Static PPTP VPN Client

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 01:43, 1 March 2006 (edit)
Cmturner2 (Talk | contribs)
m
← Previous diff
Revision as of 01:45, 1 March 2006 (edit) (undo)
Cmturner2 (Talk | contribs)
m
Next diff →
Line 38: Line 38:
You will need to enable JFFS through nvram <div style='color:red;font-weight:bold'>AND</div> via the web interface - this was the only way we were able to reliably have the JFFS partition function as intended. You will need to enable JFFS through nvram <div style='color:red;font-weight:bold'>AND</div> via the web interface - this was the only way we were able to reliably have the JFFS partition function as intended.
-= Add Additional REMOTE Networks =+= Add Additional Remote Networks =
Larger companies often have multiple networks (because of multiple regional offices for example). Using the method below you can add as many additional networks to be routed through your VPN tunnel as you desire. Larger companies often have multiple networks (because of multiple regional offices for example). Using the method below you can add as many additional networks to be routed through your VPN tunnel as you desire.
Line 69: Line 69:
chmod 700 /jffs/etc/config/my_startup.sh chmod 700 /jffs/etc/config/my_startup.sh
-== Create the Subnet Scripts ==+== Create the Network Scripts ==
Create /jffs/etc/config/addnet#.startup script for each additional network you require access to on the corporate network. In the example below our company has a second subnet of 10.20.30.0/24 Create /jffs/etc/config/addnet#.startup script for each additional network you require access to on the corporate network. In the example below our company has a second subnet of 10.20.30.0/24

Revision as of 01:45, 1 March 2006

Contents

I'm in the middle of writing this, you might want to wait an hour or so until I am done.

Introduction

Generally companies provide a VPN connection for their employees when they need to connect to corporate resources from outside the office. Often the VPN connection is something as simple as the VPN Connection built by the connection wizard in Windows. However the downside is that when you are connected to the corporate VPN in this way all network traffic from that host goes to and through the company proxies, makes requrests of their DNS servers, etcetera - not the optimal configuration. Especially if the company blocks access to internet sites or services you wish to visit.

So, for all of us Couch Warriors out there (a.k.a. those of us lucky enough to be allowed to work from home) there is a need to have a persistent static VPN connection from our home offices to the corporate VPN that is seperate from the rest of the traffic bound for the glorious unfettered Internet. And this document intends to be a HOW-TO for this scenario - if you're already using a DD-WRT enabled router and have it configured, simply use the portions of this HOW-TO appropriate to you.

Much of this information was gathered from other pages on this wiki and the DD-WRT forums - see the credits at the end of this document.

Requirements

You will require the following things to successfully follow this HOW-TO:

  • A router capable of running the DD-WRT Firmware (we'll be assuming the WRT54G & WRT54GS in this HOW-TO).
  • The dd-wrt.v23.mini (WRT54G) or dd-wrt.v23.std (WRT54GS) firmware appropriate for your specifc router.
  • The latest firmware from your router's manufacturer.
  • The VPN Server information for your corporate VPN.

Disclaimer: As with most free information, everything you do is at your OWN risk, we take no responsibility for your actions.

Further Assumptions

  • You are capable of configuring your router to establish the basic connection to your ISP.
  • You have a client machine that is capable of making an SSH connection to the router.


Getting Started (Here Begins The "HOW-TO")

Load the DD-WRT Firmware

Choose the version of DD-WRT firmware appropriate for your router. If you have a WRT54G you have a shortage of memory, and will need to use the mini version of the firmware, if you have the WRT54GS model you should use the feature rich standard version of the firmware. If you have a need for any of the other versions of the firmware, your may or may not be able to use the methods in this HOW-TO (they're simply untested).

In short, follow the excellent instructions found here.
Here are the LinkSys Firmware Downloads if you need them to get to 'Factory Fresh'.

Set up Basic Configuration

At this point, set all the configurations you need to or desire to get your router and LAN online with your ISP. This stage is all you. As a general rule of thumb however, don't turn on features you don't need.

Activate the JFFS Partition

Follow the excellent instructions found here to enable the JFFS partition on your router.

You will need to enable JFFS through nvram
AND
via the web interface - this was the only way we were able to reliably have the JFFS partition function as intended.

Add Additional Remote Networks

Larger companies often have multiple networks (because of multiple regional offices for example). Using the method below you can add as many additional networks to be routed through your VPN tunnel as you desire.


Configure Router To Run Your Startup Scripts

First we set rc_startup to launch our 'controller' startup script.

nvram set rc_startup="sh /jffs/etc/my_startup.sh"
nvram commit

Now we create our 'my_startup.sh' script:

vi /jffs/etc/config/my_startup.sh

Enter the following into the editor and save.

#!/bin/sh
for I in `/bin/ls /jffs/etc/config/*.startup`
do
   sh $I&
done

Quick vi Tutorial for Windows users: i - inserts, ESC:wq - exits editing mode, writes your changes, and quits vi

Ensure the permissions enable the script to be run:

chmod 700 /jffs/etc/config/my_startup.sh

Create the Network Scripts

Create /jffs/etc/config/addnet#.startup script for each additional network you require access to on the corporate network. In the example below our company has a second subnet of 10.20.30.0/24

/jffs/etc/config/addnet1.startup:

#!/bin/sh

#First we sleep for 2 minutes...we want to wait for ppp0 to come up.
sleep 120

#Now we can proceed with the iptables rules needed for this subnet.
REMOTESUB=10.20.30.0
REMOTENET=255.255.255.0
INT=ppp0
  /sbin/route add -net $REMOTESUB netmask $REMOTENET dev $INT
  /usr/sbin/iptables --insert OUTPUT --source 0.0.0.0/0.0.0.0 --destination $REMOTESUB/$REMOTENET --jump ACCEPT --out-interface $INT
  /usr/sbin/iptables --insert INPUT --source $REMOTESUB/$REMOTENET --destination 0.0.0.0/0.0.0.0 --jump ACCEPT --in-interface $INT
  /usr/sbin/iptables --insert FORWARD --source 0.0.0.0/0.0.0.0 --destination $REMOTESUB/$REMOTENET --jump ACCEPT --out-interface $INT
  /usr/sbin/iptables --insert FORWARD --source $REMOTESUB/$REMOTENET --destination 0.0.0.0/0.0.0.0 --jump ACCEPT --in-interface $INT
  /usr/sbin/iptables --table nat --append POSTROUTING --out-interface $INT --jump MASQUERADE
  /usr/sbin/iptables --insert FORWARD --protocol tcp --tcp-flags SYN,RST SYN --jump TCPMSS --clamp-mss-to-pmtu
exit 0

Ensure the permissions enable the script to be run:

chmod 700 /jffs/etc/config/my_startup.sh

Reboot your router:

reboot

Credits

  • Peter Frischknecht - Worked out the final details on our experimental WRT54GS to provide the first working solution.
  • Curtis Turner - Contributed moral support and technical information, along with motivation for Peter. Performed WRT54G testing.
  • The JFFS Wiki Page


Site Index

An Alphabetical Ordered Index of all DD-WRT Docu (EN) pages.


You are here: Main Page/DD-WRT Docu (EN)/Static PPTP VPN Client