PPTP VPN with MPD and PF on FreeBSD

And here’s another thing I posted 4 years ago (reposted with backdating in 2016) about something I’ve totally forgotten! Could very well be useful.

Surfing the internet on public wifi is not secure. Anyone could be snooping on your communication. I’ve a computer running FreeBSD 9.0 that I use for many things and I’ve recently added VPN to one of those things. I imagine you could use other BSDs, Linux, or OS X for this also. I imagine even Windows could do it.

One thing I’d been doing was using the FreeBSD server for SSH tunneling for privacy but VPN is simpler from the end user standpoint since clients just support it without command line magic. I ended up setting up a PPTP VPN on FreeBSD using MPD and PF. You might hear that PPTP is not a secure VPN. Well, from lots of surfing it seems like PPTP is secure enough as long as you use the 2nd version (the first version is insecure) and have a good password. If you aren’t a bank or other organization needing ultimate security it’s likely safe enough and much better than not using any VPN.

It took me a while to figure this out so I thought I’d write what I needed to do here for posterity. The main thing was I need to make the IP range to a fake range as this is the range MPD sets up. Then I needed to setup PF to forward from the fake ip range network to the real network which was the IP of the FreeBSD server. Using PF messed up my IPFilters firewall but the server is behind a router firewall so doesn’t need IPFilter anyhow.

Here’s some pertinant parts of mpf.conf:

startup:

        # configure mpd users

        set user admin_username admin_password admin

        # configure the console

        set console self 0.0.0.0 5005

        set console open

        # configure the web server

        set web self 0.0.0.0 5006

        set web open

pptp_server:

# Define dynamic IP address pool. <This is the fake range>

      set ippool add pool1 172.16.0.1 172.16.0.50

# Create clonable bundle template named B

        create bundle template B

        set iface enable proxy-arp

        set iface idle 1800

        set iface enable tcpmssfix

        set ipcp yes vjcomp

# Specify IP address pool for dynamic assigment.  <This is the real local address of the BSD machine>

        set ipcp ranges 192.xxx.x.xx/32 ippool pool1

        set ipcp dns 208.67.222.222    #don’t know if it matters but this is openDNS

# The five lines below enable Microsoft Point-to-Point encryption

# (MPPE) using the ng_mppc(8) netgraph node type.

        set bundle enable compression

        set ccp yes mppc

        set mppc yes e40

        set mppc yes e128

        set mppc yes stateless

# Create clonable link template named B

        create link template L pptp

# Set bundle template to use

        set link action bundle B

# Multilink adds some overhead, but gives full 1500 MTU.

        set link enable multilink

        set link yes acfcomp protocomp

        set link no pap chap eap

        set link enable chap

        set link keep-alive 10 60

# Enable utmp/wtmp logging

        set auth enable system-acct

# We reducing link mtu to avoid GRE packet fragmentation.

        set link mtu 1460

# Configure PPTP <real local address again>

        set pptp self 192.xxx.x.xx

# Allow to accept calls

        set link enable incoming