Difference between revisions of "PPTP Client"

From ArchWiki
Jump to navigation Jump to search
(Installing PPTP Client: updated to comply with the new style guide)
(Making A VPN Daemon and Connecting On Boot: updated the patch for /usr/bin/poff to use a (in my opinion) somewhat better method of accomplishing the same thing)
Line 135: Line 135:
To resolve this issue, you can patch your {{Filename|/usr/bin/poff}} file by making the following changes on line 93:
To resolve this issue, you can patch your {{Filename|/usr/bin/poff}} file by making the following changes on line 93:
<pre><nowiki>-PID=`ps axw | grep "[ /]pppd call $1 *\$" | awk '{print $1}'`
<pre><nowiki>-PID=`ps axw | grep "[ /]pppd call $1 *\$" | awk '{print $1}'`
+PID=`ps axw | grep "[ /]pppd call $1" | awk '{print $1}'`</nowiki></pre>}}
+PID=`ps axw | grep -E "[ /]pppd call $1 .*\$" | awk '{print $1}'`</nowiki></pre>}}

Revision as of 20:59, 19 November 2011

This template has only maintenance purposes. For linking to local translations please use interlanguage links, see Help:i18n#Interlanguage links.

Local languages: Català – Dansk – English – Español – Esperanto – Hrvatski – Indonesia – Italiano – Lietuviškai – Magyar – Nederlands – Norsk Bokmål – Polski – Português – Slovenský – Česky – Ελληνικά – Български – Русский – Српски – Українська – עברית – العربية – ไทย – 日本語 – 正體中文 – 简体中文 – 한국어

External languages (all articles in these languages should be moved to the external wiki): Deutsch – Français – Română – Suomi – Svenska – Tiếng Việt – Türkçe – فارسی

pptpclient is a program implementing the Microsoft PPTP protocol. As such, it can be used to connect to a Microsoft VPN network provided by a school or workplace.

Installing PPTP Client

PPTP Client is provided by the Template:Package Official package found in the official repositories.


To configure pptpclient you will need to collect the following information from your network administrator:

  • The IP or hostname of the VPN server
  • The name you wish to use for the tunnel.
  • The authentication (Windows) domain name. This is not provided or needed for certain networks.
  • The username you will use to connect.
  • The password you will use to connect.

Edit The options.pptp File

With your favorite text editor open Template:Filename. This file enables a lot of security for your VPN connection by default. If you have trouble connecting to your network, you can relax the options down. At a minimum, your Template:Filename file should contain:


Edit The chap-secrets File

Next, open or create the Template:Filename file. We will be storing your password in this file, so make sure that the permissions are set such that no-one besides root can read this file.

chmod 0600 /etc/ppp/chap-secrets

The file should have the following format:


Or, if your connection does not require a domain:


Simply replace each bracketed term in the examples with the appropriate value.

Note: If your password contains a special character such as "$" you should place the password in double-quotes.

Name Your Tunnel

With your favorite text editor create a Template:Filename file, where <TUNNEL> is the name you wish to use for your VPN connection. The file should look like this:

pty "pptp <SERVER> --nolaunchpppd"
remotename PPTP
file /etc/ppp/options.pptp
ipparam <TUNNEL>
Note: As before, if your connection does not require a domain, omit Template:Codeline from the file you create
Note: Template:Codeline is used to find <PASSWORD> in the Template:Filename File.

<SERVER> is the remote address of the VPN server, <DOMAIN> is the domain your user belongs to, <USERNAME> is the name you will use to connect to the server, and <TUNNEL> is the name of the connection.

Note: If you do not need MPPE support, you should remove the Template:Codeline option from this file and from Template:Filename

Making Your Connection

To make sure that everything is configured properly, as root execute:

# pon $TUNNEL debug dump logfd 2 nodetach

If everything has been configured correctly, the Template:Codeline command should not terminate. Once you are satisfied that it has connected successfully, you can terminate the command.

Note: As an additional verification you can run Template:Codeline and ensure that a new device, Template:Codeline, is available.

To connect to your VPN normally, simply execute:

# pon <TUNNEL>

Where <TUNNEL> is the name of the tunnel you established earlier. Note that this command should be run as root.


Once you have connected to your VPN, you should be able to interact with anything available on the VPN server. To access anything on the remote network, you need to add a new route to your routing table.

Note: Depending on your configuration, you may need to re-add the routing information every time you connect to your VPN.

For more information on how to add routes, you can read this article which has many more examples: PPTP Routing Howto

Split Tunneling

Packets with a destination of your VPN's network should be routed through the VPN interface (usually Template:Codeline). To do this, you create the route:

# ip route add dev ppp0

This will route all the traffic with a destination of 192.168.10.* through your VPN's interface, (Template:Codeline).

Route All Traffic

It may be desirable to route all traffic through your VPN connection. You can do this by running:

# ip route add default dev ppp0
Note: Routing all traffic through the VPN may result in slower over all connection speed because your traffic will be routed through the remote VPN before being routed normally.

Route All Traffic by /etc/ppp/ip-up.d

Note: All scripts in Template:Filename will called when the VPN connection is established.

# This script is called with the following arguments:
# Arg Name
# $1 Interface name
# $2 The tty
# $3 The link speed
# $4 Local IP number
# $5 Peer IP number
# $6 Optional ``ipparam'' value foo

route add default gw $4

named this script as Template:Filename in Template:Filename .

Note: This script currently uses Template:Package Official instead of Template:Package Official which the other examples use.


To disconnect from your VPN simply execute:

# poff <TUNNEL>

Where <TUNNEL> is the name of your connection.

Making A VPN Daemon and Connecting On Boot

You can create a simple daemon for your VPN connection by creating an appropriate Template:Filename script:

Note: As always, <TUNNEL> is the name of your tunnel. <ROUTING COMMAND> is the command you use to add the appropriate route to the routing table.
Note: The stop functionality of this script will not work if the Template:Codeline and Template:Codeline arguments are passed to Template:Codeline when pon is started. The reason for this is that the Template:Codeline script contains a bug when determining the PID of the specified Template:Codeline process if arguments were passed to Template:Codeline.

To resolve this issue, you can patch your Template:Filename file by making the following changes on line 93:

-PID=`ps axw | grep "[ /]pppd call $1 *\$" | awk '{print $1}'`
+PID=`ps axw | grep -E "[ /]pppd call $1 .*\$" | awk '{print $1}'`

. /etc/rc.conf
. /etc/rc.d/functions


[ -r /etc/conf.d/$DAEMON ] && . /etc/conf.d/$DAEMON

case "$1" in
   stat_busy "Starting $DAEMON"
   pon <TUNNEL> updetach persist &>/dev/null && <ROUTING COMMAND> &>/dev/null
   if [ $? = 0 ]; then
     add_daemon $DAEMON
     exit 1
   stat_busy "Stopping $DAEMON"
   poff <TUNNEL> &>/dev/null
   if [ $? = 0 ]; then
     rm_daemon $DAEMON
     exit 1
   $0 stop
   sleep 1
   $0 start
   echo "usage: $0 {start|stop|restart}"  
Note: We call Template:Codeline in the script with two additional arguments: Template:Codeline and Template:Codeline. The argument Template:Codeline makes pon block until the connection has been established. The other argument, Template:Codeline, makes the network automatically reconnect in the event of a failure. To connect at boot add @<TUNNEL>-vpn to the end of your Template:Codeline array in Template:Filename.


You can find more information about configuring pptpclient at their website: pptpclient website. The contents of this article where adapted from their Ubuntu How-To which also provides some hints on how to do things such as connecting on boot. These examples should be easy to adapt into daemons or other scripts to help automate your configuration.