How to add PPTP routes to alternate routing tables?

"Greg Scott" <[email protected]> Sun, 15 Jul 2012 06:48:45 -0500
Newsgroups gmane.network.poptop
Message-ID <925A849792280C4E80C5461017A4B8A2646407@mail733.InfraSupportEtc.com>
Hello - 

I have a Linux pptp server system running pptpd 1.3.4.  The pptpd server
has two Internet feeds and I have some ip rules and scripting to decide
which feed to use, depending on the application and internal host.  This
all works as expected.

I have one internal host at 192.168.15.30 giving me trouble.  I am
unable to access this host at all from any PPTP client.  I can access
any other host in the LAN behind the PPTP server, but not this specific
host.  

And now I know why.  Because I have this ip rule:

ip rule add from 192.168.15.30 lookup att

And routing table att looks like this:

1.2.98.112/29 dev eth2  scope link  src 1.2.98.113
default via 1.2.98.118 dev eth2

That's the difference - none of the other hosts have an ip rule.
Anything from this host uses my alternate routing table named att.
That's the difference.  

And sure enough - if I get rid of my ip rule, now my host at .30
responds to my PPTP client.  

OK - so what does the main routing table show?  Here is the relevant
PPTP route that my problem host never sees:
192.168.15.91 dev ppp0  proto kernel  scope link  src 192.168.15.90

My PPTP client is at .91 - so the PPTP server must put in this route
when the client makes a connection and then get rid of it when a client
hangs up.  Sure enough - I just put my ip rule back in and added this
route to my att table by hand and now my PPTP client can access the host
at .30.  So that "special" PPTP route does the trick.  

Wonderful - so how would I tell pptpd to also add its routes to my
alternate tables automatically when a PPTP client connects and get rid
of them when a client disconnects, same as it does for the main table?

Or maybe there's another way to attack this problem, such that the host
at 192.168.15.30 uses the main table if it's talking to a PPTP client,
otherwise use my alternate att table.  I just tried this rule by hand
and it seems to do the trick:

ip rule add to 192.168.15.0/24 table main

 Am I opening up a can of worms here or am I on the right track?

Thanks

- Greg Scott


------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/