LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
Search this Thread
Old 03-10-2007, 01:01 PM   #1
saf
LQ Newbie
 
Registered: Mar 2004
Location: Bucharest
Distribution: Slackware 10.2
Posts: 26

Rep: Reputation: 15
pptp multiple clients behind iptables nat


Hello

I know this has been discussed before (I've read the topic on the forum concerning this), but no conclusions were drawn. Furthermore, those threads are pretty old. So here it goes:
- Public IP Windows PPTP VPN server(s)
- Clients behind NAT - Slackware 11.0, Kernel 2.6.20, IPtables 1.3.7
=> only one connection at a time working (the second one halts on "Verifying username and password")
- to enable the first connection I modprobe'd: nf_conntrack_pptp, nf_conntrack_proto_gre, nf_nat_pptp, nf_nat_proto_gre

Is there a solutions to this?

Thanks in advance for any ideas you might have.
 
Old 03-12-2007, 02:22 PM   #2
peter_robb
Senior Member
 
Registered: Feb 2002
Location: Szczecin, Poland
Distribution: Gentoo, Debian
Posts: 2,458

Rep: Reputation: 47
It's working for me in pptpd ver 1.3
however it's in a custom kernel.

Which ver are you using and which patches?
 
Old 03-12-2007, 02:29 PM   #3
saf
LQ Newbie
 
Registered: Mar 2004
Location: Bucharest
Distribution: Slackware 10.2
Posts: 26

Original Poster
Rep: Reputation: 15
It's not about pptpd, since the clients and the server are both windowses, nevertheless it's still pptp traffic (i.e. tcp 1723, proto 50 <esp> and proto 51 <ah>)
The kernel built from sources. I was thinking that, since one connection passes through and the nat and conntrack helpers are loaded for pptp and gre, it should work.
These protocols are not explicitly nat-ed, but the main nat line is
Code:
$c -t nat -A POSTROUTING -s $intlan -o $extif -j SNAT --to-source $extip
Furthermore, those protocols/ports are allowed in the FORWARD section.
 
Old 03-19-2007, 07:01 AM   #4
peter_robb
Senior Member
 
Registered: Feb 2002
Location: Szczecin, Poland
Distribution: Gentoo, Debian
Posts: 2,458

Rep: Reputation: 47
The earlier module versions didn't handle NATting multiple streams, but since patch-o-matic-ng I have had no problems. There are 4 modules to load.

proto 47 is gre which is necessary for pptp
Protos 50 & 51 are for ipsec
 
Old 08-06-2012, 02:43 PM   #5
danielhilst
LQ Newbie
 
Registered: Apr 2010
Location: Brazil
Distribution: Gentoo,Archlinux
Posts: 18

Rep: Reputation: 0
Hi, I have the exactly the same issue that saf. Two windows clients running behind
an iptables NAT. One can connect per time.. Loading the follow modules solves the problem

Code:
modprobe ip_nat_pptp       
modprobe ip_conntrack_pptp 
modprobe ip_gre
Best regards,
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
multiple ipsec vpn clients behind nat egarnel Linux - Networking 1 12-30-2005 05:18 PM
pptp-conntrack-nat jobbe314 Linux - Networking 1 07-16-2005 09:37 AM
Help! problem with PPTPD and pptp nat helper radien Linux - Networking 0 12-21-2004 08:27 AM
RH9 - pptp-conntrack-nat.patch mightym Red Hat 1 10-15-2004 07:22 AM
Multiple Windows PPTP Clients/Easy VPN Solution??? Tarantismic Yak Linux - Security 5 04-17-2003 01:24 PM


All times are GMT -5. The time now is 11:27 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration