I used this guide to set up a PPTP VPN server on my Ubuntu 12.04 server.
To summarize the main points in the link, though:
iptables can be used in place of ufw, but for the sake of easiness,
ufw is better if you don't know
sudo apt-get install pptpd ufw
2: Open the ports needed. The guide suggests 22 (SSH) and 1723 for the pptp vpn.
sudo ufw allow 22
sudo ufw allow 1723
sudo ufw enable
/etc/ppp/pptpd-options. Open the file with your favorite editor (mine's nano, so the command for me is
sudo nano /etc/ppp/pptpd-options), and comment out these lines by putting a
# before them, if you want this to work universally on all OSes:
You can comment this line if you want to disable encryption:
4: While editing
/etc/ppp/pptpd-options, add DNS servers for the VPN. This example uses OpenDNS servers:
/etc/pptpd.conf. Open the file with your favorite editor (mine's nano, so the command for me is
sudo nano /etc/pptpd.conf). You need to add the local VPN IPs for the system, so add:
If your system is a VPS, use the public IP for "localip". If it is not and is on a local network, use your computer's network IP. Use different IPs and ranges if these IPs exist on your subnet!
/etc/ppp/chap-secrets. Open the file with your favorite editor (mine's nano, so the command for me is
sudo nano /etc/ppp/chap-secrets), and add the auth data.
The format for
[Username] [Service] [Password] [Allowed IP Address]
An example would be:
sampleuser pptpd samplepassword *
7: Restart pptpd. Run this command in terminal:
sudo /etc/init.d/pptpd restart
/etc/sysctl.conf. Open the file with your favorite editor (mine's nano, so the command for me is
sudo nano /etc/sysctl.conf). Un-comment the following line (by removing the
# at the beginning of it) in
Reload the configuration:
sudo sysctl -p
9: This step assumes you have ufw.
/etc/default/ufw and change the option
10: This step assumes you have ufw.
/etc/ufw/before.rules, and add the following either at the beginning of
/etc/ufw/before.rules or just before the
*filter rules (recommended):
# NAT table rules
:POSTROUTING ACCEPT [0:0]
# Allow forward traffic to eth0
-A POSTROUTING -s 10.99.99.0/24 -o eth0 -j MASQUERADE
# Process the NAT table rules
11: Restart the firewall:
sudo ufw disable && sudo ufw enable
Warning: If you have other ports you need open, such as for HTTPS if your server hosts a website, you need to individually add those ports to the allowed list with
sudo ufw allow <PORT>