Vpn client

DasTieRR

Совместно с товарищем Evgeny удалось решить требуемую задачу.
Есть рабочий вариант, с ручным редактированием файлов.

Елси кому понадобиться (до выхода 2) то пишите: nickston@yandex.ru или 405555123

Лучше выложите сюда

nickston

@DasTieRR:

Лучше выложите сюда

1) http://ru.doc.pfsense.org/index.php/PPPoE_%D0%B8%D0%BB%D0%B8_PPTP_%D0%BD%D0%B0_WAN_c_DHCP
2) останавливаем mpd (kill pid -срабатывает, mpd -k не очень, вообще не срабатывает)
3) с уже открытым 22 портом заходим и редактируем файл /var/etc/mpd.conf
4) дописываем:
set link no pap chap
set link accept chap
set bundle enable compression
set ccp yes mppc
set ccp yes mpp-e40
set ccp yes mpp-e128
set bundle enable crypt-reqd
set ccp yes mpp-stateless open
5) сохраняем
6) делаем копию данного файла ибо при перезагрузке будет затерт
7) /usr/local/sbin/mpd -b -d /var/etc/ -p /var/run/mpd.pid -pptp
8) в статических маршрутах в ручную пишем нужные маршруты (ибо автоматом не все прописываются)
9) днс можно указать в основных, и снять галку менять днс
10) днс форвардер иногда зависает, можно перезапустить через службы (если пинги идут, а имена не разрешаються),
как вариант если имен не много то можно их же в форвардере и обозначить

Eugene

Отмечу, что вот это: @nickston:

дописываем:
set link no pap chap
set link accept chap
set bundle enable compression
set ccp yes mppc
set ccp yes mpp-e40
set ccp yes mpp-e128
set bundle enable crypt-reqd
set ccp yes mpp-stateless open

нужно, чтобы fpSense работал с MS Windows PPTP сервером

vardan

dobry den ya pitayus u sebya postavit ne poluchaetsya :(

The following error occurred in the Point to Point Protocol module on port: VPN5-125, UserName: ADCVPN\vpn_hasmik. The remote computer does not support the required data encryption type.

eto vivodit win xp na kotoroy stoit pptp server

configuraciya servera takaya
server type PPP
Transports TCP/IP
Authentication MS CHAP V2
Encription MPPE 128
Compression MPPC
server IP address 192.168.0.197

config v pfsense takoy

pptp:
new -i ng0 pptp pptp
set iface route default
set iface disable on-demand
set iface idle 0
set iface up-script /usr/local/sbin/ppp-linkup
set bundle disable multilink
set bundle authname "vpn_hasmik"
set bundle password "123456"
set link keep-alive 61 753
set link max-redial 0
set link no acfcomp protocomp
set link no pap chap
set link accept chap
set bundle enable compression
set ccp yes mppc
set ccp yes mpp-e40
set ccp yes mpp-e128
set bundle enable crypt-reqd
set ccp yes mpp-stateless

set ipcp enable req-pri-dns
open
pfsense 1.2.3 vidayot sleduyushee

Nov 3 14:18:17 mpd: [pptp] device is now in state DOWN
Nov 3 14:18:17 mpd: [pptp] device: CLOSE event in state DOWN
Nov 3 14:18:17 mpd: [pptp] LCP: LayerFinish
Nov 3 14:18:17 mpd: [pptp] LCP: state change Starting –> Initial
Nov 3 14:18:17 mpd: [pptp] LCP: Close event
Nov 3 14:18:17 mpd: [pptp] link: CLOSE event
Nov 3 14:18:17 mpd: [pptp] closing link "pptp"…
Nov 3 14:18:16 check_reload_status: reloading filter
Nov 3 14:18:16 mpd: pptp0: killing connection with 10.10.124.10:1723
Nov 3 14:18:16 mpd: pptp0: closing connection with 10.10.124.10:1723
Nov 3 14:18:16 mpd: pptp0-0: killing channel
Nov 3 14:18:16 mpd: pptp0-0: peer call disconnected res=zero? err=none
Nov 3 14:18:16 mpd: [pptp] device is now in state DOWN
Nov 3 14:18:16 mpd: [pptp] device: OPEN event in state DOWN
Nov 3 14:18:16 mpd: [pptp] device is now in state DOWN
Nov 3 14:18:16 mpd: [pptp] pausing 9 seconds before open
Nov 3 14:18:16 mpd: [pptp] device: OPEN event in state DOWN
Nov 3 14:18:16 mpd: [pptp] LCP: LayerStart
Nov 3 14:18:16 mpd: [pptp] LCP: phase shift ESTABLISH –> DEAD
Nov 3 14:18:16 mpd: [pptp] LCP: state change Stopped –> Starting
Nov 3 14:18:16 mpd: [pptp] LCP: Down event
Nov 3 14:18:16 mpd: [pptp] link: DOWN event
Nov 3 14:18:16 mpd: [pptp] device is now in state DOWN
Nov 3 14:18:16 mpd: [pptp] device: DOWN event in state CLOSING
Nov 3 14:18:16 mpd: [pptp] device is now in state CLOSING
Nov 3 14:18:16 mpd: pptp0-0: clearing call
Nov 3 14:18:16 mpd: [pptp] device: CLOSE event in state UP
Nov 3 14:18:16 mpd: [pptp] LCP: LayerFinish
Nov 3 14:18:16 mpd: [pptp] LCP: phase shift TERMINATE –> ESTABLISH
Nov 3 14:18:16 mpd: [pptp] LCP: state change Stopping –> Stopped
Nov 3 14:18:16 mpd: [pptp] LCP: SendTerminateAck #4
Nov 3 14:18:16 mpd: [pptp] LCP: rec'd Terminate Request #7 link 0 (Stopping)
Nov 3 14:18:14 mpd: [pptp] LCP: LayerDown
Nov 3 14:18:14 mpd: [pptp] LCP: SendTerminateAck #3
Nov 3 14:18:14 mpd: [pptp] IPCP: state change Ack-Sent –> Starting
Nov 3 14:18:14 mpd: [pptp] IPCP: Down event
Nov 3 14:18:14 mpd: [pptp] up: 0 links, total bandwidth 9600 bps
Nov 3 14:18:14 mpd: [pptp] setting interface ng0 MTU to 1500 bytes
Nov 3 14:18:14 mpd: [pptp] LCP: phase shift NETWORK –> TERMINATE
Nov 3 14:18:14 mpd: [pptp] LCP: state change Opened –> Stopping
Nov 3 14:18:14 mpd: [pptp] LCP: rec'd Terminate Request #6 link 0 (Opened)
Nov 3 14:18:14 mpd: pptp0: CID 0x0985 in SetLinkInfo not found
Nov 3 14:18:14 mpd: [pptp] IPCP: state change Req-Sent –> Ack-Sent
Nov 3 14:18:14 mpd: IPADDR 192.168.0.197
Nov 3 14:18:14 mpd: [pptp] IPCP: SendConfigAck #5
Nov 3 14:18:14 mpd: 192.168.0.197 is OK
Nov 3 14:18:14 mpd: IPADDR 192.168.0.197
Nov 3 14:18:14 mpd: [pptp] IPCP: rec'd Configure Request #5 link 0 (Req-Sent)
Nov 3 14:18:14 mpd: [pptp] rec'd unexpected protocol CCP on link 0, rejecting
Nov 3 14:18:14 mpd: [pptp] error writing len 20 frame to bypass: Network is down
Nov 3 14:18:14 mpd: PRIDNS 0.0.0.0
Nov 3 14:18:14 mpd: IPADDR 0.0.0.0
Nov 3 14:18:14 mpd: [pptp] IPCP: SendConfigReq #1
Nov 3 14:18:14 mpd: [pptp] IPCP: state change Starting –> Req-Sent
Nov 3 14:18:14 mpd: [pptp] IPCP: Up event
Nov 3 14:18:14 mpd: [pptp] up: 1 link, total bandwidth 64000 bps
Nov 3 14:18:14 mpd: [pptp] setting interface ng0 MTU to 1400 bytes
Nov 3 14:18:14 mpd: [pptp] LCP: phase shift AUTHENTICATE –> NETWORK
Nov 3 14:18:14 mpd: [pptp] LCP: authorization successful
Nov 3 14:18:14 mpd: MESG: S=801B730E8676520353BC2AE7F8F065E0EFD0CAE6
Nov 3 14:18:14 mpd: [pptp] CHAP: rec'd SUCCESS #0
Nov 3 14:18:14 mpd: [pptp] CHAP: sending RESPONSE
Nov 3 14:18:14 mpd: Using authname "vpn_hasmik"
Nov 3 14:18:14 mpd: Name: "ADCVPN"
Nov 3 14:18:14 mpd: [pptp] CHAP: rec'd CHALLENGE #0
Nov 3 14:18:14 mpd: pptp0: CID 0x0985 in SetLinkInfo not found
Nov 3 14:18:14 mpd: [pptp] LCP: LayerUp
Nov 3 14:18:14 mpd: [pptp] LCP: auth: peer wants CHAP, I want nothing
Nov 3 14:18:14 mpd: [pptp] LCP: phase shift ESTABLISH –> AUTHENTICATE
Nov 3 14:18:14 mpd: [pptp] LCP: state change Ack-Rcvd –> Opened
Nov 3 14:18:14 mpd: ENDPOINTDISC [LOCAL] 9a 90 17 ef f1 b3 44 26 b1 e9 c3 0e 60 34 39 0b 00 00 00 00
Nov 3 14:18:14 mpd: MAGICNUM 56a62772
Nov 3 14:18:14 mpd: AUTHPROTO CHAP MSOFTv2
Nov 3 14:18:14 mpd: MRU 1400
Nov 3 14:18:14 mpd: [pptp] LCP: SendConfigAck #2
Nov 3 14:18:14 mpd: ENDPOINTDISC [LOCAL] 9a 90 17 ef f1 b3 44 26 b1 e9 c3 0e 60 34 39 0b 00 00 00 00
Nov 3 14:18:14 mpd: MAGICNUM 56a62772
Nov 3 14:18:14 mpd: AUTHPROTO CHAP MSOFTv2
Nov 3 14:18:14 mpd: MRU 1400
Nov 3 14:18:14 mpd: [pptp] LCP: rec'd Configure Request #2 link 0 (Ack-Rcvd)
Nov 3 14:18:14 mpd: AUTHPROTO CHAP MD5
Nov 3 14:18:14 mpd: [pptp] LCP: SendConfigNak #1
Nov 3 14:18:14 mpd: ENDPOINTDISC [LOCAL] 9a 90 17 ef f1 b3 44 26 b1 e9 c3 0e 60 34 39 0b 00 00 00 00
Nov 3 14:18:14 mpd: MAGICNUM 56a62772
Nov 3 14:18:14 mpd: AUTHPROTO 0xc227
Nov 3 14:18:14 mpd: MRU 1400
Nov 3 14:18:14 mpd: [pptp] LCP: rec'd Configure Request #1 link 0 (Ack-Rcvd)
Nov 3 14:18:14 mpd: [pptp] LCP: state change Req-Sent –> Ack-Rcvd
Nov 3 14:18:14 mpd: MAGICNUM 216029c2
Nov 3 14:18:14 mpd: MRU 1500
Nov 3 14:18:14 mpd: [pptp] LCP: rec'd Configure Ack #2 link 0 (Req-Sent)
Nov 3 14:18:14 mpd: BACP
Nov 3 14:18:14 mpd: MP MRRU 1614
Nov 3 14:18:14 mpd: CALLBACK
Nov 3 14:18:14 mpd: ACFCOMP
Nov 3 14:18:14 mpd: PROTOCOMP
Nov 3 14:18:14 mpd: [pptp] LCP: SendConfigRej #0
Nov 3 14:18:14 mpd: Not supported
Nov 3 14:18:14 mpd: BACP
Nov 3 14:18:14 mpd: ENDPOINTDISC [LOCAL] 9a 90 17 ef f1 b3 44 26 b1 e9 c3 0e 60 34 39 0b 00 00 00 00
Nov 3 14:18:14 mpd: MP MRRU 1614
Nov 3 14:18:14 mpd: Not supported
Nov 3 14:18:14 mpd: CALLBACK
Nov 3 14:18:14 mpd: ACFCOMP
Nov 3 14:18:14 mpd: PROTOCOMP
Nov 3 14:18:14 mpd: MAGICNUM 56a62772
Nov 3 14:18:14 mpd: AUTHPROTO 0xc227
Nov 3 14:18:14 mpd: MRU 1400
Nov 3 14:18:14 mpd: [pptp] LCP: rec'd Configure Request #0 link 0 (Req-Sent)
Nov 3 14:18:14 mpd: MAGICNUM 216029c2
Nov 3 14:18:14 mpd: MRU 1500
Nov 3 14:18:14 mpd: [pptp] LCP: SendConfigReq #2
Nov 3 14:18:13 php: /interfaces_opt.php: No default gateway detected, adding 212.34.250.25
Nov 3 14:18:13 php: /interfaces_opt.php: Creating rrd update script
Nov 3 14:18:12 mpd: MAGICNUM 216029c2
Nov 3 14:18:12 mpd: MRU 1500
Nov 3 14:18:12 mpd: [pptp] LCP: SendConfigReq #1
Nov 3 14:18:12 mpd: [pptp] LCP: phase shift DEAD –> ESTABLISH
Nov 3 14:18:12 mpd: [pptp] LCP: state change Starting –> Req-Sent
Nov 3 14:18:12 mpd: [pptp] LCP: Up event
Nov 3 14:18:12 mpd: [pptp] link: origination is local
Nov 3 14:18:12 mpd: [pptp] link: UP event
Nov 3 14:18:12 mpd: [pptp] device is now in state UP
Nov 3 14:18:12 mpd: [pptp] device: UP event in state OPENING
Nov 3 14:18:12 mpd: [pptp] PPTP call successful
Nov 3 14:18:12 mpd: pptp0-0: outgoing call connected at 14808325 bps
Nov 3 14:18:12 mpd: pptp0: attached to connection with 10.10.124.10:1723
Nov 3 14:18:12 mpd: pptp0: connected to 10.10.124.10:1723
Nov 3 14:18:12 mpd: [pptp] device is now in state OPENING
Nov 3 14:18:12 mpd: pptp0: connecting to 10.10.124.10:1723
Nov 3 14:18:12 mpd: [pptp] device: OPEN event in state DOWN
Nov 3 14:18:12 mpd: [pptp] LCP: LayerStart
Nov 3 14:18:12 mpd: [pptp] LCP: state change Initial –> Starting
Nov 3 14:18:12 mpd: [pptp] LCP: Open event
Nov 3 14:18:12 mpd: [pptp] link: OPEN event
Nov 3 14:18:12 mpd: [pptp] opening link "pptp"…
Nov 3 14:18:12 mpd: [pptp] bundle: OPEN event in state CLOSED
Nov 3 14:18:12 mpd: [pptp] IPCP: LayerStart
Nov 3 14:18:12 mpd: [pptp] IPCP: state change Initial –> Starting
Nov 3 14:18:12 mpd: [pptp] IPCP: Open event
Nov 3 14:18:12 mpd: [pptp] IFACE: Open event
Nov 3 14:18:12 mpd: [pptp] IPCP: peer address cannot be zero
Nov 3 14:18:12 mpd: [pptp] using interface ng0

Eugene

Очень похоже, что у тебя два (или больше) процесса mpd сразу запущены, отсюда и бардак. Замочи один, глядишь чего и получится.

Helfer_Panch

@nickston:

@DasTieRR:

Лучше выложите сюда

1) http://ru.doc.pfsense.org/index.php/PPPoE_%D0%B8%D0%BB%D0%B8_PPTP_%D0%BD%D0%B0_WAN_c_DHCP
2) останавливаем mpd (kill pid -срабатывает, mpd -k не очень, вообще не срабатывает)
3) с уже открытым 22 портом заходим и редактируем файл /var/etc/mpd.conf
4) дописываем:
set link no pap chap
set link accept chap
set bundle enable compression
set ccp yes mppc
set ccp yes mpp-e40
set ccp yes mpp-e128
set bundle enable crypt-reqd
set ccp yes mpp-stateless open
5) сохраняем
6) делаем копию данного файла ибо при перезагрузке будет затерт
7) /usr/local/sbin/mpd -b -d /var/etc/ -p /var/run/mpd.pid -pptp
8) в статических маршрутах в ручную пишем нужные маршруты (ибо автоматом не все прописываются)
9) днс можно указать в основных, и снять галку менять днс
10) днс форвардер иногда зависает, можно перезапустить через службы (если пинги идут, а имена не разрешаються),
как вариант если имен не много то можно их же в форвардере и обозначить

Эта схема работает только до пересохранения настроек opt1. Лучше прописать данные строчки в /etc/inc/interfaces.inc.
Тот пакет, который позволяет создать opt1 делает резервную копию interfaces.inc, поэтому есть возможность всегда переустановить пакет.

vardan

tak posle dobovleniya interface a poyavlyaetsya oshibka`

php: : There were error(s) loading the rules: pfctl: DIOCSETSTATUSIF - The line in question reads [ DIOCSETSTATUSIF]:
Nov 8 13:07:05 php: : New alert found: There were error(s) loading the rules: pfctl: DIOCSETSTATUSIF The line in question reads [ DIOCSETSTATUSIF]:
Nov 8 13:07:03 check_reload_status: reloading filter
Nov 8 13:06:58 php: : There were error(s) loading the rules: pfctl: DIOCSETSTATUSIF - The line in question reads [ DIOCSETSTATUSIF]:
Nov 8 13:06:58 php: : New alert found: There were error(s) loading the rules: pfctl: DIOCSETSTATUSIF The line in question reads [ DIOCSETSTATUSIF]:

vardan

tak pri perezagruzke stiraet conf file komandu /usr/local/sbin/mpd -b -d /var/etc/ -p /var/run/mpd.pid -pptp ne ponimaet iz za poslednego '-pptp' mojet chto ne bud nedopisano? mojete ukazivat mesto otkuda chitaet nachalnie configi chtob ne styorlas pri perezagruzke

Helfer_Panch

@vardan:

tak posle dobovleniya interface a poyavlyaetsya oshibka`

php: : There were error(s) loading the rules: pfctl: DIOCSETSTATUSIF - The line in question reads [ DIOCSETSTATUSIF]:
Nov 8 13:07:05 php: : New alert found: There were error(s) loading the rules: pfctl: DIOCSETSTATUSIF The line in question reads [ DIOCSETSTATUSIF]:
Nov 8 13:07:03 check_reload_status: reloading filter
Nov 8 13:06:58 php: : There were error(s) loading the rules: pfctl: DIOCSETSTATUSIF - The line in question reads [ DIOCSETSTATUSIF]:
Nov 8 13:06:58 php: : New alert found: There were error(s) loading the rules: pfctl: DIOCSETSTATUSIF The line in question reads [ DIOCSETSTATUSIF]:

Это есть, думал, только у меня было. Появляется когда изменения вносишь в WAN или OPT. Просто перезагрузить pfsense и подключится должен нормально. Правда при следующей смене настроек опять появится..

vardan

da ne meshaet ona no nastroyki ne derjatsya nado ix gde to propisat chtob dejalis posle perezagruzki mpd.

Helfer_Panch

@vardan:

da ne meshaet ona no nastroyki ne derjatsya nado ix gde to propisat chtob dejalis posle perezagruzki mpd.

Лучше прописать данные строчки в /etc/inc/interfaces.inc

Там найти секцию, которая отвечает за pptp, вроде сначала идут настройки для pppoe, потом l2tp и в конце pptp.. Но я могу ошибаться, посмотри внимательно, думаю там поймешь..

vardan

tam est vpm.inc poproboval dobavit tam ne pomoglo :((( poroyus v interfaces rasskaju

Helfer_Panch

@vardan:

tam est vpm.inc poproboval dobavit tam ne pomoglo :((( poroyus v interfaces rasskaju

Я ж показал, где править! Точно ТАМ..

vardan

da popravil zarabotalo :)))) v konce file a s novim modulem dobavlyalsya sekci popravit nado tam!

pptp:
new -i ng0 pptp pptp
set iface route default
set iface {$ondemand} on-demand
set iface idle {$idle}
set iface up-script /usr/local/sbin/ppp-linkup

EOD;

/* Check for ppp-linkdown Script in /usr/local/sbin

Create reference in mpd.conf
*/
if ( file_exists("/usr/local/sbin/ppp-linkdown") ){
$mpdconf .= << <eod set iface down-script /usr/local/sbin/ppp-linkdown

EOD;
}

if (isset($pptpcfg['ondemand'])) {
$mpdconf .= << <eod set iface addrs 10.0.0.1 10.0.0.2

EOD;
}

$mpdconf .= << <eod set bundle disable multilink
set bundle authname "{$pptpcfg['username']}"
set bundle password "{$pptpcfg['password']}"
set link keep-alive 10 60
set link max-redial 0
set link no acfcomp protocomp
set link no pap chap
set link accept chap
set bundle enable compression
set ccp yes mppc
set ccp yes mpp-e40
set ccp yes mpp-e128
set bundle enable crypt-reqd
set ccp yes mpp-stateless open
set ipcp no vjcomp
set ipcp ranges 0.0.0.0/0 0.0.0.0/0

EOD;
if (isset($config['system']['dnsallowoverride'])) {
$mpdconf .= << <eod set ipcp enable req-pri-dns

EOD;
}

$mpdconf .= << <eod open

EOD;

fwrite($fd, $mpdconf);
fclose($fd);

/* generate mpd.links */
$fd = fopen("{$g['varetc_path']}/mpd.links", "w");
if (!$fd) {
printf("Error: cannot open mpd.links in interfaces_wan_pptp_configure().\n");
return 1;
}

$mpdconf = <<<eod pptp:
set link type pptp
set pptp enable originate outcall
set pptp disable windowing
set pptp self {$pptpcfg['local']}
set pptp peer {$pptpcfg['remote']}

EOD;

fwrite($fd, $mpdconf);
fclose($fd);

/* configure interface - for PPTP OPTx we do not need this, as WAN already has to be configured /
/ mwexec("/sbin/ifconfig " . escapeshellarg($wancfg['if']) . " " .
escapeshellarg($pptpcfg['local'] . "/" . $pptpcfg['subnet'])); */

/* fire up mpd */
mwexec("/usr/local/sbin/mpd -b -d {$g['varetc_path']} -p {$g['varrun_path']}/mpd.pid pptp");

return 0;
}

function interfaces_opt_pptp_restart() {
interfaces_opt_pptp_down();
sleep(1);
interfaces_opt_pptp_up();
}

function interfaces_opt_pptp_down() {
global $g;
sigkillbypid("{$g['varrun_path']}/mpd.pid", "SIGUSR2");
sleep(1);
}

function interfaces_opt_pptp_up() {
global $g;
sigkillbypid("{$g['varrun_path']}/mpd.pid", "SIGUSR1");
sleep(1);
}

?></eod </eod </eod </eod </eod </eod

vardan

opyat dobry den vot chto pishet v interfaces`

OPT3 interface (ng0)
Status up
MAC address 11129
IP address 192.168.0.194
Subnet mask 255.255.255.255
In/out packets 0/0 (8 KB/0 bytes)
In/out errors 6382788/907699

chto za in/out errors??

link poshyol pingi idut k file am dostuchalsya outluk edet na exchange vot toka programma glyuchit s coonectom na MS SQL server
pravila v firewall e stoyat any to any i nat napisal mojet nat a ne nado bilo?

Helfer_Panch

>In/out packets 0/0 (8 KB/0 bytes)
>In/out errors 6382788/907699
Насколько я понял, просто перепутаны названия для данных, т.е. In/out errors это In/out packets и наоборот соответственно.

Что значит глючит? В чем это выражается, и почему подозрение на pfsense?

dvserg

Я тут мимо пробегал, поэтому в подробности не заглядывал. Маска так и должна быть?

Subnet mask 255.255.255.255

vardan

na danny moment vpn podklyuchyon v win xp i sdelana static route na nego
kogda menyayu na pfsense to programma kotory podklyuchaetsya k ms sql vidayot oshibku sboya seti

vot config iz winxp
Connection-specific DNS Suffix . :

Description . . . . . . . . . . . : WAN (PPP/SLIP) Interface

Physical Address. . . . . . . . . : 00-53-45-00-00-00

Dhcp Enabled. . . . . . . . . . . : No

IP Address. . . . . . . . . . . . : 192.168.0.185

Subnet Mask . . . . . . . . . . . : 255.255.255.255

Default Gateway . . . . . . . . . : 192.168.0.185

DNS Servers . . . . . . . . . . . : 192.168.0.2

da k stati ya dobavil nat dlya pptp interface a i dobavlyayu static route chtob paketi shli cherez nego nadeyus vsyo pravilno sdelal