EHL VPN Client Configuration in Fedora
The EHL has a PPTP VPN for remote access.
Contents
Creating a VPN User
1. Add an entry to the /etc/ppp/chap-secrets file on morocco
:
# Secrets for authentication using CHAP # client server secret IP addresses userid pptpd password *
2. Reload the pptpd server: sudo systemctl reload pptpd
Setting up Remote Access Using NetworkManager GUI Setup Tools in Fedora (Gnome)
To set up access to the VPN from a remote Fedora system graphically:
- Access the Network portion of the Setting application.
- Click the + sign to add a new network connection.
- Select VPN as the connection type.
- Select Point-to-Point Tunneling Protocol (PPTP) as the VPN type.
- Fill in these parameters:
- Gateway:
ehl.internal.cdot.systems
(currently: 10.46.52.62) - User name: Your VPN Username
- Password: Your VPN Password (the system will ask you for this when you connect anyway)
- NT Domain: leave blank
- Gateway:
- In the IPv4 tab, fill in these parameters:
- IPv4: On
- Address: DHCP
- DNS: Automatic OFF and all fields blank
- Routes:
- Address: 172.16.172.0
- Netmask: 255.255.255.0
- Gateway: 172.16.172.254 (currently: 172.16.172.215)
- Metric: leave blank
- Check the box marked "Use this connection only for resources on its network".
- Apply the changes.
- Start the VPN with the control in the Network Settings screen or at the top of the Gnome screen.
Note: If you are unable to connect to the VPN after following the above steps, it is possibly due to the firewall restricting access. To check if that is the case, turn off the firewall temporarily with sudo systemctl stop firewalld
and attempt to the connect to the VPN. Turn the firewall back on afterwards with sudo systemctl start firewalld
.
Setting up VPN via command line
Add a new basic vpn using nmcli:
nmcli conn add con-name EHL type vpn vpn-type pptp
Edit /etc/NetworkManager/system-connections/EHL and add following lines:
[connection] ... autoconnect=true [vpn] ... gateway=ehl.internal.cdot.systems user=[Your VPN Username] password-flags=0 [vpn-secrets] password=[Your VPN Password] [ipv6] method=auto [ipv4] method=auto route1=172.16.172.0/24,172.16.172.215,0 ignore-auto-dns=true ignore-auto-routes=true never-default=true
Reload configuration file:
nmcli conn reload
Turn on the VPN connection:
nmcli conn up EHL
Firewall Adjustment
To enable this to work through the Fedora firewall, issue these commands:
firewall-cmd --direct --add-rule ipv4 filter INPUT 0 -p gre -j ACCEPT firewall-cmd --permanent --direct --add-rule ipv4 filter INPUT 0 -p gre -j ACCEPT firewall-cmd --reload
(From here).
Other Configuration
For convenient access to the EHL resources:
- Merge
/etc/hosts
entries from Red (=ehl.internal.cdot.systems, which is the gateway system) into your local/etc/hosts
file, commenting out or removing the line for Red/EHL itself. - Copy
/usr/local/bin/{serial,pingbuilders,startkojids,pdu}
from Red into your local/usr/local/bin
directory. - Copy your SSH public key to the EHL systems using
ssh-copy-id
, including theostep
account onserial
.
ssh-copy-id ostep@serial serial x1