Chapter 6. PPTP/PPPoA configuration

Revision History
Revision 0.22002-04-14JN
initial revision

Table of Contents

Step 1: declare the ppp and the pptp packages
Step 2: declare the ppp modules
Step 3: configure ppp
Step 4: configure your interfaces file
Step 5: configure Shorewall
Step 7: reboot...


We assume here that you want to connect your LEAF router to the Internet via an Alcatel SpeedTouch home ADSL modem which supports both PPPoE and PPPoA connections. The PPPoE connection is covered in another section. For the PPPoA connection, we assume that your modem is connected to a dedicated NIC as eth0 and will communicate with your router through the pptp protocol. What is described here corresponds to section 3.2.5 of the DSL How-To document. The traffic to your internal network goes through eth0 while access to the Internet via PPPoA goes through ppp0.

The PPP-Howto, the PPTP-Client project and the DSL-Howto are two useful references for this section.

Thanks to Eric de Thouars who suggested the required adjustment to Shorewall for this setup to work properly. Comments on this section should be addressed to its maintainer: Jacques Nilo .

Step 1: declare the ppp and the pptp packages

Boot a Bering floppy image. Once the LEAF menu appears get access to the linux shell by (q)uitting the menu. Edit the syslinux.cfg file and REPLACE the pump entry by ppp,pptp in the LRP= list of packages to be loaded at boot. Check the Bering installation guide to learn how to do that.

Your syslinux.cfg file will then look like (adjust to your tastes):

display syslinux.dpy
timeout 0
default linux initrd=initrd.lrp init=/linuxrc rw root=/dev/ram0 boot=/dev/fd0u1680:msdos
	PKGPATH=/dev/fd0u1680 LRP=root,etc,local,modules,iptables,ppp,pptp,keyboard,shorwall,ulogd,dnscache,weblet


The last two lines ("default linux ... dnscache,weblet") must be typed as a single one in syslinux.cfg

The ppp package is provided on the standard Bering floppy. The pptp.lrp package is available here. Check the Bering installation guide.

Step 2: declare the ppp modules

In order to have a PPTP/PPPoA connection working, you need to have ppp support enabled through the appropriate kernel modules. You also need to declare the driver(s) module(s) of your network card(s). In the following example, we assume that both ethernet interfaces are provided through a standard ne 2000 PCI card.

All the modules which are necessary for a PPTP/PPPoA connection are provided on the standard Bering floppy. You just need to "declare" them since they are not loaded by default. As far as your network cards are concerned, the most popular driver modules are provided in /lib/modules but you might need to download the one corresponding to your own hardware from the Bering modules download area. Refer to the Bering installation guide to learn how to do that.

To declare your modules, go to the LEAF Packages configuration menu and choose modules. Enter 1) to edit the /etc/modules file and enter the following information:

# 8390 based ethernet cards

# Modules needed for PPTP/PPPoA connection

# Masquerading 'helper' modules


The /etc/modules file provided in the Bering distro is already setup with those entries commented out. Just remove the leading # sign to activate the corresponding module.

Backup the modules.lrp package.

Step 3: configure ppp

Connection with your ISP will be handled by PPP. The PPP Howto document will give you very detailed information about this protocol and how to set-up its numerous parameters.

Through the LEAF packages configuration menu get access to ppp configuration. The following menu will show-up

                        ppp configuration files

        1) ISP pppd options
        2) ISP login script
        3) System wide pppd options
        4) chap secret
        5) pap secret
        6) pppd daemon script

  q) quit

Enter 1) and 2) and empty out the corresponding files completely

Enter 3) allows you to adjust the parameter of your ppp connection through the /etc/ppp/options file. This file must contain:

name "ISPUserID"

Edit either the CHAP (Entry 4) or PAP (Entry 5) option to set up how your system authenticates.

For PAP authentication, choose the PAP option and add a line saying "<ISPUserID> * <ISPUserPassword> to the bottom of the file. <ISPUserID> is the same entry that you made in Entry 3) - the "System wide pppd options" file. The <ISPUserPassword> entry is self-explanatory. The "*" can be replaced with the IP address or name of the server you are dialling into if you know it. Usually, an asterisk is sufficient.

If you want to authenticate using CHAP, add the same entry to the CHAP item instead.

Backup the ppp.lrp package.

Step 4: configure your interfaces file

Trough the LEAF configuration menu type 1 to access to the network configuration menu and 1 again to edit your /etc/network/interfaces file. Enter the following information:

auto lo eth0 eth1

iface lo inet loopback

iface eth0 inet static
	masklen 24
	up pptp

iface eth1 inet static
	masklen 24

In this /etc/network/interfaces file the lo, eth0 and eth1 interfaces are brought up automatically when the ifup -a statement is executed at boot time by the /etc/init.d/networking script.

The "iface eth0 inet static" section defines the external address of the router and says:

  • Bring up eth0 at address

  • Execute the pptp command once eth0 is up to establish the PPTP/PPPoA connection.

The "iface eth1 inet static" defines the internal address of the router.

Backup the etc.lrp package.

Step 5: configure Shorewall

Through the LEAF packages configuration menu, choose shorwall and check the three following files:

A/ The interfaces file (entry 3) defines your interfaces. Here connection to the net goes through ppp0. So we must set:

net     ppp0            -	        routefilter
adsl	eth0
loc     eth1            detect          routestopped


Do not forget the "-" under the BROADCAST heading for the net/ppp0 entry.

B/ Add the following line to /etc/shorewall/policy. Now the policy for traffic between the firewall and the adsl zone is set to ACCEPT:

fw      adsl    ACCEPT

C/ The masq file (entry 8). With a dial-up modem setup it should look like:

#INTERFACE              SUBNET
ppp0                    eth1

D/ You may also need to edit the config file (entry 12) to adjust the CLAMPMSS variable to "yes":

# Set this variable to "Yes" or "yes" if you want the TCP "Clamp MSS to PMTU"
# option. This option is most commonly required when your internet
# interface is some variant of PPP (PPTP or PPPoE). Your kernel must
# If left blank, or set to "No" or "no", the option is not enabled.

Backup the shorwall.lrp package.

Step 7: reboot...

Your modem connection should be established automatically. Type plog to check the login sequence with your ISP. If there is no output check /var/log/syslog to get a clue on potential problems.