CentOS 下配置PPTP ×××服务器文档
一、利用rpm包进行安装
1.准备
root@CentOS /root # vim /etc/sysctl.conf
net.ipv4.ip_forward = 1 //将0置为1，打开IP转发功能
root@CentOS /root # /sbin/sysctl –p //使其立即生效
root@CentOS /root # modprobe ppp-compress-18 && echo ok
ok //确认MPPE补丁是否有安装成功，如OK继续下一步
root@CentOS /root # strings ''/usr/sbin/pppd''|grep -i mppe|wc –lines
42 //检查PPP是否支持MPPE，输出大于等于“30”则表示支持
以上如果不成功，则分别下载以下软件进行安装或升级
http://poptop.sourceforge.net/yum/stable/rhel5/i386/dkms-2.0.17.5-1.noarch.rpm
ftp://ftp.ntua.gr/pub/net/poptop/mppe%20module%20builder/kernel_ppp_mppe-1.0.2%20dkms-2.0.6/kernel_ppp_mppe-1.0.2-3dkms.noarch.rpm
http://poptop.sourceforge.net/yum/stable/rhel5/i386/ppp-2.4.4-14.1.rhel5.i386.rpm
官方网站:
http://poptop.sourceforge.net/
http://poptop.sourceforge.net/yum/
http://poptop.sourceforge.net/yum/stable/rhel5/i386/pptpd-1.3.4-2.rhel5.i386.rpm
root@CentOS /root # wget http://poptop.sourceforge.net/yum/stable/rhel5/i386/pptpd-1.3.4-2.rhel5.i386.rpm
root@CentOS /root # rpm -ivh pptpd-1.3.4-2.rhel5.i386.rpm
root@CentOS /root # rpm -ql pptpd
/etc/ppp/options.pptpd //选项配置文件
/etc/pptpd.conf //主配置文件
/etc/rc.d/init.d/pptpd
/usr/bin/***stats.pl
/usr/bin/***user
/usr/lib/pptpd/pptpd-logwtmp.so
/usr/sbin/bcrelay
/usr/sbin/pptp-portslave
/usr/sbin/pptpctrl
/usr/sbin/pptpd //主程序
/usr/share/doc/pptpd-1.3.4
/usr/share/doc/pptpd-1.3.4/AUTHORS
/usr/share/doc/pptpd-1.3.4/COPYING
/usr/share/doc/pptpd-1.3.4/ChangeLog
/usr/share/doc/pptpd-1.3.4/INSTALL
/usr/share/doc/pptpd-1.3.4/README
/usr/share/doc/pptpd-1.3.4/README.bcrelay
/usr/share/doc/pptpd-1.3.4/README.cvs
/usr/share/doc/pptpd-1.3.4/README.inetd
/usr/share/doc/pptpd-1.3.4/README.logwtmp
/usr/share/doc/pptpd-1.3.4/README.portslave
/usr/share/doc/pptpd-1.3.4/README.slirp
/usr/share/doc/pptpd-1.3.4/TODO
/usr/share/doc/pptpd-1.3.4/samples
/usr/share/doc/pptpd-1.3.4/samples/chap-secrets
/usr/share/doc/pptpd-1.3.4/samples/options.pptpd
/usr/share/doc/pptpd-1.3.4/samples/pptpd.conf
/usr/share/man/man5/pptpd.conf.5.gz
/usr/share/man/man8/pptpctrl.8.gz
/usr/share/man/man8/pptpd.8.gz
2.配置
（1）主配置文件
root@CentOS /root # grep -v '#' /etc/pptpd.conf |grep -v '^$
option /etc/ppp/options.pptpd //指定选项配置文件路径。
logwtmp
localip 192.168.10.155 //指定侦听IP
remoteip 10.10.8.1-10 0 //客户端被分配的IP地址范围
（2）选项配置文件
root@CentOS /root # grep -v '#' /etc/ppp/options.pptpd |grep -v '^$
name pptpd //指定PPTP服务器名称
refuse-pap //拒绝使用pap验证
refuse-chap //拒绝使用chap验证
refuse-mschap //拒绝使用mschap验证
require-mschap-v2 //要求使用mschap-v2验证
require-mppe-128 //要求加密长度为128bit
ms-dns 202.96.128.166 //指定客户端获取的DNS1
ms-dns 8.8.8.8 //指定客户端获取的DNS2
proxyarp //打开ARP代理
debug //打开debug调试模式，默认写进/var/log/message，便于排错
lock //锁定客户端 PTY 设备文件
nobsdcomp //禁用 BSD 压缩模式
novj
novjccomp //禁用 Van Jacobson 压缩模式
nologfd //禁止将错误信息记录到输出标准错误(stderr)。
（3）用户名及密码配置文件（调用pppd进行验证）
root@CentOS /root # cat /etc/ppp/chap-secrets
# Secrets for authentication using CHAP
# client server secret IP addresses
yuanliang * yuanliang *
//第一个*表示自动获取服务器名称,如果配置则配置选项文件中配置的那个名字。
//第二个*表示由服务器随机分配IP地址，当然也可以指定用户获取到某个IP。
(4) 分离出pptpd的debug日志
root@CentOS /root # vim /etc/syslog.conf
daemon.debug /var/log/pptpd.log //追加此行至末尾
root@CentOS /root # service syslog restart //重启日志服务
root@CentOS /root # tail -f /var/log/pptpd.log //客户端拨号时将记录以下debug日志
Aug 22 12:26:01 CentOS pptpd[25149]: MGR: Manager process started
Aug 22 12:26:01 CentOS pptpd[25149]: MGR: Maximum of 100 connections available
Aug 22 12:29:30 CentOS pptpd[25160]: MGR: Launching /usr/local/pptp×××/sbin/pptpctrl to handle client
Aug 22 12:29:30 CentOS pptpd[25160]: CTRL: local address = 192.168.10.155
Aug 22 12:29:30 CentOS pptpd[25160]: CTRL: remote address = 10.10.8.1
Aug 22 12:29:30 CentOS pptpd[25160]: CTRL: pppd options file = /usr/local/pptp×××/etc/options.pptpd
Aug 22 12:29:30 CentOS pptpd[25160]: CTRL: Client 10.1.1.2 control connection started
Aug 22 12:29:30 CentOS pptpd[25160]: CTRL: Received PPTP Control Message (type: 1)
Aug 22 12:29:30 CentOS pptpd[25160]: CTRL: Made a START CTRL CONN RPLY packet
Aug 22 12:29:30 CentOS pptpd[25160]: CTRL: I wrote 156 bytes to the client.
Aug 22 12:29:30 CentOS pptpd[25160]: CTRL: Sent packet to client
Aug 22 12:29:30 CentOS pptpd[25160]: CTRL: Received PPTP Control Message (type: 7)
Aug 22 12:29:30 CentOS pptpd[25160]: CTRL: Set parameters to 100000000 maxbps, 64 window size
Aug 22 12:29:30 CentOS pptpd[25160]: CTRL: Made a OUT CALL RPLY packet
Aug 22 12:29:30 CentOS pptpd[25160]: CTRL: Starting call (launching pppd, opening GRE)
Aug 22 12:29:30 CentOS pptpd[25160]: CTRL: pty_fd = 6
Aug 22 12:29:30 CentOS pptpd[25160]: CTRL: tty_fd = 7
Aug 22 12:29:30 CentOS pptpd[25161]: CTRL (PPPD Launcher): program binary = /usr/sbin/pppd
Aug 22 12:29:30 CentOS pptpd[25161]: CTRL (PPPD Launcher): local address = 192.168.10.155
Aug 22 12:29:30 CentOS pptpd[25160]: CTRL: I wrote 32 bytes to the client.
Aug 22 12:29:30 CentOS pptpd[25161]: CTRL (PPPD Launcher): remote address = 10.10.8.1
Aug 22 12:29:30 CentOS pptpd[25160]: CTRL: Sent packet to client
Aug 22 12:29:30 CentOS pptpd[25160]: CTRL: Received PPTP Control Message (type: 15)
Aug 22 12:29:30 CentOS pptpd[25160]: CTRL: Got a SET LINK INFO packet with standard ACCMs
Aug 22 12:29:30 CentOS pppd[25161]: Plugin /usr/lib/pptpd/pptpd-logwtmp.so loaded.
Aug 22 12:29:30 CentOS pppd[25161]: pppd 2.4.4 started by root, uid 0
Aug 22 12:29:30 CentOS pppd[25161]: Using interface ppp0
Aug 22 12:29:30 CentOS pppd[25161]: Connect: ppp0 <--> /dev/pts/1
Aug 22 12:29:30 CentOS pptpd[25160]: GRE: accepting packet #0
Aug 22 12:29:30 CentOS pptpd[25160]: GRE: accepting packet #1
Aug 22 12:29:30 CentOS pptpd[25160]: GRE: accepting packet #2
Aug 22 12:29:30 CentOS pptpd[25160]: GRE: accepting packet #3
Aug 22 12:29:30 CentOS pptpd[25160]: GRE: accepting packet #4
Aug 22 12:29:30 CentOS pptpd[25160]: GRE: accepting packet #5
Aug 22 12:29:30 CentOS pptpd[25160]: CTRL: Received PPTP Control Message (type: 15)
Aug 22 12:29:30 CentOS pptpd[25160]: CTRL: Ignored a SET LINK INFO packet with real ACCMs!
Aug 22 12:29:30 CentOS pptpd[25160]: GRE: accepting packet #6
Aug 22 12:29:30 CentOS pptpd[25160]: GRE: accepting packet #7
Aug 22 12:29:30 CentOS pptpd[25160]: GRE: accepting packet #8
Aug 22 12:29:30 CentOS pptpd[25160]: GRE: accepting packet #9
Aug 22 12:29:30 CentOS pppd[25161]: MPPE 128-bit stateless compression enabled
Aug 22 12:29:30 CentOS pptpd[25160]: GRE: accepting packet #10
Aug 22 12:29:32 CentOS pptpd[25160]: GRE: accepting packet #11
Aug 22 12:29:32 CentOS pptpd[25160]: GRE: accepting packet #12
Aug 22 12:29:32 CentOS pptpd[25160]: GRE: accepting packet #13
Aug 22 12:29:32 CentOS pppd[25161]: Cannot determine ethernet address for proxy ARP
Aug 22 12:29:32 CentOS pppd[25161]: local IP address 192.168.10.155
Aug 22 12:29:32 CentOS pppd[25161]: remote IP address 10.10.8.1
Aug 22 12:29:32 CentOS pptpd[25160]: GRE: accepting packet #14
Aug 22 12:29:32 CentOS pptpd[25160]: GRE: accepting packet #15
Aug 22 12:29:32 CentOS pptpd[25160]: GRE: accepting packet #16
Aug 22 12:29:32 CentOS pptpd[25160]: GRE: accepting packet #17
Aug 22 12:29:32 CentOS pptpd[25160]: GRE: accepting packet #18
Aug 22 12:29:33 CentOS pptpd[25160]: GRE: accepting packet #19
3.防火墙配置
接下来是防火墙的配置，个人认为是非常关键的一步。
(1) 设置默认规则
root@CentOS /root # iptables -P INPUT DROP //设置(进入)默认拒绝
root@CentOS /root # iptables -P OUTPUT ACCEPT //设置(出去)默认允许
root@CentOS /root # iptables -P FORWARD DROP //设置(转发)默认拒绝
当然，这里也可以先放开其他的必要服务，如以下SSH、ICMP、HTTP、DNS等
root@CentOS /root # iptables -A INPUT -p tcp --dport 22 -j ACCEPT
root@CentOS /root # iptables -A INPUT -p icmp -j ACCEPT
root@CentOS /root # iptables -A INPUT -p tcp --dport 80 -j ACCEPT
root@CentOS /root # iptables -A INPUT -p udp --dport 53 -j ACCEPT
(2) 允许连接PPTP服务,1723为pptp服务的端口
root@CentOS /root # iptables -A INPUT -p tcp --dport 1723 -j ACCEPT
(3) 允许建立×××隧道,否则无法验证用户名及密码
root@CentOS /root # iptables -A INPUT -p gre -j ACCEPT
(4) 建立NAT规则,否则拨上也无法通过远程网关连上公网
root@CentOS /root # iptables -t nat -A P0STROUTING -s 10.10.8.0/24 -o eth0 -j SNAT --to 192.168.10.155
// 10.10.8.0/24是前面定义的×××客户端的IP地址分配范围
// 192.168.10.155为连接公网的以太网接口IP地址
PS:也可以使用下面这条规则达到同样的效果，使用伪装的形式
root@CentOS /root # iptables -t nat -A POSTROUTING -s 10.10.8.0/24 -j MASQUERADE
(5) 允许客户端的路由转发.
root@CentOS /root # iptables -A FORWARD -s 10.10.8.0/24 -j ACCEPT
root@CentOS /root # iptables -A FORWARD -d 10.10.8.0/24 -j ACCEPT
到这里就完成服务端的配置，Windows客户端新建一个×××连接即可拨上号使用啦。
root@CentOS /root # service pptpd start //启动之后客户端就可以拨号啦
root@CentOS /root # ifconfig
eth0 Link encap:Ethernet HWaddr 00:0C:29:E8:73:24
inet addr:192.168.10.155 Bcast:192.168.10.255 Mask:255.255.255.0
inet6 addr: fe80::20c:29ff:fee8:7324/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:64366 errors:0 dropped:0 overruns:0 frame:0
TX packets:27227 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:13411305 (12.7 MiB) TX bytes:3705070 (3.5 MiB)
Interrupt:59 Base address:0x2000
eth1 Link encap:Ethernet HWaddr 00:0C:29:E8:73:2E
inet addr:10.1.1.1 Bcast:10.1.1.255 Mask:255.255.255.0
inet6 addr: fe80::20c:29ff:fee8:732e/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:6704 errors:0 dropped:0 overruns:0 frame:0
TX packets:7545 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:908433 (887.1 KiB) TX bytes:5980701 (5.7 MiB)
Interrupt:67 Base address:0x2080
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:1454 errors:0 dropped:0 overruns:0 frame:0
TX packets:1454 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:133663 (130.5 KiB) TX bytes:133663 (130.5 KiB)
ppp0 Link encap:Point-to-Point Protocol
inet addr:192.168.10.155 P-t-P:10.10.8.1 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1396 Metric:1
RX packets:4213 errors:0 dropped:0 overruns:0 frame:0
TX packets:5401 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:3
RX bytes:406029 (396.5 KiB) TX bytes:5486009 (5.2 MiB)
root@CentOS /root # service iptables status
Table: nat
Chain PREROUTING (policy ACCEPT)
num target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
num target prot opt source destination
1 SNAT all -- 10.10.8.0/24 0.0.0.0/0 to:192.168.10.155
Chain OUTPUT (policy ACCEPT)
num target prot opt source destination
Table: filter
Chain INPUT (policy DROP)
num target prot opt source destination
1 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
2 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80
3 ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:53
4 ACCEPT 47 -- 0.0.0.0/0 0.0.0.0/0
5 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:1723
Chain FORWARD (policy DROP)
num target prot opt source destination
1 ACCEPT all -- 10.10.8.0/24 0.0.0.0/0
2 ACCEPT all -- 0.0.0.0/0 10.10.8.0/24
Chain OUTPUT (policy ACCEPT)
num target prot opt source destination
PS:最简单的方式就是全部放开防火墙策略，追加一条NAT转换规则就OK了.
#!/bin/bash
/sbin/iptables -F
/sbin/iptables -Z
/sbin/iptables -X
/sbin/iptables -P INPUT ACCEPT
/sbin/iptables -P OUTPUT ACCEPT
/sbin/iptables -P FORWARD ACCEPT
/sbin/iptables -t nat -A POSTROUTING -s 10.10.8.0/24 -o eth0 -j MASQUERADE
/etc/init.d/iptables save
0.准备情况
root@CentOS /root # vim /etc/sysctl.conf
net.ipv4.ip_forward = 1 //将0置为1，打开IP转发功能
root@CentOS /root # /sbin/sysctl -p //使其立即生效
root@CentOS /root # modprobe ppp-compress-18 && echo ok
ok //确认MPPE补丁是否有安装成功，如OK继续下一步
root@CentOS /root #strings ''/usr/sbin/pppd''|grep -i mppe|wc --lines
42 //检查PPP是否支持MPPE，输出大于等于“30”则表示支持
PS:以上如果不成功，则分别下载以下软件进行安装或升级
http://poptop.sourceforge.net/yum/stable/rhel5/i386/dkms-2.0.17.5-1.noarch.rpm
ftp://ftp.ntua.gr/pub/net/poptop/mppe%20module%20builder/kernel_ppp_mppe-1.0.2%20dkms-2.0.6/kernel_ppp_mppe-1.0.2-3dkms.noarch.rpm
http://poptop.sourceforge.net/yum/stable/rhel5/i386/ppp-2.4.4-14.1.rhel5.i386.rpm
root@CentOS /root # ifconfig
eth0 Link encap:Ethernet HWaddr 00:0C:29:0A:75:8A
inet addr:192.168.10.155 Bcast:10.0.0.0 Mask:255.255.255.0
inet6 addr: fe80::20c:29ff:fe0a:758a/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:7273 errors:0 dropped:0 overruns:0 frame:0
TX packets:6253 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:1071881 (1.0 MiB) TX bytes:905796 (884.5 KiB)
Interrupt:59 Base address:0x2000
eth1 Link encap:Ethernet HWaddr 00:0C:29:0A:75:94
inet addr:10.1.1.1 Bcast:192.168.0.0 Mask:255.255.255.0
inet6 addr: fe80::20c:29ff:fe0a:7594/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:581 errors:0 dropped:0 overruns:0 frame:0
TX packets:415 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:85109 (83.1 KiB) TX bytes:107530 (105.0 KiB)
Interrupt:67 Base address:0x2080
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:40 errors:0 dropped:0 overruns:0 frame:0
TX packets:40 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:3224 (3.1 KiB) TX bytes:3224 (3.1 KiB)
1.下载安装
root@CentOS /root # wget http://nchc.dl.sourceforge.net/project/poptop/pptpd/pptpd-1.3.4/pptpd-1.3.4.tar.gz
root@CentOS /root # tar xvf pptpd-1.3.4.tar.gz
注意：解压后先修改 /root/pptpd-1.3.4/plugins/patchlevel.h 文件再配置编译安装：
root@CentOS /root/pptpd-1.3.4/plugins # vim patchlevel.h
#define VERSION "2.4.3" //将2.4.3修改成2.4.4
#define DATE "13 Jan 2004"
否则，后续有可能会出现以下错误，版本不同，导致客户端拨号失败。
Aug 22 11:33:10 CentOS pptpd[23264]: CTRL: Client 10.1.1.2 control connection started
Aug 22 11:33:10 CentOS pptpd[23264]: CTRL: Starting call (launching pppd, opening GRE)
Aug 22 11:33:10 CentOS pppd[23265]: Plugin /usr/lib/pptpd/pptpd-logwtmp.so is for pppd version 2.4.3, this is 2.4.4
Aug 22 11:33:10 CentOS pptpd[23264]: GRE: read(fd=6,buffer=8058640,len=8196) from PTY failed: status = -1 error = Input/output error, usually caused by unexpected termination of pppd, check option syntax and pppd logs
Aug 22 11:33:10 CentOS pptpd[23264]: CTRL: PTY read or GRE write failed (pty,gre)=(6,7)
Aug 22 11:33:10 CentOS pptpd[23264]: CTRL: Client 10.1.1.2 control connection finished
root@CentOS /root/pptpd-1.3.4 # ./configure --prefix=/usr/local/pptp×××
root@CentOS /root/pptpd-1.3.4 # make && make install
安装好后，复制/usr/local/pptp×××/lib/pptpd目录到/usr/lib下
root@CentOS /root # cp -r /usr/local/pptp×××/lib/pptpd /usr/lib/
否则，后续会出现以下错误，而导致客户端拨号不成功。
Aug 22 11:31:37 CentOS pptpd[23245]: MGR: Manager process started
Aug 22 11:31:37 CentOS pptpd[23245]: MGR: Maximum of 100 connections available
Aug 22 11:31:49 CentOS pptpd[23248]: CTRL: Client 10.1.1.2 control connection started
Aug 22 11:31:49 CentOS pptpd[23248]: CTRL: Starting call (launching pppd, opening GRE)
Aug 22 11:31:49 CentOS pppd[23249]: /usr/lib/pptpd/pptpd-logwtmp.so: cannot open shared object file: No such file or directory
Aug 22 11:31:49 CentOS pppd[23249]: Couldn't load plugin /usr/lib/pptpd/pptpd-logwtmp.so
Aug 22 11:31:49 CentOS pptpd[23248]: GRE: read(fd=6,buffer=8058640,len=8196) from PTY failed: status = -1 error = Input/output error, usually caused by unexpected termination of pppd, check option syntax and pppd logs
Aug 22 11:31:49 CentOS pptpd[23248]: CTRL: PTY read or GRE write failed (pty,gre)=(6,7)
Aug 22 11:31:49 CentOS pptpd[23248]: CTRL: Client 10.1.1.2 control connection finished
2.配置
root@CentOS /root/pptpd-1.3.4 # mkdir /usr/local/pptp×××/etc
root@CentOS /root/pptpd-1.3.4 # cp samples/pptpd.conf /usr/local/pptp×××/etc
root@CentOS /root/pptpd-1.3.4 # cp samples/options.pptpd /usr/local/pptp×××/etc
（1）主配置文件
root@CentOS /root # grep -v '#' /usr/local/pptp×××/etc/pptpd.conf |grep -v '^$
option /usr/local/pptp×××/etc/options.pptpd //指定选项配置文件路径。
logwtmp
localip 192.168.10.155 //指定侦听IP
remoteip 10.10.8.1-100 //客户端被分配的IP地址范围
（2）选项配置文件
root@CentOS /root # grep -v '#' /usr/local/pptp×××/etc/options.pptpd |grep -v '^$
name pptpd //指定PPTP服务器名称
refuse-pap //拒绝使用pap验证
refuse-chap //拒绝使用chap验证
refuse-mschap //拒绝使用mschap验证
require-mschap-v2 //要求使用mschap-v2验证
require-mppe-128 //要求加密长度为128bit
ms-dns 202.96.128.166 //指定客户端获取的DNS1
ms-dns 8.8.8.8 //指定客户端获取的DNS2
proxyarp //打开ARP代理
debug //打开debug调试模式，默认写进/var/log/message，便于排错
lock //锁定客户端 PTY 设备文件
nobsdcomp //禁用 BSD 压缩模式
novj
novjccomp //禁用 Van Jacobson 压缩模式
nologfd //禁止将错误信息记录到输出标准错误(stderr)。
（3）用户名及密码配置文件（调用pppd进行验证）
root@CentOS /root # cat /etc/ppp/chap-secrets
# Secrets for authentication using CHAP
# client server secret IP addresses
yuanliang * yuanliang *
//第一个*表示自动获取服务器名称,如果配置则配置选项文件中配置的那个名称。
//第二个*表示由服务器随机分配IP地址，当然也可以指定用户获取到某个IP。
（4）分离pptp的debug日志
root@CentOS /root # vim /etc/syslog.conf
daemon.debug /var/log/pptpd.log //追加此行至文件末尾
root@CentOS /root # service syslog restart //重启日志服务
root@CentOS /root # tail -f /var/log/pptpd.log //客户端拨号时将记录以下debug日志
Aug 22 12:26:01 CentOS pptpd[25149]: MGR: Manager process started
Aug 22 12:26:01 CentOS pptpd[25149]: MGR: Maximum of 100 connections available
Aug 22 12:29:30 CentOS pptpd[25160]: MGR: Launching /usr/local/pptp×××/sbin/pptpctrl to handle client
Aug 22 12:29:30 CentOS pptpd[25160]: CTRL: local address = 192.168.10.155
Aug 22 12:29:30 CentOS pptpd[25160]: CTRL: remote address = 10.10.8.1
Aug 22 12:29:30 CentOS pptpd[25160]: CTRL: pppd options file = /usr/local/pptp×××/etc/options.pptpd
Aug 22 12:29:30 CentOS pptpd[25160]: CTRL: Client 10.1.1.2 control connection started
Aug 22 12:29:30 CentOS pptpd[25160]: CTRL: Received PPTP Control Message (type: 1)
Aug 22 12:29:30 CentOS pptpd[25160]: CTRL: Made a START CTRL CONN RPLY packet
Aug 22 12:29:30 CentOS pptpd[25160]: CTRL: I wrote 156 bytes to the client.
Aug 22 12:29:30 CentOS pptpd[25160]: CTRL: Sent packet to client
Aug 22 12:29:30 CentOS pptpd[25160]: CTRL: Received PPTP Control Message (type: 7)
Aug 22 12:29:30 CentOS pptpd[25160]: CTRL: Set parameters to 100000000 maxbps, 64 window size
Aug 22 12:29:30 CentOS pptpd[25160]: CTRL: Made a OUT CALL RPLY packet
Aug 22 12:29:30 CentOS pptpd[25160]: CTRL: Starting call (launching pppd, opening GRE)
Aug 22 12:29:30 CentOS pptpd[25160]: CTRL: pty_fd = 6
Aug 22 12:29:30 CentOS pptpd[25160]: CTRL: tty_fd = 7
Aug 22 12:29:30 CentOS pptpd[25161]: CTRL (PPPD Launcher): program binary = /usr/sbin/pppd
Aug 22 12:29:30 CentOS pptpd[25161]: CTRL (PPPD Launcher): local address = 192.168.10.155
Aug 22 12:29:30 CentOS pptpd[25160]: CTRL: I wrote 32 bytes to the client.
Aug 22 12:29:30 CentOS pptpd[25161]: CTRL (PPPD Launcher): remote address = 10.10.8.1
Aug 22 12:29:30 CentOS pptpd[25160]: CTRL: Sent packet to client
Aug 22 12:29:30 CentOS pptpd[25160]: CTRL: Received PPTP Control Message (type: 15)
Aug 22 12:29:30 CentOS pptpd[25160]: CTRL: Got a SET LINK INFO packet with standard ACCMs
Aug 22 12:29:30 CentOS pppd[25161]: Plugin /usr/lib/pptpd/pptpd-logwtmp.so loaded.
Aug 22 12:29:30 CentOS pppd[25161]: pppd 2.4.4 started by root, uid 0
Aug 22 12:29:30 CentOS pppd[25161]: Using interface ppp0
Aug 22 12:29:30 CentOS pppd[25161]: Connect: ppp0 <--> /dev/pts/1
Aug 22 12:29:30 CentOS pptpd[25160]: GRE: accepting packet #0
Aug 22 12:29:30 CentOS pptpd[25160]: GRE: accepting packet #1
Aug 22 12:29:30 CentOS pptpd[25160]: GRE: accepting packet #2
Aug 22 12:29:30 CentOS pptpd[25160]: GRE: accepting packet #3
Aug 22 12:29:30 CentOS pptpd[25160]: GRE: accepting packet #4
Aug 22 12:29:30 CentOS pptpd[25160]: GRE: accepting packet #5
Aug 22 12:29:30 CentOS pptpd[25160]: CTRL: Received PPTP Control Message (type: 15)
Aug 22 12:29:30 CentOS pptpd[25160]: CTRL: Ignored a SET LINK INFO packet with real ACCMs!
Aug 22 12:29:30 CentOS pptpd[25160]: GRE: accepting packet #6
Aug 22 12:29:30 CentOS pptpd[25160]: GRE: accepting packet #7
Aug 22 12:29:30 CentOS pptpd[25160]: GRE: accepting packet #8
Aug 22 12:29:30 CentOS pptpd[25160]: GRE: accepting packet #9
Aug 22 12:29:30 CentOS pppd[25161]: MPPE 128-bit stateless compression enabled
Aug 22 12:29:30 CentOS pptpd[25160]: GRE: accepting packet #10
Aug 22 12:29:32 CentOS pptpd[25160]: GRE: accepting packet #11
Aug 22 12:29:32 CentOS pptpd[25160]: GRE: accepting packet #12
Aug 22 12:29:32 CentOS pptpd[25160]: GRE: accepting packet #13
Aug 22 12:29:32 CentOS pppd[25161]: Cannot determine ethernet address for proxy ARP
Aug 22 12:29:32 CentOS pppd[25161]: local IP address 192.168.10.155
Aug 22 12:29:32 CentOS pppd[25161]: remote IP address 10.10.8.1
Aug 22 12:29:32 CentOS pptpd[25160]: GRE: accepting packet #14
Aug 22 12:29:32 CentOS pptpd[25160]: GRE: accepting packet #15
Aug 22 12:29:32 CentOS pptpd[25160]: GRE: accepting packet #16
Aug 22 12:29:32 CentOS pptpd[25160]: GRE: accepting packet #17
Aug 22 12:29:32 CentOS pptpd[25160]: GRE: accepting packet #18
Aug 22 12:29:33 CentOS pptpd[25160]: GRE: accepting packet #19
4.启动程序
root@CentOS /root #/usr/local/pptp×××/sbin/pptpd --help
pptpd v1.3.4
Usage: pptpd [options], where options are:
[-c] [--conf file] Specifies the config file to read default
settings from (default is /etc/pptpd.conf).
[-d] [--debug] Turns on debugging (to syslog).
[-e] [--ppp file] Use alternate pppd binary, default /usr/sbin/pppd.
[-f] [--fg] Run in foreground.
[-h] [--help] Displays this help message.
[-i] [--noipparam] Suppress the passing of the client's IP address
to PPP, which is done by default otherwise.
[-l] [--listen x.x.x.x] Specifies IP of local interface to listen to.
[-o] [--option file] Specifies the PPP options file to use
(default is /etc/ppp/options).
[-p] [--pidfile file] Specifies the file to write the process ID to
(default is /var/run/pptpd.pid).
[-s] [--speed baud] Specifies the baud speed for the PPP daemon
(default is 115200).
[-t] [--stimeout seconds] Specifies the timeout for the first packet. This is a DOS protection
(default is 10).
[-v] [--version] Displays the pptpd version number.
[-w] [--logwtmp] Update wtmp as users login.
[-C] [--connections n] Limit on number of connections.
[-D] [--delegate] Delegate IP allocation to pppd.
Logs and debugging go to syslog as DAEMON.
Command line options will override any default settings and any settings
specified in the config file (default config file: /etc/pptpd.conf).
root@CentOS /root # /usr/local/pptp×××/sbin/pptpd -c /usr/local/pptp×××/etc/pptpd.conf -o /usr/local/pptp×××/etc/options.pptpd --debug
5.防火墙配置
#!/bin/bash
/sbin/iptables -F
/sbin/iptables -Z
/sbin/iptables -X
/sbin/iptables -P INPUT ACCEPT
/sbin/iptables -P INPUT ACCEPT
/sbin/iptables -P FORWARD ACCEPT
/sbin/iptables -t nat -A POSTROUTING -s 10.10.8.0/24 -o eth0 -j MASQUERADE
/etc/init.d/iptables save
//以上表示全部放开策略，只追加一条NAT转换规则，如果原本防火墙有策略，必须保证以下规则是放通的。
(1) 允许连接PPTP服务,1723为pptp服务端口.
/sbin/iptables -A INPUT -p tcp --dport 1723 -j ACCEPT
(2) 允许建立×××隧道,否则无法验证用户名及密码.
/sbin/iptables -A INPUT -p gre -j ACCEPT
(3) 建立NAT转换规则,否则拨上也无法通过远程网关连上公网.
/sbin/iptables -t nat -A P0STROUTING -s 10.10.8.0/24 -o eth0 -j SNAT --to 192.168.10.155
10.10.10.0/24 //是前面定义的×××客户端的IP地址分配范围.
10.0.0.162 //为连接公网的以太网接口IP地址.
PS:也可以使用下面这条规则使用伪装的形式达到同样的效果.
/sbin/iptables -t nat -A POSTROUTING -s 10.10.8.0/24 -j MASQUERADE
(4) 允许客户端的路由转发.
/sbin/iptables -A FORWARD -s 10.10.8.0/24 -j ACCEPT
/sbin/iptables -A FORWARD -d 10.10.8.0/24 -j ACCEPT
root@CentOS /root #ifconfig
eth0 Link encap:Ethernet HWaddr 00:0C:29:E8:73:24
inet addr:192.168.10.155 Bcast:192.168.10.255 Mask:255.255.255.0
inet6 addr: fe80::20c:29ff:fee8:7324/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:64366 errors:0 dropped:0 overruns:0 frame:0
TX packets:27227 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:13411305 (12.7 MiB) TX bytes:3705070 (3.5 MiB)
Interrupt:59 Base address:0x2000
eth1 Link encap:Ethernet HWaddr 00:0C:29:E8:73:2E
inet addr:10.1.1.1 Bcast:10.1.1.255 Mask:255.255.255.0
inet6 addr: fe80::20c:29ff:fee8:732e/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:6704 errors:0 dropped:0 overruns:0 frame:0
TX packets:7545 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:908433 (887.1 KiB) TX bytes:5980701 (5.7 MiB)
Interrupt:67 Base address:0x2080
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:1454 errors:0 dropped:0 overruns:0 frame:0
TX packets:1454 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:133663 (130.5 KiB) TX bytes:133663 (130.5 KiB)
ppp0 Link encap:Point-to-Point Protocol
inet addr:192.168.10.155 P-t-P:10.10.8.1 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1396 Metric:1
RX packets:4213 errors:0 dropped:0 overruns:0 frame:0
TX packets:5401 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:3
RX bytes:406029 (396.5 KiB) TX bytes:5486009 (5.2 MiB)
root@CentOS /root #service iptables status
Table: nat
Chain PREROUTING (policy ACCEPT)
num target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
num target prot opt source destination
1 SNAT all -- 10.10.8.0/24 0.0.0.0/0 to:192.168.10.155
Chain OUTPUT (policy ACCEPT)
num target prot opt source destination
Table: filter
Chain INPUT (policy DROP)
num target prot opt source destination
1 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
2 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80
3 ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:53
4 ACCEPT 47 -- 0.0.0.0/0 0.0.0.0/0
5 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:1723
Chain FORWARD (policy DROP)
num target prot opt source destination
1 ACCEPT all -- 10.10.8.0/24 0.0.0.0/0
2 ACCEPT all -- 0.0.0.0/0 10.10.8.0/24
Chain OUTPUT (policy ACCEPT)
num target prot opt source destination
以上是全部过程，Windows客户端只要新建一个PPTP的×××连接输入以上定义的用户名及密码即可拨上号并可通过《远程网关》进行互联网访问.
当然，这里的互联网访问的前提必须不被iptables防火墙阻止，根据自己的需求配置iptables即可。
转载于:https://blog.51cto.com/cookeer/649581