ubuntu 搭建pptp 详细教程

How to install a VPN Server (PPTP) on Debian/Ubuntu Linux VPS

**WARNING** PPTP is insecure. It’s better and arguably easier to setup OpenVPN instead:OpenVPN setup tutorial

Low-end (cheap) VPS accounts are very popular nowadays and one of the reason is that people use them for personal VPN purposes.
There are some advantages on using a personal VPN server:
- server resources such as CPU, bandwidth are not shared among others
- you will know for certain what VPN or Internet activity logs are kept on the server (even though many public VPN providers say that they do not keep any logs on servers, you can’t really verify that)

PPTP is probably the most popular VPN protocol. Here is a short installation guide for Debian Linux (or Ubuntu).

Step 1: install pptpd

apt-get update
apt-get install pptpd

this will install bcrelay, ppp, pptpd

Step 2: configure pptpd and ppp

pico -w /etc/pptpd.conf

(or use your favorite text editor, like vim)

Add the local and remote IP pool and the end of file:

localip 10.10.0.1
remoteip 10.10.0.2-10

in the above example, the VPN server IP will be 10.10.0.1 and the clients connecting to the VPN will be assigned private IP addresses from 10.10.0.2 to 10.10.0.10. You can obviously use other IP range or different private IP addresses (ex.: 192.168.x.y)

Save the file and exit the editor. Now edit the ppp configuration file:

pico -w /etc/ppp/pptpd-options

add the following at the end of file:

name pptpd
refuse-pap
refuse-chap
refuse-mschap
require-mschap-v2
require-mppe-128
ms-dns 208.67.220.220
ms-dns 208.67.222.222
proxyarp
nodefaultroute
lock
nobsdcomp

this is what you should have in the file. Notice that the ppp daemon will refuse unsecure CHAP and MSCHAP V1 authentications. MS-CHAP V2 PPTP VPN is not too safe, either, but is definitely a better option that older CHAP and MS-CHAP V1.

Now you should add the VPN account username/password to the ppp secrets file. Edit /etc/ppp/chap-secrets and add something like this:

myusername pptpd mys3cr3tpass 10.10.0.2
myfriendsuser pptpd hisp@ssword 10.10.0.3

Step 3: enable packets forwarding 

Edit /etc/sysctl.conf and enable ipv4 forwarding by un-commenting the line (removing the # sign) and changing 0 to 1 so it looks like this:

net.ipv4.ip_forward=1

Save & exit the editor, then run:

sysctl -p

for the changes to take effect.

Add the iptables rule to create the NAT between eth0 and ppp interfaces:

建立 防火墙规则

-A POSTROUTING -o eth0 -j MASQUERADE
-A POSTROUTING -o ppp+ -j MASQUERADE

-A POSTROUTING -s 153.121.37.0/24 -o eth0 -j MASQUERADE

-A FORWARD -i eth0 -o ppp0 -m state --state RELATED,ESTABLISHED -j ACCEPT

-A FORWARD -i ppp0 -o eth0 -j ACCEPT

 建立防火墙开机启动

开机启动防火墙规则-也可以加入shadowsocks 启动项

1）保存iptables现有规则到/etc/iptables.up.rules

iptables-save > /etc/iptables.up.rules

2）建立系统启动加载文件/etc/network/if-pre-up.d/iptables

vi /etc/network/if-pre-up.d/iptables

输入以下内容

#!/bin/bash
/sbin/iptables-restore < /etc/iptables.up.rules

3）让文件具备执行权限

chmod +x /etc/network/if-pre-up.d/iptables

Note that iptables MASQUERADE doesn’t work on OpenVZ VPS containers. Works on KVM and XEN.

If you use OpenVZ, you need to use iptables SOURCE like this:

service pptpd restart