HOWTO: Connect to a Microsoft PPTP VPN

[prodonjs]

Well here is my issue. I'm using Kubuntu Dapper and I have everything working with PPTP config. I can connect to my VPN fine but what I want to do is use the Client to LAN setting so that I only use my VPN for connecting to the three shared network drives that I need to use.

So far I cannot figure out how to get this to work. Two of the network drives are just folders on the same IP whereas the third one resides on another machine but both IPs for the shared drives I need to map are distinct from the IP I use to VPN. I'm doing all of this to access shared stuff on my college's network from my machine here at home.

I can do this in Windows but there, I cannot figure out how to avoid sending all my traffic through the VPN tunnel rather than just the parts that I need. I can use Samba inside of Konqueror to map to any of these drives if I have the settings in PPTPConfig set to All to Tunnel, but otherwise I cannot. I am still very new to all of this Linux stuff but I am a CS undergraduate student and am really anxious to learn.

I basically just want to be able to set up mount points for these 3 network drives, map them whenever I want to connect to the VPN, synchronize data with my local data and then disconnect my VPN. Can anyone help me out?

[TheOrangeRider]

I can do this in Windows but there, I cannot figure out how to avoid sending all my traffic through the VPN tunnel rather than just the parts that I need.

For a Windows vpn, you should make sure that you have the option "Use default gateway on remote network" unchecked. I think the setting is under Properties->Networking->TCP/IP->Properties->Advanced. I believe that should make it so only traffic destined for your VPN will be routed through the tunnel.

[prodonjs]

Ok well I'll try that the next time I boot back into Windows.

Now applying that logic, how can I do the same in Kubuntu. I want to be able to use the Client to LAN setting in PPTPConfig and still access those folders?

[TheOrangeRider]

I haven't done this so if someone else is more of an expert feel free to jump in.

Have you tried the following?

Joe, under the routing tab I suggest that you use the "Client to LAN" Routing Style so only the necessary traffic go via the VPN.

Then there is the "Routes To Be Added Via Tunnel".

So click on "Edit Network Routes.." and add the network that u want to connect to using the tunnel.

For example if its a standard 192.168.1. net then u write

Network: 192.168.1.0/24
Name: Whatever

Then u press update and u are good to go.

Basically you're setting up explicit routes for prefixes so that your computer will know where to divert traffic based on the destination IP address. I've previously had problems with pptp configuring routing tables so you may have to figure out how to set them manually if WetWilly's suggestion doesn't work.

[prodonjs]

Well see here is my problem and maybe this is due to my lack of in depth networking knowledge.

One of the IPs is only a small difference from the IP I use for connecting to the VPN. Only the the last number is different. But the other two IPs are completely distinct from the VPN address. I'm not sure what that /24 refers to but I remember seeing that it meant 255.255.255.0 or xFF FF FF 00. How exactly do I take a server IP and a folder location and translate it into Route to be Added Via Tunnel.

[TheOrangeRider]

The /24 refers to a subnet mask. The 24 means that the first 24 bits of the IP address denote the subnet. So if you enter a route for 192.168.1.0/24, you're telling your computer to route any traffic that begins with "192.168.1." to be tunneled to your VPN. If you are interested in only accessing only one or two computers on your remote network you can specify them as /32 addresses. As an example, an entry with 192.168.1.130/32 will only route traffic destined to that exact destination IP address through your tunnel. So you could just make ip_address/32 entries into your routing table for the exact machines you want to reach and it should work fine.

[vyvar]

However, adding routes to enable me to see all the computers in the remote network proved more difficult. I tried adding "route add" statements to the /etc/ppp/ip-up.d/myprovider file, but that wasn't working. "run-parts /etc/ppp/ip-up.d" returned:
run-parts: failed to exec /etc/ppp/ip-up.d/myprovider: Exec format error
run-parts: /etc/ppp/ip-up.d/myprovider exited with return code 1
So, I put the "route add" statements directly into the /etc/ppp/ip-up file for now, and it works great. If anyone has any ideas what might be causing this problem, please suggest them. Oh, the contents of my myprovider file:
#!/bin/sh
route add ...
route add ...
Thanks!

This helped me:

# chmod +x /etc/ppp/ip-up.d/tunnel

...replace tunnel with appropriate name.

its from
http://pptpclient.sourceforge.net/routing.phtml

[NoJock]

Badmactuck: hope you have resolved and can lead me in the right direction! I mave been trying to get this to work with to no avail and dont know much at all abought networing. This is my out put from pptp debug it would be nice if some one could direct me in the right direction??

pptpconfig: debug information dump begins
WARNING: security sensitive information follows
pptpconfig 1.12 2006/08/21 06:19:12
# pptp --version
pptp: unrecognized option `--version'
pptp version 1.7.0
Usage:
pptp <hostname> [<pptp options>] [[--] <pppd options>]

Or using pppd's pty option:
pppd pty "pptp <hostname> --nolaunchpppd <pptp options>"

Available pptp options:
--phone <number> Pass <number> to remote host as phone number
--nolaunchpppd Do not launch pppd, for use as a pppd pty
--quirks <quirk> Work around a buggy PPTP implementation
Currently recognised values are BEZEQ_ISRAEL only
--debug Run in foreground (for debugging with gdb)
--sync Enable Synchronous HDLC (pppd must use it too)
--timeout <secs> Time to wait for reordered packets (0.01 to 10 secs)
--nobuffer Disable packet buffering and reordering completely
--idle-wait Time to wait before sending echo request
--max-echo-wait Time to wait before giving up on lack of reply
--logstring <name> Use <name> instead of 'anon' in syslog messages
--localbind <addr> Bind to specified IP address instead of wildcard
--loglevel <level> Sets the debugging level (0=low, 1=default, 2=high)
# pppd --version
pppd version 2.4.4b1
# uname -a
Linux lee-desktop 2.6.15-27-386 #1 PREEMPT Fri Dec 8 17:51:56 UTC 2006 i686 GNU/Linux
# modinfo ppp_mppe || modinfo ppp_mppe_mppc
filename: /lib/modules/2.6.15-27-386/kernel/drivers/net/ppp_mppe.ko
author: Frank Cusack <fcusack@fcusack.com>
description: Point-to-Point Protocol Microsoft Point-to-Point Encryption support
license: Dual BSD/GPL
alias: ppp-compress-18
version: 1.0.2
vermagic: 2.6.15-27-386 preempt 486 gcc-4.0
depends: ppp_generic
srcversion: 6B88E623CA7C4D7FE2F11FA
# grep mppe /proc/modules
Array
(
[name] => usm
[server] => vpn.name.com
[domain] => (hidden by pptpconfig)
[username] => Me
[password] => (hidden by pptpconfig)
[pppd-options] =>
[pptp-options] =>
[resolv] =>
[dns-options] =>
[routing] => routing_client_to_lan
[usepeerdns] => 1
[require-mppe] => 1
[nomppe-40] => 1
[nomppe-128] =>
[refuse-eap] => 1
[mppe-stateful] =>
[autostart] =>
[iconify] =>
[persist] =>
[debug] => 1
[client-to-lan] =>
)
# route -n (before pppd)
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
0.0.0.0 192.168.1.1 0.0.0.0 UG 0 0 0 eth0
pptpconfig: debug information dump ends, starting pppd
pppd options in effect:
debug # (from /etc/ppp/peers/usm)
updetach # (from command line)
logfd 1 # (from command line)
linkname usmo # (from /etc/ppp/peers/usm)
dump # (from /etc/ppp/peers/usm)
noauth # (from /etc/ppp/options.pptp)
refuse-chap # (from /etc/ppp/options.pptp)
refuse-mschap # (from /etc/ppp/options.pptp)
refuse-eap # (from /etc/ppp/options.pptp)
name us\\me # (from /etc/ppp/peers/usm)
remotename usm # (from /etc/ppp/peers/usm)
# (from /etc/ppp/options.pptp)
pty pptp vpn.name.com --nolaunchpppd # (from /etc/ppp/peers/usm)
crtscts # (from /etc/ppp/options)
# (from /etc/ppp/options)
asyncmap 0 # (from /etc/ppp/options)
lcp-echo-failure 4 # (from /etc/ppp/options)
lcp-echo-interval 30 # (from /etc/ppp/options)
hide-password # (from /etc/ppp/options)
ipparam usm # (from /etc/ppp/peers/usm)
proxyarp # (from /etc/ppp/options)
usepeerdns # (from /etc/ppp/peers/usm)
nobsdcomp # (from /etc/ppp/options.pptp)
nodeflate # (from /etc/ppp/options.pptp)
# (from /etc/ppp/peers/usm)
# (from /etc/ppp/peers/usm)
require-mppe-128 # (from /etc/ppp/options.pptp)
noipx # (from /etc/ppp/options)
using channel 16
Using interface ppp0
pptpconfig: monitoring interface ppp0
Connect: ppp0 <--> /dev/pts/0
sent [LCP ConfReq id=0x1 <asyncmap 0x0> <magic 0xaca60dd0> <pcomp> <accomp>]
rcvd [LCP ConfReq id=0x4a <mru 1500> <asyncmap 0xa0000> <auth chap MS> <magic 0x6a378b5e> <pcomp> <accomp>]
sent [LCP ConfNak id=0x4a <auth chap MS-v2>]
rcvd [LCP ConfAck id=0x1 <asyncmap 0x0> <magic 0xaca60dd0> <pcomp> <accomp>]
rcvd [LCP ConfReq id=0x4b <mru 1500> <asyncmap 0xa0000> <auth pap> <magic 0x6a378b5e> <pcomp> <accomp>]
sent [LCP ConfAck id=0x4b <mru 1500> <asyncmap 0xa0000> <auth pap> <magic 0x6a378b5e> <pcomp> <accomp>]
sent [LCP EchoReq id=0x0 magic=0xaca60dd0]
sent [PAP AuthReq id=0x1 user="**\\ME" password=<hidden>]
rcvd [LCP EchoRep id=0x0 magic=0x6a378b5e 00 00]
rcvd [PAP AuthAck id=0x1 "Login ok"]
Remote message: Login ok
PAP authentication succeeded
MPPE required, but MS-CHAP[v2] auth not performed.
sent [LCP TermReq id=0x2 "MPPE required but not available"]
rcvd [IPCP ConfReq id=0xcc <addr 10.50.11.4> <compress VJ 07 00>]
Discarded non-LCP packet when LCP not open
rcvd [LCP TermAck id=0x2]
Connection terminated.
Waiting for 1 child processes...
script pptp vpn.name.com --nolaunchpppd , pid 10125
Script pptp vpn.name.com --nolaunchpppd finished (pid 10125), status = 0x0
# route -n (after pppd exit)
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
0.0.0.0 192.168.1.1 0.0.0.0 UG 0 0 0 eth0
pptpconfig: pppd process terminated by signal 10 (failed)
pptpconfig: SIGUSR1
# route -n (after completion)
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
0.0.0.0 192.168.1.1 0.0.0.0 UG 0 0 0 eth0
have been reading referances of tunneling but now idea if that is the probem it look slike the mppe is failing and im using ubuntu dapper drake is it in the kernel??

Thanks.

[speedothebrief]

I have two things:

first:

AMD 64 USERS!!!!
YES YOU CAN SET UP PPTP CONFIGURATIONS ON YOUR MACHINE!!!
no... it isn't nearly as easy!
I'm using AMD64 and I'm very close to having a working vpn connection.

Here is what I did so far:

download the pptp-linux stuff just forget the pptpconfig utility ever existed and use the "

<a href=http://pptpclient.sourceforge.net/howto-debian.phtml#configure_by_hand">configuring pptp by hand</a>

" instructions to set up the pptp config files (it really isn't that hard, trust me).

Next, I had to change my tunnel's subnet mask from 255.255.255.255 to 255.255.255.0. I did this programatically by editing the ip-up config file ( /etc/ppp/ip-up)
I added this:

#set the remote server IP mask
/sbin/ifconfig ppp0 netmask 255.255.255.0

Then I added some stuff to resolv.conf.tail (which is appended to resolv.conf) since dhclient overwrites any user settings in resolv.conf.
/etc/resolv.conf.tail

search name.address.of.nameserver.com
nameserver $IP_ADDRESS_OF_NAMESERVER

You'll need to know the nameserver's IP address and name (i.e. 192.168.0.1 and vpn.myserver.com)

now I connect to the vpn successfully, authenticate successfully and can ping my vpn server at 192.168.0.10 successfully

I can even use smb://(ipaddress) to browse machines on the network.

Now onto my second thing:
I can't seem to get any mail. And I can't access things on the samba network by their name (only IP address). If I use mutt to get mail on the IMAP server, I can see that it get stuck trying to fetch message headers. It just shows:

fetching message headers... (1/41)

and never makes any progress.

Any Ideas? Thanks for all of the help!

[monkeyking]

I get this broken dep on feisty fawn

sudo apt-get install pptpconfig
Reading package lists... Done
Building dependency tree       
Reading state information... Done
Some packages could not be installed. This may mean that you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.

Since you only requested a single operation it is extremely likely that
the package is simply not installable and a bug report against
that package should be filed.
The following information may help to resolve the situation:

The following packages have unmet dependencies:
  pptpconfig: Depends: php-pcntl (>= 4.3.7) but it is not installable
              Depends: php-gtk-pcntl (>= 1.0.0) but it is not installable
E: Broken packages