Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I had configured my server (server1) to connect to another server(server2) over a VPN with IPsec (secure vpn). But now I need to setup another VPN (work vpn) so I will be able to connect to my server(server1) and access to the other server (server2).

My server has 1 external network interface (eth0 with IP 71.185.153.102 - access to internet). The secure VPN uses eth0:0 which is a virtual network interface with IP 71.185.200.240.

Goal: connect to the secure VPN (from my work office) and access a page on it with address: http://20.35.166.61:6084/test/

How it should work:

my home office -> connects to work VPN (which is on my server) -> the server gets packets through interface ppp0 -> iptables should forward and translate all the packets to eth0:0 (VPN over IPsec)

What i've done so far:

  • installed poptop (pptpd)
  • gave it a localeip and a remoteip (localeip 192.168.0.1 remoteip 192.168.0.100-200)
  • accept all trafic from ppp0: iptables -A INPUT -i ppp0 -j ACCEPT
  • accept all forward from ppp0 to eth0: iptables -A INPUT -i ppp0 -o eth0 -j ACCEPT opened gre protocol:
    • iptables -A INPUT -p gre -j ACCEPT
    • iptables -A OUTPUT -p gre -j ACCEPT
  • addded the DNAT and SNAT:
    • iptables -A PREROUTING -p tcp -i ppp0 -j DNAT --to 91.185.200.240 (forward to eth0:0)
    • iptables -t nat -A POSTROUTING -s 192.168.0.1 -o eth0 -j SNAT --to 71.185.200.240 (change the IP if coming from ppp0)

But the problem is that nothing works and i'm not quite sure how to debug it to see whats going wrong (not an expert on networks). I can connect through the VPN, but it disconnects after a couple minutes. And i can't ping the IP on the secure VPN (i can ping it from the server just fine). Also when i connect to the VPN my internet connection drops..

I'm also willing to do this any other way as long as i can access the webpage.

Network diagram: network diagram

share|improve this question
    
Exactly how your network set up is a bit confusing. Would you be able to draw a diagram of how your network is set up and attach it to your question? Also, a possible alternative to setting up a full VPN if all you need is access to a single port on TCP would be using ssh tunneling. –  Per von Zweigbergk Dec 4 '11 at 17:28
    
yes sure no problem, i'll also rephrase the question with my findings. just give me a couple of minutes. –  blejzz Dec 4 '11 at 17:33
    
update my question. hope you get a better understanding what i'm trying to do. Also there is a possibility that i'm doing everything wrong. –  blejzz Dec 4 '11 at 17:59
add comment

1 Answer

up vote 1 down vote accepted
+100

You really have two possible ways to go here.

1. Use an SSH Tunnel instead

Get rid of all the PPtP VPN stuff, and use an SSH tunnel instead. Assuming you can SSH to your machine, you won't need to set up anything else or perform any kind of reconfiguration that might break anything.

You didn't specify what operating system you're using on your client, but I assume you're using either PuTTY on Windows or OpenSSH on some other OS (Mac OS X, Linux, etc).

On PuTTY on Windows you would go into SSH->Tunnels, and adding a forwarded port, for example source = 6084, destination = 20.35.166.61:6084 and then connect to the server. (It's helpful to save a profile to save you from setting that up every time.)

With OpenSSH you'd so something like ssh -L 6084:20.35.166.61:6084 yourusername@71.185.153.102 (yourusername@ may be ommitted if it happens to be the same as your local username on your computer).

You should then be able to access the remote web server using http://127.0.0.1:6084. Some web applications won't like you using a different IP address and will break links. In some cases, it will be sufficient to add the hostname to the secure server to your hosts file (C:\WINDOWS\SYSTEM32\DRIVERS\ETC\HOSTS on Windows, /etc/hosts on OS X, Linux, and other similar OSes) - with an IP address of 127.0.0.1. This will of course break things if you try to do anything else but connect to port 6084 on that particular hostname, or if the ssh session isn't up.

An alternative to tunneling a single port, is to use "dynamic SSH tunneling" which means that the ssh client emulates a SOCKS proxy. In this mode, you'd do something like ssh -D 3128 yourusername@71.185.153.102 (with OpenSSH) or, using PuTTY, selecting a "dynamic" tunnel with 3128 as the source port (you don't need to specify a destination). You then configure your web browser with 127.0.0.1:3128 as your SOCKS proxy, and bam - all your web browser traffic will be redirected through your server. This includes any other web traffic from your machine though, so take care if that's not what you want. Also, it means your web browser will stop working once your SSH tunnel is down.

2. Fix your PPtP tunnel

You seem to have enumerated a few specific problems.

1. The VPN disconnects after a few minutes.

This is probably because of a firewall with stateful packet inspection (such as your garden variety "broadband router") somewhere between you and the server causing a connection to time out. Depending on the make and model of this firewall you may be able to increase your timeouts. As a workaround you might want to set the set link keep-alive option in PoPToP to something low enough to make sure the sessions don't expire.

2. Your Internet connection stops working when connected.

This is because when connecting your VPN, your "default route" will be set to go via the VPN connection. I.e. it's going to try to send your internet traffic via your server. Unless you set up source NAT, traffic that exits the server onto the greater internet will have an IP between 192.168.0.100-200 as its source IP, and while your packets may get to your destination, you have no way of knowing because the remote host has no way of sending your traffic back to your non-routable IP address.

There are a few possible solutions to this problem:

  • Set up NAT on the server so that the source address for any traffic exiting the VPN is the same as the IP address of the server's Internet-facing network interface.
  • Use public IP addresses rather than private IP addresses and set up routing accordingly (probably impractical in your scenario)
  • Don't route traffic to the Internet via the VPN in the first place - you haven't specified what VPN client you're using so I can't help you with that really. PoPToP might have the capability to "push" routing configuration to the PPtP client, but I'm not sure how. Check out some documentation. But most likely you can fix this at the client side.

3. You cannot reach the remote server

This isn't working for the same reason your Internet connection stops working - the packets may well be reaching their destination, but the remote server has no way of sending packets back to you.

Possible solutions are:

  • Make sure the remote server has your VPN in its routing table. (I suspect this might not be feasible in your case, I have a feeling you don't administer the remote server, and the remote admin may well be unwilling to add a route to a private IP range...)
  • Use source-NAT to translate the source IP address of packets exiting via the VPN.
share|improve this answer
    
Personally I'd go with the SSH solution, since it's a lot easier to set up. Just set up your SSH client for SSH tunneling, and you're done. There's no server configuration to mess up, causing a downtime risk. And you can get rid of PoPToP altogether, the fewer services running and exposed on your server, the more secure it will be. –  Per von Zweigbergk Dec 4 '11 at 20:42
    
thank you so much, you answer help A LOT! i went for the SSH solution since it doesn't make a mess on the server and it worked like a charm! Thanks for pointing that out and for your exhaustive answer. You deserve a hug! :) –  blejzz Dec 5 '11 at 19:03
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.