What am I doing wrong with my VPN server setup?

VPN
1

I am trying to set up a PPTP VPN on a Ubuntu 20.04 VPS hosted on Oracle Cloud and I want to set up my old Mi 3c router as the VPN client. I know PPTP is old and deprecated, as has been clearly mentioned in the DigitalOcean PPTP setup guide that I followed. I usually use a VPN that costs 5 Euros a month on my 5 devices but I don’t want to have it running all the time on my mobile devices, which is why I wanted to set up a VPN connection on the router.

I ran the following commands after setting up my Ubuntu 20.04 VPS and SSHing into it.

apt-get install pptpd

edited the /etc/pptpd.conf by adding

localip 10.0.0.1

remoteip 10.0.0.100-200

edited /etc/ppp/chap-secrets by adding

user123 protocol password123  *

then added DNS servers to /etc/ppp/pptpd-options

and then started the PPTP daemon with

service pptpd restart

Then I set up port forwarding by uncommenting

net.ipv4.ip_forward = 1

And then ran the following

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE && iptables-save
iptables --table nat --append POSTROUTING --out-interface ppp0 -j MASQUERADE iptables -I INPUT -s 10.0.0.0/8 -i ppp0 -j ACCEPT iptables --append FORWARD --in-interface eth0 -j ACCEPT

After this, I set up a new PPTP VPN connection on my Mi 3c router in VPN settings (it supports only PPTP). There I entered user123 as the username, password123 as the password and for the server address, I entered the IPv4 address of the VPS.

I also have added port 1723 (TCP) to allowed ports.

What am I doing wrong?

2

You said you know PPTP is old and outdated and insecure, but didn’t say why you want to use it anyway. There might be a better solution.

3

The old router that I have doesn’t support OpenVPN or Wireguard. There’s an OpenWRT firmware available for it but I’ve not been able to flash it with that yet. So with the stock firmware, I can only use PPTP.

As for why not use a commercial VPN’s app all the time, my main concern is battery. On my main PC (desktop), it’s not a problem but I don’t want to have a VPN running on my phone and tablet all day long.

4

At the bottom, they mention it was bcz the router only supports pptp

5

Gotcha.

I think you need an iptables FORWARD rule to allow traffic arriving on ppp0. Currently you allowed traffic arriving on eth0, which would be reply traffic from the internet. You need to allow the initial request outbound as well.

6

TBH, I’m not very familiar with this stuff (which is why I was following the DO guide). Can you tell me what I have to do to set up iptables FORWARD rule to allow traffic arriving on ppp0 and to allow the initial request outbound?

7

iptables -t filter -A FORWARD -i ppp0 -o eth0 -j ACCEPT

Overall your iptables rules aren’t fantastic, although will probably work if I’m reading them right. If that rule I just posted above works for you, I’ll send a more sensible/readable set of rules later on when I’m by my computer.

8

Pretty sure I’m doing something wrong. I ran that rule but it still didn’t work. I’ll try once more in the morning and provide an update.

9

You can check whether traffic is making it to the VPN server like this:

tcpdump -pni ppp0

That will show you any traffic arriving on the VPN interface. Ctrl+c to stop.

10

I got this response

tcpdump: ppp0: No such device exists

(SIOCGIFHWADDR: No such device)

11

That would be what we call a “clue” lol.

Is your server actually running? Is the virtual interface actually called ppp0?

What’s the output of ‘ifconfig’ or ‘ip address show’ ? How about ‘systemctl status pptpd’

12

The VPS was running, yeah. But I kinda abandoned the project. Actually I came across a guide on running OpenWrt on my old router and spent the last 4 hours trying to figure out how to get it working and how to iron out issues I was having. I managed to run OpenWrt on it and that opened up Wireguard and OpenVPN as options for me. So I downloaded a config file from my VPN provider and set it up with the help of the guide they have. So instead of PPTP that I wanted to set up earlier, I now have set up Wireguard. Thanks once again for all the help.

13

Not the VPS, the pptpd server process.

You’ll be much better off with openwrt and wireguard. Good work, enjoy :slight_smile: