Confused by pptp and gre, what is the true way to do it?
Gabriele Bulfon <[email protected]> Wed, 10 Nov 2010 17:02:22 +0100 (CET)
| Newsgroups | gmane.comp.security.firewalls.ipfilter |
|---|---|
| Message-ID | <29715_1289405372_4CDAC3BC_29715_5964_1_3385016.283.1289404942003.JavaMail.root@www> |
------=_Part_281_21726381.1289404942002 Content-Type: multipart/alternative; boundary="----=_Part_282_15961865.1289404942002" ------=_Part_282_15961865.1289404942002 Content-type: text/plain Content-Transfer-Encoding: 7bit Hello, I've read around about how to make windows pptp vpn work behind ipfilter, but I've seen a lot of confusion...(to me, at least). My windows machine is in the LAN, passing through a solaris machine with ipfilter 4.1.9. What are the general rules to let Windows pass the NAT and run the handshake? Some talks about proxy / pptp rules mappings, some talks about just opening the ports... I tried this but it doesn't work: ipnat: #NAT rules map igb1 mylan/24 -mypubip/32 proxy port ftp ftp/tcp map igb1 mylan/24 -mypubip/32 portmap tcp/udp 10000:40000 map igb1 mylan/24 -mypubip/32 #redirect gre to my windows machine rdr igb1 mypubip/32 -winlanip gre ipf: #NAT windows machine pass out quick on igb1 from mywinip/32 to any keep state #Let gre enter the firewall pass in quick on igb1 proto gre from any to mypubip/32 #Let gre pass the rdr pass in quick on igb1 proto gre from any to winlanip/32 -= Mail sent through WebTop2 =- ------=_Part_282_15961865.1289404942002 Content-type: text/html Content-Transfer-Encoding: quoted-printable <div style=3D"font-family: Verdana; font-size: 12px;">Hello, I've read = around about how to make windows pptp vpn work behind ipfilter, but I'v= e seen<br>a lot of confusion...(to me, at least).<br><br>My windows machine= is in the LAN, passing through a solaris machine with ipfilter 4.1.9.<br>W= hat are the general rules to let Windows pass the NAT and run the handshake= ?<br>Some talks about proxy / pptp rules mappings, some talks about just op= ening the ports...<br><br>I tried this but it doesn't work:<br><br>ipna= t:<br><br>#NAT rules<br>map igb1 mylan/24 -> mypubip/32 proxy port ftp f= tp/tcp<br>map igb1 mylan/24 -> mypubip/32 portmap tcp/udp 10000:40000<br= >map igb1 mylan/24 -> mypubip/32<br>#redirect gre to my windows machine<= br>rdr igb1 mypubip/32 -> winlanip gre<br><br>ipf:<br>#NAT windows machi= ne<br>pass out quick on igb1 from mywinip/32 to any keep state<br>#Let gre = enter the firewall<br>pass in quick on igb1 proto gre from any to mypubip/3= 2<br>#Let gre pass the rdr<br>pass in quick on igb1 proto gre from any to w= inlanip/32<br><div><br><font size=3D"1"> -=3D Mail sent thr= ough WebTop2 =3D-</font> </div></div> ------=_Part_282_15961865.1289404942002-- ------=_Part_281_21726381.1289404942002--