http://blog.kamens.brookline.ma.us/~jik/wordpress/?p=71

« Another positive customer service experience

I’m hiring great IT Engineers »

Starting a VPN automatically on boot with Windows XP

I recently needed to figure out how to make a Windows XP machine connect to a particular VPN automatically on reboot, before anyone logged into the machine. I eventually managed to assemble bits and pieces of information floating around the net into a working solution to the problem, but it wasn’t completely addressed in any single location, so I thought I’d stick the details in my blog for other people to Google and use (if you found this blog entry useful, please add a comment and let me know!).

The first thing I tried was to look for a property I could set on the VPN network connection to tell Windows that I wanted this connection to start automatically when the machine boots. I couldn’t find one; I doubt there is one.

After that, I considered setting the “Set as Default Connection” checkbox for the connection, but I couldn’t find any documentation of exactly what that would do, and I was worried that another user of the machine might muck with that setting, perhaps with good reason.

All I could think of at this point was to write a batch file that would start the VPN and then tell Windows to run that batch file on reboot.

The key to the first part, starting a VPN from a batch file, is a Windows command-line tool called “rasdial”. If you run “rasdial connection-name username password” from the command line or a batch file, the specified connection will be started with the specified username and password. Dandy!

The key to the second part, getting Windows XP to run a batch file during reboot, is a utility called AutoExnt that Microsoft distributes for free but doesn’t include with Windows. The utility is described at http://support.microsoft.com/kb/243486/en-us, and although that article doesn’t mention Windows XP, it works just fine for XP as well. You can download it from http://download.microsoft.com/ by searching for “Windows Server 2003 Resource Kit Tools”, which may or may not still be available at http://www.microsoft.com/downloads/details.aspx?FamilyID=9d467a69-57ff-4ae7-96ee-b18c4790cffd when you read this blog entry. This should give you a file called rktools.exe, which when executed will install the tools on your hard disk, including the three files you need which are mentioned in the KB article referenced above.

With this knowledge in hand, here’s what you do to start a VPN when the machine boots:

1. Put “rasdial connection-name username password” in the file c:\windows\system32\autoexnt.bat which you create.
2. Copy the files autoexnt.exe, servmess.dll, and instexnt.exe from the resource kit tools folder you unpacked from the download mentioned above into c:\windows\system32.
3. Run “instexnt install”.

That’s it!


iptables -P INPUT ACCEPT
iptables -F INPUT
iptables -P OUTPUT ACCEPT
iptables -F OUTPUT
iptables -P FORWARD ACCEPT
iptables -F FORWARD
iptables -t nat -F
iptables -A INPUT -p tcp -i eth1 --dport 22 -j ACCEPT
iptables -A INPUT -p udp -i eth1 --dport 22 -j ACCEPT
iptables -A INPUT -p tcp -i eth1 --dport 80 -j ACCEPT
iptables -A INPUT -p udp -i eth1 --dport 80 -j ACCEPT
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 3389 -j DNAT --to 192.168.10.2:3389
iptables -N pptp
iptables -A pptp -p tcp --destination-port 1723 --dst 192.168.10.2 -j ACCEPT
iptables -A pptp -p 47 --dst 192.168.10.2 -j ACCEPT
iptables -I FORWARD -j pptp
iptables -t nat -N pptp
iptables -t nat -A pptp -i eth1 -p tcp --dport 1723 -j DNAT --to 192.168.10.2:1723
iptables -t nat -A pptp -i eth1 -p 47 -j DNAT --to 192.168.10.2
iptables -t nat -A PREROUTING -j pptp
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE


http://martybugs.net/smoothwall/vpn.cgi

vpnserver="172.16.0.2”
/sbin/iptables -N pptp
/sbin/iptables -A pptp -p tcp –destination-port 1723 –dst $vpnserver -j ACCEPT
/sbin/iptables -A pptp -p 47 –dst $vpnserver -j ACCEPT
/sbin/iptables -I FORWARD -j pptp
/sbin/iptables -t nat -N pptp
/sbin/iptables -t nat -A pptp -i $RED_DEV -p tcp –dport 1723 -j DNAT –to $vpnserver:1723
/sbin/iptables -t nat -A pptp -i $RED_DEV -p 47 -j DNAT –to $vpnserver
/sbin/iptables -t nat -A PREROUTING -j pptp

Install PPTP and the pptpconfig GUI using the following commands:

# rpm -Uvh http://pptpclient.sourceforge.net/yum/stable/fc6/pptp-release-current.noarch.rpm
# yum –enablerepo=pptp-stable install pptpconfig

http://pptpclient.sourceforge.net/howto-fedora-core-6.phtml 

http://infohost.nmt.edu/tcc/help/pubs/vpnfedora/configuration.html

able of Contents

1. Overview: A remote access method for Linux

2. Installation for Fedora Core 2

3. Configuration

4. Connecting

5. Closing the connection

1. Overview: A remote access method for Linux

This document describes how to install PPTP Client on a Fedora Core 2 system. This client allows you to connect to a remote system reliably and securely.

This connection is sometimes referred to as a tunnel to the remote system.

This information was adapted from documentation located on the PPTP Client website. Please see this site for installing PPTP Client on Linux systems other than Fedora Core 2, but follow the configuration steps below.

The process involves installing two products (MPPE and then PPTP), followed by configuration. Later sections will describe the process of connecting and disconnecting.

This publication is available in Web form and also as a PDF document. Please forward any comments to tcc-doc@nmt.edu.

Next: 2. Installation for Fedora Core 2.

2. Installation for Fedora Core 2

Each of the links below takes you to a page that allows you to select a mirror site for downloading an RPM file. To download, click on that link, then click on one of the mirror site icons. (Use left-click in both cases. Right-clicking will get you a Web page, not an RPM.)

1. Download the dkms rpm.

   Install it using this shell command:

   rpm --install dkms-1.12-2.noarch.rpm

2. Download the kernel_ppp_mppe dkms rpm.

   Install it using:

   rpm --install kernel_ppp_mppe-0.0.4-2dkms.noarch.rpm

3. Test to make sure the MPPE loads correctly:

   modprobe ppp-compress-18 && echo success

   It should print “success”.

4. Download the ppp rpm.

   Upgrade ppp with this shell command:

   rpm --upgrade ppp-2.4.3-0.cvs_20040527.4.fc2.i386.rpm

5. Download the PPTP client program.

   Install it:

   rpm --install  pptp-linux-1.5.0-1.i386.rpm

6. Download the configuration program interpreter php-pcntl rpm.

   Install it:

   rpm --install  php-pcntl-4.3.8-1.i386.rpm

7. Download the configuration program GTK+ interface php-gtk-pcntl rpm.

   Install it:

   rpm --install  php-gtk-pcntl-1.0.0-2.i386.rpm

8. Download the configuration program pptpconfig rpm.

   Install it:

   rpm --install  pptpconfig-20040722-0.noarch.rpm

Next: 3. Configuration

3. Configuration

These steps will have to be done only once.

1. As root, run pptpconfig. A window will appear:

   

2. Enter the following information into the Server tab:

   Name:

   Enter a name for this connection, such as “TCC VPN”.

   Server:

   Enter “vpn.nmt.edu”.

   Domain:

   Leave this blank.

   Username:

   Enter your TCC username.

   Password:

   Enter your TCC password.

3. Select All to Tunnel in the Routing tab:

   

4. In the DNS tab:
   • Under “Servers:”, enter these two addresses:

     129.138.4.138 129.138.250.10

   • Under “Options:”, enter “search nmt.edu”.

   

5. In the Encryption tab:
   • Select Refuse 40-bit Encryption.
   • Select Refuse Stateless Encryption.

   

6. In the Miscellaneous tab, add the option “mtu 1444” to the text field for “Options for pppd, see 'man pppd'”.

   

7. Click on Add, and the tunnel will appear in the PPTP Client Tunnel List.

Next: 4. Connecting

4. Connecting

To make a VPN connection to the TCC:

1. As root, bring up the pptpconfig application as described above.
2. Right-click on the TCC tunnel in the “PPTP Client Tunnel List”, and select Start from the popup menu.

   

   Alternatively, you can click on the TCC tunnel in the list and then click the Start button.

3. A window appears, showing the progress of the connection. You may close this window at any time without closing the connection.

   

4. If the connection was successful, the status of the VPN will show as “Running”. Once the connection is running, you can close the main window without closing the connection.

   

Once you have opened your VPN tunnel, your machine is effectively on the TCC network. You can use TCC machines in these ways, and more:

• To log in to a TCC system, use this command:

  ssh hostname

  where hostname is the name of the system, such as rainbow.

• Your Web browser can access any Web page on the Internet.
• You can transfer files with ftp (File Transfer Protocol) or scp (Secure Copy). See the man pages for ftp and scp.

Next: 5. Closing the connection

5. Closing the connection

If you closed the pptpconfig window after you established the connection, run pptpconfig as root to bring the window back.

To close the connection, select the VPN item from the list and click the Stop button.

PPTP (1723/tcp and 47/ip):

/sbin/iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 1723 -j DNAT --to 192.168.0.5
/sbin/iptables -t nat -A PREROUTING -i eth1 -p 47 -j DNAT --to 192.168.0.5

src:

http://www.diver.net/capture/www.impsec.org/linux/masquerade/ip_masq_vpn.html