you need VPN clients can access other subnets of your infrastructure. You can do as you like, even setting up a bridge , but for these things any better than iptables .
Consider a scenario where we have a local lan part our server (address 192.168.0.0) and create new network for VPN's (address 192.168.3.0). To enable full routing between the two networks would do something like:
- # / Bin / sh
- >/proc/sys/net/ipv4/ip_forward echo 1> / proc/sys/net/ipv4/ip_forward
- LAN = "192.168.0.0/16"
- VPN2 = "192.168.3.0/24"
- -j ACCEPT iptables-A FORWARD-s $ LAN-d $ VPN2-j ACCEPT
- -m state –state ESTABLISHED,RELATED -j ACCEPT iptables-A FORWARD-s $ VPN2-d $ LAN-m state-state ESTABLISHED, RELATED-j ACCEPT
- iptables-t nat-A POSTROUTING-d $ VPN2-j MASQUERADE
Single. If we wanted only certain users to the local network accediesen would modify the variable IP VPN2 the radius gives the user.
FreeRadius from a web environment, dialup_admin
Okay, it's true, it's a pain in the ass to manage FreeRadius and all its parameters, so what better than a simple web environment for user management and visualization of business and system log. This utility is dialup_admin . I shall not be installed because I think it comes out this article and in addition is a simple web application without much difficulty.
With this tool it will be much easier to create users and their properties and keep track of who is connected, connection periods have, etc..
Establishing VPN from Windows
Very simple. From Network Connections, you create a new connection, choose Connect to the network at my workplace and is basically just enter the hostname or IP of your VPN server host and connect. I recommend unchecking the Use default gateway on remote network in the properties of this new connection, Networking, TCP / IP, Advanced, otherwise all normal Internet traffic you will through the VPN.
If all goes well will connect to your server and get access to it as if you were on your own local network.
Establishing VPN from Linux
Since Linux is a tad more complicated because, as usual, to do the configuration manually. There is a graphical utility for creating connections in a similar way to Windows, but rather explain how to do it from the console if your machine has no graphical environment.
- # cat /etc/ppp/options.pptp [Osus @ server ~] # cat / etc / ppp / options.pptp
- lock
- noauth
- refuse-eap
- refuse-chap
- refuse-mschap
- nobsdcomp
- nodeflate
We now indicate the username and password used to connect. IdentificadorRed is the name we give to the connection, you can be anything you want.
- # cat /etc/ppp/chap-secrets [Osus @ server ~] # cat / etc / ppp / chap-secrets
- IdentificadorRed user key *
Now create the configuration for the connection that you are creating with IdentificadorRed we discussed earlier. In TUIP must put the hostname or IP of your VPN server.
- # cat /etc/ppp/peers/IdentificadorRed [Osus @ server ~] # cat / etc / ppp / peers / IdentificadorRed
- remotename IdentificadorRed
- linkname IdentificadorRed
- ipparam IdentificadorRed
- pty "pptp-nolaunchpppd TUIP"
- User name
- require-mppe
- require-mschap-v2
- refuse-eap
- refuse-pap
- refuse-chap
- refuse-mschap
- # Demand
- holdoff 5
- persist
- maxfail 0
- ipcp-accept-remote
- ipcp-accept-local
- noauth
- 192.168 .3 .1: 3 .254 192.168
Here are two interesting options:
- persist: recreated automatically if the tunnel is cut off for some reason so that is always active.
- demand: automatically creates the tunnel when accessing the server IP or some other that are routed through this tunnel, while not required inactive. Should obviously not be so persist otherwise is always active.
Finally, we create a simple startup script to automatically launch or just for not having to remember the parameters.
- # cat /etc/init.d/IdentificadorRed [Osus @ server ~] # cat / etc / init.d / IdentificadorRed
- # / Bin / sh
- in case "$ 1" in
- start)
- echo-n "Starting VPN IdentificadorRed"
- Echo
- touch / var / lock / subsys / pptpd
- / Usr / sbin / pppd call IdentificadorRed logfd 1 updetach &
- ;;
- stop)
- echo-n "Stopping VPN IdentificadorRed"
- Echo
- -n 1 /var/run/ppp-IdentificadorRed.pid` kill-TERM `head-n 1 / var / run / ppp-IdentificadorRed.pid`
- ;;
- *)
- echo "Usage: $ 0 {start | stop}"
- exit 1
- esac
- exit 0
And that's all folks. It took me quite longer than expected to write this article because as I was writing I was jumping new memories about details that should be appointed.
Note that my experience with PPTP goes back five years ago so it might have changed some detail in recent years. After that first VPN server last year we moved to CentOS5 OS and reconfigure the VPN server virtually all parameters left as they were. I do not think that you have no problem in solving some small detail that may arise.











