Re: Debian作PPTP VPN服务器不能路由转发的问题
没仔细看，是从59.65.196.0/24没法访问到192.168.0.0/16这里。
你在vpn服务器从iptables做一个转发应该就可以了。
Feng Lu 写道:
> 各位好，再次打搅，小弟去年就遇到这个问题一直未找到解决办法（汗……）
>
> 利用 Debian + PPTP 作 VPN 服务，客户端能正常登录分配到合法的地址，并能
> 访问VPN服务器所在网段( 59.65.196.0/24 <http://59.65.196.0/24> )
> 但是无法访问VPN服务器外的网段（单位服务器属一个网段，全是公网地址，其
> 它网络设备――如交换机――和用户个人电脑都是内网地址 192.168.x.x）
> 这样的话就无法通过VPN远程管理交换机了，关键时候（内部网络故障）起不了作用
> 请帮忙分析是何原因，非常感谢！
>
> 我自己感觉是少配置了什么东西，但是在网上也没有找到相应的说明。
> 当时配置基本上是参照这两篇文章：http://pigtail.net/nicholas/pptp/
> http://www.yxyr.com/post/344.html
>
> 我的配置如下：
>
> # cat /etc/pptpd.conf
> ####...
> option /etc/ppp/pptpd-options
> ###....
> logwtmp
> ####...
> localip 59.65.196.63
> remoteip 59.65.196.250-254
>
> # cat /etc/ppp/pptpd-options
> # Authentication
> name pptpd
>
> # Encryption
> # Debian: on systems with a kernel built with the package
> # kernel-patch-mppe >= 2.4.2 and using ppp >= 2.4.2, ...
> # {{{
> refuse-pap
> refuse-chap
> refuse-mschap
> # Require the peer to authenticate itself using MS-CHAPv2 [Microsoft
> # Challenge Handshake Authentication Protocol, Version 2] authentication.
> require-mschap-v2
> # Require MPPE 128-bit encryption
> # (note that MPPE requires the use of MSCHAP-V2 during authentication)
> require-mppe-128
> # }}}
>
> # Network and Routing
>
> # If pppd is acting as a server for Microsoft Windows clients, this
> # option allows pppd to supply one or two DNS (Domain Name Server)
> # addresses to the clients. The first instance of this option
> # specifies the primary DNS address; the second instance (if given)
> # specifies the secondary DNS address.
> # Attention! This information may not be taken into account by a Windows
> # client. See KB311218 in Microsoft's knowledge base for more information.
> #ms-dns 10.0.0.1
> #ms-dns 10.0.0.2
>
> # If pppd is acting as a server for Microsoft Windows or "Samba"
> # clients, this option allows pppd to supply one or two WINS (Windows
> # Internet Name Services) server addresses to the clients. The first
> # instance of this option specifies the primary WINS address; the
> # second instance (if given) specifies the secondary WINS address.
> #ms-wins 10.0.0.3
> #ms-wins 10.0.0.4
>
> # Add an entry to this system's ARP [Address Resolution Protocol]
> # table with the IP address of the peer and the Ethernet address of this
> # system. This will have the effect of making the peer appear to other
> # systems to be on the local ethernet.
> # (you do not need this if your PPTP server is responsible for routing
> # packets to the clients -- James Cameron)
> proxyarp
>
> # Debian: do not replace the default route
> nodefaultroute
>
> # Miscellaneous
>
> # Create a UUCP-style lock file for the pseudo-tty to ensure exclusive
> # access.
> lock
>
> # Disable BSD-Compress compression
> nobsdcomp
>
> # cat /etc/sysctl.conf
> # Uncomment the next line to enable packet forwarding for IPv4
> net.ipv4.conf.default.forwarding=1
>
> --
> 0000
> MININEWS.INFO <http://MININEWS.INFO>
> Mininews是一个业界微新闻站点，添加xiaohuabot@hotmail.com
> <mailto:xiaohuabot@hotmail.com>为MSN好友
> 做最敏捷的媒体，人人都可以是记者，关注身边正在发生的事。[M]
Reply to: