Smoothwall Express 2.0 - MS VPN

http://martybugs.net/smoothwall/vpn.cgi

Internal PPTP VPN Server

[These modifications only apply to Smoothwall Express 2.0, as GPL 1.0 uses ipchains.]

This page describes how configure Smoothwall to allow access to an internal PPTP VPN server that's behind your Smoothwall (ie, a
Microsoft VPN server, or Poptop on a linux box).
For information on making similar changes to a Smoothwall GPL 1.0 box (using ipchains), refer to Hilton's web site.

Requirements:
You'll need:
A Smoothwall Express 2.0 installation (obviously...).
A PPTP VPN server on your orange (or green) network.
A way of getting a command-line prompt on your Smoothwall box (either by logging directly onto your Smoothwall box, using a SSH client such as PuTTY or SSH Secure Shell, or via the Smoothwall web interface).

Background:
A PPTP VPN server requires TCP port 1723 forwarded to the VPN server, as well as the GRE protocol (protocol 47).
As the Smoothwall web interface doesn't provide functionality for forwarding the GRE protocol, you'll have to edit the firewall script.

Editing the Firewall Script:
Smoothwall's iptables firewall configuration is stored in /etc/rc.d/rc.firewall.up, so to make changes to the firewall, you'll
need to edit this script.
As with any modifications to your Smoothwall, make a backup copy of this file before making any changes to it, so you can easily revert back to a known working version.

Firewall Script Changes:
At the end of /etc/rc.d/rc.firewall.up, add the following:
vpnserver="172.16.0.2"
/sbin/iptables -N pptp
/sbin/iptables -A pptp -p tcp --destination-port 1723 --dst $vpnserver -j ACCEPT
/sbin/iptables -A pptp -p 47 --dst $vpnserver -j ACCEPT
/sbin/iptables -I FORWARD -j pptp
/sbin/iptables -t nat -N pptp
/sbin/iptables -t nat -A pptp -i $RED_DEV -p tcp --dport 1723 -j DNAT --to $vpnserver:1723
/sbin/iptables -t nat -A pptp -i $RED_DEV -p 47 -j DNAT --to $vpnserver
/sbin/iptables -t nat -A PREROUTING -j pptp

The above commands will configure your firewall to forward TCP port 1723, as well as GRE traffic to the specified IP address.
Note that you'll have to replace 172.16.0.2 with the actual IP address of your PPTP VPN server.
Also note that if your red interface is a modem, ISDN, or using PPPoE or PPPoA, you can't use the $RED_DEV alias, but need to specify the actual interface name, for example, ppp0.

Applying Your Changes:
Any changes you make to the firewall script will not take effect immediately.
After making changes to the firewall script, you can either reboot your Smoothwall, or run the following from a command line:
/etc/rc.d/rc.netaddress.down
/etc/rc.d/rc.netaddress.up
This will re-apply the firewall (as well as restart Snort, any VPNs, etc), and your modifications to the firewall script should be taking effect.

If you see any iptables errors immediately after the line Setting up firewall then you've probably made a typo or other mistake in the firewall script, and you'll have to make the appropriate corrections.

Note that you need execute this as a single line if you're accessing your Smoothwall via SSH - otherwise your SSH connection will be terminated, and you won't be able to re-establish it without logging onto Smoothwall's console to run the up script!

You should now be able to establish a PPTP VPN connection from another internet connection to your Smoothwall's red IP address / hostname.

Note:
Note that some of the Smoothwall fixes may overwrite rc.firewall.up with a newer version, so if you install a new fix, it may overwrite your changes, so always keep a backup copy of your rc.firewall.up before patching your Smoothie, so you can reapply the changes to the new rc.firewall.up.
Similarly, when doing a fresh installation of Smoothwall, only make these changes once you've fully patched the installation.

References:
netfilter/iptables project
last updated 7 Sep 2004