Yah, I had a similar setup as Brian, I was using my shorewall and
mega-patched Poptop/PPPD/Kernel on Redhat. It was allowing both PPTP clients
out as well as PPTP serving.
Thanks for the help guys. I'll play with it too -- luckily, it's just a home
server I'm working with and not a production box. Unluckily, I'm in "road
warrior" mode now, so I won't be able to play with this until Friday when I
am back at home.
Let me know if anyone has any other ideas.
----- Original Message -----
From: "Hilton Travis" <Hilton at QuarkAV dot com>
To: <m0n0wall at lists dot m0n0 dot ch>
Sent: Sunday, February 15, 2004 7:18 PM
Subject: Re: [m0n0wall] PPTP Server with PPTP Clients Behind]
> Hi All,
> > From: darkside <darkside at ricerage dot org>
> > Hi again Hilton :)
> > On Sun, 2004-02-15 at 18:12, Hilton Travis wrote:
> > > Hi Brian,
> > >
> > > On Mon, 2004-02-16 at 09:06, darkside wrote:
> > > > On Sun, 2004-02-15 at 17:55, Hilton Travis wrote:
> > > > > Hi Ben,
> > > > >
> > > > > On Mon, 2004-02-16 at 07:06, Ben Carlisle wrote:
> > > > > > Folks,
> > > > > > Just got m0n0 working and I love it (convert from shorewall
on a Linux
> > > > > > machine). I am having one problem however. When I enable the
PPTP server on
> > > > > > m0n0, my LAN clients from behind m0n0 cannot open VPN PPTP
> > > > > > the outside world. If I disable the PPTP server, connections are
> > > > > > fine.
> > > > > >
> > > > > > I'd like to have my m0n0 machine as a PPTP server for road
> > > > > > connections from the outside world, and allow PPTP from clients
on the LAN
> > > > > > to outside PPTP servers. Can I do both?
> > > > >
> > > > > The reason you cannot do this is because when the PPTP Server is
> > > > > on m0n0wall, it needs to use the same ports/protocols that need to
> > > > > forwarded thru the m0n0wall if you want to get internal machines
> > > > > PPTP connections. The only way this could possibly work is if you
> > > > > multiple public IPs, and utilize one for the PPTP Server, and
> > > > > for the outbound clients.
> > > >
> > > > I'm not trying to be argumentative, but I doubt thats the case.
> > > > discovering m0n0wall my firewall ran on a minimal Debian GNU/linux
> > > > install, with both the poptop pptpd, as well as netfilter and pppd
> > > > patches. pptpd acted as the PPTP server for inbound connections, and
> > > > netfilter patches allowed the NAT'ed hosts behind it to connect to
> > > > remote pptpd's. Granted this was accomplished through netfilter
> > > > patch-o-matic voodoo, but it worked great.
> > > >
> > > > As for ports/protocols, again I'm pretty sure thats incorrect. On
> > > > external interface, one would need to allow port 1723 and GRE
> > > > inbound. On outbound initiated connections, one would need to make
> > > > that GRE traffic wasn't munged by the NAT implementation. Outbound
> > > > connections certainly wouldn't require 1723, but instead would
> > > > on a "high port".
> > >
> > > It still uses protocol GRE in both directions, but yes, different
> > > are used. I've not had my coffee yet! :)
> I now have a coffee in front of me, and I'm feeling much better, now.
> > > > Now that I've actually thought that through enough to provide you
> > > > the above explanation, sounds more like ipfilter's "proxy"
> > > > for particular protocols (ftp, irc dcc, etc, ad nauseum) getting in
> > > > way.
> > >
> > > Does, kinda, doesn't it.
> > Hell. Sent this mail from a freshly imaged box, and apparently my mail
> > settings are incorrect. I was hoping the previous mail would hit the
> > list.
> > Mind taking care of that for me, since apparently I'm too silly to
> > properly set it up myself? Much appreciated. :)
> Sure, I'll also add Ben's question - hope he doesn't mind. :)
> On Mon, 2004-02-16 at 09:52, Ben Carlisle wrote:
> > Could I get around this by forwarding WAN PPTP traffic to a
> > LAN PPTP server?
> You could, but thinking about it now, this may not be necessary.
> Inbound PPTP (to your internal/m0n0wall PPTP Server) requires
> TCP/1723/Inbound and Protocol 47 Inbound to be opened (and forwarded
> to an internal server, if the m0n0wall box is not acting as the PPTP
> Outbound PPTP (from your internal LAN to a remote server) shouldn't
> require anything - m0n0wall should allow the traffic out without
> issue. HOWEVER, returned traffic will be using GRE and port 1723,
> therefore this is where the issue may well be.
> Not having used PPTP myself in dsuch a situation, I'd need to play
> with this a bit more to come up with a "supported" answer. :)
> Hopefully someone else in here has this working and can let us all
> know how to configure things before I have to set it up just to play.
> Hilton Travis Phone: +61-(0)7-3343-3889
> Manager, Quark AudioVisual Phone: +61-(0)419-792-394
> Quark Computers http://www.QuarkAV.com/
> (Brisbane, Australia) http://www.QuarkAV.net/
> Open Source Projects: http://www.ares-desktop.org/
> Non Linear Video Editing Solutions & Digital Audio Workstations
> Network Administration, SmoothWall Firewalls, NOD32 AntiVirus
> Conference and Seminar AudioVisual Production and Recording
> War doesn't determine who is right. War determines who is left.
> To unsubscribe, e-mail: m0n0wall dash unsubscribe at lists dot m0n0 dot ch
> For additional commands, e-mail: m0n0wall dash help at lists dot m0n0 dot ch