PPPoSSH extras

• This how-to describes the most common PPPoSSH tuning scenarios adapted for OpenWrt.
• Follow PPPoSSH server for server setup and PPPoSSH client for client setup.
• Follow Dropbear for server configuration and PPPoSSH protocol for client configuration.
• Follow DDNS client to use own server with dynamic IP address.
• Follow Random generator to overcome low entropy issues.

• PPPoSSH documentation

If you want to manage VPN settings using web interface. Install the necessary packages.

# Install packages
opkg update
opkg install luci-proto-pppossh
service rpcd restart

Navigate to LuCI → Network → Interfaces to configure PPPoSSH.

Implement plain routing between server side LAN and client side LAN assuming that:

• 192.168.1.0/24 - server side LAN
• 192.168.2.0/24 - client side LAN

Add route to client side LAN on VPN server.

cat << "EOF" > /etc/ppp/ip-up
#!/bin/sh
case ${IPREMOTE} in
(192.168.9.2) ip route add 192.168.2.0/24 via ${IPREMOTE} dev ${IFNAME} ;;
esac
EOF
chmod +x /etc/ppp/ip-up

Consider VPN network as private and assign VPN interface to LAN zone on VPN client, add route to server side LAN.

uci del_list firewall.wan.network="vpn"
uci add_list firewall.lan.network="vpn"
uci commit firewall
service firewall restart
uci -q delete network.vpn_rt
uci set network.vpn_rt="route"
uci set network.vpn_rt.interface="vpn"
uci set network.vpn_rt.target="192.168.1.0/24"
uci set network.vpn_rt.gateway="192.168.9.1"
uci commit network
service network restart

If VPN gateway is separate from your LAN gateway. Implement plain routing between LAN and VPN networks assuming that:

• 192.168.1.0/24 - LAN network
• 192.168.1.2/24 - VPN gateway
• 192.168.9.0/24 - VPN network

Add port forwarding for VPN server on LAN gateway.

uci -q delete firewall.pppossh
uci set firewall.pppossh="redirect"
uci set firewall.pppossh.name="Redirect-PPPoSSH"
uci set firewall.pppossh.src="wan"
uci set firewall.pppossh.src_dport="22"
uci set firewall.pppossh.dest="lan"
uci set firewall.pppossh.dest_ip="192.168.1.2"
uci set firewall.pppossh.family="ipv4"
uci set firewall.pppossh.proto="tcp"
uci set firewall.pppossh.target="DNAT"
uci commit firewall
service firewall restart

Add route to VPN network via VPN gateway on LAN gateway.

uci -q delete network.vpn
uci set network.vpn="route"
uci set network.vpn.interface="lan"
uci set network.vpn.target="192.168.9.0/24"
uci set network.vpn.gateway="192.168.1.2"
uci commit network
service network restart

Automated VPN server installation.

URL="https://openwrt.org/_export/code/docs/guide-user/services/vpn/pppossh/server"
cat << EOF > pppossh-server.sh
$(wget -U "" -O - "${URL}?codeblock=0")
$(wget -U "" -O - "${URL}?codeblock=1")
$(wget -U "" -O - "${URL}?codeblock=2")
$(wget -U "" -O - "${URL}?codeblock=3")
EOF
sh pppossh-server.sh