星期五, 四月 15, 2011

Debug PPTPVPN

最近公司的project是在一份linux 24.18的 OS上,使PPTP VPN server可以運作。一連遇到了好幾個關卡:

這分linux source code是被patched過的,所以它的pppd的版本比較舊,支援的option也不太一樣。最大的不同點在於,和mppe相關的config,格式有所修改。變成和pptpvpn官網的不一樣。

Usage:
By default pppd tries to negotiate MPPC and don't negotiate MPPE but will agree if peer wants encryption. If peer supports a few key lengths, according to RFC3078 pppd will choose the strongest one.

mppe suboptions:
required - make MPPE obligatory, disconnect if peer doesn't support MPPE
stateless - try to negotiate stateless mode
no40 - disable 40 bit keys
no56 - disable 56 bit keys
no128 - disable 128 bit keys

Examples:

pppd [options] - try to negotiate MPPC, MPPE is optional
pppd nomppe [options] - try to negotiate MPPC and disable MPPE; peer will disconnect if it requires MPPE
pppd nomppc [options] - disable MPPC; MPPE is optional
pppd mppe required,stateless,no128 [options] - try to negotiate MPPC, require MPPE in stateless mode and disable 128 bit keys; pppd will disconnect if peer doesn't support MPPE

//
在除錯的過程中,也一直不知道windows的pptpvpn 的選項,直到最後,終於看懂了
ConfReq <+H, -M, +S, -L, -D>
=> 這是使用mppe 128bits, stateless, nomppc的意思

之後,掙扎了很久,總算是生出一分可以使用的config檔。

/etc/ppp/options.pptpd
name "pptpd"
lock
mtu 1450
mru 1450
proxyarp
auth
ipcp-accept-local
ipcp-accept-remote
lcp-echo-failure 3
lcp-echo-interval 5
deflate 0
+chap
+mschap-v2
mppe required,stateless

/etc/pptpd.conf
ppp /bin/pppd
option /etc/ppp/options.pptpd
localip 172.16.16.1
remoteip 172.16.17.1-254

/etc/ppp/chap-secrets
"帳號" pptpd "密碼" *