This document describes how to configure masquerading of IPsec and PPTP VPN traffic. SSH-based VPNs (such as that sold by F-Secure and outlined in the VPN mini-HOWTO) are based on standard TCP traffic and do not need any special kernel modifications.
VPN Masquerade allows you to establish one or more IPsec and/or PPTP sessions to internet-accessible VPN servers via your Linux internet firewall without forcing you to connect to your ISP directly from the VPN client system - thus retaining all of the benefits of your Linux internet firewall. It also allows you to set up a VPN server with a Private Network IP address (as described in RFC1918) behind a masquerading Linux firewall, permitting you to provide relatively secure access to a private network via only one registered IP address - even if that IP address represents a dynamic dial-up link.
It is strongly recommended that you understand, configure and test regular IP Masquerading before you attempt to set up VPN masquerading. Please see the IP Masquerade HOWTO and the IP Masquerade Resource page at http://ipmasq.cjb.net/ before proceeding. Planning and setting up your VPN and firewall is beyond the scope of this document. Here are some resources:
The patch for the 2.0.x-series kernels works well on Linux kernel version 2.0.36, has been incorporated into the 2.0.37 release, may work on versions earlier than 2.0.36, and should work on Linux kernels up to about version 2.1.102. The IP masquerade code in the kernel was restructured at about version 2.1.103, requiring a different patch for the 2.1.105+ and 2.2.x series of kernels. A patch is available for kernels from 2.2.5 to 2.2.17, and it may work on earlier kernels.
The home page for the Linux VPN Masquerade kernel patches is http://www.impsec.org/linux/masquerade/ip_masq_vpn.html
Please feel free to send any feedback or comments regarding this document to me at <jhardin@wolfenet.com>. The current version can be found at:
It can also be found via the
Linux Documentation Project's
HOWTO repository and in the
/usr/doc/HOWTO/
directory on your nearest Linux system. These copies are not directly
updated by me, so they may be somewhat out of date.
I personally have experience with masquerading IPsec and PPTP clients running on MS W'98 and NT, configuring a registered-IP PPTP server, and using PPTP for network-to-network routing.
The information on masquerading a Private-IP PPTP server is from discussions with Len Bayles <len@isdi.com>, Simon Cocking <simon@ibs.com.au> and C. Scott Ananian <cananian@lcs.mit.edu>.
The home page for the PPTP-only Masquerade kernel patch for the 2.1.105+ and early 2.2.x kernel series is http://bmrc.berkeley.edu/people/chaffee/linux_pptp.html.
The home page for the ipportfw port-forwarding kernel patch and
configuration tool for 2.0.x kernels is
http://www.ox.compsoc.org.uk/~steve/portforwarding.html.
Port forwarding is built into the 2.2.x kernel, and the ipmasqadm
configuration tool for controlling 2.2.x port forwarding can be obtained at
http://juanjox.kernelnotes.org/.
The home page for the ipfwd generic IP redirector is
http://www.pdos.lcs.mit.edu/~cananian/Projects/IPfwd/.
Profuse thanks to Gordon Chaffee <chaffee@cs.berkeley.edu> for coding and sharing a patch to traceroute that allows tracing GRE traffic. It should prove invaluable in troubleshooting if your GRE traffic is being blocked somewhere. The patch is available at http://www.wolfenet.com/~jhardin/pptp-traceroute.patch.gz
More thanks to Steve Chinatti <chinatti@alumni.Princeton.EDU> for contributing his original IPsec masquerade hack, from which I shamelessly stole some very important ideas...
More information on setting up firewall rules to run automatically - including how to automatically use the correct IP address in a dynamic-IP environment - can be found at http://www.wolfenet.com/~jhardin/ipfwadm/invocation.html
The home page for Linux FreeS/WAN (IPsec for Linux) is http://www.xs4all.nl/~freeswan/ - this is the preferred Linux VPN solution.
A native Linux PPTP server called PoPToP is available at http://www.moretonbay.com/vpn/pptp.html - for the most up-to-date information about PPTP on Linux, go there.
Paul Cadach <paul@odt.east.telecom.kz> has made patches that add MS-CHAP-v2, MPPE and Multilink support to Linux pppd. See ftp://ftp.east.telecom.kz/pub/src/networking/ppp/ppp-2.3.5-my.tgz for MS-CHAP and MPPE, and ftp://ftp.east.telecom.kz/pub/src/networking/ppp/multilink/ppp-2.3.5-mp.tgz for Multilink. Another (possibly related) set of pppd patches are available at the PoPToP download site at http://www.moretonbay.com/vpn/download_pptp.html.
The home page for the original Linux PPTP project is http://www.pdos.lcs.mit.edu/~cananian/Projects/PPTP and a patch to add PPTP server capability to it is available at http://debs.fuller.edu/cgi-bin/display?list=pptp&msg=222
Thanks to Eric Raymond for maintaining the Jargon File, and Denis Howe for The Free On-line Dictionary of Computing.
This document is copyright © 1999-2000 by John D. Hardin. Permission is granted to redistribute it under the terms of the LDP License, available at http://www.linuxdoc.org/COPYRIGHT.html
The information presented in this document is correct to the best of my knowledge. IP Masquerading is experimental, and it is possible that I have made a mistake in writing or testing the kernel patch or composing the instructions in this document; you should determine for yourself if you want to make the changes outlined in this document.
THE AUTHOR IS NOT RESPONSIBLE FOR ANY DAMAGES INCURRED DUE TO ACTIONS TAKEN BASED ON THE INFORMATION IN THIS DOCUMENT. BACK UP ANY AND ALL CRITICAL INFORMATION BEFORE IMPLEMENTING THE CHANGES OUTLINED IN THIS DOCUMENT. MAKE SURE YOU HAVE A WORKING, BOOTABLE KERNEL AVAILABLE BEFORE PATCHING AND RECOMPILING YOUR KERNEL AS OUTLINED IN THIS DOCUMENT.In other words, take sensible precautions.