我新建的vpn
系统是centos 4.7，单网卡。网上搜了很多实例，也看过一点书，现在把成果报告一下。wget http://poptop.sourceforge.net/yum/stable/packages/dkms-2.0.17.5-1.noarch.rpm
wget http://poptop.sourceforge.net/yum/stable/packages/kernel_ppp_mppe-1.0.2-3dkms.noarch.rpm
wget http://poptop.sourceforge.net/yum/stable/packages/ppp-2.4.3-7.rhel4.i386.rpm
wget http://poptop.sourceforge.net/yum/stable/packages/pptpd-1.3.4-1.rhel4.i386.rpm
要先装GCC和kernel-smp-devel，再给rhel4的核心打补丁。
yum install gcc kernel-smp-devel
rpm -ivh dkms-2.0.17.5-1.noarch.rpm
rpm -ivh kernel_ppp_mppe-1.0.2-3dkms.noarch.rpm 核心的mppe补丁
modprobe ppp-compress-18 && echo ok 执行这个显示ok，说明补丁成功
rpm -Uvh ppp-2.4.3-7.rhel4.i386.rpm 升级ppp
rpm -ivh pptpd-1.3.4-1.rhel4.i386.rpm
vi /etc/pptpd.conf 设置本地IP和远程IP范围(10.0.10.1和10.0.10.2-200)
vi /etc/ppp/chap-secrets 设置登录的用户名和密码("username" pptpd "password" *)
service pptpd start
service pptpd restart
service pptpd restart-kill
service pptpd start
setup 到服务里把pptpd打*号，开机自启动
vi /etc/sysctl.conf 修改成net.ipv4.ip_forward = 1
在防火墙上打开TCP端口1723和GRE协议(47)，重启iptables，使其生效。
iptables -L
iptables -t nat -A POSTROUTING -o eth0 -s 10.0.10.0/24 -j SNAT --to XXX.XXX.XXX.XXX 公网IP
iptables -t nat -L
iptables -L FORWARD
iptables -F FORWARD 清空
service iptables save 保存配置
reboot
再附上最终的iptables内容：
*filter
:INPUT ACCEPT
:FORWARD ACCEPT
:OUTPUT ACCEPT
:RH-Firewall-1-INPUT -
-A INPUT -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp -m icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p gre -j ACCEPT
-A RH-Firewall-1-INPUT -p ipv6-crypt -j ACCEPT
-A RH-Firewall-1-INPUT -p ipv6-auth -j ACCEPT
-A RH-Firewall-1-INPUT -d 224.0.0.251 -p udp -m udp --dport 5353 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 1723 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT
*nat
:PREROUTING ACCEPT
:POSTROUTING ACCEPT
:OUTPUT ACCEPT
-A POSTROUTING -s 10.0.10.0/255.255.255.0 -o eth0 -j SNAT --to-source XXX.XXX.XXX.XXX 公网IP
COMMIT
[ 本帖最后由 cyxhome 于 2008-11-8 01:51 编辑 ]
页:
[1]