PPTP Tunneling

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 18:38, 27 August 2006 (edit)
Coperton (Talk | contribs)

← Previous diff
Revision as of 00:01, 23 October 2011 (edit) (undo)
Gnassar (Talk | contribs)
(Tested Versions)
Next diff →
(45 intermediate revisions not shown.)
Line 1: Line 1:
-<b>Point-to-Point Tunneling with two DD-WRT</b><br />+= Introduction =
-(Updated: August 27, 2006)+This setup will bridge DD-WRT routers, allowing any host connected to the network to be visible from the WAN cloud.
 +To turn this HOWTO simple I'll use only two DD-WRT routers but theoretically you can further extend the setup to any number of routers.
-The next configuration was made in two wrt54g (hardware version 2.2) and firmware "DD-WRT v23 SP1 (04/13/06) std"<br /> 
-<u>Scenario:</u><br />+== Notes ==
-*Network A in location "a"<br />+* If your ISP do not provide you a fixed IP address, you should now create a dynamic DNS account from any DD-WRT supported provider. I'll use a No-IP.com account in the article's examples.
-<center>+* I assume you've got your WAN already up, if you need a different setup please feel free to change whatever you need.
-{| border=1 cellspacing=0 cellpadding=5+
-| Router A address+
-| 192.168.1.1+
-|- +
-| DHCP range+
-| 192.168.1.100-150+
-|- +
-| Dyndns address+
-| "direccion_de_A.dyndns.org"+
-|}+
-</center>+
 +== Tested Versions ==
 +This article should work with any supported DD-WRT version. Feel free to add your version to the following list:
 +* DD-WRT v24-sp2 (01/21/09) std
 +Does NOT work with
 +* DD-WRT v24-sp2 (10/10/09) std-nokaid (instructions below are not for v24-sp2 firmware; may work (untested) with method from http://www.dd-wrt.com/phpBB2/viewtopic.php?p=10933#10933)
-*Network B in location "b"<br />+= Configuration =
-<center>+
-{| border=1 cellspacing=0 cellpadding=5+
-| Router B address+
-| 192.168.2.1+
-|- +
-| DHCP range+
-| 192.168.2.100-150+
-|- +
-| Dyndns address+
-| "direccion_de_B.dyndns.org"+
-|}+
-</center>+
-<br />+
-:And you wish connect to any IP of the network A or B, not mattering in what of them was connected+
 +== Generic information ==
 +* '''dd-wrt-01'''
 +** Address: 192.168.1.1
 +** Netmask: 255.255.255.0
 +** Gateway: 0.0.0.0
 +** DHCP Range: 192.168.1.100-150
 +** DDNS: foo-corp-dd-wrt-01.no-ip.com
-<u>Configuration:</u><br /> 
 +* '''dd-wrt-02'''
 +** Address: 192.168.2.1
 +** Netmask: 255.255.255.0
 +** Gateway: 0.0.0.0
 +** DHCP Range: 192.168.2.100-150
 +** DDNS: foo-corp-dd-wrt-02.no-ip.com
-*To work fine VPN connection<br /> 
-:On both routers+== dd-wrt-01 ==
 +This step will configure the basic information for the local network.
 +# Goto Setup > Basic Setup
 +# Set Router Name and Host Name to "dd-wrt-01"
 +# Set Local IP Address to "192.168.1.1"
 +# Set Subnet Mask to "255.255.255.0"
 +# '''Save'''
-::In "Administration" tab 
-::In "Management" tab 
-<center>+Now lets make your dynamic IP address always reachable trough a hostname.
-{| border=1 cellspacing=0 cellpadding=5+# Goto Administration > DDNS
-| DNS Masq+# Set DNS Service to "No-IP.com"
-| Enable+# Change Username, Password and Hostname to your personal account information
-|- +# Hostname in this example will be set to "foo-corp-dd-wrt-01.no-ip.com"
-| Local DNS+# '''Save'''
-| Enable+
-|- +
-| Loopback+
-| Disable+
-|}+
-</center>+
-<u>Note:</u> 
-Loop back must be disable because VPN not always work when it is enable. 
-The image<br />+Now we tell the router that there is another network on the other side of the WAN.
-<center>http://img237.imageshack.us/img237/9766/loopbackzs4.jpg</center> +Basically we're telling "If you want to access any host on the 192.168.2.x subnet please forward your packet trough the router at the IP address "192.168.2.1".
 +# Goto Setup > Advanced Routing
 +# Under Static Routing:
 +# Set Route Name to "foo-corp-dd-wrt-02"
 +# Set Metric to "0"
 +# Set Destination LAN NET to "192.168.2.0"
 +# Set Subnet Mask to "255.255.255.0"
 +# Set Gateway to "192.168.2.1"
 +# Set Interface to "ANY"
 +# '''Save'''
 +This router will have the role of "concentrator" meaning that every router that wants to be part of our bridge should connect to it.
 +If you've got a more complex design with three routers (A, B and C) traffic from B to C will always pass trough router A.
 +# Goto Services > PPTP
 +# Enable PPTP Server
 +# Set Server IP to "192.168.1.1"
 +# Set Client IP(s) to "192.168.1.200-201"
 +# Set CHAP-Secrets to: "<PPTP_CLIENT_USERNAME_SITE02> * <PPTP_CLIENT_PASSWORD_SITE02> *"
 +# Disable PPTP Client Options
 +# '''Save'''
-*For network A has access to network B<br />+Saving ourselves from a headache.. ;-)
 +# Goto Security > VPN
 +# Enable PPTP Passthrough
 +# Disable IPSec and L2TP Passthrough
 +# '''Save'''
-:On router A<br />+This step maybe optional.. but routing packets trough a WAN interface without being encrypted is stupid.
-::In "Administration" tab<br />+# Goto Administration > Commands
-::In "Services" tab<br />+# Enter "sed -i -e 's/mppe .*/mppe required,stateless/' /tmp/pptpd/options.pptpd"
-<center>+# Save Startup
-{| border=1 cellspacing=0 cellpadding=5+# NOTE: This will force all PPTP clients to use encryption
-| PPTP Client Options+# '''Save'''
-| Enable+
-|- +
-| Server IP or DNS Name+
-| direccion_de_B.dyndns.org+
-|- +
-| Remote Subnet+
-| 192.168.2.0+
-|- +
-| Remote Subnet Mask+
-| 255.255.255.0+
-|- +
-| MPPE Encryption+
-| mppe required+
-|- +
-| MTU+
-| 1450+
-|- +
-| MRU+
-| 1450+
-|- +
-| User Name+
-| usernameB+
-|- +
-| Password+
-| passwordB+
-|}+
-</center>+
-:On router B<br /> 
-::In "Administration" tab<br /> 
-::In "Services" tab<br /> 
-<center> 
-{| border=1 cellspacing=0 cellpadding=5 
-| PPTP Server 
-| Enable 
-|-  
-| Server IP 
-| 192.168.2.1 
-|-  
-| Client IP(s) 
-| 192.168.2.200-250 
-|-  
-| CHAP-Secrets 
-| usernameB * passwordB * 
-|} 
-</center> 
 +Wrapping everything up..
 +# Goto Administration
 +# '''Reboot Router'''
 +== dd-wrt-02 ==
 +# Goto Setup > Basic Setup
 +# Set Router Name and Host Name to "dd-wrt-02"
 +# Set Local IP Address to "192.168.2.1"
 +# Set Subnet Mask to "255.255.255.0"
 +# '''Save'''
-*For network B has access to network A<br /> 
 +# Goto Administration > DDNS
 +# Set DNS Service to "No-IP.com"
 +# Change Username, Password and Hostname to your personal account information
 +# Hostname in this example will be set to "foo-corp-dd-wrt-02.no-ip.com"
 +# '''Save'''
-:On router A<br /> 
-::In "Administration" tab<br /> 
-::In "Services" tab<br /> 
-<center> 
-{| border=1 cellspacing=0 cellpadding=5 
-| PPTP Server 
-| Enable 
-|-  
-| Server IP 
-| 192.168.1.1 
-|-  
-| Client IP(s) 
-| 192.168.1.200-250 
-|-  
-| CHAP-Secrets 
-| usernameA * passwordA * 
-|} 
-</center> 
 +Now we tell the router that there is another network on the other side of the WAN.
 +Basically we're telling "If you want to access any host on the 192.168.1.x subnet please forward your packet trough the router at the IP address "192.168.1.1".
 +# Goto Setup > Advanced Routing
 +# Set Route Name to "foo-corp-dd-wrt-01"
 +# Set Metric to "0"
 +# Set Destination LAN NET to "192.168.1.0"
 +# Set Subnet Mask to "255.255.255.0"
 +# Set Gateway to "192.168.1.1"
 +# Set Interface to "ANY"
 +# '''Save'''
-:On router B<br /> 
-::In "Administration" tab<br /> 
-::In "Services" tab<br /> 
-<center> 
-{| border=1 cellspacing=0 cellpadding=5 
-| PPTP Client Options 
-| Enable 
-|-  
-| Server IP or DNS Name 
-| direccion_de_A.dyndns.org 
-|-  
-| Remote Subnet 
-| 192.168.1.0 
-|-  
-| Remote Subnet Mask 
-| 255.255.255.0 
-|-  
-| MPPE Encryption 
-| mppe required 
-|-  
-| MTU 
-| 1450 
-|-  
-| MRU 
-| 1450 
-|-  
-| User Name 
-| usernameA 
-|-  
-| Password 
-| passwordA 
-|} 
-</center> 
-<u>Notes:</u>+This router will have the role of "node".
-*The third octet of direction IP (192.168. thirdoctet.1) of the network A must be different of the network B+# Goto Services > PPTP
-*The range of Client IP(s) must be outside of dhcp+# Disable PPTP Server
-*In the example the IP range that occurred for clients vpn ("Client IP(s)") was 192.168.x.200-250 therefore 51 VPN clients allowed+# Enable PPTP Client Options
 +# Set Server IP or DNS Name to "foo-corp-dd-wrt-01.no-ip.com"
 +# Set Remote Subnet to "192.168.1.0"
 +# Set Remote Subnet Mask to "255.255.255.0"
 +# Set MPPE Encryption to "mppe required"
 +# Set MTU to "1450"
 +# Set MRU to "1450"
 +# Enable NAT
 +# Set Username to "PPTP_CLIENT_USERNAME_SITE02"
 +# Set Password to "PPTP_CLIENT_PASSWORD_SITE02"
 +# '''Save'''
-<u>Some Images</u><br /> 
-The result in router A<br />+# Goto Security > VPN
-<center>http://img162.imageshack.us/img162/22/ruteadora6ir.jpg</center>+# Enable PPTP Passthrough
 +# Disable IPSec and L2TP Passthrough
 +# '''Save'''
-The result in router B<br /> 
-<center>http://img73.imageshack.us/img73/4391/ruteadorb3nn.jpg</center> 
-<br />+Wrapping everything up..
-<br />+# Goto Administration
 +# '''Reboot Router'''
-'''Tip'''+== Notes ==
-*To monitoring and guarantee the connection you can do this+* The router's subnets should not intersect each other (i.e. 192.168.<XXX>.1).
 +* The IP address pool for VPN clients must be outside the range of DHCP clients.
 +* In the example the IP range used for VPN clients were "192.168.1.200-201" thus 2 VPN clients are allowed to connect to our concentrator. You should increase this if more routers will be bridged.
-:On both routers+== Issues ==
 +* Not sure why "NAT" is enabled, given the sites are a site to site route - NAT will break the whole premise of a site to site connection
-::In "Administration" tab+= See Also =
-::In "Keep Alive" tab+[[PPTP_Server_Configuration]]<br>
 +[[HOW_TO_configure_a_WINDOWS_BOX_to_make_a_VPN_Connection_to_linksys]]
-<center> 
-{| border=1 cellspacing=0 cellpadding=5 
-| Enable Watchdog 
-| Enable 
-|-  
-| Interval (in seconds) 
-| 300 
-|-  
-| IP Addresses 
-| 192.168.1.200 192.168.2.200 
-|} 
-</center> 
-The image<br />+[[Category:Tunneling]]
-<center>http://img201.imageshack.us/img201/9416/keepaliveye2.jpg</center> +[[Category:Advanced tutorials]]
- +
- +
- +
-Explanation:+
-With this configuration the router will monitoring every 5 minutes (the 300 seconds) VPN server can assign an ip address and VPN client can obtain an ip address, if not the router will reboot until it can do that.+
- +
- +
-An other way to make VPN tunnel+
-http://www.dd-wrt.com/phpBB2/viewtopic.php?t=1767+
- +
- +
-<u>Useful Links</u>+
-;PPTP Server Configuration+
-:http://wrt-wiki.bsr-clan.de/index.php?title=PPTP_Server_Configuration+
-;HOW TO configure a WINDOWS BOX to make a VPN Connection to linksys+
-:http://wrt-wiki.bsr-clan.de/index.php?title=HOW_TO_configure_a_WINDOWS_BOX_to_make_a_VPN_Connection_to_linksys+
- +
- +
- +
-[[Category:advanced HOWTO]]+
- +
-[[Category:English documentation]]+

Revision as of 00:01, 23 October 2011

Contents

Introduction

This setup will bridge DD-WRT routers, allowing any host connected to the network to be visible from the WAN cloud. To turn this HOWTO simple I'll use only two DD-WRT routers but theoretically you can further extend the setup to any number of routers.


Notes

  • If your ISP do not provide you a fixed IP address, you should now create a dynamic DNS account from any DD-WRT supported provider. I'll use a No-IP.com account in the article's examples.
  • I assume you've got your WAN already up, if you need a different setup please feel free to change whatever you need.


Tested Versions

This article should work with any supported DD-WRT version. Feel free to add your version to the following list:

  • DD-WRT v24-sp2 (01/21/09) std

Does NOT work with

Configuration

Generic information

  • dd-wrt-01
    • Address: 192.168.1.1
    • Netmask: 255.255.255.0
    • Gateway: 0.0.0.0
    • DHCP Range: 192.168.1.100-150
    • DDNS: foo-corp-dd-wrt-01.no-ip.com


  • dd-wrt-02
    • Address: 192.168.2.1
    • Netmask: 255.255.255.0
    • Gateway: 0.0.0.0
    • DHCP Range: 192.168.2.100-150
    • DDNS: foo-corp-dd-wrt-02.no-ip.com


dd-wrt-01

This step will configure the basic information for the local network.

  1. Goto Setup > Basic Setup
  2. Set Router Name and Host Name to "dd-wrt-01"
  3. Set Local IP Address to "192.168.1.1"
  4. Set Subnet Mask to "255.255.255.0"
  5. Save


Now lets make your dynamic IP address always reachable trough a hostname.

  1. Goto Administration > DDNS
  2. Set DNS Service to "No-IP.com"
  3. Change Username, Password and Hostname to your personal account information
  4. Hostname in this example will be set to "foo-corp-dd-wrt-01.no-ip.com"
  5. Save


Now we tell the router that there is another network on the other side of the WAN. Basically we're telling "If you want to access any host on the 192.168.2.x subnet please forward your packet trough the router at the IP address "192.168.2.1".

  1. Goto Setup > Advanced Routing
  2. Under Static Routing:
  3. Set Route Name to "foo-corp-dd-wrt-02"
  4. Set Metric to "0"
  5. Set Destination LAN NET to "192.168.2.0"
  6. Set Subnet Mask to "255.255.255.0"
  7. Set Gateway to "192.168.2.1"
  8. Set Interface to "ANY"
  9. Save


This router will have the role of "concentrator" meaning that every router that wants to be part of our bridge should connect to it. If you've got a more complex design with three routers (A, B and C) traffic from B to C will always pass trough router A.

  1. Goto Services > PPTP
  2. Enable PPTP Server
  3. Set Server IP to "192.168.1.1"
  4. Set Client IP(s) to "192.168.1.200-201"
  5. Set CHAP-Secrets to: "<PPTP_CLIENT_USERNAME_SITE02> * <PPTP_CLIENT_PASSWORD_SITE02> *"
  6. Disable PPTP Client Options
  7. Save


Saving ourselves from a headache.. ;-)

  1. Goto Security > VPN
  2. Enable PPTP Passthrough
  3. Disable IPSec and L2TP Passthrough
  4. Save


This step maybe optional.. but routing packets trough a WAN interface without being encrypted is stupid.

  1. Goto Administration > Commands
  2. Enter "sed -i -e 's/mppe .*/mppe required,stateless/' /tmp/pptpd/options.pptpd"
  3. Save Startup
  4. NOTE: This will force all PPTP clients to use encryption
  5. Save


Wrapping everything up..

  1. Goto Administration
  2. Reboot Router

dd-wrt-02

  1. Goto Setup > Basic Setup
  2. Set Router Name and Host Name to "dd-wrt-02"
  3. Set Local IP Address to "192.168.2.1"
  4. Set Subnet Mask to "255.255.255.0"
  5. Save


  1. Goto Administration > DDNS
  2. Set DNS Service to "No-IP.com"
  3. Change Username, Password and Hostname to your personal account information
  4. Hostname in this example will be set to "foo-corp-dd-wrt-02.no-ip.com"
  5. Save


Now we tell the router that there is another network on the other side of the WAN. Basically we're telling "If you want to access any host on the 192.168.1.x subnet please forward your packet trough the router at the IP address "192.168.1.1".

  1. Goto Setup > Advanced Routing
  2. Set Route Name to "foo-corp-dd-wrt-01"
  3. Set Metric to "0"
  4. Set Destination LAN NET to "192.168.1.0"
  5. Set Subnet Mask to "255.255.255.0"
  6. Set Gateway to "192.168.1.1"
  7. Set Interface to "ANY"
  8. Save


This router will have the role of "node".

  1. Goto Services > PPTP
  2. Disable PPTP Server
  3. Enable PPTP Client Options
  4. Set Server IP or DNS Name to "foo-corp-dd-wrt-01.no-ip.com"
  5. Set Remote Subnet to "192.168.1.0"
  6. Set Remote Subnet Mask to "255.255.255.0"
  7. Set MPPE Encryption to "mppe required"
  8. Set MTU to "1450"
  9. Set MRU to "1450"
  10. Enable NAT
  11. Set Username to "PPTP_CLIENT_USERNAME_SITE02"
  12. Set Password to "PPTP_CLIENT_PASSWORD_SITE02"
  13. Save


  1. Goto Security > VPN
  2. Enable PPTP Passthrough
  3. Disable IPSec and L2TP Passthrough
  4. Save


Wrapping everything up..

  1. Goto Administration
  2. Reboot Router

Notes

  • The router's subnets should not intersect each other (i.e. 192.168.<XXX>.1).
  • The IP address pool for VPN clients must be outside the range of DHCP clients.
  • In the example the IP range used for VPN clients were "192.168.1.200-201" thus 2 VPN clients are allowed to connect to our concentrator. You should increase this if more routers will be bridged.

Issues

  • Not sure why "NAT" is enabled, given the sites are a site to site route - NAT will break the whole premise of a site to site connection

See Also

PPTP_Server_Configuration
HOW_TO_configure_a_WINDOWS_BOX_to_make_a_VPN_Connection_to_linksys