Thanks for the critical mppe config line!
There appears to be no documentation anywhere about how to properly set up OpenWrt to use client VPN using PPTP. The Openwrt Wiki link is pretty much useless.
Anyway, I FIGURED IT OUT (thank you) and it works! My home Comcast D-LINK DIR-825 router with OpenWrt 10.03.1 (Backfire) now has a permanent working client VPN connection to my office PPTPD server (DD-WRT). Yay!
Here's how I did it.
First, below is my /etc/config/network section. Substitute 111.222.000.111 with the external IP of your RRAS or PPTPD server.
Code: Select all
config 'interface' 'vpn'
option 'proto' 'pptp'
option 'server' '111.222.000.111'
option 'username' 'MyUserName'
option 'password' 'MyPassword'
option 'defaultroute' '0'
option 'peerdns' '0'
option 'keepalive' '10'
option 'interval' '5'
option 'pppd_options' 'logfile /tmp/pptp.log dump mppe required,no40,no56,stateless'
The last line is the critical one. It writes status messages into a text file (/tmp/pptp.log), dumps the parsed contents of the options from all sources (command-line, /etc/ppp/options, /etc/ppp/options.pptp, in that order of priority), and sets the bleeping mppe option.
Put no spaces between the commas.
Here are the config sections for /etc/config/firewall:
Code: Select all
config 'zone'
option 'name' 'vpn'
option 'network' 'vpn'
option 'input' 'ACCEPT'
option 'output' 'ACCEPT'
option 'forward' 'ACCEPT'
option 'masq' '1'
option 'log' '1'
config 'forwarding'
option 'src' 'lan'
option 'dest' 'vpn'
config 'forwarding'
option 'src' 'vpn'
option 'dest' 'lan'
The trick is to turn on MASQUERADE. The PPP endpoint is usually a single IP address on the remote end, so this is generally required if you have multiple devices at home.
Add 'debug' to /etc/ppp/options:
Code: Select all
# Comment-out the following for production (noisy in syslog GUI)
debug
# The remainder of this file is stock default:
logfile /dev/null
noaccomp
nopcomp
nocrtscts
lock
maxfail 0
The option 'debug' is critical for debugging and troubleshooting client VPN problems with pppd. Output goes to /tmp/pptp.log. Once things are working remove the line as it really slows down performance.
Finally I had to set up the dynamic route to the office VPN. I didn't want to enable defaultroute as it would force all my home traffic to run through my office.
Create the file /etc/ppp/ip-up.d/ip-up.sh. The following example assumes that the office pptpd gateway is located remotely at 10.0.0.254 in the office LAN 10.0.0.0/24:
Code: Select all
#!/bin/sh
# chmod 755 /etc/ppp/ip-up.d/ip-up.sh
# Add routes
REMOTESUB=10.0.0.0
REMOTENET=255.255.255.0
GW=10.0.0.254
DEV=pptp-vpn
echo 1 > /proc/sys/net/ipv4/conf/pptp-vpn/log_martians
route add -net $REMOTESUB netmask $REMOTENET gw $GW dev $DEV
#
#Correct 'ip route' output:
# 10.0.0.254 dev pptp-vpn proto kernel scope link src 10.0.0.200
# 10.0.0.0/24 via 10.0.0.254 dev pptp-vpn
#
#Correct 'route -e' output:
# Destination Gateway Genmask Flags Iface
# 10.0.0.254 * 255.255.255.255 UGH pptp-vpn
# 10.0.0.0 10.0.0.254 255.255.255.0 UG pptp-vpn
#
iptables -A output_rule --source 0.0.0.0/0.0.0.0 --destination $REMOTESUB/$REMOTENET --jump ACCEPT --out-interface $DEV
iptables -A input_rule --source $REMOTESUB/$REMOTENET --destination 0.0.0.0/0.0.0.0 --jump ACCEPT --in-interface $DEV
iptables -A forwarding_rule --source 0.0.0.0/0.0.0.0 --destination $REMOTESUB/$REMOTENET --jump ACCEPT --out-interface $DEV
iptables -A forwarding_rule --source $REMOTESUB/$REMOTENET --destination 0.0.0.0/0.0.0.0 --jump ACCEPT --in-interface $DE
Next, create the file /etc/ppp/ip-down.d/ip-down.sh to unwind your route(s) and your iptables settings:
Code: Select all
#!/bin/sh
# chmod 755 /etc/ppp/ip-down.d/ip-down-ALAN.sh
# Delete PPP route(s)
REMOTESUB=10.0.0.0
REMOTENET=255.255.255.0
GW=10.0.0.254
DEV=pptp-vpn
route del -net $REMOTESUB netmask $REMOTENET gw $GW dev $DEV
# Delete iptables rules
iptables -D output_rule --source 0.0.0.0/0.0.0.0 --destination $REMOTESUB/$REMOTENET --jump ACCEPT --out-interface $DEV
iptables -D input_rule --source $REMOTESUB/$REMOTENET --destination 0.0.0.0/0.0.0.0 --jump ACCEPT --in-interface $DEV
iptables -D forwarding_rule --source 0.0.0.0/0.0.0.0 --destination $REMOTESUB/$REMOTENET --jump ACCEPT --out-interface $DEV
iptables -D forwarding_rule --source $REMOTESUB/$REMOTENET --destination 0.0.0.0/0.0.0.0 --jump ACCEPT --in-interface $DEV
I had to decode hundreds of lines of spaghetti shell code to figure this mess. It took days to figure out.
The hardest part was figuring out how to stop and restart the PPP client without rebooting every time. You'd think the OpenWrt developers would give you an easy way to start/stop daemons.
Here is what I finally came up with..
Code: Select all
To modify files in /etc/config
cd /etc/config
mkdir /etc/_SAVE/etc/config/OLD
cp * /etc/_SAVE/etc/config/OLD
vi network (or vi wifi, or whatever)
cp * /etc/_SAVE/etc/config
uci commit <-- Copy to NVRAM -- important!
To show the configuration tree
uci show network
uci show system
uci show firewall
To stop and restart the client VPN pppd: (SAVE!)
sh
set -x
. /etc/functions.sh
include /lib/config
include /lib/network
config_load network
stop_interface_ppp vpn # This stops VPN pppd
rm /tmp/pptp.log # Clean up
rm /var/lock/ppp-pptp-vpn # Clean up
setup_interface_pptp pptp-vpn vpn # This restarts VPN pppd
The above executes the following command:
start-stop-daemon -S -b -x /usr/sbin/pppd -m -p /var/run/ppp-pptp-vpn.pid -- pty /usr/sbin/pptp 111.222.000.111 --loglevel 0 --nolaunchpppd file /etc/ppp/options.pptp mtu 1492 mru 1492 lcp-echo-interval 5 lcp-echo-failure 10 persist nodefaultroute user MyUserName password MyPassword ipparam vpn ifname pptp-vpn logfile /tmp/pptp.log dump mppe required,no40,no56,stateless nodetach
-S == Start
-b == Fork to background
-x == Daemon to execute
-p == Path to the lock file to create/check
-m == Check the lock file and bail if already started
-- == Pass the remainder of the command-line as-is to the daemon
The above in turn invokes
/usr/sbin/pppd pty /usr/sbin/pptp 111.222.000.111 --loglevel 0 --nolaunchpppd file /etc/ppp/options.pptp mtu 1492 mru 1492 lcp-echo-interval 5 lcp-echo-failure 10 persist nodefaultroute user MyUserName password MyPassword ipparam vpn ifname pptp-vpn logfile /tmp/pptp.log dump mppe required,no40,no56,stateless nodetach
If there is an easier way I'd love to know about it.
I'm really beginning to regret switching from DD-WRT to OpenWrt. If the developers hadn't apparently abandoned the development of DD-WRT a couple years ago I would switch back from OpenWrt in a heatbeat.
I can't believe there is no way to start/stop a daemon without such contortions. And the lack of documentation. Unbelievable.
)
