0

I have setup a PPTP server on a CentOS 6 box.
Several clients (Windows and Linux) connect to this server.
All clients use the same subnet.
All clients (Win or Lin) can surf the Internet using the VPN successfully.
Windows clients can ping any other Windows client (XP/Vista/7) connected to VPN.
Linux clients (KVPNC) can ping any Windows client (XP/Vista/7) connected to VPN.

So far so good. But there's this weird problem and I've been trying to figure it out with no luck:
No client can ping (reach) a Linux client (successfully) connected to VPN. And yes, the firewall is completely disabled.

I'd really appreciate any hint/idea. TIA,

EDIT: The ultimate goal of this is to share services across the VPN, like accessing a HTTPD running on a Linux box from a Windows client.

Improve this question
2
  • Is ping response enabled on the Linux clients, i.e. what is the output of sysctl net.ipv4.icmp_echo_ignore_all?
    – lupincho
    Dec 8, 2012 at 18:51
  • @lupincho net.ipv4.icmp_echo_ignore_all = 0 As you may have guessed my main goal is to able to reach some services (like httpd or Tomcat) running on Linux box across the VPN. So the ping problem just denotes that the Linux boxes are not reachable at all.
    – BahmanM
    Dec 9, 2012 at 4:35

1 Answer 1

Reset to default
1

On the VPN SERVER, following need to be done:

Enable tcp/ip forwarding

Linux TCP/IP stack by default does not forward packets (either between interfaces or re-routing them between IP network). It has to be enabled

echo 1 > /proc/sys/net/ipv4/ip_forward

Without that, VPN server will accept VPN client packet locally, and route client packet according to NAT rule, but will not route traffic to local network, which include other vPN client.

Iptables

Iptables block all traffic by default. You need rules to allow traffic to get through.

$IPTABLES -A FORWARD -s 192.168.1.0/24 -d 192.168.1.0/24 -j ACCEPT

Change 192.168.1.0/24 to match your vpn network ip addresses. That will allow traffic between your vpn network machines.

/etc/pptp.conf

When vpn client need to talk to each together, the vpn server is acting as a routing point and need to be on the same netowrk.

localip 192.168.1.1
remoteip 192.168.1.2-254

Modify the above according to your network setup.

Improve this answer
10
  • Thanks but I don't get the iptables part. Do you mean I should add that FORWARD rule on the server or on Linux clients?
    – BahmanM
    Dec 11, 2012 at 8:56
  • yes, you can try it from commsnd promt 1st.
    – John Siu
    Dec 11, 2012 at 13:17
  • Oops! My mistake! It didn't work :-S I added the rule to client iptables and it's still the same.
    – BahmanM
    Dec 11, 2012 at 15:24
  • Both tcp/ip forward and iptables rule are to be applied on the vpn server, not the client.
    – John Siu
    Dec 11, 2012 at 15:36
  • Thanks for your response. Applied to no avail which makes sense as if the problem was in forwarding, Windows clients shouldn't have been reachable as well while they are.
    – BahmanM
    Dec 11, 2012 at 15:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .