RE: VPN

May I encourage all who use LEAF version users to JOIN the leaf-user
mailing list. Bering and Dachstein are just two of at least seven versions
on the LEAF site. Usually questions get replies,
 A lot of the time from the developers and users!
The developers usually cooperate with each other to make better systems
for all. By helping all learn to do things in a differant way!


Larry Platzek  [email protected]


On Tue, 4 Feb 2003, Tom Curbishley wrote:

> Date: Tue, 4 Feb 2003 09:34:54 -0500
> From: Tom Curbishley <[email protected]>
> To: 'Marcus Steeneken' <[email protected]>, [email protected]
> Subject: RE: [LRP] VPN
>
> Hello Marcus,
>
>
>
> Which version of LRP? I've just upgraded to the Bering distro and it is
> marvelously simple to set up and easier to understand than the previous
> EigerStein LRP that I had installed. Bering is based on Charlie
> Steinkuhler's Dachstein LRP lrp.steinkuehler.net
> <http://lrp.steinkuehler.net/>   (If you have not already done so, I
> would encourage you to investigate Bering or its contemporaries at
> leaf.sourceforge.net <http://leaf.sourceforge.net/> .)
>
>
>
> Anyway, I had a similar setup. In my case I have a Win2K server hosting
> VPN connections sitting behind my Bering firewall. The firewall is set
> up to masq our single static IP address. In order to allow clients from
> the Internet to establish a PPTP VPN tunnel to the inside host, you have
> to route TCP port 1723 and protocol 47 (something called GRE). Note that
> GRE is a protocol and not a port.
>
>
>
> Bering uses a package called Shorewall to manage iptables rules. For
> this package you might add the following rules:
>
>
>
> DNAT    net        loc:x.x.x.x         tcp        1723
>
> DNAT    net        loc:x.x.x.x         47
>
>
>
> This would allow anyone on the Internet who could authenticate against
> your server to establish a PPTP VPN tunnel. I just tried this last night
> and it worked like a charm. You could also restrict the rule to specific
> source addresses for added security.
>
>
>
> I also tried to allow L2TP VPN connections, but there's some stuff about
> certificates that I need to learn. For L2TP you need to open port
> 500/udp (IPsec), protocols 50 and 51 (ESP and AH) and port 1701/udp. For
> Bering/Shorewall my guess is that these commands would do it:
>
>
>
> DNAT    net        loc:x.x.x.x         udp       500       #IPsec
>
> DNAT    net        loc:x.x.x.x         50                     #ESP -
> Tunnel mode
>
> DNAT    net        loc:x.x.x.x         51                     #AH -
> Transport mode
>
> DNAT    net        loc:x.x.x.x         udp       1701     #L2TP
>
>
>
> I tried this last night too, but as I indicated above, the client
> complained about certificates. I guess I have more reading to do. You
> might have a look at http://mccammon.org/articles/vpn_faq.php. I found
> it very helpful.
>
>
>
> Hope this helps,
>
> Tom Curbishley
>
> Ewing, NJ USA
>
>
>
> -----Original Message-----
> From: [email protected]
> [mailto:[email protected]] On Behalf Of Marcus
> Steeneken
> Sent: Sunday, February 02, 2003 6:11 PM
> To: [email protected]
> Subject: [LRP] VPN
>
>
>
> I am using the LRP and would like to setup a PPTP serving inside the
> firewall, but can't find any good info on how to do this. Can anyone
> help me please?
>
>


_______________________________________________
linux-router maillist  -  [email protected]
http://www.linuxrouter.org/mailman/listinfo/linux-router