一、需求
1.有时候我们在外地出差,需要连到公司的内网办公,这个时候就需要一个×××服务器了。
2.我们内网的pc想出外网也是可以通过×××服务器出去的
二、测试环境:
1.服务器:外网IP eth0:10.20.230.46
内网IP eth1:192.168.9.1
2.×××外网客户端:IP:10.20.230.48
×××内网客户端:192.168.9.100
3.VPV客户端分配的IP网段:172.28.29.11-30
三、服务端安装:
wget http://poptop.sourceforge.net/yum/stable/packages/pptpd-1.3.4-2.rhel5.x86_64.rpm
rpm -ivh pptpd-1.3.4-2.rhel5.x86_64.rpm
四、修改配置文件:
1.配置文件/etc/ppp/options.pptpd
mv /etc/ppp/options.pptpd /etc/ppp/options.pptpd.bak
vi /etc/ppp/options.pptpd
输入如下内容:
name pptpd
refuse-pap
refuse-chap
refuse-mschap
require-mschap-v2
require-mppe-128
proxyarp
lock
nobsdcomp
novj
novjccomp
nologfd
idle 2592000
ms-dns 8.8.8.8
ms-dns 8.8.4.4
2.配置文件/etc/ppp/chap-secrets
mv /etc/ppp/chap-secrets /etc/ppp/chap-secrets.bak
vi /etc/ppp/chap-secrets
输入如下内容:
# Secrets for authentication using CHAP
# client server secret IP addresses
test pptpd 123 *
3. 配置文件/etc/pptpd.conf
mv /etc/pptpd.conf /etc/pptpd.conf.bak
vi /etc/pptpd.conf
输入以下内容:
option /etc/ppp/options.pptpd
logwtmp
localip 10.20.230.46
注:为拨入×××的用户动态分配172.28.9.11~172.28.9.30之间的IP,特别强调:客户端要拨入的IP是:10.20.230.46
vi /etc/sysctl.conf
修改以下内容:
net.ipv4.ip_forward = 1
保存、退出后执行:/sbin/sysctl -p
五、启动服务:
/sbin/service pptpd start
六、防火墙设置:
iptables -t nat -A POSTROUTING -s 172.28.29.0/255.255.255.0 -o eth0 -j MASQUERADE
# Generated by iptables-save v1.3.5 on Sun May 13 11:30:41 2012
*nat
:PREROUTING ACCEPT [3581:1078915]
:POSTROUTING ACCEPT [9:593]
:OUTPUT ACCEPT [9:593]
-A POSTROUTING -s 172.28.29.0/255.255.255.0 -o eth0 -j MASQUERADE
COMMIT
# Completed on Sun May 13 11:30:41 2012
# Generated by iptables-save v1.3.5 on Sun May 13 11:30:41 2012
*filter
:INPUT ACCEPT [3475:1092039]
:FORWARD DROP [23:928]
:OUTPUT ACCEPT [5142:1575131]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 172.28.29.0/255.255.255.0 -j ACCEPT
-A FORWARD -j RH-Firewall-1-INPUT
-A FORWARD -s 172.28.29.0/255.255.255.0 -j ACCEPT
-A FORWARD -s 172.28.29.0/255.255.255.0 -j ACCEPT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp -m icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -d 224.0.0.251 -p udp -m udp --dport 5353 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -s 0.0.0.0/255.255.255.0 -p tcp -m state --state NEW -m tcp -j ACCEPT
-A RH-Firewall-1-INPUT -s 172.28.29.0/255.255.255.0 -p tcp -m state --state NEW -m tcp -j ACCEPT
COMMIT
# Completed on Sun May 13 11:30:41 2012
外网用户通过拨×××的外网IP进入内网办公
内网用户通过拨×××的内网IP出去上网
在内网的机器上ping一下百度,看看可以上网不:
ok,成功了。
本文出自 “为了梦想奋斗” 博客,请务必保留此出处http://navyaijm.blog.51cto.com/4647068/862195
转载于:https://blog.51cto.com/linushai/1177689