PPTP サーバーのソースを表示

[[Category:Virtual Private Network]]
[[en:PPTP server]]
[[ru:PPTP server]]
[[zh-CN:PPTP Server]]
[[Wikipedia:PPTP|Point-to-Point Tunneling Protocol]] (PPTP) は仮想プライベートネットワークを実装するための手段です。PPTP は PPP パケットをカプセル化する TCP や GRE トンネルを使ってコントロールチャンネルを使用します。

このエントリでは Arch で PPTP サーバーを作成する方法を示します。

{{Warning|The PPTP protocol is inherently insecure. See http://poptop.sourceforge.net/dox/protocol-security.phtml for details.}}

== インストール ==

[[公式リポジトリ]]の {{Pkg|pptpd}} を[[インストール]]してください。

== 設定 ==

{{Tip|Configuration examples can be found in the {{ic|/usr/share/doc/pptpd}} directory.}}

A typical configuration may look like:

{{hc|/etc/pptpd.conf|
# See man pptpd.conf to get more information about this file

# pppd options file. By default, /etc/ppp/options is used
option /etc/ppp/options.pptpd

# Server IP in local network
localip 192.168.1.2

# IP address ranges used to assign IPs to new connecting clients
# Here we define two ranges for our 192.168.1.* subnet: 234-238 and 245
remoteip 192.168.1.234-238,192.168.1.245
}}

Now create the pppd options file, in our example this is {{ic|/etc/ppp/options.pptpd}}:

{{hc|/etc/ppp/options.pptpd|
# Read man pppd to see the full list of available options

# The name of the local system for authentication purposes
name pptpd

# Refuse PAP, CHAP or MS-CHAP connections but accept connections with
# MS-CHAPv2 or MPPE with 128-bit encryption
refuse-pap
refuse-chap
refuse-mschap
require-mschap-v2
require-mppe-128

# Add entry to the ARP system table
proxyarp

# For the serial device to ensure exclusive access to the device
lock

# Disable BSD-Compress and Van Jacobson TCP/IP header compression
nobsdcomp
novj
novjccomp

# Disable file logging
nolog

# DNS servers for Microsoft Windows clients. Using Google's public servers here
ms-dns 8.8.8.8
ms-dns 8.8.4.4
}}

{{Note|Ensure that empty line at the end of the file exists to prevent possible parsing issues.}}

Now create credentials file for authenticating users:

{{hc|/etc/ppp/chap-secrets|
# <username> <server name> <password> <ip addresses>
user2    pptpd    123    *
}}

Now you can be authenticated with ''user2'' as username and ''123'' for password.

sysctl 設定ファイル {{ic|/etc/sysctl.d/30-ipforward.conf}} を作成してカーネルのパケット転送を有効化し、サブネットにアクセスできるクライアントに接続できるようにします ([[インターネット共有#パケット転送の有効化]]も参照):

{{hc|/etc/sysctl.d/30-ipforward.conf|2=
net.ipv4.ip_forward=1
}}

Now apply changes to let the sysctl configuration take effect:

 # sysctl --system

=== iptables ファイアウォールの設定 ===

Configure your iptables settings to enable access for PPTP Clients

{{bc|
# Accept all packets via ppp* interfaces (for example, ppp0)
iptables -A INPUT -i ppp+ -j ACCEPT
iptables -A OUTPUT -o ppp+ -j ACCEPT

# Accept incoming connections to port 1723 (PPTP)
iptables -A INPUT -p tcp --dport 1723 -j ACCEPT

# Accept GRE packets
iptables -A INPUT -p 47 -j ACCEPT
iptables -A OUTPUT -p 47 -j ACCEPT

# Enable IP forwarding
iptables -F FORWARD
iptables -A FORWARD -j ACCEPT

# Enable NAT for eth0 и ppp* interfaces
iptables -A POSTROUTING -t nat -o eth0 -j MASQUERADE
iptables -A POSTROUTING -t nat -o ppp+ -j MASQUERADE
}}
Now save the new iptables rules with:

 # iptables-save > /etc/iptables/iptables.rules

詳細は [[Iptables]] を読んでください。

=== UFW ファイアウォールの設定 ===

Configure your ufw settings to enable access for PPTP Clients.

You must change default forward policy in {{ic|/etc/default/ufw}}

{{hc|/etc/default/ufw|2=
DEFAULT_FORWARD_POLICY="ACCEPT"
}}

Now change {{ic|/etc/ufw/before.rules}}, add following code after header and before *filter line

{{hc|/etc/ufw/before.rules|
# nat Table rules
*nat
:POSTROUTING ACCEPT [0:0]

# Allow traffic from clients to eth0
-A POSTROUTING -s 172.16.36.0/24 -o eth0 -j MASQUERADE

# commit to apply changes
COMMIT
}}

Open pptp port 1723

{{bc|
ufw allow 1723
}}

Restart ufw for good measure

{{bc|
ufw disable
ufw enable
}}

== サーバーの起動 ==

{{ic|pptpd.service}} を使って PPTP サーバーを[[systemd#ユニットを使う|起動・有効化]]してください。

== トラブルシューティング ==

他のサービスと同じように、エラーを調査するときは [[Systemd#トラブルシューティング]] を見てください。

=== Error 619 on the client side ===

Search for the {{ic|logwtmp}} option in {{ic|/etc/pptpd.conf}} and comment it out. When this is enabled, ''wtmp'' will be used to record client connections and disconnections.

 #logwtmp

=== pptpd[xxxxx]: Long config file line ignored ===

Add a blank line at the end of {{ic|/etc/pptpd.conf}}. [http://sourceforge.net/p/poptop/bugs/35/]

=== ppp0: ppp: compressor dropped pkt ===

If you have this error while a client is connected to the server, add the following script to {{ic|/etc/ppp/ip-up.d/mppefixmtu.sh}}:

 #!/bin/sh
 CURRENT_MTU="`ip link show $1 | grep -Po '(?<=mtu )([0-9]+)'`"
 FIXED_MTU="`expr $CURRENT_MTU + 4`"
 ip link set $1 mtu $FIXED_MTU

Make the script executable: 

 # chmod 755 /etc/ppp/ip-up.d/mppefixmtu.sh

参照: [http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=330973]