Vpn connections
Configuring Software - VPN Connections
pptp client
You may need to connect to a VPN at your workplace or otherwise. Some of these VPNs use all software (such as Microsoft's pptp VPN connections) or a hardware device with a software client (such as nortel or cisco).
To connect to a Microsoft pptp vpn, you will need to ensure you have enabled the proper networking support in your kernel. Once you've got those requirements sorted out, you'll need to emerge the pptp client.
$ sudo emerge -av pptpclient
Once the emerge completes, there are a few files you will need to configure in order to get your VPN connection working properly. On this example, we'll use myVPN as the name of the vpn connection. Be sure to substitute that with your desired name. The first file we'll set up is the peers file.
$ sudo nano -w /etc/ppp/peers/myVPN
/etc/ppp/peers/myVPN
Make sure the file has the following directives. Be sure to change vpn.domain.com to the address of your vpn and user@domain.com with your username and domain.
pty "pptp vpn.domain.com --nolaunchpppd" name user@domain.com file /etc/ppp/options.myVPN require-mppe-128 usepeerdns
Now that the master peers file is configured, we can configure the options file.
$ sudo nano -w /etc/ppp/options.myVPN
/etc/ppp/options.myVPN
The following file contains most of the options you will need. The following configuration should work, but if your VPN is configured differently, you may have to experiment with the options in this file to establish a successful connection.
#pptp options for myVPN #lock the port lock # tunnel originates here so authorization not needed noauth # refuse eap - always results in auth failure without this refuse-eap #use this space to turn off unused protocols #nobsdcomp #nodeflate #mppe for kernel >= 2.6.15 #require-mppe-128 #mtu settings comment out if broken #mtu 1000 #mru 1000 #timeout #lcp-echo-failure 10 #lcp-echo-interval 1
Last but not least, we'll need to configure the chap-secrets file. This is where the connection information such as the password are stored.
$ sudo nano -w /etc/ppp/chap-secrets
/etc/ppp/chap-secrets
Set up your secrets file in the following way. Be sure to substitute username@domain.com with your username and domain, password with your password, and SERVER with your server.
# Secrets for authentication using CHAP # client server secret IP addresses username@domain.com SERVER password * SERVER username@domain.com password *
Once you have connected, you may have to add routes in order to tell your networking infrastructure how to handle requests to destinations on the other side of the ppp connection. This is done in the ip-up file.
$ sudo nano -w /etc/ppp/ip-up
/etc/ppp/ip-up
Use the following example for your configuration. The following adds a route to the 10.10.0.0/16 network on the other side of the pptp connection.
... route add -net 10.10.0.0 netmask 255.255.0.0 dev ppp0
You should now be able to connect to your VPN. To establish a connection
$ sudo pon myVPN
After a few moments, you should be able to see your connection in ifconfig.
$ sudo ifconfig
Your connection should appear something like this:
ppp0 Link encap:Point-to-Point Protocol
inet addr:10.10.3.126 P-t-P:10.10.3.131 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1396 Metric:1
RX packets:16 errors:0 dropped:0 overruns:0 frame:0
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:3
RX bytes:392 (392.0 B) TX bytes:116 (116.0 B)
To disconnect, enter the following:
$ sudo poff myVPN
It's not working!!
Fear not. You can add a few parameters to your tunnel activation command to get verbose debugging messages to find out what's wrong.
$ sudo pon myVPN debug dump logfd 2 nodetach
Cisco AnyConnect client
You will need to download and extract the AnyConnect client from whatever source makes it available. Navigate into the extracted folder, then enter the vpn folder.
$ cd vpn
Install the client using the bash script provided.
$ sudo bash vpn_install.sh
The client files will be installed to /opt/cisco/. In the anyconnect folder is where you'll find the client binaries, of importance are vpnui (used to start the GTK-based vpn client GUI) and vpnagentd (the UI and client will not run without this service running in the background).
The service doesn't integrate nicely into Gentoo's startup. After rebooting, you'll need to run it again before the UI will start, or simply reinstall the agent.
There is also a dependency for the GUI. If the client doesn't work from the desktop manager's shortcut, try running vpnui from the command line and note the missing library. This can be installed from portage, but I forget which one it is specifically...