Re: How do I know my Connection is Encrypted.

On 18/04/2012 11:29 AM, James Cameron wrote:
> On Tue, Apr 17, 2012 at 03:14:37PM -1000, Mike Gibbons wrote:
>> I'll set my DNS to the server's dns. What's "pass these addresses back
>> via LCP?"
>
> Steve probably meant IPCP and the ms-dns option for pppd.

Heh, yep - sorry, IPCP, I constantly get the two mixed up.

> You give this option to pppd using the pptpd options file for pppd.  You
> probably already have such an options file.  See man pppd for other
> options.

For example, this will hand back addresses to MS Windows clients, your 
pppd may or may not accept these options. (look for your options file 
under /etc/ppp on your pptp server - probably called options.pptp)

ms-dns 203.0.113.1
ms-dns 203.0.113.2

(Obviously, replace the IP addresses with your real ones)

However, your pppd may not actually do anything with this, but there are 
other ways to fix things.

> You also give the usepeerdns option to the client pppd used by pptp.
> Again, see what the manual page says about it.
>
> When a pppd client sees this option, it changes the local configuration
> so that name resolution goes via the specified IP addresses.
>
> Most Linux distributions handle this in /etc/ppp/ip-up scripts.

This is probably the more supported option, however, if you find this 
doesn't work then there are other options, the easiest one is to simply 
have two /etc/resolv.conf files somewhere (say, in 
/etc/ppp/resolv.conf.local and /etc/ppp/resolv.conf.vpn) and have your 
/etc/ppp/ip-up script copy/symlink the /etc/ppp/resolv.conf.vpn to 
/etc/resolv.conf and the /etc/ppp/ip-down script to restore the original 
(/etc/ppp/resolv.conf.local)

The reason you probably don't want to simply set your servers DNS 
resolvers in your local resolv.conf file is that when the VPN isn't 
connected your server will still try to use these DNS servers as a way 
to resolve names/hosts and it's unlikely that will work as most 
providers block this sort of thing. This will result in all sorts of 
things just not working with errors like "cannot resolve host 
server.example.com"

Simply leaving things as they are is also a potential option, although 
you will probably get crappy performance to anything that redirects you 
based on what DNS resolvers you are using (pretty much all akamai 
content for example) and can potentially allow someone to figure out 
where in the world you are located based on where the DNS queries 
originated.

HTH,

-- 
Steve.

------------------------------------------------------------------------------
Better than sec? Nothing is better than sec when it comes to
monitoring Big Data applications. Try Boundary one-second 
resolution app monitoring today. Free.
http://p.sf.net/sfu/Boundary-dev2dev

_______________________________________________
Poptop-server mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/poptop-server