Friday, January 7, 2011

Internet Sharing via VPN

Setup the VPN server (Ubuntu 10.04):
  1. sudo apt-get install pptpd
  2. In /etc/pptpd.conf, uncomment the two lines starting with "localip" and "remoteip" respectively, e.g.


    When a VPN connection is established, the system will create a virtual network interface. Its IP address will be one of those specified by "remoteip", and its gateway will be "localip".
  3. Add accounts in /etc/ppp/chap-secrets, e.g.

    # client server secret IP addresses
    jingyue pptpd password *

  4. Run "/etc/init.d/pptpd restart" to restart the VPN server and apply the changes.
  5. Now we should be able to connect to the VPN server via a VPN client using the above account. After the connection is established, we should be able to ping the server using "ping". However, we need more steps to share the server's internet connection.
  6. Enable IP forwarding: Uncomment the line "net.ipv4.ip_forwarding=1" in /etc/sysctl.conf.
  7. Configure IP tables: e.g.

    iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
    iptables -I FORWARD -p tcp --syn -i ppp+ -j TCPMSS --set-mss 1460

    The first line setups the NAT using IP masquerading, so that a client connecting to our server is able to go beyond the intra network. The second line sets the maximum segment size (MSS) of TCP SYN packets that the firewall sees. If the client is behind a firewall that blocks ICMP fragmentation packets, without doing this may cause some weird problems such as being able to view small webpages but not large ones. See this for more details.

  8. Restart the server.
Run the VPN client (Mac OS 10.6):
  1. System Preferences => Network.
  2. Create a new connection. Choose VPN as the interface, and PPTP as the VPN type.
  3. Enter the server's IP address and the account.
  4. Click "Authentication Settings" to enter the password.
  5. Click "Advanced" and select "Send all traffic over VPN connection".
  6. Once connected, we should be able to connect to the internet using the VPN connection.