PPTP Tunneling
From DD-WRT Wiki
Revision as of 05:06, 5 January 2008 (edit) SirSilentBob (Talk | contribs) (→Fixing routing from server to client network) ← Previous diff |
Current revision (13:41, 18 March 2018) (edit) (undo) Ian5142 (Talk | contribs) (Added PPTP Category.) |
||
(15 intermediate revisions not shown.) | |||
Line 1: | Line 1: | ||
- | + | = Introduction = | |
+ | This setup will bridge DD-WRT routers, allowing any host connected to the network to be visible from the WAN cloud. | ||
+ | To turn this HOWTO simple I'll use only two DD-WRT routers but theoretically you can further extend the setup to any number of routers. | ||
- | (Update: The mini version of v23 SP1 may work better than standard, because the free memory will help.) | ||
- | + | == Notes == | |
- | + | * If your ISP do not provide you a fixed IP address, you should now create a dynamic DNS account from any DD-WRT supported provider. I'll use a No-IP.com account in the article's examples. | |
- | + | * I assume you've got your WAN already up, if you need a different setup please feel free to change whatever you need. | |
- | Have a look at [[#Fixing routing from server to client network]] for a script solution. | ||
- | |} | ||
+ | == Tested Versions == | ||
+ | This article should work with any supported DD-WRT version. Feel free to add your version to the following list: | ||
+ | * DD-WRT v24-sp2 (01/21/09) std | ||
- | + | Does NOT work with | |
- | * | + | * DD-WRT v24-sp2 (10/10/09) std-nokaid (instructions below are not for v24-sp2 firmware; may work (untested) with method from http://www.dd-wrt.com/phpBB2/viewtopic.php?p=10933#10933) |
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
= Configuration = | = Configuration = | ||
- | == For Both Routers == | ||
- | # Goto "Administration" tab and "Management" sub-tab | ||
- | # Enable DNSmasq and Local DNS | ||
- | # Disable Loopback | ||
- | # Set Maximum Ports:4096 | ||
- | # Set TCP Timeout: 3600 | ||
- | # Set UDP Timeout: 3600 | ||
- | + | == Generic information == | |
+ | * '''dd-wrt-01''' | ||
+ | ** Address: 192.168.1.1 | ||
+ | ** Netmask: 255.255.255.0 | ||
+ | ** Gateway: 0.0.0.0 | ||
+ | ** DHCP Range: 192.168.1.100-150 | ||
+ | ** DDNS: foo-corp-dd-wrt-01.no-ip.com | ||
- | '''Note:''' Loopback must be disable because VPN doesn't always work when it is enabled. | ||
- | + | * '''dd-wrt-02''' | |
+ | ** Address: 192.168.2.1 | ||
+ | ** Netmask: 255.255.255.0 | ||
+ | ** Gateway: 0.0.0.0 | ||
+ | ** DHCP Range: 192.168.2.100-150 | ||
+ | ** DDNS: foo-corp-dd-wrt-02.no-ip.com | ||
- | == Router A == | ||
- | === Router B > VPN > Router A === | ||
- | # Goto "Administration" tab and "Services" sub-tab | ||
- | # Enable PPTP Server | ||
- | # Set "Server IP or DNS Name" to "192.168.1.1" | ||
- | # Set "Client IP(s)" to "192.168.1.200-250" | ||
- | # Set "CHAP-Secrets" to "usernameA * passwordA *" | ||
- | # Apply Changes | ||
- | == | + | == dd-wrt-01 == |
- | # Goto | + | This step will configure the basic information for the local network. |
- | + | # Goto Setup > Basic Setup | |
- | # Set | + | # Set Router Name and Host Name to "dd-wrt-01" |
- | # Set | + | # Set Local IP Address to "192.168.1.1" |
- | # Set | + | # Set Subnet Mask to "255.255.255.0" |
- | + | # '''Save''' | |
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | # | + | |
- | http://img162.imageshack.us/img162/22/ruteadora6ir.jpg | ||
- | + | Now lets make your dynamic IP address always reachable trough a hostname. | |
- | + | # Goto Administration > DDNS | |
- | # Goto | + | # Set DNS Service to "No-IP.com" |
- | + | # Change Username, Password and Hostname to your personal account information | |
- | # Set | + | # Hostname in this example will be set to "foo-corp-dd-wrt-01.no-ip.com" |
- | # | + | # '''Save''' |
- | # | + | |
- | # | + | |
- | === Router B > VPN > Router A === | ||
- | # Goto "Administration" tab and "Services" sub-tab | ||
- | # Enable PPTP Client | ||
- | # Set "Server IP or DNS Name" to the location of Server A (direccion_de_A.dyndns.org) | ||
- | # Set "Remote Subnet" to "192.168.1.0" | ||
- | # Set "Remote Subnet Mask" to 255.255.255.0 | ||
- | # Set "MPPE Encryption" to "mppe required" | ||
- | # Set "MTU" to 1450 | ||
- | # Set MRU to 1450 | ||
- | # Set Username to usernameA | ||
- | # Set password to passwordA | ||
- | # Apply Changes | ||
- | + | Now we tell the router that there is another network on the other side of the WAN. | |
+ | Basically we're telling "If you want to access any host on the 192.168.2.x subnet please forward your packet trough the router at the IP address "192.168.2.1". | ||
+ | # Goto Setup > Advanced Routing | ||
+ | # Under Static Routing: | ||
+ | # Set Route Name to "foo-corp-dd-wrt-02" | ||
+ | # Set Metric to "0" | ||
+ | # Set Destination LAN NET to "192.168.2.0" | ||
+ | # Set Subnet Mask to "255.255.255.0" | ||
+ | # Set Gateway to "192.168.2.1" | ||
+ | # Set Interface to "ANY" | ||
+ | # '''Save''' | ||
- | ==== Notes ==== | ||
- | * The subnets should not intersect each other (i.e. The third octet of direction IP (192.168.thirdoctet.1) of the network A must be different of the network B. | ||
- | * The range of Client IP(s) must be outside the range of DHCP clients. | ||
- | * In the example the IP range that occurred for clients vpn ("Client IP(s)") was 192.168.x.200-250 therefore 51 VPN clients allowed | ||
- | + | This router will have the role of "concentrator" meaning that every router that wants to be part of our bridge should connect to it. | |
- | + | If you've got a more complex design with three routers (A, B and C) traffic from B to C will always pass trough router A. | |
- | + | # Goto Services > PPTP | |
- | + | # Enable PPTP Server | |
+ | # Set Server IP to "192.168.1.1" | ||
+ | # Set Client IP(s) to "192.168.1.200-201" | ||
+ | # Set CHAP-Secrets to: "<PPTP_CLIENT_USERNAME_SITE02> * <PPTP_CLIENT_PASSWORD_SITE02> *" | ||
+ | # Disable PPTP Client Options | ||
+ | # '''Save''' | ||
- | On both routers: | ||
- | # Goto | + | Saving ourselves from a headache.. ;-) |
- | # Enable | + | # Goto Security > VPN |
- | # | + | # Enable PPTP Passthrough |
- | # | + | # Disable IPSec and L2TP Passthrough |
+ | # '''Save''' | ||
- | http://img201.imageshack.us/img201/9416/keepaliveye2.jpg | ||
+ | This step maybe optional.. but routing packets trough a WAN interface without being encrypted is stupid. | ||
+ | # Goto Administration > Commands | ||
+ | # Enter "sed -i -e 's/mppe .*/mppe required,stateless/' /tmp/pptpd/options.pptpd" | ||
+ | # Save Startup | ||
+ | # NOTE: This will force all PPTP clients to use encryption | ||
+ | # '''Save''' | ||
- | = Final Words = | ||
- | *Some times the connection takes minutes in completing itself (more or less 30 minutes), some times is instantaneous. | ||
- | + | Wrapping everything up.. | |
- | + | # Goto Administration | |
- | + | # '''Reboot Router''' | |
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
+ | == dd-wrt-02 == | ||
+ | # Goto Setup > Basic Setup | ||
+ | # Set Router Name and Host Name to "dd-wrt-02" | ||
+ | # Set Local IP Address to "192.168.2.1" | ||
+ | # Set Subnet Mask to "255.255.255.0" | ||
+ | # '''Save''' | ||
- | =Fixing routing from server to client network= | ||
- | To fix the routing problem stated above you can try the folowing script as a [[Startup Scripts | startup script]]: | ||
- | + | # Goto Administration > DDNS | |
- | + | # Set DNS Service to "No-IP.com" | |
+ | # Change Username, Password and Hostname to your personal account information | ||
+ | # Hostname in this example will be set to "foo-corp-dd-wrt-02.no-ip.com" | ||
+ | # '''Save''' | ||
- | echo "if [ $CLIENTIP == \$6 ]; then" >> /tmp/pptpd/ip-up | ||
- | echo " /usr/sbin/ip route add $CLIENTNETWORK dev \$1" >> /tmp/pptpd/ip-up | ||
- | echo "fi" >> /tmp/pptpd/ip-up | ||
- | + | Now we tell the router that there is another network on the other side of the WAN. | |
- | + | Basically we're telling "If you want to access any host on the 192.168.1.x subnet please forward your packet trough the router at the IP address "192.168.1.1". | |
- | + | # Goto Setup > Advanced Routing | |
- | + | # Set Route Name to "foo-corp-dd-wrt-01" | |
+ | # Set Metric to "0" | ||
+ | # Set Destination LAN NET to "192.168.1.0" | ||
+ | # Set Subnet Mask to "255.255.255.0" | ||
+ | # Set Gateway to "192.168.1.1" | ||
+ | # Set Interface to "ANY" | ||
+ | # '''Save''' | ||
- | Change xxx.xxx.xxx.xxx to the public ip address of the client. | ||
- | Change 192.168.0.0/24 to the subnet range of the client. | ||
- | + | This router will have the role of "node". | |
- | + | # Goto Services > PPTP | |
+ | # Disable PPTP Server | ||
+ | # Enable PPTP Client Options | ||
+ | # Set Server IP or DNS Name to "foo-corp-dd-wrt-01.no-ip.com" | ||
+ | # Set Remote Subnet to "192.168.1.0" | ||
+ | # Set Remote Subnet Mask to "255.255.255.0" | ||
+ | # Set MPPE Encryption to "mppe required" | ||
+ | # Set MTU to "1450" | ||
+ | # Set MRU to "1450" | ||
+ | # Enable NAT | ||
+ | # Set Username to "PPTP_CLIENT_USERNAME_SITE02" | ||
+ | # Set Password to "PPTP_CLIENT_PASSWORD_SITE02" | ||
+ | # '''Save''' | ||
- | In the CLIENTIP field in the top of the script shown above, you can specify a dynamic domain name instead of an ip address to allow both ends of the connection to remain connected to each other despite ISP ip address changes on either side! If you use a dynamic dns provider that the integrated INADYN updater supports, and set up both routers to auto-update it if any changes occur, then you will be able to easily maintain a "permanent" PPTP tunnel between two routers with dynamic ip addresses with no extra programs running on any of the computers on either side of the network. | ||
- | + | # Goto Security > VPN | |
+ | # Enable PPTP Passthrough | ||
+ | # Disable IPSec and L2TP Passthrough | ||
+ | # '''Save''' | ||
- | SEE BELOW BOX FOR AN EXAMPLE OF THE ABOVE IMPLEMENTED: | ||
- | + | Wrapping everything up.. | |
- | + | # Goto Administration | |
+ | # '''Reboot Router''' | ||
- | + | == Notes == | |
- | + | * The router's subnets should not intersect each other (i.e. 192.168.<XXX>.1). | |
- | + | * The IP address pool for VPN clients must be outside the range of DHCP clients. | |
+ | * In the example the IP range used for VPN clients were "192.168.1.200-201" thus 2 VPN clients are allowed to connect to our concentrator. You should increase this if more routers will be bridged. | ||
- | + | == Issues == | |
- | + | * Not sure why "NAT" is enabled, given the sites are a site to site route - NAT will break the whole premise of a site to site connection | |
- | + | ||
- | + | ||
- | + | = See Also = | |
[[PPTP_Server_Configuration]]<br> | [[PPTP_Server_Configuration]]<br> | ||
[[HOW_TO_configure_a_WINDOWS_BOX_to_make_a_VPN_Connection_to_linksys]] | [[HOW_TO_configure_a_WINDOWS_BOX_to_make_a_VPN_Connection_to_linksys]] | ||
- | ==External Links== | ||
- | http://www.dd-wrt.com/phpBB2/viewtopic.php?t=1767 | ||
- | http://www.dd-wrt.com/dd-wrtv2/bugtracker/ | ||
- | [[Category: | + | [[Category:PPTP]] |
- | + |
Current revision
Contents |
[edit] Introduction
This setup will bridge DD-WRT routers, allowing any host connected to the network to be visible from the WAN cloud. To turn this HOWTO simple I'll use only two DD-WRT routers but theoretically you can further extend the setup to any number of routers.
[edit] Notes
- If your ISP do not provide you a fixed IP address, you should now create a dynamic DNS account from any DD-WRT supported provider. I'll use a No-IP.com account in the article's examples.
- I assume you've got your WAN already up, if you need a different setup please feel free to change whatever you need.
[edit] Tested Versions
This article should work with any supported DD-WRT version. Feel free to add your version to the following list:
- DD-WRT v24-sp2 (01/21/09) std
Does NOT work with
- DD-WRT v24-sp2 (10/10/09) std-nokaid (instructions below are not for v24-sp2 firmware; may work (untested) with method from http://www.dd-wrt.com/phpBB2/viewtopic.php?p=10933#10933)
[edit] Configuration
[edit] Generic information
- dd-wrt-01
- Address: 192.168.1.1
- Netmask: 255.255.255.0
- Gateway: 0.0.0.0
- DHCP Range: 192.168.1.100-150
- DDNS: foo-corp-dd-wrt-01.no-ip.com
- dd-wrt-02
- Address: 192.168.2.1
- Netmask: 255.255.255.0
- Gateway: 0.0.0.0
- DHCP Range: 192.168.2.100-150
- DDNS: foo-corp-dd-wrt-02.no-ip.com
[edit] dd-wrt-01
This step will configure the basic information for the local network.
- Goto Setup > Basic Setup
- Set Router Name and Host Name to "dd-wrt-01"
- Set Local IP Address to "192.168.1.1"
- Set Subnet Mask to "255.255.255.0"
- Save
Now lets make your dynamic IP address always reachable trough a hostname.
- Goto Administration > DDNS
- Set DNS Service to "No-IP.com"
- Change Username, Password and Hostname to your personal account information
- Hostname in this example will be set to "foo-corp-dd-wrt-01.no-ip.com"
- Save
Now we tell the router that there is another network on the other side of the WAN.
Basically we're telling "If you want to access any host on the 192.168.2.x subnet please forward your packet trough the router at the IP address "192.168.2.1".
- Goto Setup > Advanced Routing
- Under Static Routing:
- Set Route Name to "foo-corp-dd-wrt-02"
- Set Metric to "0"
- Set Destination LAN NET to "192.168.2.0"
- Set Subnet Mask to "255.255.255.0"
- Set Gateway to "192.168.2.1"
- Set Interface to "ANY"
- Save
This router will have the role of "concentrator" meaning that every router that wants to be part of our bridge should connect to it.
If you've got a more complex design with three routers (A, B and C) traffic from B to C will always pass trough router A.
- Goto Services > PPTP
- Enable PPTP Server
- Set Server IP to "192.168.1.1"
- Set Client IP(s) to "192.168.1.200-201"
- Set CHAP-Secrets to: "<PPTP_CLIENT_USERNAME_SITE02> * <PPTP_CLIENT_PASSWORD_SITE02> *"
- Disable PPTP Client Options
- Save
Saving ourselves from a headache.. ;-)
- Goto Security > VPN
- Enable PPTP Passthrough
- Disable IPSec and L2TP Passthrough
- Save
This step maybe optional.. but routing packets trough a WAN interface without being encrypted is stupid.
- Goto Administration > Commands
- Enter "sed -i -e 's/mppe .*/mppe required,stateless/' /tmp/pptpd/options.pptpd"
- Save Startup
- NOTE: This will force all PPTP clients to use encryption
- Save
Wrapping everything up..
- Goto Administration
- Reboot Router
[edit] dd-wrt-02
- Goto Setup > Basic Setup
- Set Router Name and Host Name to "dd-wrt-02"
- Set Local IP Address to "192.168.2.1"
- Set Subnet Mask to "255.255.255.0"
- Save
- Goto Administration > DDNS
- Set DNS Service to "No-IP.com"
- Change Username, Password and Hostname to your personal account information
- Hostname in this example will be set to "foo-corp-dd-wrt-02.no-ip.com"
- Save
Now we tell the router that there is another network on the other side of the WAN.
Basically we're telling "If you want to access any host on the 192.168.1.x subnet please forward your packet trough the router at the IP address "192.168.1.1".
- Goto Setup > Advanced Routing
- Set Route Name to "foo-corp-dd-wrt-01"
- Set Metric to "0"
- Set Destination LAN NET to "192.168.1.0"
- Set Subnet Mask to "255.255.255.0"
- Set Gateway to "192.168.1.1"
- Set Interface to "ANY"
- Save
This router will have the role of "node".
- Goto Services > PPTP
- Disable PPTP Server
- Enable PPTP Client Options
- Set Server IP or DNS Name to "foo-corp-dd-wrt-01.no-ip.com"
- Set Remote Subnet to "192.168.1.0"
- Set Remote Subnet Mask to "255.255.255.0"
- Set MPPE Encryption to "mppe required"
- Set MTU to "1450"
- Set MRU to "1450"
- Enable NAT
- Set Username to "PPTP_CLIENT_USERNAME_SITE02"
- Set Password to "PPTP_CLIENT_PASSWORD_SITE02"
- Save
- Goto Security > VPN
- Enable PPTP Passthrough
- Disable IPSec and L2TP Passthrough
- Save
Wrapping everything up..
- Goto Administration
- Reboot Router
[edit] Notes
- The router's subnets should not intersect each other (i.e. 192.168.<XXX>.1).
- The IP address pool for VPN clients must be outside the range of DHCP clients.
- In the example the IP range used for VPN clients were "192.168.1.200-201" thus 2 VPN clients are allowed to connect to our concentrator. You should increase this if more routers will be bridged.
[edit] Issues
- Not sure why "NAT" is enabled, given the sites are a site to site route - NAT will break the whole premise of a site to site connection
[edit] See Also
PPTP_Server_Configuration
HOW_TO_configure_a_WINDOWS_BOX_to_make_a_VPN_Connection_to_linksys