» ppptp в Linux

При попытке коннекта отваливается с ошибкой №691

Код:
Apr 22 19:48:13 localhost pptpd[1719]: CTRL: Client 212.91.107.53 control connection started
Apr 22 19:48:13 localhost pptpd[1719]: CTRL: Starting call (launching pppd, opening GRE)
Apr 22 19:48:14 localhost kernel: CSLIP: code copyright 1989 Regents of the University of California
Apr 22 19:48:14 localhost kernel: PPP generic driver version 2.4.2
Apr 22 19:48:14 localhost pppd[1720]: pppd 2.4.2 started by root, uid 0
Apr 22 19:48:14 localhost pppd[1720]: Using interface ppp0
Apr 22 19:48:14 localhost pppd[1720]: Connect: ppp0 <--> /dev/pts/1
Apr 22 19:48:44 localhost pppd[1720]: LCP: timeout sending Config-Requests
Apr 22 19:48:44 localhost pppd[1720]: Connection terminated.
Apr 22 19:48:44 localhost pppd[1720]: Exit.
Apr 22 19:48:44 localhost pptpd[1719]: GRE: read(fd=5,buffer=804e6e0,len=8196) from PTY failed: status = -1 error = Input/output error
Apr 22 19:48:44 localhost pptpd[1719]: CTRL: PTY read or GRE write failed (pty,gre)=(5,6)
Apr 22 19:48:44 localhost pptpd[1719]: CTRL: Client 212.91.107.53 control connection finished

L_S_V похоже на фаерволл закрыт gre - протокол номер 47 , открой его и заодно проверь порт 1723 на открытость.


Добавлено:
L_S_V или на той стороне закрыто .

ipmanyak
ni-ftp 47/tcp #NI FTP
ni-ftp 47/udp #NI FTP
??????

Поскажите как в iptables сделать правило равносильное этому из ipfw?
add pass tcp from any to 10.10.10.10 1723 setup in recv fxp0

Linux VPN Masquerade http://www.impsec.org/linux/masquerade/ip_masq_vpn.html
#!/bin/bash
# Load the NAT module (this pulls in all the others).
/sbin/modprobe iptable_nat
# In the NAT table (-t nat), Append a rule (-A) after routing
# (POSTROUTING) for all packets going out ppp0 (-o ppp0) which says to
# MASQUERADE the connection (-j MASQUERADE).
/usr/local/sbin/iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
# Turn on IP forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward
Server masquerade for PPTP also works with the default masquerade code. Add the following rules:
PPTP (1723/tcp and 47/ip):
/sbin/iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 1723 -j DNAT --to 192.168.0.5
/sbin/iptables -t nat -A PREROUTING -i eth1 -p 47 -j DNAT --to 192.168.0.5

...where 192.168.0.5 is the local-network IP address of the PPTP server. I have not had any reports regarding IPsec server masquerade.

Добавлено:
это если сервер или клиент сидят в локалке за натом , если нет то просто открой на входе
iptables -A INPUT -p tcp --dport 1723 -j ACCEPT
iptables -A INPUT -p 47 -j ACCEPT

В FAQ сукины дети! (ц) Jackill

http://iptables-tutorial.frozentux.net/iptables-tutorial.html

Хм, с линуховой стороны всё ОК.
Оказалась трабла с фрюшного гейта на другой стороне.
Там у меня так
00500 63905 4251415 allow ip from me to any dst-port 21,22,25,43,53,110,80,443,465,995,1025-65535 out xmit rl0
00600 42056 8892874 allow ip from any 21,22,25,53,43,110,80,443,465,995,1025-65535 to me in recv rl0
и ещё добавил так...
10000 0 0 allow ip from any 47 to me via rl0
10000 0 0 allow ip from me to any dst-port 47 via rl0

Добавлено:
но неработает

ipfw add permit tcp from any to ${pppip} pptp in via ${extif} setup
    ipfw add permit gre from any to ${pppip}
    ipfw add permit gre from ${pppip} to any
    ipfw add permit gre from ${fwip} to any out via ${extif}


have added the following rules to my firewall.

pass tcp from any 1723 to ${internalnetwork)
pass tcp from any 1723 to ${externalip}
pass tcp from ${internalnetwork} to any 1723
pass tcp from ${externalip} to any 1723

pass gre from any to ${internalnetwork}
pass gre from ${internalnetwork) to any
pass gre from any to ${externalip}
pass gre from ${externalip} to any

natd is also running.

# Allow connections on pptp.
$fwcmd add pass tcp from any 1723 to any 1024-65535 out xmit ${oif}
$fwcmd add pass tcp from any 1024-65535 to any 1723 in recv ${oif}
$fwcmd add pass 47 from any to any out xmit ${oif}
$fwcmd add pass 47 from any to any in recv ${oif}