adw0rd.
RUEN
← All posts
·5 min read

FreeBSD. Using mpd5 as a VPN client (PPTP)

FreeBSDMPDPPTPVPN

vpn

After jumping through hoops with pptpclient, with the “/bin/ip not found” problem being particularly annoying, I finally decided to use mpd5 as my VPN client! :)

Background

I had no Internet access, so I downloaded packages from ftp.freebsd.org (on another machine), put them on a USB flash drive, and installed them on the “server” that needed a VPN client to access the Internet.

So, here are the players:

  • On the client side (that’s me)
    • A laptop running Windows XP
    • A server running FreeBSD 7.1
      • Network interface rl1 for connecting to the Internet
      • Network interface rl0 for connecting to the local network (not relevant here)
  • On the server side (ISP AirNet)
    • FreeBSD 5.2.1 (SPARC)
    • DHCP server
    • Gateway: 192.168.128.33
    • DNS: 192.168.128.33
    • VPN: vpn.airnet.lan (192.168.128.7)

When connecting in Windows, we see the following:

  • “Secured password” is used
  • Encryption is disabled

windows-vpn

Installing mpd5

Go to ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-7.1-release/ and http://www.freshports.org/ (to search for packages).

  1. Download mpd (net/mpd-5.1_1.tbz)
  2. Download expat (textproc/expat-2.0.1.tbz)
  3. Download libpdel (devel/libpdel-0.5.3_4.tbz)

Copy everything to the flash drive and mount it in FreeBSD:

# mount_msdosfs /dev/da0s1 /mnt

Install the “moped”

# pkg_add  mpd-5.1_1.tbz

The other packages (dependencies) will install automatically if they are in the same directory as mpd-5.1_1.tbz

You can download all these packages from my website: mpd-51_1, expat-201 and libpdel-053_4

Configuring pptp_client

Edit /etc/rc.conf to look like this:


# Запускаем при загрузке MPD
mpd_enable="YES"
# Для интерфейса rl1 используем DHCP
ifconfig_rl1="DHCP"

Edit /etc/resolv.conf and add the DNS addresses


nameserver 192.168.128.33

Edit /usr/local/etc/mpd5/mpd.conf to look like this:


startup:

default:
    load pptp_client

pptp_client:
    create bundle static B1
    set iface route default
    set ipcp ranges 0.0.0.0/0 0.0.0.0/0

    create link static L1 pptp
    set link action bundle B1
    set auth authname "ЛОГИН"
    set auth password "ПАРОЛЬ"
    set link max-redial 0
    set link mtu 1460
    set link keep-alive 20 75
    set pptp peer vpn.airnet.lan
    set pptp disable windowing
    open

For more information on commands and options, refer to the official manual pages.

To restart the DHCP client, use: # dhclient -d rl1

Everything should work now! If not, leave a comment :)

And now, the rest of my story…

The configuration was fully working, but I couldn’t establish a connection!


Multi-link PPP daemon for FreeBSD

process 1080 started, version 5.1 (root@freebsd.org 18:20  9-Sep-2008)
[B1] Bundle: Interface ng1 created
[L1] [L1] Link: OPEN event
[L1] LCP: Open event
[L1] LCP: state change Initial --> Starting
[L1] LCP: LayerStart
[L1] PPTP call successful
[L1] Link: UP event
[L1] Link: origination is local
[L1] LCP: Up event
[L1] LCP: state change Starting --> Req-Sent
[L1] LCP: SendConfigReq #1
[L1]   ACFCOMP
[L1]   PROTOCOMP
[L1]   ACCMAP 0x000a0000
[L1]   MRU 1500
[L1]   MAGICNUM a04506b0
[L1] LCP: rec'd Configure Ack #1 (Req-Sent)
[L1]   ACFCOMP
[L1]   PROTOCOMP
[L1]   ACCMAP 0x000a0000
[L1]   MRU 1500
[L1]   MAGICNUM a04506b0
[L1] LCP: state change Req-Sent --> Ack-Rcvd
[L1] LCP: state change Ack-Rcvd --> Req-Sent
[L1] LCP: SendConfigReq #2
[L1]   ACFCOMP
[L1]   PROTOCOMP
[L1]   ACCMAP 0x000a0000
[L1]   MRU 1500
[L1]   MAGICNUM a04506b0
[L1] LCP: rec'd Configure Ack #2 (Req-Sent)
[L1]   ACFCOMP
[L1]   PROTOCOMP
[L1]   ACCMAP 0x000a0000
[L1]   MRU 1500
[L1]   MAGICNUM a04506b0
[L1] LCP: state change Req-Sent --> Ack-Rcvd
[L1] LCP: rec'd Configure Request #148 (Ack-Rcvd)
[L1]   ACFCOMP
[L1]   PROTOCOMP
[L1]   MRU 1500
[L1]   MAGICNUM 4a711d50
[L1]   AUTHPROTO CHAP MSOFTv2
[L1] LCP: SendConfigAck #148
[L1]   ACFCOMP
[L1]   PROTOCOMP
[L1]   MRU 1500
[L1]   MAGICNUM 4a711d50
[L1]   AUTHPROTO CHAP MSOFTv2
[L1] LCP: state change Ack-Rcvd --> Opened
[L1] LCP: auth: peer wants CHAP, I want nothing
[L1] LCP: LayerUp
[L1] CHAP: rec'd CHALLENGE #1 len: 21
[L1]   Name: ""
[L1] CHAP: Using authname "andreevmv"
[L1] CHAP: sending RESPONSE #1 len: 63
[L1] CHAP: sending RESPONSE #1 len: 63
[L1] CHAP: rec'd FAILURE #1 len: 31
[L1]   MESG: E=691 R=0 M=Login incorrect
[L1] LCP: authorization failed
[L1] LCP: parameter negotiation failed
[L1] LCP: state change Opened --> Stopping
...

The problem was found: the ISP wasn’t assigning a proper IP address via DHCP to equipment that wasn’t registered to the user. In other words, my server’s network card wasn’t registered, while the laptop’s card was registered in the billing system.

A solution was found right away: use a spoofed MAC address from the laptop’s network card!

Spoof the MAC on the server:


# ifconfig rl1 ether 00:00:00:00:00:00

And we managed to change the MAC and get a proper IP address via DHCP:


...
rl1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
    options=8<VLAN_MTU>
    ether 00:00:00:00:00:00
    inet 192.168.135.18 netmask 0xffff0000 broadcast 192.168.255.255
    media: Ethernet autoselect (none)
    status: no carrier
...

To avoid changing it every time, I added this to /etc/rc.conf:


# Для rl1 подменяем MAC-адрес
ifconfig_rl1="ether 00:00:00:00:00:00"

After that, I tried connecting via VPN again:

# mpd5

And I managed to authenticate and get an external IP address!


...
[L1] CHAP: Using authname "andreevmv"
[L1] CHAP: sending RESPONSE #1 len: 63
[L1] CHAP: rec'd SUCCESS #1 len: 46
[L1]   MESG: S=7E9FBD94F23E66ED6EF6E8105664B9F8A20982C8
[L1] LCP: authorization successful
...
[B1] IPCP: LayerUp
[B1]   172.16.4.41 -> 93.92.200.24
[B1] IFACE: Up event
...

At last, I managed to bring up the ng1 interface and get online!


...
rl1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
    options=8<VLAN_MTU>
    ether 00:00:00:00:00:00
    inet 192.168.135.18 netmask 0xffff0000 broadcast 192.168.255.255
    media: Ethernet autoselect (100baseTX <full-duplex>)
    status: active
...
ng0: flags=8890<POINTOPOINT,NOARP,SIMPLEX,MULTICAST> metric 0 mtu 1500
ng1: flags=88d1<UP,POINTOPOINT,RUNNING,NOARP,SIMPLEX,MULTICAST> metric 0 mtu 1460
    inet 172.16.4.41 --> 93.92.200.20 netmask 0xffffffff

My thanks to:

  • My home forum, Pyha.ru, and phpdude for keeping the discussion going :)
  • The AirNet ISP forum (unfortunately, the forum is only accessible from inside the network http://forum.airnet.lan/showthread.php?t=1759), and specifically users CoDe and Technogen for helping track down the bug!
  • User alexshur for nudging me toward mpd5 :)

Comments are closed. Read the original discussion in Russian →