I wanted easy/secure access to my home network. I had a Raspberry Pi sat in my office doing nothing and this would make a nice project for it.
I had a play around with the Pi when it first came out (this Pi came from the initial batch that had been released) so the SD card had a very old version of Raspbian linux. So I went over to Raspbian and downloaded the latest image and installed in onto the SD card. I used RPI SD card builder as I was using a Mac but this guide will help if you are running other operating systems.
Once you have your Pi up and running you need to install Point-to-Point Tunnelling (PPTP) on your Pi.
sudo apt-get install pptpd
This will install the neccessary packages. Then you need to setup
Now you need to edit the PPTP configuration file which is located
you need to add the following lines to the bottom of this file
The localip setting is the IP address of the Pi. To avoid having to change this value it is worth either setting your home route to always give out this IP address. If this is not possible then you need to configure the Pi for static IP (more on this later).
The remoteip setting is the set/range of IP addresses which will be issued to clients that connect to your VPN. In the above example the setting specifies that 50 IP addresses will be available. You can specify IP addresses in a comma separated list or in ranges (or combination). So the following is valid
Once you have got these settings how you want you need to edit the file
Find the lines the lines (about half way down the file)
These lines specify the DNS server that the clients connected to your VPN will use. If you have machines in your internal home network which can be addressed by name rather than IP then you will need to change this setting to your internal DNS gateway (probably your routers address). But if you don't need this facility then set these values to Google's Public DNS server.
So now the settings should look like this (I am using Google's DNS)
You don't need two lines, so if you are using your internal router for this setting then you would only require one ms-dns setting.
Now go to the bottom of the file and add the following lines
You may find some of these settings already there, possibly commented out (have a # character in front). If so simply add the settings you don't have and comment out any that you need to.
Now we need to add users to our VPN setup. Edit the file
This file will probably look like this
# Secrets for authentication using CHAP # client server secret IP addresses
Modify this file so it looks like this (change your username and password to what you want)
# Secrets for authentication using CHAP # client server secret IP addresses< james * testpassword *
This gives this user full access to your home network.
Now you need to modify the Raspberry Pi's internal firewall/routing tables by editing the file
and putting the following towards the top of the file below the comments.
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
sudo iptables -I FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
Now the Pi will know how to correctly route packets coming through the VPN.
Now if you don't want to setup static ip for your Pi go straight to the bottom.
Edit the file
and find the line
iface eth0 inet dhcp
and comment it out. You then need to manually add the settings which normally would come from your DHCP server in your router.
I added the following
iface eth0 inet static address 192.168.1.2 netmask 255.255.255.0 gateway 192.168.1.1
to my file. Address is the static IP you would like the Pi to have. This setting needs to match the localip setting in the /etc/pptp.conf file. Use the netmask that you router was already using and set the gateway setting to be the address of your router.
Now you need to configure your router to forward all traffic from the external port 1723 to your Pi on the same port. Follow guidance from your router provider on how to do this as it varies from router to router.
Reboot your Pi and configure your devices to use the VPN. You will need to know the external IP address of your internet connection which can be found either in your router's settings or by visiting http://www.whatsmyip.org on a computer from inside your home network.