$OpenBSD: README,v 1.1 2010/11/12 15:04:51 jasper Exp $
PoPToP - Unix PPTP Server
----------------------------
1. GRE Support
PoPToP requires GRE support to be enabled. It will be enabled at run time
by the pptpd daemon.
2. Configuration of PPTP
A sample configuration file is copied into your configuration directory
(normally /etc) as pptpd.conf. Personalise this config file to suit. At
least configure 'localip' and 'remoteip'. Only 'localip' needs to be
configured on one of your interfaces.
3. Configuration of PPP
PoPToP only handles a small part of the PPTP connection, most of the work
is done by PPP.
3.1 /etc/ppp/options
General desired options:
proxyarp
For Microsoft clients you will want the following options:
+MSChap-V2 mppe-128 mppe-stateless
Lower cryptography level (40-bit v 128-bit) is also available, but not
recommended.
mppe-40
Optional for Microsoft clients (not preferred)
+MSChap
3.2 /etc/ppp/ppp.conf
In ppp.conf create a section pptp
pptp: enable proxy set dns IP.Of.DNS.Server1 IP.Of.DNS.Server2 set
ifaddr Local.IP Remote.IP set timeout 0
For non-Microsoft clients chose your authentication method (one or more
of):
enable pap enable chap
For Microsoft clients you will also want:
enable MSChapV2
If you chose "+MSChap" in options above you can enable it with
enable MSChap
If you have a WINS server:
set nbns IP.Of.WINS.Server
3.3 Users and Passwords
You will now need to create username/password entries for your users in
/etc/ppp/ppp.secret. See /etc/ppp/ppp.secret.sample for examples. If you
assigned a range to 'remoteip' in the above configuration files, you can
assign per-user IPs for accounting purposes here (third field).
4. Firewalls
There are three flows you will need to create. An inbound TCP connection
to port 1723 (Initial connection)
pass in quick on $ext_if proto tcp from any to $ext_ip port = 1723 \
modulate state
An inbound and outbound GRE connection (The main data channel)
pass in quick on $ext_if proto gre from any to $ext_ip keep state
pass out quick on $ext_if proto gre from $ext_ip to any keep state
Where $ext_ip is the externally accessable IP address ('host' in the PPTP
client config).
Also, make sure you have flows defined to allow the traffic out of your
server. The traffic will appear to be from the IP address defined in
ppp.secret, or if not defined there, Remote.IP as defined in ppp.conf
(first available if this a pool).
