RE: PPTP reviisted

["Chris Miller" <cmiller@xxxxxxxxxxxxxx>]

Now I’ve got another problem. Here are the steps and what I did:

 

1)       I got kernel 2.4.22

2)       Didn’t need this

3)       Done.

4)       Done.

5)       Did almost all of them. Didn’t do the ones like ipv6 stuff. Everything went fine. Done.

6)       Done.

7)       Booted new kernel. Everything seems fine. SSH in so I can apply a rule that for some reason didn’t get applied at boot. Here’s what happenend:

 

# iptables -t nat -A POSTROUTING -s 192.168.1.0/24 –j MASQUERADE

iptables: Invalid argument

#

 

So, you can see my problem. I’ve tried –j MASQ and iptables tells me it can’t find that target. I’ve got ipt_MASQUERADE loaded, and a mod-info shows it’s the right one for my kernel. I’ve also tried it with –o eth1. eth1 is inside, eth2 is outside (eth0 is nothing as of now). Outside is DHCP or I’d use SNAT. However, I replaced MASQUERADE with SNAT and got the same error.

 

What gives? I’m getting closer at least…

 

 

Thanks,

 

Chris Miller

Compuville Computers

www.compuville.net

 

---

From: Daniel Chemko [mailto:dchemko@xxxxxxxxxx]
Sent: Sunday, September 28, 2003 3:28 AM
To: Chris Miller
Cc: netfilter@xxxxxxxxxxxxxxxxxxx
Subject: Re: PPTP reviisted

 

If you want to enable conntrack for Linux you will need:

1. A Recent Kernel, I know anything later than 2.4.20 can work fine.
2. Kernel patches from pptpclient.sourceforge.net if you want the firewall itself setting up the pptp tunnel, if not, ignore this step
3. CVS download the netfilter code from netfilter.org
4. Apply the patch-o-matic directory to your kernel sources directory like so:
# KERNEL_DIR=/usr/src/<kerneldir> ./runme extra
5. Apply all patches that you really care for, but I would recommend anything that doesn't fail out on your configuration.Make sure to include the connectrack patch
6. Build the kernel with the new netfilter options turned on as modules
7. Install Kernel
8. Execute the following every time you want pptp (once per boot):
# modprobe ip_conntrack_proto_gre
# modprobe ip_nat_proto_gre
# modprobe ip_conntrack_pptp
# modprobe ip_nat_pptp

Chris Miller wrote:

I’ve seen a few things in the netfilter archive about PPTP, but no one has ever really said anything about getting it to work.

 

Here’s the deal: I’ve got a Windows box (192.168.1.10) sitting behind my Linux firewall. On the firewall runs Debian Woody with iptables 1.2.6a. The Linux box acts as a NAT to all the hosts behind it. Currently I forward TCP port 1723 to 192.168.1.10, but clients cannot connect. I know it’s got something to do with GRE?

 

I saw something on Google about an ip_conntrac_pptp module, or something to that nature, but I’ve not been able to find it anywhere. I’d love to compile it and give it a try if it’s made to fix this issue.

 

So could someone fill me in with what my options are as far as getting my VPN working through my NAT? What exactly is going on?

 

 

Thanks,

 

Chris Miller

Compuville Computers

www.compuville.net

423.276.6692