Static PPTP VPN Client

From DD-WRT Wiki

Revision as of 02:28, 1 March 2006 by Cmturner2 (Talk | contribs)
Jump to: navigation, search

Contents

Introduction

Generally companies provide a VPN connection for their employees when they need to connect to corporate resources from outside the office. Often the VPN connection is something as simple as the VPN Connection built by the connection wizard in Windows. However the downside is that when you are connected to the corporate VPN in this way all network traffic from that host goes to and through the company proxies, makes requrests of their DNS servers, etcetera - not the optimal configuration. Especially if the company blocks access to internet sites or services you wish to visit.

So, for all of us Couch Warriors out there (a.k.a. those of us lucky enough to be allowed to work from home) there is a need to have a persistent static VPN connection from our home offices to the corporate VPN that is seperate from the rest of the traffic bound for the glorious unfettered Internet. And this document intends to be a HOW-TO for this scenario - if you're already using a DD-WRT enabled router and have it configured, simply use the portions of this HOW-TO appropriate to you.

Much of this information was gathered from other pages on this wiki and the DD-WRT forums - see the credits at the end of this document.

Requirements

You will require the following things to successfully follow this HOW-TO:

  • A router capable of running the DD-WRT Firmware (we'll be assuming the WRT54G & WRT54GS in this HOW-TO).
  • The dd-wrt.v23.mini (WRT54G) or dd-wrt.v23.std (WRT54GS) firmware appropriate for your specifc router.
  • The latest firmware from your router's manufacturer.
  • The VPN Server information for your corporate VPN.

Disclaimer: As with most free information, everything you do is at your OWN risk, we take no responsibility for your actions.

Further Assumptions

  • You are capable of configuring your router to establish the basic connection to your ISP.
  • You have a client machine that is capable of making an SSH connection to the router.

If you have all of the above we are ready to begin.

Getting Started (Here Begins The "HOW-TO")

Load the DD-WRT Firmware

Choose the version of DD-WRT firmware appropriate for your router. If you have a WRT54G you have a shortage of memory, and will need to use the mini version of the firmware, if you have the WRT54GS model you should use the feature rich standard version of the firmware. If you have a need for any of the other versions of the firmware, your may or may not be able to use the methods in this HOW-TO (they're simply untested).

In short, follow the excellent instructions found here.
Here are the LinkSys Firmware Downloads if you need them to get to 'Factory Fresh'.

Set up Basic Configuration

At this point, set all the configurations you need to or desire to get your router and LAN online with your ISP. This stage is all you. As a general rule of thumb however, don't turn on features you don't need.

Activate the JFFS Partition

Follow the excellent instructions found here to enable the JFFS partition on your router.

You will need to enable JFFS through nvram AND via the web interface - this was the only way we were able to reliably have the JFFS partition function as intended.

Configure PPTP Client

A very nice feature is the inclusion of a ready-to-go PPTP client configuration in the Web Interface. It has some limitations (addressed further along in this HOW-TO) but for many users you don't need anything more that what you get in the Web Interface.

Browse on over to Administration - Services.

Enable the PPTP Client and, Save Settings

Return to the PPTP Client settings, and configure them as appropriate for your corporate VPN.

PPTP Client Options

Server IP or DNS Name The IP Address of your company VPN server (Don't use the FQDN, use the IP address for best results)
Remote Subnet Use the Network Address for the Remote Network (10.20.1.0 for example)
Remote Subnet Mask Use the Subnet Mask Appropriate for the Remote Network (255.255.255.0 for example)
User Name Your Remote PPTP Network Domain\Username (YOURCORP\\johndoe for example. BOTH backslashes are necessary.)
Password Your Remote PPTP Network Password (p@ssw0rd for example)

Save Settings and Reboot your router. You should now have a basic PPTP VPN connection to your office.

Add Additional Remote Networks

Larger companies often have multiple networks (because of multiple regional offices for example). Using the method below you can add as many additional networks to be routed through your VPN tunnel as you desire.

Configure Router To Run Your Startup Scripts

Ensure that SSHD is enabled on your router (Administration - Services tab) and SSH into your router. Note that you should replace the IP address in the line below with whatever the actual IP address of your router is on the LAN side.

#ssh -u admin 192.168.1.1

If you are a Windows user, you can find a fine SSH client in PuTTY. You will need to learn to configure and use PuTTY on your own, however.

First we set rc_startup to launch our 'controller' startup script.

nvram set rc_startup="sh /jffs/etc/my_startup.sh"
nvram commit

Ensure the directories needed exist:

mkdir -p /jffs/etc/config

Now we create our 'my_startup.sh' script:

vi /jffs/etc/config/my_startup.sh

Enter the following into the editor and save.

#!/bin/sh
for I in `/bin/ls /jffs/etc/config/*.startup`
do
   sh $I&
done

Quick vi Tutorial for Windows users: i - inserts, ESC:wq - exits editing mode, writes your changes, and quits vi

Ensure the permissions enable the script to be run:

chmod 700 /jffs/etc/config/my_startup.sh

Create the Network Scripts

Create a /jffs/etc/config/addnet#.startup script for each additional network range you require access to on the corporate network. In the example below our company has a second subnet of 10.20.30.0/24

Example /jffs/etc/config/addnet1.startup:

#!/bin/sh

#First we sleep for 2 minutes...we want to wait for ppp0 to come up.
sleep 120

#Now we can proceed with the iptables rules needed for this subnet.
REMOTESUB=10.20.30.0
REMOTENET=255.255.255.0
INT=ppp0
  /sbin/route add -net $REMOTESUB netmask $REMOTENET dev $INT
  /usr/sbin/iptables --insert OUTPUT --source 0.0.0.0/0.0.0.0 --destination $REMOTESUB/$REMOTENET --jump ACCEPT --out-interface $INT
  /usr/sbin/iptables --insert INPUT --source $REMOTESUB/$REMOTENET --destination 0.0.0.0/0.0.0.0 --jump ACCEPT --in-interface $INT
  /usr/sbin/iptables --insert FORWARD --source 0.0.0.0/0.0.0.0 --destination $REMOTESUB/$REMOTENET --jump ACCEPT --out-interface $INT
  /usr/sbin/iptables --insert FORWARD --source $REMOTESUB/$REMOTENET --destination 0.0.0.0/0.0.0.0 --jump ACCEPT --in-interface $INT
  /usr/sbin/iptables --table nat --append POSTROUTING --out-interface $INT --jump MASQUERADE
  /usr/sbin/iptables --insert FORWARD --protocol tcp --tcp-flags SYN,RST SYN --jump TCPMSS --clamp-mss-to-pmtu
exit 0

Ensure the permissions enable the script to be run:

chmod 700 /jffs/etc/config/my_startup.sh

Reboot your router:

reboot

Enjoy!

Credits

  • Peter Frischknecht - Worked out the final details on our experimental WRT54GS to provide the first working solution.
  • Curtis Turner - Contributed moral support and technical information, along with motivation for Peter. Performed WRT54G testing.
  • The JFFS Wiki Page


Site Index

An Alphabetical Ordered Index of all DD-WRT Docu (EN) pages.


You are here: Main Page/DD-WRT Docu (EN)/Static PPTP VPN Client