Peter Mount's Blog

Although NetworkManager on Ubuntu supports VPN’s, it doesn’t always work so this article describes how to setup a PPTP VPN under linux. Although it’s Ubuntu specific (this works with 9.10 and 10.04), this should work for most distributions.

What you need

You need to know:

• The remote IP address of the vpn server
• The remote network address range
• A remote name to give to this connection
• remote username and password

What we’ll use for this article:

• remote Server Ip – 192.168.2.100
• remote network address range – 192.168.3.0/24
• remote Name – myvpn
• name – peter
• password – password

Installation

First you need to install pptpd:

peter@kira:~$ sudo apt-get install pptp-linux ppp pptpd

Configuration

Now as root create/etc/ppp/peers/myvpn with the following content – replace the example values listed above with your ones:

peter@kira:~$ sudo vi /etc/ppp/peers/myvpn

pty "pptp 192.168.2.100 --nolaunchpppd"
#debug
#nodetach
#logfd 2
noproxyarp
ipparam myvpn
remotename myvpn
name peter
require-mppe-128
nobsdcomp
nodeflate
lock
noauth
refuse-eap

Next edit /etc/ppp/chap-secrets and add the following line:

peter@kira:~$ sudo vi /etc/ppp/chap-secrets

peter  myvpn  password *

Now edit (create if missing) /etc/ppp/ip-up.d/add-subnet with the following:

peter@kira:~$ sudo vi /etc/ppp/ip-up.d/add-subnet

#!/bin/bash
if [ "$PPP_IPPARAM" = "myvpn" ]
then
    route add -net 192.168.3.0/24 dev $PPP_IFACE
fi

If you created the add-subnet script then:

peter@kira:~$ chmod +x /etc/ppp/ip-up.d/add-subnet

Running the VPN Connection

Now if you have configured everything correctly you’ll be able to start the vpn with

peter@kira:~$ sudo pon myvpn

To stop the vpn:

peter@kira:~$ sudo poff myvpn

If it does not work first time you can uncomment the three lines of /etc/ppp/peers/myvpn. When you do the pon command will not return but it will log what it’s doing.

You may also have to tweek the other parameters in that file so it’s specific to your vpn.

Name resolution

The above will get you up and running with the actual connection but does nothing with configuring dns.

What you can do is either:

• Manually edit /etc/resolv.conf each time with the remote dns
• Edit /etc/ppp/ip-up.d/add-subnet to edit resolv.conf when it connects
• Add hosts directly into your local /etc/hosts file
• Use a local bind nameserver to use the remote dns server

I actually use the latter with a local bind nameserver.

Pages: 1 2 3 4

Some of the applications on Ubuntu 10.04 like Gwibber can fail if they don’t get responses quickly enough from a DNS so one solution is to run a local copy of Bind9 which will handle the requests locally. This will not only solve some of the problems but would also speed up dns lookups in general.

A simple installation

First you need to install bind:

peter@kira:~$ sudo apt-get update
peter@kira:~$ sudo apt-get install bind9 dnsutils

Configure local networking

Next you need to configure networking to always use your local bind. Now this depends on if you are using static IP's or DHCP.

For static IP's simply replace the dns server addresses with that of your server, either 127.0.0.1 or it's own IP address on your network.

For DHCP, you need to tell it to ignore the dns settings. To do this:

1. right click the network icon in the tool bar and select Edit Connections
2. select the interface you want to use the dns server like Auto eth0 and press Edit
3. Select the IPv4 Settings tab and change the method from Automatic (DHCP) to Automatic (DHCP) addresses only.
4. Apply everything and you should be set.

Common problems to look out for

The following are common problems you should be aware of before you setup bind9.

IPv4 or IPv6

Ubuntu comes with both IPv4 and IPv6 enabled, however if you are not using IPv6 - or quite probably your ISP is still not supporting it either you may notice bind is a bit slow. This is because it's trying to do lookups using IPv6 first, timing out so it then uses IPv4 which works.

To fix this you need to turn off IPv6 within bind.

peter@kira:~$ sudo vi /etc/default/bind9

Find the line starting with OPTIONS= and add -4 to it. Here's what mine looks like.

# run resolvconf?
RESOLVCONF=yes

# startup options for the server
OPTIONS="-4 -u bind"

Once you have done that, when you next start/restart bind9 it will use IPv4 only.

Installing bind9 with dnsmasq already installed

If you already have dnsmasq installed you must either uninstall it first or, if you want to keep it as your DHCP server, disable it's DNS server first otherwise the installation will fail as both cannot use the same port.

Now with dnsmasq you can't actually do this but you can trick it by getting it to run on a different port. Simply edit /etc/dnsmasq.conf and add the following line near the top of the file:

port=54

Once you have done that then restart dnsmasq then you'll be able to install bind.

Next we'll cover how to create zone files defining your local network