Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I know there are many tutorials on the net for setting up VPN client and server.

I you find one that is simple/short, I am interested only in the server part.

For client, I will use OS X so I prefer a solution that uses L2TP over IPsec or PPTP because I suppose Cisco IPsec would cost something.

I don't want to spent too many hours setting it up. You know, maybe someone already made a setup script :)

Note: I am using an EC2 micro instance running Ubuntu 12.04 on it.

share|improve this question
Note: CISCO IPSec can be achieved via StrongSwan and a lot of configuration, but it's tricky. PPTP is not secure anymore. ANd L2TP over IPSec requires both L2TP and IPSec configuration. Pick at your leisure, although my answer explains PPTP – Thomas W. Jun 3 '15 at 16:38
up vote 19 down vote accepted

PPTP via PoPToP is easy

  1. apt-get install pptpd
  2. edit /etc/pptpd.conf and set the remoteip option to a range on your network that is NOT served by your DHCP server.
  3. edit /etc/ppp/chap-secrets and add a username and password


vpnuser pptpd vpnpassword *

This is all it takes to setup pptp. Now test it with your OS X client.

share|improve this answer
I'm also wondering which localip and remoteip values are the safest, considering that I'm going to connect to this server from any location. Definetly the default values with 192.168.0. and 192.168.1. are probably one of the worst possible. – sorin May 12 '12 at 11:56
May 12 13:28:06 zork pppd[9447]: Plugin /usr/lib/pptpd/ loaded. May 12 13:28:06 zork pppd[9447]: pppd 2.4.5 started by root, uid 0 May 12 13:28:06 zork pppd[9447]: Using interface ppp0 May 12 13:28:06 zork pppd[9447]: Connect: ppp0 <--> /dev/pts/3 May 12 13:28:36 zork pppd[9447]: Hangup (SIGHUP) May 12 13:28:36 zork pppd[9447]: Modem hangup May 12 13:28:36 zork pppd[9447]: Connection terminated. May 12 13:28:36 zork pppd[9447]: Exit.It doesn't work yet! Your guide is incomplete (yet) ;) – sorin May 12 '12 at 13:30
Yeah this does not work. – bkerensa Jun 7 '13 at 19:25
didn't work for me – Tyler Gillies Sep 15 '13 at 7:01
@SorinSbarnea those ips are private and never go over the internet, so I don't know what you mean by "safest". You'll have best luck if they aren't the same IP range as the cafe, or workplace from which you are connecting. Try 192.168.42.* :) – Jay _silly_evarlast_ Wren Dec 16 '13 at 20:31
up vote 72 down vote

I used this guide to set up a PPTP VPN server on my Ubuntu 12.04 server.

To summarize the main points in the link, though:

1: Install pptpd and ufw. iptables can be used in place of ufw, but for the sake of easiness, ufw is better if you don't know iptables.

sudo apt-get install pptpd ufw

2: Open the ports needed. The guide suggests 22 (SSH) and 1723 for the pptp vpn.

sudo ufw allow 22
sudo ufw allow 1723
sudo ufw enable

3: Edit /etc/ppp/pptpd-options. Open the file with your favorite editor (mine's nano, so the command for me is sudo nano /etc/ppp/pptpd-options), and comment out these lines by putting a # before them, if you want this to work universally on all OSes:


You can comment this line if you want to disable encryption: require-mppe-128

4: While editing /etc/ppp/pptpd-options, add DNS servers for the VPN. This example uses OpenDNS servers:


5: Edit /etc/pptpd.conf. Open the file with your favorite editor (mine's nano, so the command for me is sudo nano /etc/pptpd.conf). You need to add the local VPN IPs for the system, so add:


If your system is a VPS, use the public IP for "localip". If it is not and is on a local network, use your computer's network IP. Use different IPs and ranges if these IPs exist on your subnet! If you don't know your public IP of your VPS, find it by running dig +short

6: Edit /etc/ppp/chap-secrets. Open the file with your favorite editor (mine's nano, so the command for me is sudo nano /etc/ppp/chap-secrets), and add the auth data.
The format for /etc/ppp/chap-secrets is:

[Username] [Service] [Password] [Allowed IP Address]

An example would be: sampleuser pptpd samplepassword *

7: Restart pptpd. Run this command in terminal: sudo /etc/init.d/pptpd restart

8: Edit /etc/sysctl.conf. Open the file with your favorite editor (mine's nano, so the command for me is sudo nano /etc/sysctl.conf). Un-comment the following line (by removing the # at the beginning of it) in /etc/sysctl.conf: net.ipv4.ip_forward=1
Reload the configuration: sudo sysctl -p

9: This step assumes you have ufw.
Edit /etc/default/ufw and change the option DEFAULT_FORWARD_POLICY from DROP to ACCEPT

10: This step assumes you have ufw.
Edit /etc/ufw/before.rules, and add the following either at the beginning of /etc/ufw/before.rules or just before the *filter rules (recommended):

# NAT table rules

# Allow forward traffic to eth0

# Process the NAT table rules

If you have kernel version 3.18 and newer, also add the following lines before the # drop INVALID packets ... line:

-A ufw-before-input -p 47 -j ACCEPT

11: Restart the firewall, to refresh the rule sets and to apply the rules we added to the /etc/ufw/*.rules files: sudo ufw disable && sudo ufw enable

Warning: If you have other ports you need open, such as for HTTPS if your server hosts a website, you need to individually add those ports to the allowed list with sudo ufw allow <PORT>

share|improve this answer
Now what the heck do I do :D I've got that working on the server, no idea how to connect to it lol – Jamie Hutber Jul 2 '14 at 22:17
@Jamie There's a ton of other documents and entries here on Ask Ubuntu on connecting to a VPN not to mention documentation inside Network Manager. This question only covers setting up the VPN, and the server side. NOT the connecting to it part. – Thomas W. Jul 2 '14 at 22:18
:D super fast response :D I think I may have worked it out, I must have just set something incorrectly. This said ufw is active and allowing most ports. I will play with iptables see if this gets me anyway – Jamie Hutber Jul 2 '14 at 22:35
@Jamie I can give you iptables commands to use when I get home of you prefer iptables to ufw. – Thomas W. Jul 2 '14 at 22:36
iptables/netfilter is used with ufw, ufw is just nicer with rules and commands handling for the end users. – Thomas W. Jul 2 '14 at 23:19

PPTP VPN on Ubuntu 12.04 Example

Here is a quick tutorial to set up a basic PPTP VPN server on Ubuntu 12.04.

Install Necessary Packages

                          sudo apt-get install ppp pptpd

Configure PPTP IP Ranges on the Server

                          sudo nano /etc/pptpd.conf

Add the following lines in end


This sets up the PPTP server to use IP while distributing the IP range to to PPTP clients. Change these as you wish as long as they are private IP addresses and do not conflict with IP addresses already used by your server.

Configure DNS Servers to Use When Clients Connect to this PPTP Server

                          sudo nano /etc/ppp/pptpd-options

Modify OR Add the following lines in end


Create a PPTP User

                          sudo nano /etc/ppp/chap-secrets

Append a line at the bottom so your file looks something like:

                          # client    server  secret          IP addresses
                          test        pptpd   abcd1234        *

Configure NAT for PPTP Connections

Without this step you will be able to connect but your connection will not be able to load any web connection from this server.

                          sudo nano /etc/rc.local

Add the following to the bottom right before “exit 0” line:

                          iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Assuming eth0, you can use ifconfig to check network name.

Enable IPv4 forwading:

                          sudo nano /etc/sysctl.conf

Uncomment the following line:


Then reload the configuration:

                          sudo sysctl -p

Reboot your VPS and everything should work swimmingly from any PPTP client.

Client side configuration

For Mac, make sure you added PPTP VPN connection. Besides that you only need to setup server address, account name, and password in authentication settings. No pain here.

For Linux, NetworkManager to add VPN connections. Make sure you added PPTP VPN connection. And the configuration I use is here:

How To Debug and Fix PPTP/VPN Client Connection

enter image description here

And for Windows

enter image description here

share|improve this answer
Does this method also work on Ubuntu 12.04 non-server edition? What IP number the client has to use to connect to this VPN network? – Rasoul Aug 29 '13 at 14:55
Yes it is for non-server edition also, You have to use server ip on client to connect to vpn @Rasoul – Qasim Aug 30 '13 at 2:42
Doesn't work, Ubuntu server 13.04. Client stuck looking for DNS. – knutole Nov 12 '13 at 2:35
@knutole check that your IPTables rules are routing properly. Make sure you have the en0 interface and it's not named something else. You should see a public IP address listed. – Nick Woodhams Nov 20 '13 at 6:35
ok, so, in your example which ip is server ip? ? Then in the Ubuntu network manager the client would list as the Gateway? – dranxo Oct 13 '14 at 23:50

The other answers on this thread were only partial answers in my case. Here's what worked for me on Ubuntu 12.04.3

sudo apt-get install pptpd

Append the following to /etc/pptpd.conf (IP Address does not matter, this is only IP Addresses for your ppp0 interface.)


Add DNS Servers to /etc/ppp/pptpd-options


Enable IP Forwarding

sudo vim /etc/sysctl.conf

Uncomment this line


Save changes

sudo sysctl -p /etc/sysctl.conf

Edit /etc/ppp/chap-secrets, add a VPN user in this format:

# Secrets for authentication using CHAP
# client    server  secret          IP addresses
username pptpd supersecretpassword *

Restart PPTP

service pptpd restart

Run ifconfigand find your default interface, in my case it was br0 (I changed it to allow virtual machines on my physical machine to share the interface. Yours will probably be en0)

enter image description here

Back up iptables

iptables-save > ~/

Now make your iptables changes use your default interface as revealed by ifconfig.

iptables -t nat -A POSTROUTING -o br0 -j MASQUERADE
iptables --table nat --append POSTROUTING --out-interface ppp0 -j MASQUERADE
iptables -I INPUT -s -i ppp0 -j ACCEPT
iptables --append FORWARD --in-interface br0 -j ACCEPT

To keep it persistent when your system reboots;

sudo apt-get install iptables-persistent

Add VPN on client computer (Mac)

System Preferences > Network > [+] > VPN

enter image description here

enter image description here

Then choose Authentication settings > Password, then fill in your password here

enter image description here

share|improve this answer

Here's a pretty sweet project that scripts away the OpenVPN pain:

Just run it and it will install open vpn and configure it. At the end it will pop out a client.ovpn file that you can use to setup you client. Seems to work pretty well.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.