Ubuntu安装pptp

2015年01月01日

导读

在Linode服务器上，基于Ubuntu系统安装PPTP，实现电脑、平板、手机等所有上网设备通过VPN使用及访问互联网。

系统环境：Ubuntu

1、安装pptpd

sudo apt-get install pptpd

2、编辑/etc/pptpd.conf

sudo nano /etc/pptpd.conf

3、删除localip和remoteip选项前的＃，修改后如下：

# (Recommended)

localip 192.168.0.1

remoteip 192.168.0.234-238,192.168.0.245

4、编辑/etc/ppp/pptpd-options

sudo nano /etc/ppp/pptpd-options

5、在代码最后粘贴以下代码

name pptpd

refuse-pap

refuse-chap

refuse-mschap

require-mschap-v2

require-mppe-128

proxyarp

lock

nobsdcomp

novj

novjccomp

nologfd

ms-dns 8.8.8.8

ms-dns 8.8.4.4

6、编辑/etc/ppp/chap-secrets

sudo nano /etc/ppp/chap-secrets

7、输入用户名及密码，格式如下：

用户名 pptpd 密码 *

8、重启pptpd

sudo service pptpd restart

9、编辑/etc/sysctl.conf

sudo nano /etc/sysctl.conf

10、删除以下代码前面的＃

net.ipv4.ip_forward=1

11、保存并运行程序

sudo sysctl -p

12、添加iptables规则

sudo nano /etc/iptables.firewall.rules

13、粘贴以下代码并保存

*filter

# Allow all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0

-A INPUT -i lo -j ACCEPT

-A INPUT -d 127.0.0.0/8 -j REJECT

# Accept all established inbound connections

-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow all outbound traffic - you can modify this to only allow certain traffic

-A OUTPUT -j ACCEPT

# Allow HTTP and HTTPS connections from anywhere (the normal ports for websites and SSL).

-A INPUT -p tcp --dport 80 -j ACCEPT

-A INPUT -p tcp --dport 443 -j ACCEPT

# VPN PPTPD

-A INPUT -p tcp --dport 1723 -j ACCEPT

-A INPUT -p 47 -j ACCEPT

# Allow SSH connections

# The -dport number should be the same port number you set in sshd_config

-A INPUT -p tcp -m state --state NEW --dport 22 -j ACCEPT

# Allow ping

-A INPUT -p icmp -j ACCEPT

# Log iptables denied calls

-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7

# Drop all other inbound - default deny unless explicitly allowed policy

-A INPUT -j DROP

# -A FORWARD -j DROP

COMMIT

*nat

# VPN PPTPD

-A POSTROUTING -s 192.168.0.0/24 -o eth0 -j MASQUERADE

COMMIT

14、执行iptables规则（每次重启Ubuntu需重新执行）

iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -o eth0 -j MASQUERADE