Poptop: Linux VPN server for Windows clients using PPTP

• Author
• Recent Posts

Michael Pietroforte

Michael Pietroforte is the founder and editor in chief of 4sysops. He has more than 35 years of experience in IT management and system administration.

Latest posts by Michael Pietroforte (see all)

• Poll: How reliable are ChatGPT and Bing Chat? - Tue, May 23 2023
• Pip install Boto3 - Thu, Mar 24 2022
• Install Boto3 (AWS SDK for Python) in Visual Studio Code (VS Code) on Windows - Wed, Feb 23 2022

But let me say a word about security first. PPTP has many critics. Crypto experts have shown that it is possible to crack this protocol under certain circumstances, especially MSCHAPv2 which is used for authentication, has its weaknesses. MPPE (Microsoft Point-to-Point Encryption) "only" uses a 128-bit-key. However, I think for most scenarios PPTP is secure enough. If you want to hide your communication from curious system administrators, PPTP will do the job quite well, but if you think that the NSA or Mr. Super Hacker will be interested in your data, better use a more secure VPN protocol like IPSec. The disadvantage is that things will usually become more complicated.

Installing Poptop is not difficult, if you are a Linux admin. The documentation is a bit poor, though. I think most Linux distributions already come with the necessary packages. I installed it with YaST on a SuSE 9.0 machine. The name of the package is "pptpd". If some other packages are missing, YaST will tell you which ones. I had a problem getting the pptpd service running in the beginning. After a while it turned out that my 2.4.29 kernel didn't like Poptop, somehow. I tried several other kernel versions, and it always worked fine with them.

These are four configuration files:

• /etc/modules.conf
• /etc/pptpd.conf
• /etc/ppp/options.pptpd
• /etc/ppp/chap-secrets

If you have an older Linux distribution, check your modules.conf for these entries:

alias char-major-108 ppp_generic
alias tty-ldisc-3 ppp_async
alias tty-ldisc-14 ppp_synctty
alias ppp-compress-18 ppp_mppe
alias ppp-comress-21 bsd_comp
alias ppp-compress-24 ppp_deflate
alias ppp-compress-26 ppp_deflate

In pptpd.conf, I only uncommented the localip and the remoteip variables. I used private IPs for both variables. In options.pptpd, I enabled mppe-128. Most important is chap-secrets. Here you set the user name and the password. You can reduce the weakness of MSCHAPv2 by setting a strong password here. Use a random password, with a mixed of small and capital letters. Ten characters should be the minimum length. Don't use a password which you can remember easily. It is safer to let your VPN client store a strong password, instead of entering a weak and an easy-to-remember password whenever you connect to the VPN Server.

Then I configured the firewall to allow the PPTP protocol. With iptables, it looks like this:

iptables -A INPUT -p tcp --dport 1723 -j ACCEPT
iptables -A INPUT -p 47 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 1723 -j ACCEPT
iptables -A OUTPUT -p 47 -j ACCEPT

If you want to work with NAT (Network Address Translation), you have to add these lines to your iptables shell script:

iptables -A FORWARD -i ppp0 -o eth0 -s 192.168.10.0/24 -m state --state NEW -j ACCEPT

iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A POSTROUTING -t nat -j MASQUERADE

The IP range here is the one you configured in pptpd.conf. You also have to enable IP forwarding which is disabled by default. On a SuSE box the easiest way to do this is by using YaST. You'll find it under network services/routing. If you don't use SuSE please check out Marius' post about IP Forwarding.

Then you have to setup the VPN client on your Windows machine. Please go to this site for more information. The default PPTP setting of Windows should work.

With this configuration, you can already access the internet thru your Linux server using NAT. To make sure that you always use the VPN connection to access applications on the server, you can change C:\WINDOWS\system32\drivers\etc\hosts. Add the IP address to hosts which you set before for localip in pptpd.conf for the domain names that you are hosting on your Linux server. You have to reboot after changing the hosts file.

This way, your communication with the Linux host will always be encrypted regardless what application you use to access it. If you ever forget to establish the VPN connection first, you even won't be able to access the Linux machine.