Poptop installation

[Jethro]

I have installed the poptop package with ipkg. I have gone through the pptdp.conf and options.pptpd files and verified that the service S20poptop is running. The problem I am having is that I can't connect from LAN (not tried WAN, needs iptables config first).

I have altered the pptpd.conf file to match the following:

localip 192.168.1.1 (=my router's internal address)
remoteip 192.168.1.100-110, (=the ip's I want it to use)

Not working when trying to connect from a LAN client to the router.

What other configuration steps do I need to perform?

[pfugl]

Jethro, did you ever manage to get this working?
If yes could you give me the steps?
If not - anyone else has it working?
I am running into authentication errors, though I have made the chap-secrets file correctly and placed it in:
/opt/etc/ppp/chap-secrets
(perhaps this is the wrong place?)

[mmX]

Hi Pfugl,

it takes a few hours for me but finally I found the right place for the file.
It is in the /tmp/ppp directory.
I did a little workaround and place a symlink from my original file placed in /opt/etc/ppp
at boottime with the post-boot script into the /tmp/ppp directory.


mmX

[jaaput]

Not working when trying to connect from a LAN client to the router.

Uhmm, Jethro, is this subnet you use for the tunnel (obviously something
like 192.168.1.0/24) the same as your LAN-subnet? As you state, your
routers internal address, which is part of the LAN-subnet, is also in the
subnet you want to use for your tunnel-client. So I guess the answer is yes.
And I think the pptp-protocol was not designed with that option in mind.
If you really insist on testing it on your LAN first (which is by all means a
good thing in my opinion) then you better introduce a separate subnet.
I believe your LAN-adapter can become part of that new subnet simply
by adding an IP-alias to it:

ifconfig br0:0 192.168.3.1

It will be default get a subnetmask of 255.255.255.0, but if you want to
overrule that you can use:

ifconfig br0:0 192.168.3.1 netmask 255.255.0.0

And you can delete the alias by:

ifconfig br0:0 0.0.0.0

It will complain:

SIOCSIFFLAGS: Cannot assign requested address

but the alias will vanish.

Maybe that helps...

Good luck, and regards, Jaap.
42'12/~245

[pfugl]

Thx MMX.
It would be very nice if some could do a how-to for this. Every little step forward creates new problems. Well - that's life I guess. After creation of the new chap-secrets file my log looks as follows when I connect from XP from the lan side:

Sep 26 13:32:52 pptpd[5171]: MGR: Manager process started
Sep 26 13:32:52 pptpd[5171]: MGR: Maximum of 1 connections available
Sep 26 13:32:52 bcrelay[5172]: Initial active interfaces: br0(0/7/6) br0:0(1/7/8)
Sep 26 13:33:24 pptpd[5171]: MGR: No free connection slots or IPs - no more clients can connect!
Sep 26 13:33:24 pptpd[5173]: CTRL: Client 192.168.1.3 control connection started
Sep 26 13:33:24 pptpd[5173]: CTRL: Starting call (launching pppd, opening GRE)
Sep 26 13:33:24 pppd[5174]: pppd options in effect:
Sep 26 13:33:24 pppd[5174]: debug^I^I# (from /opt/etc/ppp/options.pptpd)
Sep 26 13:33:24 pppd[5174]: dump^I^I# (from /opt/etc/ppp/options.pptpd)
Sep 26 13:33:24 pppd[5174]: require-mschap-v2^I^I# (from /opt/etc/ppp/options.pptpd)
Sep 26 13:33:24 pppd[5174]: refuse-pap^I^I# (from /opt/etc/ppp/options.pptpd)
Sep 26 13:33:24 pppd[5174]: refuse-chap^I^I# (from /opt/etc/ppp/options.pptpd)
Sep 26 13:33:24 pppd[5174]: refuse-mschap^I^I# (from /opt/etc/ppp/options.pptpd)
Sep 26 13:33:24 pppd[5174]: name pptpd^I^I# (from /opt/etc/ppp/options.pptpd)
Sep 26 13:33:24 pppd[5174]: 115200^I^I# (from command line)
Sep 26 13:33:24 pppd[5174]: lock^I^I# (from /opt/etc/ppp/options.pptpd)
Sep 26 13:33:24 pppd[5174]: local^I^I# (from command line)
Sep 26 13:33:24 pppd[5174]: ipparam 192.168.1.3^I^I# (from command line)
Sep 26 13:33:24 pppd[5174]: proxyarp^I^I# (from /opt/etc/ppp/options.pptpd)
Sep 26 13:33:24 pppd[5174]: 192.168.0.3:192.168.0.234^I^I# (from command line)
Sep 26 13:33:24 pppd[5174]: nobsdcomp^I^I# (from /opt/etc/ppp/options.pptpd)
Sep 26 13:33:24 pppd[5174]: require-mppe-128^I^I# (from /opt/etc/ppp/options.pptpd)
Sep 26 13:33:24 pppd[5174]: pppd 2.4.2 started by dk05835, uid 0
Sep 26 13:33:24 pppd[5174]: Using interface ppp0
Sep 26 13:33:24 pppd[5174]: Connect: ppp0 <--> /dev/pts/1
Sep 26 13:33:25 kernel: ip_conntrack_pptp: error during exp_gre
Sep 26 13:33:26 kernel: ip_conntrack_pptp: error during exp_gre
Sep 26 13:33:27 kernel: ip_conntrack_pptp: error during exp_gre
Sep 26 13:33:31 kernel: ip_conntrack_pptp: error during exp_gre
Sep 26 13:33:38 kernel: ip_conntrack_pptp: error during exp_gre
Sep 26 13:33:51 kernel: ip_conntrack_pptp: error during exp_gre
Sep 26 13:33:55 pppd[5174]: LCP: timeout sending Config-Requests
Sep 26 13:33:55 pppd[5174]: Connection terminated.
Sep 26 13:33:55 pppd[5174]: Exit.
Sep 26 13:33:55 pptpd[5173]: GRE: read(fd=5,buffer=100004f0,len=8196) from PTY failed: status = -1 error = Input/output error, usually caused by unexpected termination of pppd, check option syntax and pppd logs
Sep 26 13:33:55 pptpd[5173]: CTRL: PTY read or GRE write failed (pty,gre)=(5,6)
Sep 26 13:33:55 pptpd[5173]: CTRL: Client 192.168.1.3 control connection finished

Any ideas?

[mmX]

Hi Pfugl,

it seems you have a problem with GRE or a mistake in your configuration file.
Here are my configuration files. Maybe you find something usefull:

pptpd.conf

###############################################################################
# $Id: pptpd.conf,v 1.1 2005/06/10 07:18:16 jeanfabrice Exp $
#
# Sample Poptop configuration file /etc/pptpd.conf
#
# Changes are effective when pptpd is restarted.
###############################################################################

# TAG: ppp
#       Path to the pppd program, default '/usr/sbin/pppd' on Linux
#
#ppp /usr/sbin/pppd

# TAG: option
#       Specifies the location of the PPP options file.
#       By default PPP looks in '/etc/ppp/options'
#
option /opt/etc/ppp/options.pptpd

# TAG: debug
#       Turns on (more) debugging to syslog
#
#debug

# TAG: stimeout
#       Specifies timeout (in seconds) on starting ctrl connection
#
# stimeout 10

# TAG: noipparam
#       Suppress the passing of the client's IP address to PPP, which is
#       done by default otherwise.
#
#noipparam

# TAG: logwtmp
#       Use wtmp(5) to record client connections and disconnections.
#
#logwtmp

# TAG: bcrelay <if>
#       Turns on broadcast relay to clients from interface <if>
#
#bcrelay eth1

# TAG: localip
# TAG: remoteip
#       Specifies the local and remote IP address ranges.
#
#       Any addresses work as long as the local machine takes care of the
#       routing.  But if you want to use MS-Windows networking, you should
#       use IP addresses out of the LAN address space and use the proxyarp
#       option in the pppd options file, or run bcrelay.
#
#       You can specify single IP addresses seperated by commas or you can
#       specify ranges, or both. For example:
#
#               192.168.0.234,192.168.0.245-249,192.168.0.254
#
#       IMPORTANT RESTRICTIONS:
#
#       1. No spaces are permitted between commas or within addresses.
#
#       2. If you give more IP addresses than MAX_CONNECTIONS, it will
#          start at the beginning of the list and go until it gets
#          MAX_CONNECTIONS IPs. Others will be ignored.
#
#       3. No shortcuts in ranges! ie. 234-8 does not mean 234 to 238,
#          you must type 234-238 if you mean this.
#
#       4. If you give a single localIP, that's ok - all local IPs will
#          be set to the given one. You MUST still give at least one remote
#          IP for each simultaneous client.
#
# (Recommended)
#localip 192.168.0.1
#remoteip 192.168.0.234-238,192.168.0.245
# or
#localip 192.168.0.234-238,192.168.0.245
#remoteip 192.168.1.234-238,192.168.1.245
localip 192.168.253.1
remoteip 192.168.253.2-3

chap-secrets

# PPP CHAP secrets file.
# See pppd(1) for file format.

# Secrets for authentication using CHAP
# client        server  secret          IP addresses
#username       pptpd   password        *
#test           *       "test"          *

mmx       pptpd   "password"      192.168.253.2


# For ppp patched with smbauth you use
# *     pptpd   &/etc/samba/smbpasswd   *

options.pptpd

###############################################################################
# $Id: options.pptpd,v 1.1 2005/06/10 07:18:16 jeanfabrice Exp $
#
# Sample Poptop PPP options file /etc/ppp/options.pptpd
# Options used by PPP when a connection arrives from a client.
# This file is pointed to by /etc/pptpd.conf option keyword.
# Changes are effective on the next connection.  See "man pppd".
#
# You are expected to change this file to suit your system.  As
# packaged, it requires PPP 2.4.2 and the kernel MPPE module.
###############################################################################


# Authentication

# Name of the local system for authentication purposes
# (must match the second field in /etc/ppp/chap-secrets entries)
name pptpd

# Strip the domain prefix from the username before authentication.
# (applies if you use pppd with chapms-strip-domain patch)
#chapms-strip-domain


# Encryption
# (There have been multiple versions of PPP with encryption support,
# choose with of the following sections you will use.)


# BSD licensed ppp-2.4.2 upstream with MPPE only, kernel module ppp_mppe.o
# {{{
refuse-pap
refuse-chap
refuse-mschap
# Require the peer to authenticate itself using MS-CHAPv2 [Microsoft
# Challenge Handshake Authentication Protocol, Version 2] authentication.
require-mschap-v2
# Require MPPE 128-bit encryption
# (note that MPPE requires the use of MSCHAP-V2 during authentication)
require-mppe-128
# }}}


# OpenSSL licensed ppp-2.4.1 fork with MPPE only, kernel module mppe.o
# {{{
#-chap
#-chapms
# Require the peer to authenticate itself using MS-CHAPv2 [Microsoft
# Challenge Handshake Authentication Protocol, Version 2] authentication.
#+chapms-v2
# Require MPPE encryption
# (note that MPPE requires the use of MSCHAP-V2 during authentication)
#mppe-40        # enable either 40-bit or 128-bit, not both
#mppe-128
#mppe-stateless
# }}}


# Network and Routing

# If pppd is acting as a server for Microsoft Windows clients, this
# option allows pppd to supply one or two DNS (Domain Name Server)
# addresses to the clients.  The first instance of this option
# specifies the primary DNS address; the second instance (if given)
# specifies the secondary DNS address.
#ms-dns 10.0.0.1
#ms-dns 10.0.0.2

# If pppd is acting as a server for Microsoft Windows or "Samba"
# clients, this option allows pppd to supply one or two WINS (Windows
# Internet Name Services) server addresses to the clients.  The first
# instance of this option specifies the primary WINS address; the
# second instance (if given) specifies the secondary WINS address.
#ms-wins 10.0.0.3
#ms-wins 10.0.0.4

# Add an entry to this system's ARP [Address Resolution Protocol]
# table with the IP address of the peer and the Ethernet address of this
# system.  This will have the effect of making the peer appear to other
# systems to be on the local ethernet.
# (you do not need this if your PPTP server is responsible for routing
# packets to the clients -- James Cameron)
#proxyarp
mtu 1464
mru 1464

# Logging

# Enable connection debugging facilities.
# (see your syslog configuration for where pppd sends to)
#debug

# Print out all the option values which have been set.
# (often requested by mailing list to verify options)
#dump


# Miscellaneous

# Create a UUCP-style lock file for the pseudo-tty to ensure exclusive
# access.
lock

# Disable BSD-Compress compression
nobsdcomp
#noauth

Here the demonstration that it works for me:

Sep 27 21:40:55 pptpd[208]: CTRL: Client 192.168.1.1 control connection started
Sep 27 21:40:55 pptpd[208]: CTRL: Starting call (launching pppd, opening GRE)
Sep 27 21:40:55 pppd[209]: pppd 2.4.2 started by admin, uid 0
Sep 27 21:40:55 pppd[209]: Using interface ppp1
Sep 27 21:40:55 pppd[209]: Connect: ppp1 <--> /dev/pts/1
Sep 27 21:40:55 pptpd[208]: CTRL: Ignored a SET LINK INFO packet with real ACCMs!
Sep 27 21:40:55 pppd[209]: MPPC/MPPE 128-bit stateful compression enabled
Sep 27 21:40:55 pppd[209]: local  IP address 192.168.253.1
Sep 27 21:40:55 pppd[209]: remote IP address 192.168.253.2
Sep 27 21:41:20 pppd[209]: LCP terminated by peer (oM-^F^RM-S^@<M-Mt^@^@^@^@)
Sep 27 21:41:20 pppd[209]: Modem hangup
Sep 27 21:41:20 pppd[209]: Connection terminated.
Sep 27 21:41:20 pppd[209]: Connect time 0.5 minutes.
Sep 27 21:41:20 pppd[209]: Sent 122 bytes, received 2407 bytes.
Sep 27 21:41:21 pppd[209]: Connect time 0.5 minutes.
Sep 27 21:41:21 pppd[209]: Sent 122 bytes, received 2407 bytes.
Sep 27 21:41:21 pppd[209]: Exit.

At the clientside you must disable softwarecompression I had big problems with enable
softwarecompression.

Best regards
mmX

[pfugl]

Thanks mmX.
In the meantime I found out that in fact I could connect 1 time out of 4 from winXP client.
I have now changed my config files to match yours exactly, (except user/password), but still only succes in 1 out of 4.

Another strange thing is that my default route inside the router disappears when the client is connected, so i cannot connect to my ISP anymore.
When I have a succesfull connection my log looks as follows:

Sep 28 18:07:40 pptpd[444]: CTRL: Client 192.168.1.3 control connection started
Sep 28 18:07:40 pptpd[444]: CTRL: Starting call (launching pppd, opening GRE)
Sep 28 18:07:40 pppd[445]: pppd 2.4.2 started by dk05835, uid 0
Sep 28 18:07:40 pppd[445]: Using interface ppp0
Sep 28 18:07:40 pppd[445]: Connect: ppp0 <--> /dev/pts/1
Sep 28 18:07:40 pptpd[444]: CTRL: Ignored a SET LINK INFO packet with real ACCMs!
Sep 28 18:07:40 pppd[445]: Warning - secret file /tmp/ppp/chap-secrets has world and/or group access
Sep 28 18:07:40 pppd[445]: local  IP address 192.168.253.1
Sep 28 18:07:40 pppd[445]: remote IP address 192.168.253.2
Sep 28 18:07:40 pppd[445]: MPPE 128-bit stateful compression enabled
Sep 28 18:07:40 dnsmasq[73]: read /etc/hosts - 5 addresses
Sep 28 18:07:40 dnsmasq[73]: reading /tmp/resolv.conf
Sep 28 18:07:40 dnsmasq[73]: using nameserver 193.162.145.130#53
Sep 28 18:07:40 dnsmasq[73]: using nameserver 193.162.159.194#53
Sep 28 18:07:41 Static: connect to ISP

When it fails it looks like this:

Sep 28 18:20:13 pptpd[492]: CTRL: Client 192.168.1.3 control connection started
Sep 28 18:20:13 pptpd[492]: CTRL: Starting call (launching pppd, opening GRE)
Sep 28 18:20:14 pppd[493]: pppd 2.4.2 started by dk05835, uid 0
Sep 28 18:20:14 pppd[493]: Using interface ppp0
Sep 28 18:20:14 pppd[493]: Connect: ppp0 <--> /dev/pts/1
Sep 28 18:20:44 pppd[493]: LCP: timeout sending Config-Requests
Sep 28 18:20:44 pppd[493]: Connection terminated.
Sep 28 18:20:44 pppd[493]: Exit.
Sep 28 18:20:44 pptpd[492]: GRE: read(fd=7,buffer=100004f0,len=8196) from PTY failed: status = -1 error = Input/output error, usually caused by unexpected termination of pppd, check option syntax and pppd logs
Sep 28 18:20:44 pptpd[492]: CTRL: PTY read or GRE write failed (pty,gre)=(7,8)
Sep 28 18:20:44 pptpd[492]: CTRL: Client 192.168.1.3 control connection finished

As you can see, the difference is that the SET LINK INFO packet is never received. An Etherreal trace from the client confirms that it is never sent from XP in the failing situation.

The route problem shows up if I try to do a ROUTE command inside the WL500 - it shows the first 4 routes and then hangs (the # prompt does not return, but it can be terminated by a ctl c). The default route does not show up. Perhaps the wl500 only allows 4 static routes?

I should add that I am connecting from the LAN side - I have not had any succes from the WAN side yet.

[mmX]

Hi Pfugl,

I have got exactly the same problem that WinXP-clients connect 1 time out of 4.

http://wl500g.info/showthread.php?t=1771&page=3

But I also don't know how to fix it.

I set up 6 route entrys and if I type the route command it takes a little while,
but I see all my route entrys.

If you want your poptop-server is reachable from WAN side you must add the following rules
to your post-firewall script:

iptables -A INPUT -p 47 -j ACCEPT
iptables -A INPUT -p tcp --syn --dport 1723 -j ACCEPT

What environment to you have?
I've got a Wl500g running with Olegs 1.9.2.7-6b firmware.
Maybe this might explain the different behaviour of the router.


Best regards

mmX

[pfugl]

Hi mmX.
I have given up to make this work reliably. I have a WL500GX with Oleg's 1.9.2.7-6b fw.
Something is going wrong in the kernel I think. When connected, the Route command and the IPTABLES command both hangs halfway through. When I disconnect, both of the commands will resume the hang and continue their operation to the end.
Also I have added the iptable entries you describe, but when I connect through wan, it hangs on userid/pw authentication.
/Peter.

[hugo]

Ok, back to the subject because having a PPTP solution on wl series is an important point if you use pocket pc for example.

The 4 times to connect bug is also on the pocket pc client. This is a server problem, because if you hang the connection too early on the PC side, it will not count in the "4 to go" to connect. I guess we have to get a newer version for this one.

About the connection problem: the issue is that the routing table shift when the ppp0 link is established. As you describe, it is very long to get the routing table. The router also lose connectivity with WAN when the connection is established, on laterst Oleg firmware. Using the web interface, in the status page, you can see the router believe that the WAN interface is now the ppp connection. When hanging up, the router can ping again, but the client get usually a mangled routing table, with metric going up to 20 or 30, which is a result of a bad routing configuration (client get this if your router doesn't answer). You usually have to restart to correct this, or you have to do it by hand.

So the question is: how can we set the WAN interface. I guess this is the default route in the routing table, but if it is so, can we correct this table during the ppp link? The firewall is just a secondary problem, because if the ppp link becomes WAN, it is of course blocked by the firewall. If you open it, all packet goes through between client and server.

Another remark is that we might need another version of pppd, as it is probably the one creating the problem. What do you think?

[BadDude]

Hi there

Feb 21 21:35:23 pptpd[368]: MGR: Manager process started
Feb 21 21:35:23 pptpd[368]: MGR: Maximum of 51 connections available
Feb 21 21:35:23 bcrelay[369]: Running as child 
Feb 21 21:35:32 pptpd[370]: CTRL: Client 192.168.1.2 control connection started
Feb 21 21:35:32 pptpd[370]: CTRL: Starting call (launching pppd, opening GRE)
Feb 21 21:35:32 pppd[371]: File not found
Feb 21 21:35:32 pppd[371]: Couldn't load plugin /usr/lib/pptpd/pptpd-logwtmp.so
Feb 21 21:35:32 pptpd[370]: GRE: read(fd=5,buffer=100004f0,len=8196) from PTY failed: status = -1 error = Input/output error, usually caused by unexpected termination of pppd, check option syntax and pppd logs
Feb 21 21:35:32 pptpd[370]: CTRL: PTY read or GRE write failed (pty,gre)=(5,6)
Feb 21 21:35:32 pptpd[370]: CTRL: Client 192.168.1.2 control connection finished

has anyobody any idea what file is not found? Or what is that plugin it is cry for?

[mmX]

Hi BadDude,

just disable logwtmp in the pptpd.conf.
Its only for logging the client connection, but in the syslog you
also find who logged in.

Best regards

mmX

[BadDude]

Feb 22 09:11:59 pptpd[415]: MGR: Manager process started
Feb 22 09:11:59 pptpd[415]: MGR: Maximum of 51 connections available
Feb 22 09:11:59 bcrelay[416]: Running as child 
Feb 22 09:12:09 pptpd[417]: CTRL: Client 192.168.1.3 control connection started
Feb 22 09:12:09 pptpd[417]: CTRL: Starting call (launching pppd, opening GRE)
Feb 22 09:12:09 pppd[418]: pppd 2.4.2 started by admin, uid 0
Feb 22 09:12:09 pppd[418]: Using interface ppp0
Feb 22 09:12:09 pppd[418]: Connect: ppp0 <--> /dev/pts/1
Feb 22 09:12:10 kernel: ip_conntrack_pptp: error during exp_gre
Feb 22 09:12:10 kernel: ip_conntrack_pptp: error during exp_gre

# (Recommended)
#localip 192.168.0.1
#remoteip 192.168.0.234-238,192.168.0.245
# or
#localip 192.168.0.234-238,192.168.0.245
#remoteip 192.168.1.234-238,192.168.1.245
localip 192.168.1.1
remoteip 192.168.1.200-250

I guess now it something in my congif ... I will playing with it tonight, now i have to work. Thank you for your quick reply.

[BadDude]

Hi.

It's me again.

I couldn't get over this

Feb 23 14:59:13 kernel: ip_conntrack_pptp: error during exp_gre

error.

What I relaized, that we use different interface. Could it be? All the rest of the config files are the same.

[Isidor]

Hello

I've this error message did someone have any idea :-(

Feb 21 15:53:23 pptpd[6780]: CTRL: Client 193.98.151.180 control connection started
Feb 21 15:53:23 pptpd[6780]: CTRL: Starting call (launching pppd, opening GRE)
Feb 21 15:53:23 pppd[6781]: The remote system is required to authenticate itself
Feb 21 15:53:23 pppd[6781]: but I couldn't find any suitable secret (password) for it to use to do so.
Feb 21 15:53:23 pptpd[6780]: GRE: read(fd=5,buffer=100004f0,len=8196) from PTY failed: status = -1 error = Input/output error, usually caused by unexpected termination of pppd, check option syntax and pppd logs
Feb 21 15:53:23 pptpd[6780]: CTRL: PTY read or GRE write failed (pty,gre)=(5,6)
Feb 21 15:53:23 pptpd[6780]: CTRL: Client 193.98.151.180 control connection finished

Isidor