So, our task is: to make it so that, through a router based on FreeBSD, clients on Windows machines can connect to the company's internal network, while nothing extra needs to be installed on the Windows computers themselves.
I.e., we want to set up a VPN server on the FreeBSD side such that Windows clients can connect to it using their built-in tools.
PS. This note describes creating a VPN server with PPTP-type tunnels.
Installation
$ cd /usr/ports/net/mpd5
$ sudo make install clean
In the configuration panel I didn't select any options (all options unchecked).
ConfigurationThe mpd5 settings are located at:
/usr/local/etc/mpd5That's where we head.
$ cd /usr/local/etc/mpd5
Inside you can see several files:
- mpd.conf.sample : Sample config file for MPD5 (the main file)
- mpd.script.sample : Sample scripts config file
- mpd.secret.sample : Sample login-password database file for VPN users
A working config is not created by default - we're expected to either create it by copying the .sample file to a name without .sample, or simply write it from scratch ourselves.
The first thing we're interested in is the mpd.conf file itself. Let's create it and put the following config inside (comments are added after the # sign; you don't need to include them in the file):
mpd.conf
startup:
default:
load vpnserver
vpnserver:
# Allocate an address pool from 10.1.255.10 to 10.1.255.249 for VPN clients
set ippool add pool1 10.1.255.10 10.1.255.249
# Create template B
create bundle template B
# Set options
set iface enable proxy-arp
set iface idle 1800
set iface enable tcpmssfix
set ipcp yes vjcomp
# Subnet from which addresses will be handed out to VPN clients
set ipcp ranges 10.1.255.1/24 ippool pool1
# Specify the DNS servers that will be passed to VPN clients
set ipcp dns 10.0.1.10 10.0.7.3
# Specify the WINS servers that will be passed to VPN clients
set ipcp nbns 10.0.1.10 10.0.7.3
# Enable encryption
set bundle enable compression
set ccp yes mppc
set mppc yes e40
set mppc yes e56
set mppc yes e128
set mppc yes stateless
# Create a template for dynamically-created PPTP links
create link template L pptp
set link action bundle B
set link enable multilink
set link yes acfcomp protocomp
set link no pap chap eap
set link enable chap
set link keep-alive 10 60
set link mtu 1460
# Specify the IP address of the VPN server itself here
set pptp self 11.22.33.44
set link enable incoming
Now let's create the login-password database. It will be stored in the mpd.secret file.
Here is an example of this file:
user1 "password1"
user2 "password2"
user3 "password3"
As is, I think, obvious - the first field here is the username (login), and the second is the password. They must be separated by TAB characters (i.e., not spaces).
In this case, each user is dynamically assigned an IP address from the pool allocated in the config above.
And here's an example of the same file, but with each user having their own fixed IP address from the VPN subnet:
mpd.secret
user1 "password1" 10.1.255.10
user2 "password2" 10.1.255.11
user3 "password3" 10.1.255.123
Here a third field has been added - the IP address. In this case, each user is statically assigned their own address.
PS. Note! If you don't assign a user a static address, then the user can connect under the same account simultaneously from different computers - and everything will work, they will simply get different IPs for different computers. But if you create static IP addresses for users, then until the user closes the VPN connection on one computer, they won't be able to open it on another.EnablingNow let's go to /etc and edit rc.conf:
$ cd /etc
$ ee rc.conf
Add the following lines inside:
mpd_enable="YES"
mpd_flags="-b"
And start the MPD service:
$ sudo /usr/local/etc/rc.d/mpd5 start
TestingOn Windows, create a regular VPN connection, specify the IP address of our FreeBSD router with mpd5 installed as the server, and choose PPTP as the connection type. Enter the login and password specified in the mpd.secret file and see whether it connects.
If it connects, then on the FreeBSD router, running the ifconfig command will show the newly formed connection:
$ ifconfig
...
ng1: flags=88d1<UP,POINTOPOINT,RUNNING,NOARP,SIMPLEX,MULTICAST> metric 0 mtu 1396
inet 10.1.255.1 --> 10.1.255.19 netmask 0xffffffff
How to use it from Windows clients
Very simple. Create regular VPN connections in Windows toward this FreeBSD router - i.e., in the "server" field specify the router's IP address, and for VPN type specify PPTP - this is the type we configured above. Later I'll show how to set up L2TP connections.
Applies to: FreeBSD 7.x+
Comments