:: MENU ::
Главная
Looking Glass list
Online Nettools
Online IP Subnet Calculator
Online BGP tools
Основы маршрутизации
BGP протокол
OSPF протокол
Рук-во Quagga
Cisco команды
Ваш IP и провайдер
Файлы
Книги
Полезные ссылки
Советы
Unix ToolBox
IPv4 address space
IPv6 address space
CIDR IPv4
IPv6 prefixes
PPTP / PPPoE
Измерение скорости
Форум / Forum
Статьи (блог)
Контакты
Братья по разуму
github
Настройка PPPoE под FreeBSD :: Настройка PPTP под FreeBSD
| Статья: Настраиваем PPPoE сервер на FreeBSD используя порт MPD5 |
| Статья: PPPoE сервер на встроенном в FreeBSD демоне pppoed |
Пример конфигурационых файлов для поднятия серверов PPTP и PPPoE ( + Radius ) на FreeBSD (MPD)
Пример конфигурационых файлов для клиентской части PPPoE:
(Linux, FreeBSD, OpenBSD, Mac OS X Leopard (10.5), Mac OS X Tiger (10.4), OS/2)
Пример конфигурационых файлов для клиентской части PPTP на FreeBSDПример поднятия роутинга при коннекте
сервер PPPoE
Сервер: /usr/libexec/pppoed Запуск: /usr/libexec/pppoed -a HOSTNAME -p PROVIDER_NAME -l pppoe IFACE_NAME File /etc/ppp/ppp.conf pppoe: set timeout 0 set log Phase tun Chat Command Warning Error Alert Connect lcp ipcp set mtu 1450 set mru 1450 set speed sync set server /var/tmp/pppuser%d "" 0177 allow mode direct disable acfcomp protocomp deflate pred1 pap deny acfcomp protocomp deflate pred1 pap enable chap chap81 mppe lqr set dns 1.1.1.1 2.2.2.2 accept dns File /etc/ppp/ppp.secret login password 10.0.0.36 * * guest guest 10.255.255.2-10.255.255.254 * *
сервер PPPoE + Radius
Сервер pppoe: /usr/libexec/pppoed
Radius: /usr/ports/net/freeradius
File /etc/ppp/ppp.conf
default:
pppoe:
set timeout 0
set log Phase tun Chat Command Warning Error Alert Connect lcp ipcp
set mtu 1450
set mru 1450
set speed sync
set server /var/tmp/pppuser%d "" 0177
allow mode direct
disable acfcomp protocomp
deny acfcomp
disable deflate pred1
deny deflate pred1
disable pap
enable chap
enable chap81
enable MSCHAPv2
set dns 1.1.1.1 2.2.2.2
accept dns
enable lqr
set radius /etc/radius.conf
File /etc/radius.conf
auth RADIUS_SERVER_IP password
acct RADIUS_SERVER_IP password
File /usr/local/etc/raddb/clients.conf
client localhost {
secret = testtest
shortname = localhost
}
File /usr/local/etc/raddb/radiusd.conf
prefix = /usr/local
exec_prefix = ${prefix}
sysconfdir = ${prefix}/etc
localstatedir = /var
sbindir = ${exec_prefix}/sbin
logdir = /var/log
raddbdir = ${sysconfdir}/raddb
radacctdir = ${logdir}/radacct
# Location of config and logfiles.
confdir = ${raddbdir}
run_dir = ${localstatedir}/run/radiusd
log_file = ${logdir}/radius.log
libdir = ${exec_prefix}/lib
pidfile = ${run_dir}/radiusd.pid
user = nobody
group = nobody
max_request_time = 30
delete_blocked_requests = no
cleanup_delay = 5
max_requests = 1024
bind_address = *
#bind_address = 127.0.01
port = 0
#listen {
# ipaddr = *
# port = 0
# type = auth
#}
hostname_lookups = no
allow_core_dumps = no
regular_expressions = yes
extended_expressions = yes
log_stripped_names = no
log_auth = yes
log_auth_badpass = yes
log_auth_goodpass = no
usercollide = no
lower_user = no
lower_pass = no
nospace_user = no
nospace_pass = no
# The program to execute to do concurrency checks.
checkrad = ${sbindir}/checkrad
# SECURITY CONFIGURATION
security {
max_attributes = 200
reject_delay = 1
status_server = no
}
# PROXY CONFIGURATION
proxy_requests = no
#$INCLUDE ${confdir}/proxy.conf
# CLIENTS CONFIGURATION
$INCLUDE ${confdir}/clients.conf
# SNMP CONFIGURATION
snmp = no
#$INCLUDE ${confdir}/snmp.conf
# THREAD POOL CONFIGURATION
thread pool {
start_servers = 5
max_servers = 32
min_spare_servers = 3
max_spare_servers = 10
max_requests_per_server = 0
}
# MODULE CONFIGURATION
modules {
pap {
encryption_scheme = crypt
}
chap {
authtype = CHAP
}
mschap {
authtype = MS-CHAP
#use_mppe = no
#require_encryption = yes
#require_strong = yes
#with_ntdomain_hack = no
}
acct_unique {
key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port"
}
$INCLUDE ${confdir}/sql.conf
radutmp {
filename = ${logdir}/radutmp
username = %{User-Name}
case_sensitive = yes
check_with_nas = yes # ??
callerid = "yes"
}
radutmp sradutmp {
filename = ${logdir}/sradutmp
perm = 0644
callerid = "no"
}
attr_filter {
attrsfile = ${confdir}/attrs
}
always fail {
rcode = fail
}
always reject {
rcode = reject
}
always ok {
rcode = ok
simulcount = 0
mpp = no
}
expr {
}
digest {
}
}
instantiate {
}
authorize {
chap
mschap
sql
}
authenticate {
Auth-Type PAP {
pap
}
Auth-Type CHAP {
chap
}
Auth-Type MS-CHAP {
mschap
}
}
preacct {
}
accounting {
sql
}
session {
sql
}
post-auth {
}
File /usr/local/etc/raddb/sql.conf
sql {
driver = "rlm_sql_mysql"
server = "localhost"
login = "root"
password = ""
radius_db = "radius"
acct_table1 = "acc"
acct_table2 = "acc"
deletestalesessions = yes
# Print all SQL statements when in debug mode (-x)
sqltrace = yes
sqltracefile = ${logdir}/sqltrace.sql
num_sql_socks = 5
connect_failure_retry_delay = 60
#safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /"
# ------------------------------ requests -----------------------------------
sql_user_name = "%{User-Name}"
default_user_profile = "DEFAULT"
query_on_not_found = no
authorize_check_query = "SELECT id,name,'User-Password',password,'==' FROM users WHERE name = '%{SQL-User-Name}' ORDER BY id"
authorize_reply_query = "SELECT id,name,'Framed-IP-Address',ip_addr,'=' FROM users WHERE name = '%{SQL-User-Name}' ORDER BY id"
accounting_onoff_query = "UPDATE ${acct_table1} SET AcctStopTime='%S' WHERE AcctStopTime=0 AND FromNAS= '%{NAS-Identifier}' AND AcctStartTime <= '%S'"
accounting_update_query = "UPDATE ${acct_table1} \
SET FramedIPAddress = '%{Framed-IP-Address}', \
WHERE AcctSessionId = '%{Acct-Session-Id}' \
AND UserName = '%{SQL-User-Name}' \
AND FromNAS= '%{NAS-Identifier}'"
accounting_update_query_alt = "INSERT into ${acct_table1} \
(AcctSessionId, UserName, FromNAS, AcctStartTime, FramedIPAddress) values \
('%{Acct-Session-Id}', '%{SQL-User-Name}', '%{NAS-Identifier}', \
DATE_SUB('%S',INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND),%{Framed-IP-Address}')"
accounting_start_query = "INSERT into ${acct_table1} \
(AcctSessionId, UserName, FromNAS, AcctStartTime, AcctStopTime, FramedIPAddress) values \
('%{Acct-Session-Id}', '%{SQL-User-Name}', '%{NAS-Identifier}','%S',0,'%{Framed-IP-Address}')"
accounting_start_query_alt = "UPDATE ${acct_table1} SET \
AcctStartTime = '%S' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND FromNAS = '%{NAS-Identifier}'"
accounting_stop_query = "UPDATE ${acct_table2} SET \
AcctStopTime = '%S' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND FromNAS = '%{NAS-Identifier}'"
accounting_stop_query_alt = "INSERT into ${acct_table2} \
(AcctSessionId, UserName, FromNAS, AcctStartTime, AcctStopTime, FramedIPAddress) values\
('%{Acct-Session-Id}', '%{SQL-User-Name}', '%{NAS-Identifier}', DATE_SUB('%S', INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%S', '%{Framed-IP-Address}')"
simul_count_query = "SELECT COUNT(*) FROM ${acct_table1} WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0"
simul_verify_query = "SELECT id, AcctSessionId, UserName, FromNAS, FramedIPAddress FROM ${acct_table1} WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0"
# group_membership_query = "SELECT GroupName FROM ${usergroup_table} WHERE UserName='%{SQL-User-Name}'"
# postauth_query = "INSERT into ${postauth_table} (id, user, pass, reply, date) values ('', '%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', NOW())"
#
# Set to 'yes' to read radius clients from the database ('nas' table)
#readclients = yes
}
ADD to file /etc/rc.conf
radiusd_enable="YES"
File rad.sql
# Database : `radius`
#
# Table structure for table `acc`
#
CREATE TABLE `acc` (
`id` bigint(20) NOT NULL auto_increment,
`UserName` varchar(64) NOT NULL default '',
`AcctStartTime` datetime NOT NULL default '0000-00-00 00:00:00',
`AcctStopTime` datetime NOT NULL default '0000-00-00 00:00:00',
`FramedIPAddress` varchar(15) NOT NULL default '',
`FromNAS` varchar(32) NOT NULL default '',
`AcctSessionId` varchar(32) NOT NULL default '',
PRIMARY KEY (`id`)
) TYPE=MyISAM AUTO_INCREMENT=3 ;
# --------------------------------------------------------
#
# Table structure for table `users`
#
CREATE TABLE `users` (
`id` int(11) unsigned NOT NULL auto_increment,
`name` varchar(32) NOT NULL default '',
`password` varchar(32) NOT NULL default '',
`ip_addr` varchar(32) NOT NULL default '',
PRIMARY KEY (`id`),
KEY `name` (`name`)
) TYPE=MyISAM;
#
# Table structure for table `ppp_reply`
#
CREATE TABLE `ppp_reply` (
`id` int(11) unsigned NOT NULL auto_increment,
`UserName` varchar(64) NOT NULL default '',
`Attribute` varchar(32) NOT NULL default '',
`op` char(2) NOT NULL default '=',
`Value` varchar(253) NOT NULL default '',
PRIMARY KEY (`id`),
KEY `UserName` (`UserName`(32))
) TYPE=MyISAM;
#
# Dump for table `ppp_reply`
#
INSERT INTO `ppp_reply` (`id`, `UserName`, `Attribute`, `op`, `Value`) VALUES
(1, '', 'Framed-IP-Netmask', '=', '255.255.255.255'),
(2, '', 'Framed-Protocol', '=', 'PPP'),
(3, '', 'Service-Type', '=', 'Framed-User'),
(4, '', 'Framed-MTU', '=', '1492');
PPPoE + PPTP on MPD + Radius
Сервер: /usr/ports/net/mpd
Ядро:
options NETGRAPH #netgraph(4) system
options NETGRAPH_ASYNC
options NETGRAPH_BPF
options NETGRAPH_ECHO
options NETGRAPH_ETHER
options NETGRAPH_HOLE
options NETGRAPH_IFACE
options NETGRAPH_KSOCKET
options NETGRAPH_L2TP
options NETGRAPH_LMI
# MPPC compression requires proprietary files (not included)
#options NETGRAPH_MPPC_COMPRESSION
options NETGRAPH_MPPC_ENCRYPTION
options NETGRAPH_ONE2MANY
options NETGRAPH_PPP
options NETGRAPH_PPTPGRE
options NETGRAPH_RFC1490
options NETGRAPH_SOCKET
options NETGRAPH_TEE
options NETGRAPH_TTY
options NETGRAPH_UI
options NETGRAPH_VJC
File /usr/local/etc/mpd/mpd.conf
default:
load ppoe00
load ppoe01
load ppoe02
load pptp00
load pptp01
ppoe00:
new -i ng0 ppoe0 ppoe0
set pppoe iface fxp0
load ppoe_def
ppoe01:
new -i ng1 ppoe1 ppoe1
set pppoe iface fxp1
load ppoe_def
ppoe02:
new -i ng2 ppoe2 ppoe2
set pppoe iface fxp2
load ppoe_def
pptp00:
new -i ng300 pptp0 pptp0
load pptp_def
pptp01:
new -i ng301 pptp1 pptp1
load pptp_def
pptp_def:
set bundle enable multilink
set link type pptp
set link no acfcomp protocomp
set link no pap
set link yes chap-msv1
set link yes chap-msv2
set link yes chap-md5
set ipcp no vjcomp
set ccp no mppc
set ccp no mpp-e40
set ccp no mpp-e56
set ccp no mpp-e128
set ccp yes mpp-stateless
set pptp self 10.11.50.1
set pptp enable incoming
set pptp disable originate
load common
ppoe_def:
set pppoe enable incoming
set pppoe disable originate
set pppoe service "*"
set iface idle 1800
set iface mtu 1500
set iface enable tcpmssfix
set bundle disable multilink
set link yes acfcomp protocomp
set link disable pap chap
set link enable chap
set link mtu 1492
set link mru 1492
set link max-redial -1
set link enable magicnum
set link enable check-magic
set ipcp enable vjcomp
load common
common:
set iface disable on-demand
set ipcp ranges 192.168.1.1/32 10.11.50.0/24
set iface disable on-demand
set iface disable proxy-arp
set link keep-alive 60 180
set bundle max-logins 1
set bundle disable compression
load radius
set ipcp dns 1.1.1.1
radius:
set radius config /etc/radius.conf
set radius retries 3
# set radius timeout 30
set radius me NAME_FROM_HOSTS
set radius acct-update 30
set bundle enable radius-auth
set bundle enable radius-acct
set iface enable radius-session
set ipcp enable radius-ip
File /usr/local/etc/mpd/mpd.links
#
# For our PPTP server
#
pptp00:
set link type pptp
set pptp enable incoming
set pptp disable originate
pptp01:
set link type pptp
set pptp enable incoming
set pptp disable originate
#
# For our PPoE server
#
ppoe0:
set link type pppoe
set pppoe enable incoming
set pppoe disable originate
ppoe1:
set link type pppoe
set pppoe enable incoming
set pppoe disable originate
ppoe2:
set link type pppoe
set pppoe enable incoming
set pppoe disable originate
Для того, что бы к MPD могли конектиться Windows 2000 клиенты нужно:
создаем файлик /usr/ports/net/mpd/files/patch-bb
следующего содержания:
--- src/lcp.c.orig Wed Jul 14 18:02:12 2004
+++ src/lcp.c Wed Jul 14 18:02:13 2004
@@ -564,8 +564,10 @@
if (!LCP_PEER_REJECTED(lcp, TY_ACCMAP))
cp = FsmConfValue(cp, TY_ACCMAP, -4, &lcp->want_accmap);
}
+/*
if (!LCP_PEER_REJECTED(lcp, TY_MRU))
cp = FsmConfValue(cp, TY_MRU, -2, &lcp->want_mru);
+*/
if (lcp->want_magic && !LCP_PEER_REJECTED(lcp, TY_MAGICNUM))
cp = FsmConfValue(cp, TY_MAGICNUM, -4, &lcp->want_magic);
if (lcp->want_callback && !LCP_PEER_REJECTED(lcp, TY_CALLBACK)) {
Далее пересобираем MPD, но патч может и не прокатить и выдать ошибку, для этого
идем в диру work и папку src, ищем файлик lcp.c и коментируем в нем две строчки (выделены в патче)
затем собираем и инсталим MPD
Запуск: /usr/local/sbin/mpd -b
Radius настраивается как в предыдущем примере
Проверка Radius:
Проверка FreeRadius
Для проверки - с локальной машины (надеюсь, ее в clients.conf вписали)
выполняем
radtest user password < IP-адрес radius-сервера > 1812 < пароль к radius-серверу >
, например,
radtest testuser testpassword 10.1.1.1 1812 test2
Конечно, testuser и testpassword должны быть прописаны в базе
пользователей. В итоге получим:
Sending Access-Request of id 148 to 10.1.1.1:1812
User-Name = "testuser"
User-Password = "W\202$Y\374x\251p^\302M\376\202U\212\031"
NAS-IP-Address = host.domain
NAS-Port = 1812
rad_recv: Access-Accept packet from host 10.1.1.1:1812, id=41, length=32
Framed-IP-Address = 10.1.5.2
Framed-IP-Netmask = 255.255.255.255
То-есть, радиус-сервер проверил правильность пароля для этого
пользователя и выдал IP-адрес. В случае, если пароль не прошел, то
получим
rad_recv: Access-Reject packet from host 10.1.1.1:1812, id=148, length=20
сервер PPTP на PopTop
Сервер: /usr/ports/net/poptop/
File /etc/ppp/ppp.conf:
loop:
set timeout 0
set log phase chat connect lcp ipcp command
set device localhost:pptp
set dial
set login
set server /tmp/loop "" 0177
loop-in:
set timeout 0
set log phase lcp ipcp command
allow mode direct
pptp:
debug
load loop
# enable PAP
# enable MSCHAP
enable MSCHAPv2
# enable CHAP
disable deflate pred1
deny deflate pred1
disable pap
# proxyarp
# set mppe * *
disable ipv6cp
#enable mppc
accept dns
set dns 1.1.1.1 2.2.2.2
# set nbns 10.11.50.3
set device !/etc/ppp/secure
File /etc/ppp/secure:
#!/bin/sh
exec /usr/sbin/ppp -direct loop-in
File /etc/ppp/pptpd.conf
option /etc/ppp/ppp.conf
speed 115200
proxyarp
pidfile /var/run/pptpd.pid
File /etc/ppp/ppp.linkdown
pptp:
! sh -c "/usr/local/sbin/vpn_down.pl USER HISADDR INTERFACE UPTIME"
File /etc/ppp/ppp.linkup
pptp:
! sh -c "/usr/local/sbin/vpn_up.pl USER HISADDR INTERFACE"
! sh -c "/usr/local/sbin/vpn_up_log.pl USER HISADDR"
File /usr/local/sbin/vpn_down.pl
#!/usr/bin/perl
use Mysql;
$host="HOST";
$database="DATABASE";
$user="LOGIN";
$pass="PASSWORD";
$dbh = Mysql->Connect($host,$database,$user,$pass) or print $Mysql::db_errstr;
$dbh->SelectDB($database) or print $Mysql::db_errstr;
$action="linkdown";
$x=scalar(@ARGV);
$user=@ARGV[0];
$ext_ip=@ARGV[1];
$uptime=@ARGV[3];
$date=`/bin/date`;
@out=split(' ',$date);
$form_date="@out[1] @out[2] @out[3]";
#print "$uptime\n";
$sth=$dbh->Query("select * from vpn where login='$user'");
@arr=$sth->FetchRow;
while(! ($sth=$dbh->Query("INSERT into vpn_all_log (ownid, login,ext_ip, int_ip, date, up_down, uptime) VALUES ('@arr[4]' ,'$user','@arr[2]','@arr[1]','$form_date','$action','$uptime')"))) {
print "\nretrying ($Mysql:db_errstr)\n";
sleep 3;
}
while(! ($sth=$dbh->Query("DELETE