By the end of this document you will hopefully achieve what I have:

• Be running the latest stable release of PoPToP (1.1.4 at the time of this document).
• Patch your Linux kernel (2.6.6 as of this document) with MPPE and MPPC support.
• Patch the latest stable version of pppd (2.4.2 as of this document) with MPPE and MPPC support.
• Allow remote clients to connect to your network using the VPN server.
• Encrypt the VPN tunnel with the MPPE protocol.
• Compress the data in the tunnel with the MPPC protocol.
• Authentication done through MS CHAP-v2.
• Run your VPN server behind a Linux firewall utilizing iptables (optional, but still covered)

To start off, you will use the following applications/patches:

• PoPToP PPTP Server
• pppd
• Linux Kernel Source (2.6.6)
• MPPE/MPPC Kernel and pppd Patch by Jan Dubiec

Updates:

Installing and Patching Sources

Linux Kernel

I normally extract my kernel source into /usr/src and link to "linux". Extract the kernel, put the Kernel patch (linux-2.6.6-mppe-mppc-1.0.patch.gz) into the same directory, extract it, and patch the kernel as follows. Finally install it as you normally do.

PPP

After you finish patching and compiling the kernel (hopefully you have boot into it by now), it's now time to patch and install a copy of pppd. Make sure you have the pppd patch in the same directory as the pppd tar.gz (ppp-2.4.2-mppe-mppc-1.0.patch.gz).

PoPToP (pptpd)

Finally we compile an install a copy of the PoPToP PPTPD.

Now for configuring all of this.

Configuration

PoPToP (pptpd)

First let's setup the configuration file for PoPToP. By default it resides in /etc/pptpd.conf. Here is my configuration file:

Let's go over this line-by-line. The first line specifies the pppd configuration file, for the sake of this document (and my setup), we're going to use /etc/ppp/options-pptpd.

The second line is set to the IP address of the server's network interface (in my case, 172.19.1.6).

The line after that tells the the daemon what IP addresses to assign to incoming clients that connect to the server. In my configuration file it will give the IP addresses 172.19.1.30 to 172.19.1.50.

pppd

In the last section we setup the configuration file for our pptpd daemon. In the first line we specified the pppd configuration file. This is the one we're going to configure next. NOTE: for security sake, MAKE SURE that the /etc/ppp directory and everything in it are chmod'ed 700 and only root owns it.

My options-pptpd file looks like this:

The two lines that I had trouble with are the mschap-v2 and mppe lines.

My first mistake was that instead of putting "+mschap-v2" I was putting "chapms-v2" as I had in my configuration file that used an older version of pppd. Oddly enough pppd would not error out on this, but eventually after searching google I was able to find the correct syntax.

And lastly, I was not using the right syntax for the MPPE patch. Even though Jan Dubiec mentioned on his page that he uses a different syntax for initiating his patch, I neglected to pay attention to that and used the common "+mppe-128" line.

chap-secrects

Now we need to create the chap-secrets. This file belongs in /etc/ppp/chap-secrets. It is very important the this file be accessible by only root and no one else as it contains plaintext passwords.

# Client	Server	Password		IP Address
Serge	*	stupidpassword	*

This will allow the user "Serge" with the password "stupidpassword" to connect to this VPN server from any IP address.

Start Up

Now let's start everything up and see if it works (*crosses fingers*).

Start pptpd:

Let's check our /var/log/messages file to make sure it didn't fail...

Looks good!

Go to your Windows client (XP Pro in my case) and open "Network Connections."

Start the "New Connection Wizard." Choose "connect to the network at my workplace" ->
Choose "Virtual Private Network connection" ->
Enter a name for your connection ->
Enter the hostname of the VPN server ->
Click finish.

Go to the properties of this new connection. Click on the "Networking" tab ->
Double click on "Internet Protocol (TCP/IP)" ->
Click on "Advanced..." ->
Untick "Use default gateway on remote network."

This will prevent all your Internet traffic from running through the VPN server (not necessary to do this, but I do). Now for the real moment of truth. Trying to connect...

Connect

Enter your username and password in the connection dialog box and click "Connect." Monitor your /var/log/messages file, you should see something like this:

If you see this... CONGRATULATIONS! You have successfully setup a Linux-based PPTP VPN server capable of MPPC and MPPE using MS-CHAP v2 for handshake authentication.

VPN Server Behind Firewall (optional)

In the event that your VPN server is behind a Linux (iptables) firewall and you want to have access to it from the Internet, follow these quick instructions:

First of all, you must have "IP: GRE tunnels over IP" and "IP: broadcast GRE over IP" support in your kernel. Make sure you have that done, or else this might not work.

To forward the PPTP ports from your router's external interface (eth1 in my case, eth0 is my internal interface, 172.19.1.6 is my VPN server's internal IP) to your VPN server, use this iptables rule set:

Conclusion

Hope that this document has helped some of you in some way or another. Happy VPN'ing!