How to Setup a VPN (PPTP) Server on Debian Linux
VPN-ing into your server will allow you to connect to every possible service running on it, as if you were sitting next to it on the same network, without individually forwarding every port combination for every service you would like to access remotely.
Using a VPN connection also has the upshot of, if desired, granting access to other computers on the network as if you where in it locally from anywhere across the internet.
While not the most secure of the VPN solutions out there, PPTP is by far the simplest to install, configure and connect to from any modern system and from windows specifically as the client is a part of the OS since the XP days and you don’t need to mess with certificates (like with L2TP+IPsec or SSL VPNs) on both sides of the connection.
Did i get you interested? then let’s go 🙂
You will need to forward port 1723 from the internet to the server to enable the connection (not covered here).
You will see me use VIM as the editor program, this is just because I’m used to it… you may use any other editor that you’d like.
Install the pptp server package:
sudo aptitude install pptpd
Edit the “/etc/pptpd.conf” configuration file:
sudo vim /etc/pptpd.conf
Add to it:
Where the “localip” is the address of the server, and the remoteip are the addresses that will be handed out to the clients, it is up to you to adjust these for your network’s requirements.
Edit the “/etc/ppp/pptpd-options” configuration file:
sudo vim /etc/ppp/pptpd-options
Append to the end of the file, the following directives:
Where the IP used for the ms-dns directive is the DNS server for the local network your client will be connecting to and, again, it is your responsibility to adjust this to your network’s configuration.
Edit the chap secrets file:
sudo vim /etc/ppp/chap-secrets
Add to it the authentication credentials for a user’s connection, in the following syntax:
username * users-password *
Restart the connection’s daemon for the settings to take affect:
sudo /etc/init.d/pptpd restart
If you don’t want to grant yourself access to anything beyond the server, then you’re done on the server side.
Enable Forwarding (optional)
While this step is optional and could be viewed as a security risk for the extremely paranoid, it is my opinion that not doing it defeats the purpose of even having a VPN connection into your network.
By enabling forwarding we make the entire network available to us when we connect and not just the VPN server itself. Doing so allows the connecting client to “jump” through the VPN server, to all other devices on the network.
To achieve this we will be flipping the switch on the “forwarding” parameter of the system.
Edit the “sysctl” file:
sudo vim /etc/sysctl.conf
Find the “net.ipv4.ip_forward” line and change the parameter from 0 (disabled) to 1 (enabled):
You can either restart the system or issue this command for the setting to take affect:
sudo sysctl -p
With forwarding enabled, all the server side settings are prepared.
We recommend using a “Split Tunnel” connection mode for the VPN client.
A more in depth explanation about the recommended “Split Tunnel” mode, as well as instructions for Ubuntu Linux users can be found in the “Setting up a “Split Tunnel” VPN (PPTP) Client on Ubuntu 10.04” guide.