PPTP Tunneling

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 02:02, 15 February 2007 (edit)
Whiteboy (Talk | contribs)

← Previous diff
Revision as of 05:06, 5 January 2008 (edit) (undo)
SirSilentBob (Talk | contribs)
(Fixing routing from server to client network)
Next diff →
Line 177: Line 177:
Change xxx.xxx.xxx.xxx to the public ip address of the client. Change xxx.xxx.xxx.xxx to the public ip address of the client.
Change 192.168.0.0/24 to the subnet range of the client. Change 192.168.0.0/24 to the subnet range of the client.
 +
 +==Note on the CLIENTIP field==
 +Brief note from SirSilentBob on Jan. 8th 2008:
 +
 +In the CLIENTIP field in the top of the script shown above, you can specify a dynamic domain name instead of an ip address to allow both ends of the connection to remain connected to each other despite ISP ip address changes on either side! If you use a dynamic dns provider that the integrated INADYN updater supports, and set up both routers to auto-update it if any changes occur, then you will be able to easily maintain a "permanent" PPTP tunnel between two routers with dynamic ip addresses with no extra programs running on any of the computers on either side of the network.
 +
 +This was tested by myself and done with V24 builds RC3 and RC5, between two Buffalo WHR-G125 routers, one of them on Verizon FIOS internet, and the second on Cox Highspeed internet. No-Ip.com was used as the dynamic DNS service on both routers. RC4, and other builds may work, but I have not tested these myself. As always, YMMV.
 +
 +SEE BELOW BOX FOR AN EXAMPLE OF THE ABOVE IMPLEMENTED:
 +
 +<pre>CLIENTIP=youraccount.yourdnsprovider.net
 +CLIENTNETWORK=192.168.0.0/24
 +
 +echo "if [ $CLIENTIP == \$6 ]; then" >> /tmp/pptpd/ip-up
 +echo " /usr/sbin/ip route add $CLIENTNETWORK dev \$1" >> /tmp/pptpd/ip-up
 +echo "fi" >> /tmp/pptpd/ip-up
 +
 +echo "if [ $CLIENTIP == \$6 ]; then" >> /tmp/pptpd/ip-down
 +echo " /usr/sbin/ip route delete $CLIENTNETWORK dev \$1" >> /tmp/pptpd/ip-down
 +echo "fi" >> /tmp/pptpd/ip-down
 +</pre>
==See also== ==See also==

Revision as of 05:06, 5 January 2008

The configuration below was tested using two WRT54G (Hardware v2.2) and DD-WRT v23 SP1 std.

(Update: The mini version of v23 SP1 may work better than standard, because the free memory will help.)

Note: In v23SP2 Final this configuration does not work. Please check bugtracker ID 0001811

(Missing routes can be added manually with a "ip route add 192.168.x.0/24 dev ppp0" or similar)

Have a look at #Fixing routing from server to client network for a script solution.


The purpose of this setup is to connect to any IP Address on network A or B from network A or B.

  • Network A in location "a"
Router A address 192.168.1.1
DHCP range 192.168.1.100-150
Dyndns address "direccion_de_A.dyndns.org"
  • Network B in location "b"
Router B address 192.168.2.1
DHCP range 192.168.2.100-150
Dyndns address "direccion_de_B.dyndns.org"

Contents

Configuration

For Both Routers

  1. Goto "Administration" tab and "Management" sub-tab
  2. Enable DNSmasq and Local DNS
  3. Disable Loopback
  4. Set Maximum Ports:4096
  5. Set TCP Timeout: 3600
  6. Set UDP Timeout: 3600

http://img237.imageshack.us/img237/9766/loopbackzs4.jpg

Note: Loopback must be disable because VPN doesn't always work when it is enabled.

http://img366.imageshack.us/img366/1888/ipfiltersettingssq5.jpg

Router A

Router B > VPN > Router A

  1. Goto "Administration" tab and "Services" sub-tab
  2. Enable PPTP Server
  3. Set "Server IP or DNS Name" to "192.168.1.1"
  4. Set "Client IP(s)" to "192.168.1.200-250"
  5. Set "CHAP-Secrets" to "usernameA * passwordA *"
  6. Apply Changes

Router A > VPN > Router B

  1. Goto "Administration" tab and "Services" sub-tab
  2. Enable PPTP Client
  3. Set "Server IP or DNS Name" to the location of Server B (direccion_de_B.dyndns.org)
  4. Set "Remote Subnet" to "192.168.2.0"
  5. Set "Remote Subnet Mask" to 255.255.255.0
  6. Set "MPPE Encryption" to "mppe required"
  7. Set "MTU" to 1450
  8. Set MRU to 1450
  9. Set Username to usernameB
  10. Set password to passwordB
  11. Apply Changes

http://img162.imageshack.us/img162/22/ruteadora6ir.jpg

Router B

Router A > VPN > Router B

  1. Goto "Administration" tab and "Services" sub-tab
  2. Enable PPTP Server
  3. Set "Server IP or DNS Name" to "192.168.2.1"
  4. Set "Client IP(s)" to 192.168.2.200-250"
  5. Set "CHAP-Secrets" to "usernameB * passwordB *"
  6. Apply Changes

Router B > VPN > Router A

  1. Goto "Administration" tab and "Services" sub-tab
  2. Enable PPTP Client
  3. Set "Server IP or DNS Name" to the location of Server A (direccion_de_A.dyndns.org)
  4. Set "Remote Subnet" to "192.168.1.0"
  5. Set "Remote Subnet Mask" to 255.255.255.0
  6. Set "MPPE Encryption" to "mppe required"
  7. Set "MTU" to 1450
  8. Set MRU to 1450
  9. Set Username to usernameA
  10. Set password to passwordA
  11. Apply Changes

http://img73.imageshack.us/img73/4391/ruteadorb3nn.jpg

Notes

  • The subnets should not intersect each other (i.e. The third octet of direction IP (192.168.thirdoctet.1) of the network A must be different of the network B.
  • The range of Client IP(s) must be outside the range of DHCP clients.
  • In the example the IP range that occurred for clients vpn ("Client IP(s)") was 192.168.x.200-250 therefore 51 VPN clients allowed
  • This is a whammie if you miss it. Don't forget to enable "PPTP Passthrough" if you are using the SPI firewall as found on the SECURITY tab.

Monitoring

To monitoring and guarantee the connection you can setup Watchdog. The following instructions will setup watchdog to monitor the connection every five minutes (update: works better with 9999 seconds).

On both routers:

  1. Goto "Administration" tab and "Keep Alive" sub-tab.
  2. Enable Watchdog
  3. Set "Interval" to 300
  4. Set IP Addresses to "192.168.1.200 192.168.2.200"

http://img201.imageshack.us/img201/9416/keepaliveye2.jpg


Final Words

  • Some times the connection takes minutes in completing itself (more or less 30 minutes), some times is instantaneous.
  • You can check routing table in setup tab, advanced routing subtab, show routing table botton

if there are 6 lines like:

WAN_IP_ADRESS 255.255.255.255 0.0.0.0 WAN
192.168.Y.1 255.255.255.255 0.0.0.0 WAN
192.168.X.200 255.255.255.255 0.0.0.0 WAN
192.168.Y.0 255.255.255.0 0.0.0.0 WAN
192.168.X.0 255.255.255.0 0.0.0.0 LAN & WLAN
0.0.0.0 0.0.0.0 WAN_IP_ADRESS WAN

Your vpn tunnel must be established and working!!!


Fixing routing from server to client network

To fix the routing problem stated above you can try the folowing script as a startup script:

CLIENTIP=xxx.xxx.xxx.xxx
CLIENTNETWORK=192.168.0.0/24

echo "if [ $CLIENTIP == \$6 ]; then"				>> /tmp/pptpd/ip-up
echo "	/usr/sbin/ip route add $CLIENTNETWORK dev \$1"		>> /tmp/pptpd/ip-up
echo "fi"							>> /tmp/pptpd/ip-up

echo "if [ $CLIENTIP == \$6 ]; then"				>> /tmp/pptpd/ip-down
echo "	/usr/sbin/ip route delete $CLIENTNETWORK dev \$1"	>> /tmp/pptpd/ip-down
echo "fi"							>> /tmp/pptpd/ip-down

Change xxx.xxx.xxx.xxx to the public ip address of the client. Change 192.168.0.0/24 to the subnet range of the client.

Note on the CLIENTIP field

Brief note from SirSilentBob on Jan. 8th 2008:

In the CLIENTIP field in the top of the script shown above, you can specify a dynamic domain name instead of an ip address to allow both ends of the connection to remain connected to each other despite ISP ip address changes on either side! If you use a dynamic dns provider that the integrated INADYN updater supports, and set up both routers to auto-update it if any changes occur, then you will be able to easily maintain a "permanent" PPTP tunnel between two routers with dynamic ip addresses with no extra programs running on any of the computers on either side of the network.

This was tested by myself and done with V24 builds RC3 and RC5, between two Buffalo WHR-G125 routers, one of them on Verizon FIOS internet, and the second on Cox Highspeed internet. No-Ip.com was used as the dynamic DNS service on both routers. RC4, and other builds may work, but I have not tested these myself. As always, YMMV.

SEE BELOW BOX FOR AN EXAMPLE OF THE ABOVE IMPLEMENTED:

CLIENTIP=youraccount.yourdnsprovider.net
CLIENTNETWORK=192.168.0.0/24

echo "if [ $CLIENTIP == \$6 ]; then"				>> /tmp/pptpd/ip-up
echo "	/usr/sbin/ip route add $CLIENTNETWORK dev \$1"		>> /tmp/pptpd/ip-up
echo "fi"							>> /tmp/pptpd/ip-up

echo "if [ $CLIENTIP == \$6 ]; then"				>> /tmp/pptpd/ip-down
echo "	/usr/sbin/ip route delete $CLIENTNETWORK dev \$1"	>> /tmp/pptpd/ip-down
echo "fi"							>> /tmp/pptpd/ip-down

See also

PPTP_Server_Configuration
HOW_TO_configure_a_WINDOWS_BOX_to_make_a_VPN_Connection_to_linksys

External Links

http://www.dd-wrt.com/phpBB2/viewtopic.php?t=1767 http://www.dd-wrt.com/dd-wrtv2/bugtracker/