OpenWRT: Setup PPTP VPN Server - Revision history

Onnowpurbo: /* Referensi */

2013-04-24T03:11:29Z

Referensi

← Older revision		Revision as of 03:11, 24 April 2013
Line 139:		Line 139:

	* http://wiki.openwrt.org/doc/howto/vpn.server.pptpd		* http://wiki.openwrt.org/doc/howto/vpn.server.pptpd
			* http://www.ewdisonthen.com/how-to-setup-pptp-vpn-server-on-linux-tutorial-07577.php

			==Pranala Menarik==

Onnowpurbo: /* Test Connection */

2013-04-24T03:08:24Z

Test Connection

← Older revision		Revision as of 03:08, 24 April 2013
Line 72:		Line 72:
	option 'src' 'wan'		option 'src' 'wan'

	~~==Test Connection==~~

	~~Tell a client to connect to the PPTP server, using the username and password you set in chap-secrets.~~

	The connection should work, ping between the client and the server should work, but you may have to do some more configuring to let the client use your PPTP server as a gateway to the internet, or to see inside your LAN. See the routing section below.

Onnowpurbo: /* Firewall */

2013-04-24T03:07:59Z

Firewall

← Older revision		Revision as of 03:07, 24 April 2013
Line 62:		Line 62:
	==Firewall==		==Firewall==

	~~For your security OpenWrt will~~ ignore ~~connections on the WAN~~ interface~~, but accept connection from a client on the LAN or wireless interfaces. If your client is to connect on the~~ WAN ~~interface, edit the /etc/firewall~~.~~user file and add the following:~~		Keamanan OpenWRT biasanya akan meng-ignore permohonan sambungan dari interface WAN. Untuk mengijinkan-nya dapat menggunakan mengkonfigurasi firewall menggunakan UCI di "/etc/config/firewall":

	~~iptables~~ -~~t nat -A prerouting_rule -i $WAN -p tcp --dport 1723 -j ACCEPT~~
	~~iptables -A input_rule -i $WAN -p tcp --dport 1723 -j ACCEPT~~
	~~iptables -A output_rule -p 47 -j ACCEPT~~
	~~iptables -A input_rule -p 47 -j ACCEPT~~

	~~See the firewall for help. Be aware that $WAN might not be defined. If that is the case, insert the interface name instead. I.e. replace $WAN by eth1.~~

	~~Alternatif lain, kita~~ dapat mengkonfigurasi firewall menggunakan UCI di "/etc/config/firewall":

	config 'rule'		config 'rule'
Line 80:		Line 71:
	option 'family' 'ipv4'		option 'family' 'ipv4'
	option 'src' 'wan'		option 'src' 'wan'


	~~/sbin/iptables -t nat -A POSTROUTING -s 172.16.1.0/24 -o eth0.2 -j MASQUERADE~~
	~~/sbin/iptables -I FORWARD -p tcp --syn -i ppp+ -j TCPMSS -set-mss 1356~~

	==Test Connection==		==Test Connection==

Onnowpurbo: /* Tunnel Remote IP Address */

2013-04-24T03:07:03Z

Tunnel Remote IP Address

← Older revision		Revision as of 03:07, 24 April 2013
Line 52:		Line 52:

	vpnuser pptp-server vpnpassword *		vpnuser pptp-server vpnpassword *

			Cara lain agar kita tidak perlu mengedit dapat menggunakan perintah

			echo "vpnuser pptpd-server vpnpassword 172.16.1.10" >> /etc/ppp/chap-secrets

	Ketik man pppd di shell untuk memperoleh informasi lebih lanjut tentang file ini.		Ketik man pppd di shell untuk memperoleh informasi lebih lanjut tentang file ini.
	Perhatikan bahwa nama provider ada di /etc/ppp/options.pptpd. default adalah pptp-server.		Perhatikan bahwa nama provider ada di /etc/ppp/options.pptpd. default adalah pptp-server.

	/!\ If you have x-wrt installed and use it to edit the chap-secrets file, it will create every entry with the provider of pptpd. Also, every time the router is rebooted the file will be rewritten so that the provider is pptpd. The easiest way to deal with this is to set the default provider in /etc/ppp/options.pptpd to pptpd.

	~~/!\ For the bin and pptp builds of OpenWrt, the file will start out being a symbolic link to a template in /rom, so remove the link, copy the template, and make sure it is chmod 600.~~

	/!\ It is important to set an IP address rather than use the default asterisk. If you use an asterisk, the peer may propose it's own address, which could cause a routing loop. This results in very large transmit counters on ifconfig ppp0 and a badly performing router, as it spends all it's time trying to move packets through the loop.

	==Firewall==		==Firewall==

Onnowpurbo at 02:56, 24 April 2013

2013-04-24T02:56:48Z

← Older revision		Revision as of 02:56, 24 April 2013
Line 84:		Line 84:


	/sbin/iptables -t nat -A POSTROUTING -s 172.16.1.0/24 -o ~~eth1~~ -j MASQUERADE		/sbin/iptables -t nat -A POSTROUTING -s 172.16.1.0/24 -o eth0.2 -j MASQUERADE
	/sbin/iptables -I FORWARD -p tcp --syn -i ppp+ -j TCPMSS -set-mss 1356		/sbin/iptables -I FORWARD -p tcp --syn -i ppp+ -j TCPMSS -set-mss 1356

Onnowpurbo: /* Firewall */

2013-04-24T02:50:39Z

Firewall

← Older revision		Revision as of 02:50, 24 April 2013
Line 82:		Line 82:
	option 'family' 'ipv4'		option 'family' 'ipv4'
	option 'src' 'wan'		option 'src' 'wan'


			/sbin/iptables -t nat -A POSTROUTING -s 172.16.1.0/24 -o eth1 -j MASQUERADE
			/sbin/iptables -I FORWARD -p tcp --syn -i ppp+ -j TCPMSS -set-mss 1356

	==Test Connection==		==Test Connection==

Onnowpurbo: /* Konfigurasi */

2013-04-24T02:47:07Z

Konfigurasi

← Older revision		Revision as of 02:47, 24 April 2013
Line 25:		Line 25:
	Ubah ini menjadi IP address LAN anda jika kita ingin menggunakan IP VPN yang berbeda.		Ubah ini menjadi IP address LAN anda jika kita ingin menggunakan IP VPN yang berbeda.
	Tidak perlu me-restart pptpd jika kita mengubah parameter ini.		Tidak perlu me-restart pptpd jika kita mengubah parameter ini.

			Set agar client menggunakan DNS Server tertentu

			ms-dns 8.8.8.8
			ms-dns 8.8.4.4

	Untuk mengalokasikan lokal IP adress pada sisi server dari tunnel, gunakan opsi localip di /etc/pptpd.conf. Contoh :		Untuk mengalokasikan lokal IP adress pada sisi server dari tunnel, gunakan opsi localip di /etc/pptpd.conf. Contoh :

Onnowpurbo: /* Konfigurasi */

2013-04-24T02:43:12Z

Konfigurasi

← Older revision		Revision as of 02:43, 24 April 2013
Line 26:		Line 26:
	Tidak perlu me-restart pptpd jika kita mengubah parameter ini.		Tidak perlu me-restart pptpd jika kita mengubah parameter ini.

			Untuk mengalokasikan lokal IP adress pada sisi server dari tunnel, gunakan opsi localip di /etc/pptpd.conf. Contoh :
	~~/!\ ppp sudah obsolet opsi ini (sejak v2.4.3-7).~~ Untuk ~~mangalokasikan~~ lokal IP adress pada sisi server dari tunnel, gunakan opsi localip di /etc/pptpd.conf. Contoh :

	localip 172.16.1.1		localip 172.16.1.1
Line 34:		Line 33:

	remoteip 172.16.1.100-109		remoteip 172.16.1.100-109


	==Tunnel Remote IP Address==		==Tunnel Remote IP Address==

Onnowpurbo at 02:39, 24 April 2013

2013-04-24T02:39:25Z

← Older revision		Revision as of 02:39, 24 April 2013
Line 23:		Line 23:
	172.16.1.1:		172.16.1.1:

	Ubah ini menjadi IP address LAN anda jika kita ingin menggunakan IP ~~address LAN~~ yang berbeda. ~~Jika LAN anda menggunakan keluarga IP address 192.168.1.x maka ubah menjadi~~		Ubah ini menjadi IP address LAN anda jika kita ingin menggunakan IP VPN yang berbeda.

	~~192.168.1.1:~~

	Tidak perlu me-restart pptpd jika kita mengubah parameter ini.		Tidak perlu me-restart pptpd jika kita mengubah parameter ini.

Line 33:		Line 30:

	localip 172.16.1.1		localip 172.16.1.1

	~~atau~~

	~~localip 192.168.1.1~~


	Cara paling mudah untuk mengakses LAN adalah memastikan localip dalam range IP LAN. Untuk memberikan IP address secara dinamik ke client, kita dapat menambahkan kalimat berikut :		Cara paling mudah untuk mengakses LAN adalah memastikan localip dalam range IP LAN. Untuk memberikan IP address secara dinamik ke client, kita dapat menambahkan kalimat berikut :
Line 43:		Line 35:
	remoteip 172.16.1.100-109		remoteip 172.16.1.100-109

	~~atau~~

	~~remoteip 192.168.1.100-109~~

	~~Pastikan IP address yang dialokasikan ke client VPN tidak dalam range DHCP Server LAN agar tidak terjadi tabrakan IP address.~~

	==Tunnel Remote IP Address==		==Tunnel Remote IP Address==
Line 58:		Line 45:

	vpnuser pptp-server vpnpassword 172.16.1.2		vpnuser pptp-server vpnpassword 172.16.1.2
	vpnuser pptp-server vpnpassword ~~192.168.1.10~~
			Agar user VPN memperoleh IP dinamik, gunakan

			vpnuser pptp-server vpnpassword *

	Ketik man pppd di shell untuk memperoleh informasi lebih lanjut tentang file ini.		Ketik man pppd di shell untuk memperoleh informasi lebih lanjut tentang file ini.
Line 96:		Line 86:
	The connection should work, ping between the client and the server should work, but you may have to do some more configuring to let the client use your PPTP server as a gateway to the internet, or to see inside your LAN. See the routing section below.		The connection should work, ping between the client and the server should work, but you may have to do some more configuring to let the client use your PPTP server as a gateway to the internet, or to see inside your LAN. See the routing section below.

	~~==Configure Debug Logging==~~

	~~If you have problems making a connection, increase the amount of information logged:~~

	* edit /etc/pptpd.conf and add the line debug, and restart pptpd using /etc/init.d/S50pptpd stop followed by /etc/init.d/S50pptpd start,
	* edit /etc/ppp/options.pptpd and add the line debug, and the line logfile "/tmp/pptpd.log" … these changes take effect on next client connection, there is no need to restart pptpd.

	~~To understand the pppd debug log, read these key sections of the PPTP Client Diagnosis HOWTO:~~

	* What does ConfReq, ConfAck, ConfNak, and ConfRej mean?
	* What are those CCP MPPE bitmasks?

	==~~Configure~~ Routing==		==Konfigurasi Routing==

	~~While we now have a~~ VPN ~~ready where the clients can connect to the OpenWrt~~ router ~~we might want to allow the clients to see inside the LAN~~. Of course we can alway give appropriate routes to server and clients but there's another way. In our example we have a LAN network 192.168.0.1/24 on the LAN port of our router. We want multiple clients to connect to the pptpd server and be able to connect to the LAN without the need of client routes. This is especially useful for Windows machines as they either route everything through the pptpd tunnel or nothing and we want them to be able to connect without much configuration hassle for the users. We will use proxyarp for that purpose and add the following line to /etc/ppp/options.pptpd:		Sampai titik ini, client sudah bisa tersambung dengan VPN ke OpenWRT router.
			Untuk memberikan ijin agar client dapat tersambung ke LAN akan sangat mudah jika kita tambahkan
			pada /etc/ppp/options.pptpd:

	proxyarp		proxyarp

	~~When the next~~ client ~~connection arrives you should see something like:~~		Jika client tersambung maka akan terlihat pada log

	found interface vlan0 for proxy arp		found interface vlan0 for proxy arp

	in the logs. The kernel will now answer arp requests for the clients connected through the PPTP tunnel and thus the packets are routed correctly to either the ppp+ device or vlan0. We will have to add additional iptables ~~rules.~~		Kita perlu menambahkan rule iptables :

	# Allow all traffic in and out of the ppp interface. No reason to specify nets.		# Allow all traffic in and out of the ppp interface. No reason to specify nets.

Onnowpurbo: /* Tunnel Remote IP Addresses */

2013-04-24T01:39:55Z

Tunnel Remote IP Addresses

← Older revision		Revision as of 01:39, 24 April 2013
Line 49:		Line 49:
	Pastikan IP address yang dialokasikan ke client VPN tidak dalam range DHCP Server LAN agar tidak terjadi tabrakan IP address.		Pastikan IP address yang dialokasikan ke client VPN tidak dalam range DHCP Server LAN agar tidak terjadi tabrakan IP address.

	==Tunnel Remote IP ~~Addresses~~==		==Tunnel Remote IP Address==

	~~Add lines to~~ /etc/ppp/chap-secrets ~~for each~~ client. ~~The format is~~:		Tambahkan kalimat ke /etc/ppp/chap-secrets untuk setiap client. Formatnya adalah:

	username provider password ipaddress		username provider password ipaddress

	~~Add an~~ IP address ~~for every~~ client. ~~An example~~ chap-secrets ~~looks like this~~:		Tambahkan IP address untuk setiap client. Contoh chap-secrets sebagai berikut :

	vpnuser pptp-server vpnpassword 172.16.1.2		vpnuser pptp-server vpnpassword 172.16.1.2
			vpnuser pptp-server vpnpassword 192.168.1.10

	~~See~~ man pppd ~~on a Linux system for more information on this~~ file. ~~Take care that the~~ provider ~~field matches the name option in~~ /etc/ppp/options.pptpd. ~~The~~ default is pptp-server.		Ketik man pppd di shell untuk memperoleh informasi lebih lanjut tentang file ini.
			Perhatikan bahwa nama provider ada di /etc/ppp/options.pptpd. default adalah pptp-server.

	/!\ If you have x-wrt installed and use it to edit the chap-secrets file, it will create every entry with the provider of pptpd. Also, every time the router is rebooted the file will be rewritten so that the provider is pptpd. The easiest way to deal with this is to set the default provider in /etc/ppp/options.pptpd to pptpd.		/!\ If you have x-wrt installed and use it to edit the chap-secrets file, it will create every entry with the provider of pptpd. Also, every time the router is rebooted the file will be rewritten so that the provider is pptpd. The easiest way to deal with this is to set the default provider in /etc/ppp/options.pptpd to pptpd.