PPTP extras

This article relies on the following:

Introduction

Extras

References

Web interface

Install the necessary packages if you want to manage VPN settings using web interface. 

# Install packages
opkg update
opkg install luci-proto-ppp
/etc/init.d/rpcd restart

Navigate to LuCI → Network → Interfaces to configure PPTP.

Dynamic connection

Preserve default route to restore WAN connectivity when VPN is disconnected. 

# Preserve default route
uci set network.wan.metric="100"
uci set network.wan6.metric="100"
uci commit network
/etc/init.d/network restart

NAT traversal

Provide PPTP passthrough for LAN clients over your router. 

# Install packages
opkg update
opkg install kmod-nf-nathelper-extra
/etc/init.d/firewall restart

Static addresses

Provide static IP address allocation on VPN server. 

# Configure VPN service
rm -f /tmp/etc/chap-secrets
uci set pptpd.client.remoteip="192.168.6.2"
uci commit pptpd
/etc/init.d/pptpd restart

Disable gateway redirection

If you do not need to redirect all traffic to VPN. Disable gateway redirection on VPN client. 

# Configure VPN service
uci set network.vpn.defaultroute="0"
uci commit network
/etc/init.d/network restart

Split gateway

If VPN gateway is not your LAN gateway. Implement plain routing between LAN network and VPN network assuming that:

  • 192.168.1.0/24 - LAN network
  • 192.168.1.2/24 - VPN gateway
  • 192.168.6.0/24 - VPN network

Add port forwarding for VPN server on LAN gateway. 

uci -q delete firewall.pptp
uci set firewall.pptp="redirect"
uci set firewall.pptp.name="Redirect-PPTP"
uci set firewall.pptp.src="wan"
uci set firewall.pptp.src_dport="1723"
uci set firewall.pptp.dest="lan"
uci set firewall.pptp.dest_ip="192.168.1.2"
uci set firewall.pptp.family="ipv4"
uci set firewall.pptp.proto="tcp"
uci set firewall.pptp.target="DNAT"
uci commit firewall
/etc/init.d/firewall restart

Add route to VPN network via VPN gateway on LAN gateway. 

uci -q delete network.vpn
uci set network.vpn="route"
uci set network.vpn.interface="lan"
uci set network.vpn.target="192.168.6.0/24"
uci set network.vpn.gateway="192.168.1.2"
uci commit network
/etc/init.d/network restart

DNS over VPN

Utilize DNS over VPN to prevent DNS leak.

Disable peer DNS and configure a VPN-routed DNS provider on OpenWrt client.

Modify the VPN connection using NetworkManager on Linux desktop client. 

nmcli connection modify id VPN_CON ipv4.dns-search ~. ipv6.dns-search ~. ipv4.dns-priority -50 ipv6.dns-priority -50

Kill switch

Prevent traffic leak on OpenWrt client isolating VPN interface in a separate firewall zone. 

uci rename firewall.@forwarding[0]="lan_wan"
uci set firewall.lan_wan.enabled="0"
uci -q delete firewall.vpn
uci set firewall.vpn="zone"
uci set firewall.vpn.name="vpn"
uci set firewall.vpn.input="REJECT"
uci set firewall.vpn.output="ACCEPT"
uci set firewall.vpn.forward="REJECT"
uci set firewall.vpn.masq="1"
uci set firewall.vpn.mtu_fix="1"
uci add_list firewall.vpn.network="vpn"
uci del_list firewall.wan.network="vpn"
uci -q delete firewall.lan_vpn
uci set firewall.lan_vpn="forwarding"
uci set firewall.lan_vpn.src="lan"
uci set firewall.lan_vpn.dest="vpn"
uci commit firewall
/etc/init.d/firewall restart

Multi-client

Set up multi-client VPN server. Use unique credentials for each client. 

# Configure VPN service
uci -q delete pptpd.client1
uci set pptpd.client1="login"
uci set pptpd.client1.username="USERNAME1"
uci set pptpd.client1.password="PASSWORD1"
uci commit pptpd
/etc/init.d/pptpd restart

Automated

Automated VPN server installation. 

opkg update
opkg install curl
URL="https://openwrt.org/_export/code/docs/guide-user/services/vpn/pptp"
cat << EOF > pptp-server.sh
$(curl "${URL}/server?codeblock=0")
$(curl "${URL}/server?codeblock=1")
$(curl "${URL}/server?codeblock=2")
EOF
sh pptp-server.sh
This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
  • Last modified: 2020/12/22 04:02
  • by vgaetera