Go Back   DaemonForums > FreeBSD > FreeBSD Ports and Packages

FreeBSD Ports and Packages Installation and upgrading of ports and packages on FreeBSD.

Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #1   (View Single Post)  
Old 17th April 2010
DNAeon DNAeon is offline
Shell Scout
Join Date: Sep 2008
Location: Bulgaria
Posts: 138
Default FreeBSD + MPD + PF


I'm trying to setup a pptp server on my FreeBSD 8.0 box using mpd, hope you can help me out.

Here's what I've got so far - mpd5.5 is already installed from ports.
The mpd daemon runs on the same box that is the external firewall, and clients connect to it.

        # configure mpd users
        set user administrator admin
        set user administrator
        # configure the console
        set console self 5005
        set console open
        # configure the web server
        set web self 5006
        set web open

        load pptp_server

        set ippool add pool1

# Create clonable bundle template named B
        create bundle template B
        set iface enable proxy-arp
        set iface idle 1800
        set iface enable tcpmssfix
        set ipcp yes vjcomp
# Specify IP address pool for dynamic assigment.
        set ipcp ranges <external-ip-here>/24 ippool pool1
        set ipcp dns

# The five lines below enable Microsoft Point-to-Point encryption
# (MPPE) using the ng_mppc(8) netgraph node type.
        set bundle enable compression
        set ccp yes mppc
        set mppc yes e40
        set mppc yes e128
        set mppc yes stateless

# Create clonable link template named L
        create link template L pptp
# Set bundle template to use
        set link action bundle B
# Multilink adds some overhead, but gives full 1500 MTU.
        set link enable multilink
        set link yes acfcomp protocomp
        set link no pap chap eap
        set link enable chap
# We reducing link mtu to avoid GRE packet fragmentation.
        set link mtu 1460
# Configure PPTP
        set pptp self <external-ip-here>
# Allow to accept calls
        set link enable incoming
testuser     testuser
In the above configuration:
  • <external-ip-here> -> my publicly accessible IP
  • - -> the IP range for clients
  • -> the gateway internal's IP

In /etc/pf.conf I've added these rules:

In pf.conf I have this:
# --- MACROS section ---
ext_if = "re0"
int_if = "fxp0"

# --- IP given by the ISP ---
ip_addr = "<external-ip-here>"

# --- protocols on external interface ---
EXT_PROTOS = "{ icmp }"

# --- allow pptp connections on the external interface ---
PPTP_SERVICES = "{ 1723 47 }"

# --- hosts with internet access ---
table <allowed> { }

# --- OPTIONS section ---
set skip on lo0

# --- SCRUB section ---
scrub in all

# --- TRANSLATION (NAT/RDR) section ---
nat on $ext_if from <allowed> to any -> $ip_addr

# --- FILTER RULES ---

# --- default policy ---
block log all

# --- antispoof protection ---
antispoof quick for $ext_if inet
antispoof quick for $int_if inet

# --- INTERNAL interface ---

pass in quick on $int_if inet from <allowed> to any keep state
pass out quick on $int_if inet from any to any keep state

# --- EXTERNAL interface ---

# --- pass incoming connections on external interface for these protocols ---
pass in quick on $ext_if inet proto $EXT_PROTOS from any to $ext_if keep state 

pass in quick on $ext_if inet proto { tcp udp } from any to $ext_if port $PPTP_SERVICES keep state 

pass out quick on $ext_if inet from any to any keep state
The clients are able to connect to the pptp server successfully - they get address from the ip pool -

But they cannot ping any system from the internal network -

If I disable PF -> the clients can only ping the gateway's internal IP -

The other problem is that each time a client connects a new ng device is configured for them.

1st client -> ng0
2nd client -> ng1

I've tried adding these rules to PF as well just to test, but that doesn't help.

pass in quick on ng0 inet from any to any keep state
pass out quick on ng0 inet from any to any keep state
Now I'm stuck.. How can I configure PF, so that each time a new client is connected a new entry for ng is added and removed upon disconnect in PF?

The other strange issue from the mpd daemon I get is this:
B-1] system: command "/usr/sbin/arp" returned 256
The complete log from the daemon is attached to thread.

If I use tcpdump I can see the icmp echo request from the client only on the ng device, so it's not blocked anywhere else.

Do you an idea where/what I'm missing?


"I never think of the future. It comes soon enough." - A.E

Useful links: FreeBSD Handbook | FreeBSD Developer's Handbook | The Porter's Handbook | PF User's Guide | unix-heaven.org
Reply With Quote

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

All times are GMT. The time now is 07:11 PM.

Powered by vBulletin® Version 3.8.4
Copyright ©2000 - 2018, Jelsoft Enterprises Ltd.
Content copyright © 2007-2010, the authors
Daemon image copyright ©1988, Marshall Kirk McKusick