gmane.network.poptop

Re: Access local IP's when connected to PPTP in windows?

Greg Scott — 2013-05-18T21:48:42

First, you want to do split tunnel - In Windows XP, open the Properties of your PPTP VPN connection, go to the Networking tab, select TCP/IP, go to its properties. Click the Advanced button, uncheck "Use default gateway on remote network".   Windows 7 is similar, but the connection icons are buried deeper.  And do it for both IPV4 and IPV6.

The undocumented part with Windows 7 is, find the .PBK file with all the connection attributes.  It's either in c:\ProgramData\Microsoft\Networking\Connections\pbk\RASphone.pbk (I think) or buried deep in a hidden folder in your profile.  Edit the file with Notepad and change the line,

USERASCREDENTIALS=1

To

USERASCREDENTIALS=0

This line tells Windows what you want to use for credentials - use either the VPN credentials you supply, or the credentials when you first logged into Windows.  By default with Windows 7,  you use the VPN credentials to access stuff local in your own LAN.  So when you access a VPN connection, your local network becomes unavailable because you

Access local IP's when connected to PPTP in windows?

Edmund — 2013-05-18T15:10:29

Hi, how can i access local IP's like 192.168.9.71 that are on my network
while connected to the VPN?
------------------------------------------------------------------------------
AlienVault Unified Security Management (USM) platform delivers complete
security visibility with the essential security capabilities. Easily and
efficiently configure, manage, and operate all of your security controls
from a single console and one unified framework. Download a free trial.
http://p.sf.net/sfu/alienvault_d2d_______________________________________________
Poptop-server mailing list
Poptop-server< at >lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/poptop-server

Re: updates resolv.conf

Charlie Brady — 2013-05-07T13:08:27

You haven't said what distribution you are running. That would be
relevant.  My guess is Fedora or CentOS.

You should look in /etc/sysconfig/network-scripts/ifdown-post, and
probably in the matching ifup script as well.

Check /etc/sysconfig/network-scripts/ifcfg-pppp* - look for PEERDNS
and RESOLV_MODS.

On Tue, May 7, 2013 at 8:34 AM, Khapare Joshi <khapare77< at >gmail.com> wrote:

updates resolv.conf

Khapare Joshi — 2013-05-07T12:34:51

I have been running pptp + radius server over a year now. It was running
very well. However I had an issue with all of sudden pptp servers
/etc/resolve.conf has been updated. I know if you have network manager
installed and running - sometime this makes behaviour like updating the
resolv.conf however in my case I have not installed the network Manager.

Then I see in the log stating :

April 29 13:20:04:21 myvpn pptpd[14418]: CTRL: Client 31.209.204.29 control
connection finished
April 29 13:20:06:38 myvpn radiusd[14951]:  ... adding new socket command
file /var/run/radiusd/radiusd.sock
April 29 13:20:06:38 myvpn radiusd[14951]:  ... closing socket command file
/var/run/radiusd/radiusd.sock
April 29 13:20:06:38 myvpn radiusd[14951]:  ... adding new socket command
file /var/run/radiusd/radiusd.sock
April 29 13:20:06:38 myvpn radiusd[14951]:  ... closing socket command file
/var/run/radiusd/radiusd.sock
April 29 13:20:06:43 myvpn radiusd[14951]:  ... adding new socket command
file /var/run/radiusd/radiusd.sock

Re: NAT/IPTables question with pptpd

Chris Boyd — 2013-04-25T19:34:18

Oops.  Never tried it with both rules enabled at the same time.  And it
looks like it's working the way I want.  Thanks!

And to answer Greg's question--This is the first time I've ever needed
to do something with iptables more complicated than allow traffic into a
server.  In this case, I do want to NAT the traffic coming over the PPTP
connections so that I don't have to disturb the poorly documented
existing network and routing while we work out an upgrade plan.

--Chris


------------------------------------------------------------------------------
Try New Relic Now & We'll Send You this Cool Shirt
New Relic is the only SaaS-based application performance monitoring service 
that delivers powerful full stack analytics. Optimize and monitor your
browser, app, & servers with just a few lines of code. Try New Relic
and get this awesome Nerd Life shirt! http://p.sf.net/sfu/newrelic_d2d_apr

Re: NAT/IPTables question with pptpd

Charlie Brady — 2013-04-25T18:40:05


Isn't that what this does?

 iptables -t nat -A POSTROUTING -s 172.29.249.0/24 -o eth0 -j MASQUERADE
 iptables -t nat -A POSTROUTING -s 172.29.249.0/24 -o eth1 -j MASQUERADE

The routing table is already making the "If the destination address is
10.10.10.0/24" decision for you. That condition is implicit in the
output device. You don't need to make the same decision in iptables.

Re: NAT/IPTables question with pptpd

Greg Scott — 2013-04-25T18:16:07

Something seems fishy here.  Why are you SNATing based on a destination address?  The typical use case for SNAT (or MASQUERADE, which is really a specialized form of SNAT) is to make the outside world "think" all your traffic is coming from your public gateway, instead of computers behind your public gateway.  Or, say, you're hosting an email server or something else that initiates new outbound connections.  you want to make sure outbound SMTP traffic started by your email server has a public "from" IP Address, so then you would set up a SNAT rule.  

In your case, the logic I think you want to implement is on handling inbound traffic and sending it out the correct interface based on the sender.  So you would use a DNAT rule in PREROUTING, versus an SNAT rule in POSTROUTING.  

- Greg Scott


-----Original Message-----
From: Chris Boyd [mailto:cboyd< at >gizmopartners.com] 
Sent: Thursday, April 25, 2013 11:54 AM
To: poptop-server< at >lists.sourceforge.net
Subject: [Poptop-server] NAT/IPTables question with pptpd

He

NAT/IPTables question with pptpd

Chris Boyd — 2013-04-25T16:54:10

Hello,


I've successfully installed pptpd on an Ubuntu 12.10 server, and configured it to do what I need -- temporary convenient access to a remote network by NAT'ing the PPTP IP addresses to the internal LAN.  I'd also like to be able to access the global Internet via NAT to the PPTP server's public IP address.

Here's the config:

eth0 - Public IP address

eth1 - Private IP address 10.10.10.208/24

pptpd.conf is using 172.29.249.0/24

I can successfully NAT to either the server's public address on eth0 with
iptables -t nat -A POSTROUTING -s 172.29.249.0/24 -o eth0 -j MASQUERADE

Or the eth1 address with
iptables -t nat -A POSTROUTING -s 172.29.249.0/24 -o eth1 -j MASQUERADE

I just can't seem to find the iptables config that implements this sort of logic:

If the destination address is 10.10.10.0/24
then
NAT to eth1 IP address
else
NAT to eth0 IP address

I'm continuing to comb through the iptables man page in the mean time.

Another alternative might be to send the client a route to 10.10.10.0

Re: Help with troubleshooting performance issue

James Cameron — 2013-04-02T23:49:21

If you want ease of setup, yes, PPTP wins, but mainly by accident of
history.

For OpenVPN there are automatic setup programs.  They are easily
missed if you go straight to OpenVPN site, since they are not part of
OpenVPN.  VPN service providers often use them.  It is in their
interest to do so, to close the sale.

You should ask Microsoft directly to improve PPTP.  I doubt they will
hear your concern here.  ;-)

Re: Help with troubleshooting performance issue

Greg Scott — 2013-04-02T15:48:22

I have some Linux OpenVPN clients and I am using it in a couple of site to site situations.   OpenVPN seems great if the clients are reasonably stable.  But in my world, I have several customers with traveling Windows laptops and Windows servers, and they seem to change laptops like I change my socks.  As I see it, the challenge with OpenVPN is setting up the traveling laptops over and over and over and over again.   The setups and certificates for each individual laptop are unique, and every time I introduce a new laptop, I need to update the server settings with the info about the new laptop.  So this makes the server unstable when I have to update the server config every few days to accommodate somebody's new or rebuilt laptop.

Unless I'm missing something.

With PPTP, I can teach an end user to run through a 30 second wizard and he's set.  The Windows PPTP server is also easy to set up.  I read the Bruce Schneier paper about PPTP way back in the NT 4 days.  PPTP has improved since then - the shame is, M

Re: Help with troubleshooting performance issue

Phillip Davis — 2013-04-02T14:33:37

Yes but James is 100% correct PPTP should no longer be called a 'VPN' 
instead a 'VN' for virtual network, as the 'private' part is so insecure 
its almost useless.  I myself finally got around to setting up openVPN 
and it wasn't that hard at all.  The client part is a bit more work, but 
still really worth it in the long run.

~Phil
On 4/2/2013 4:40 AM, Greg Scott wrote:

------------------------------------------------------------------------------
Own the Future-Intel(R) Level Up Game Demo Contest 2013
Rise to greatness in Intel's independent game demo contest. Compete 
for recognition, cash, and the chance to get your game on Steam. 
$5K grand prize plus 10 genre and skill prizes. Submit your demo 
by 6/6/13. http://altfarm.mediaplex.com/ad/ck/12124-176961-30367-2_______________________________________________
Poptop-server mailing list
Poptop-server< at >lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/poptop-server

Re: Help with troubleshooting performance issue

Greg Scott — 2013-04-02T10:40:11

Its a shame everyone is dropping suppport for pptp.  Nothing else is easier to setup on Windows clients.

Sent from my Verizon Wireless 4G LTE Smartphone

-------- Original message --------
From: James Cameron <quozl< at >laptop.org>
Date: 04/02/2013 1:04 AM (GMT-06:00)
To: Jafaruddin Lie <jafaruddin.lie< at >gmail.com>
Cc: poptop-server< at >lists.sourceforge.net
Subject: Re: [Poptop-server] Help with troubleshooting performance issue

On Tue, Apr 02, 2013 at 04:37:06PM +1100, Jafaruddin Lie wrote:

Yes, that is possible, but you would need to instrument the daemon to
prove it.

Sounds like the only contention will be between SCP, FTP and PPTP.
You might try operating SCP and FTP on another host instead of the
host running PPTP.  That is how most PPTP deployments would work.

(In other words, using SCP or FTP on the same host may be invalidating
your results, since PPTP is rarely used in that way.)

Actually, I would not be surprised either way.  CentOS 6 is reasonably
recent, and the changes in kernel since my prev

Re: Help with troubleshooting performance issue

James Cameron — 2013-04-02T06:03:05

Yes, that is possible, but you would need to instrument the daemon to
prove it.


Sounds like the only contention will be between SCP, FTP and PPTP.
You might try operating SCP and FTP on another host instead of the
host running PPTP.  That is how most PPTP deployments would work.

(In other words, using SCP or FTP on the same host may be invalidating
your results, since PPTP is rarely used in that way.)


Actually, I would not be surprised either way.  CentOS 6 is reasonably
recent, and the changes in kernel since my previous tests would
invalidate my tests and my experience.  I doubt there has been any
rigorous testing of PPTP with recent releases of CentOS or Ubuntu,
because nobody should care much about PPTP anymore, as it is so
insecure.

So I shall re-estimate and restate; I would not be surprised if the
bandwidth via tunnel is between 0.05 and 0.95 of the native bandwidth.

I would be surprised if it was greater than 0.95.  I would be very
critical of any result that shows a value greater than 1.00,

Re: Help with troubleshooting performance issue

Greg Scott — 2013-04-02T05:43:21

For what it's worth, I've done some heavy-duty PPTP data moving with Windows PPTP servers.  The source was at a colo site, destination at a site that used Comcast as an ISP.  I'm not sure of the bandwidth bought at the destination site - maybe 20 mb downloads?  The colo site had oodles of bandwidth.  I just went back and looked at my notes from the tests I ran and I see I moved 2.5 GB in 30 minutes, 3 GB in 34 minutes, or around 17 mb/sec by my calculations.  I moved something like 100 GB total over a weekend.  This with Windows on both ends, NATing through a Fedora firewall on the Comcast end.  

- Greg Scott



------------------------------------------------------------------------------
Own the Future-Intel(R) Level Up Game Demo Contest 2013
Rise to greatness in Intel's independent game demo contest. Compete 
for recognition, cash, and the chance to get your game on Steam. 
$5K grand prize plus 10 genre and skill prizes. Submit your demo 
by 6/6/13. http://altfarm.mediaplex.com/ad/ck/12124-176961-30367-2

Re: Help with troubleshooting performance issue

Jafaruddin Lie — 2013-04-02T05:37:06

Thanks, James.
I am learning heaps.

On Tue, Apr 2, 2013 at 4:13 PM, James Cameron <quozl< at >laptop.org> wrote:

Like I said, this is for lab exercise, assigned by my tutor, not my choice
:)


And if I get this correct, this could be because of the contention between
pptp daemon and other user-space processes?



I did top command while the transfer was going.
On both machines, the load average didn't go above 0.08 for both machines,
and CPU %us on both machines didn't go above 9%.





Sorry to be banging on about this again, but I do want to re-confirm.
Do you mean you won't be suprised if ppptp might not sustaion a bandwidth
of more than a tenth of native link bandwidth?
more than a tenth of native link bandwidth.



I have also tested this with a Ubuntu server on different machine (same
deal), with Windows client, and OS X client.
They all give me almost the same result, some slightly faster than the
other.
Thanks again, James!
------------------------------------------------------------------------------
O

Re: Help with troubleshooting performance issue

James Cameron — 2013-04-02T05:13:31

Doesn't seem interesting.

ipsec is entirely kernel based, so you will see a performance
improvement purely based on scheduling.


Means the throughput degradation is due to missing packets.


It depends on the CPU performance, the type of memory, the kernel
version, and the amount of contention among user-space processes.
What contention do you observe?  (uptime, load averages).

But yes, I would not be surprised if on a typical pair of machines
that PPTP might sustain a bandwidth of more than a tenth of native
link bandwidth.

You might isolate the problem further by testing a client or server
using another operating system.

There has been a kernel based PPTP implementation, but not in the
CentOS packaging.  You would probably need to patch and rebuild the
kernel in order to try that.

Re: Help with troubleshooting performance issue

Jafaruddin Lie — 2013-04-02T05:01:05

Thanks, James.
I am doing a lab comparing pptp performance and ipsec vpn performance, so
this is not really for production :)

I did tcpdump on the pptp server, I am seeing a few [TCP Previous Segment
not captured] and [TCP ACKed unseen segment].
Not sure what that means though.

The machines are older machines, but they are dual-core machines.
Assuming everything is optimised, are you saying that pptp might not be
able to sustain more than around 6-8MBps traffic?




On Tue, Apr 2, 2013 at 3:39 PM, James Cameron <quozl< at >laptop.org> wrote:

Re: Help with troubleshooting performance issue

James Cameron — 2013-04-02T04:39:05

Capture the data on the PPP interface and analyse it using Wireshark.
Look for retransmits.  PPTP may be failing to allocate kernel memory
for socket operations, and it should react by discarding the packet
rather than trying again.  PPP may be doing something similar.  If
there is packet loss, the TCP stream will slow down.

PPTP data is handled by a user-space process rather than by the kernel
alone, and so contention between the SCP and FTP processes and PPTP
may be cause.  Do the machines have multiple CPUs or only one?

PPTP wasn't originally designed with this I/O rate, so I'm surprised
you are even getting 4 or 5 MBps.  I have always observed a
performance degradation with PPTP.

Have you tried OpenVPN yet?

Help with troubleshooting performance issue

Jafaruddin Lie — 2013-04-02T04:11:43

Hi guys
I hope you can help me shed some light on what's going on.
For my lab, I am trying to setup a PPtP server and a PPtP client.
I am running CentOS 6, and I downloaded the RPM package for the server.

The configuration is pretty straight forward, and the client can connect to
the server no problems using pptpsetup.

Performance, however, is bad.
The machines are connected directly to each other via Cat5e cable.

SCP and FTP transfer speed using the machines' direct IP addresses are
good, I am getting pretty close to the wire speed (around 40-50MBps, I am
not too fussed).

SCP and FTP transfer speed using the machine's VPN IP address are bad, I am
getting about 4 or 5MBps (1/10th) of the original transfer speed.

I grabbed another machine and put Ubuntu server on it, running pptp server,
still the same thing.

What I have done to check:
1. Tried lower the MTU on both connections manually, this seems to help a
bit but not much (speed fluctuates between 5-7MBps).
2. Tested another distro with another machi

Re: git now in use

Christoph Biedl — 2013-02-19T06:46:42

James Cameron wrote...


Thanks you very much, I was just about to ask about that again.

    Christoph


------------------------------------------------------------------------------
Everyone hates slow websites. So do we.
Make your web apps faster with AppDynamics
Download AppDynamics Lite for free today:
http://p.sf.net/sfu/appdyn_d2d_feb

git now in use

James Cameron — 2013-02-18T22:35:27

Both the pptp and pptpd projects are now using git for source code.

Read-only clones can be made as follows:

git clone git://git.code.sf.net/p/pptpclient/git pptpclient-git
git clone git://git.code.sf.net/p/poptop/git poptop-git

See the SourceForge project pages for read-write and HTTP access
paths.

I decided not to convert the commit author e-mail addresses.

The CVS repositories have been deleted.