Comments on: Linux configure point to point tunneling PPTP VPN client for Microsoft PPTP vpn server

By: lutpiero

lutpiero — Fri, 18 Nov 2011 01:49:36 +0000

I do exactly as u write and
I receive this on my centos LCP: timeout sending Config-Requests.

I have already try to connect from windows 7 and vpn succesfully connected

By: Ladislav

Ladislav — Mon, 05 Sep 2011 11:21:23 +0000

Hi Vivek and everybody here, does anybody here have any experiences with setting up the client VPN against Microsoft PPTP VNP server, which use the client certificates. I already patched my ppp using this patch. But I am not able to set this connection up. Thanks for some example of configuration. Information about live connection I gathered from the Windows client are following:

On the connection configuration card:
On security folder there is selected "Precise configuration", then click on the Setting
Cryptography of data: Require (disconnect if cryptography cannot be used)
Use of protocol EAP: Smart Card or another certificate
There is a button for "Properties" where is>
- Use certificate in this computer
- Verify server certificate
- and in the root certificates list I selected the CA root certificate
Windows client VPN attributes after connection made:
Type of device: vpn
Type of server: PPP
Transports: TCP/IP
Authentication: EAP
Cypher: MPPE 128
Compression: MPPC
Multilink patterns of PPP: disabled

I use following command to initiate connection, but without any success:

/usr/local/sbin/pppd \
noauth nobsdcomp nodeflate require-eap \
name "$FQDN_HOSTNAME" remotename "$CN_Z_CA_CERTIFIKATU" \
cert $PRIVATNI_CERTIFIKAT \
key $VEREJNY_KLIC
ca $CA_CERTIFIKAT
password $HESLO \
logfile /tmp/pppd.log pty \
"pptp $VPN_SERVER  --nolaunchpppd"

By: Mike

Mike — Thu, 01 Sep 2011 14:11:52 +0000

don’t worry, found it

By: Mike

Mike — Thu, 01 Sep 2011 11:06:10 +0000

The if-up.d does not exist after installation, are we supposed to create this directory, or have things changed in recent versions?
I’m on RHEL though…

By: Sysadmin

Sysadmin — Mon, 22 Aug 2011 19:03:28 +0000

Lukas, yes, you can monitor VPN users trafic. The most simplier solution – is IP-address -based traffic accounting via iptables. This approach requires that each vpn-user have it’s oun unique IP-address. For example:
iptables -N ACCOUNT
iptables -A ACCOUNT -s 10.10.10.2 -j RETURN
iptables -A ACCOUNT -s 10.10.10.3 -j RETURN
……………
iptables -A FORWARD -j ACCOUNT

Then you can get packets and bytes counters with the command:
iptables -nL ACCOUNT -vx
and probably graph the stats via cacti/munin/etc…

By: Lukas

Lukas — Mon, 22 Aug 2011 11:22:41 +0000

Hello there. Thanks for very nice PPTP VPN manual. I got just one question. IS it possible to monitor users traffic on VPN ? Give users quota for VPN ? Problem is on my server is users making too mutch traffic and i need to stop this. Thanks for any help. lu

By: Syed Zaigham Ali

Syed Zaigham Ali — Wed, 03 Aug 2011 09:49:18 +0000

Yes mahesh it was a gateway problem. My service provider didn’t want to tell the gateway and network address and said that install windows we did’t provide services on Linux. But Finally i knew it and using internet on UBUNTU…:)

By: sa144

sa144 — Mon, 01 Aug 2011 10:54:22 +0000

I have set up PPTP VPN server on linux
But accounts are open for concurrent simultaneous connections. means there can be many users using one account at the time.
i need to limit that to one user at the time.
anybody knows how it can be done?

By: Alex

Alex — Fri, 24 Jun 2011 14:36:51 +0000

$NET – the network you wish to be routed via VPN-connection. If you want all your trafic go via VPN-tunnel, use “0.0.0.0/0″ as value for $NET variable. $IFACE – is that network interface which appeares after VPN-connection established (usually ppp0).

By: Alex

Alex — Fri, 24 Jun 2011 14:33:19 +0000

And one more alternative is pptpd (vpn-server implementing PPTP protocol)

By: Alex

Alex — Fri, 24 Jun 2011 14:30:28 +0000

It’s because windows considers that VPN-connection route is more preferable than your default route. To avioid this problem try to uncheck
the option “use default gateway in remote network” in TCP-IP options of VPN-connection (“Advanced…” button).

By: Alex

Alex — Fri, 24 Jun 2011 14:26:21 +0000

If your ADSL modem is in the bridge mode, and Linux firewall performs NAT for vpnclient, you should connect to VPNSERVER without problems. However, you may need to tune the firewall on the linux box (FORWARD chain) and load ip_nat_pptp kernel module (via modprobe command).

By: Alex

Alex — Fri, 24 Jun 2011 14:21:58 +0000

Try to install rpm pptp instead of pptpconfig and use command line for further configuring.

By: James Bond

James Bond — Mon, 30 May 2011 20:59:35 +0000

I’d like to add my success to this.

For anyone who doesn’t want to force all traffic over the VPN, but rather just traffic bound to that interface, use the following script in /etc/ppp/if-up.d/route-traffic:

IF1=ppp0
IP1=VPN_CLIENT_IP
P1=VPN_GATEWAY_IP
P1_NET=VPN_NETWORK_IP

ip route add $P1_NET dev $IF1 src $IP1 table extra
ip route add default via $P1 table extra
ip route add $P1_NET dev $IF1 src $IP1
ip rule add from $IP1 table extra

Be sure to:

echo “10 extra” >> /etc/iproute2/rt_tables

Tested on countless Debian/Ubuntu servers. Enjoy!

By: Rodent

Rodent — Mon, 23 May 2011 12:38:04 +0000

Just a quick question, I run Ubuntu 10.04 – Lucid Lynx, is there any way of firing a script or scripts when the VPN Connects / disconnects from the campus VPN.

By: Rodent

Rodent — Mon, 23 May 2011 12:31:16 +0000

I know this is a very old thread, but I had the same problem with the local campus network. No Default Route to x.x.x.x.
The fix turned out to be really easy.

sudo route add default gw 10.25.10.1

and bingo it started working, hope this helps someone in the future.
p.s. replace the 10.25.10.1 with the address of YOUR gateway.

By: Carlos

Carlos — Fri, 04 Mar 2011 04:06:15 +0000

I have this problem….

By: nanotera

nanotera — Fri, 18 Feb 2011 08:43:46 +0000

In CENTOS 5 there is no ip-up.d but you can instead add the route commands to

/etc/ppp/ip-up.local

use chmod to make it executable and then it will work.

By: George Kharmujai

George Kharmujai — Tue, 15 Feb 2011 19:57:30 +0000

Thanks Sandip.

I didnt realise this one…now my VPN connection its working great!

By: ahmed

ahmed — Tue, 25 Jan 2011 10:11:36 +0000

i tried the CLI to configure
and got the following output
OS is RH 5.3

Jan 25 13:12:25 vis pptp[8755]: anon log[ctrlp_disp:pptp_ctrl.c:781]: Received Stop Control Connection Request.
Jan 25 13:12:25 vis pptp[8755]: anon log[ctrlp_rep:pptp_ctrl.c:251]: Sent control packet type is 4 ‘Stop-Control-Connection-Reply’
Jan 25 13:12:25 vis pptp[8755]: anon log[callmgr_main:pptp_callmgr.c:253]: Closing connection
Jan 25 13:12:25 vis pptp[8755]: anon log[ctrlp_rep:pptp_ctrl.c:251]: Sent control packet type is 12 ‘Call-Clear-Request’
Jan 25 13:12:25 vis pppd[8749]: Modem hangup
Jan 25 13:12:25 vis pppd[8749]: Connection terminated.
Jan 25 13:12:25 vis pptp[8755]: anon log[pptp_read_some:pptp_ctrl.c:537]: read returned zero, peer has closed
Jan 25 13:12:25 vis pppd[8749]: Exit.
Jan 25 13:12:27 vis pptp[8755]: anon log[pptp_read_some:pptp_ctrl.c:537]: read returned zero, peer has closed
Jan 25 13:12:29 vis pptp[8755]: anon log[call_callback:pptp_callmgr.c:77]: Closing connection