You only need to read this section if you're trying to connect
networks, not just hosts. I assume your host-to
host tunnel works so now your client and
server computers can exchange pings flawlessly. Now, it's time
to allow networks connected to the client and server machines to
use the tunnel as well.
First of all, you need to be sure that you're allowing packets
to be forwarded across your interfaces. You turn this on through
the proc configuration interface. It's best to do this once at
boot time, but you can also put it in the vpn-pppssh script or even
create a script in the /etc/init.d/ip-up.d directory (see
Section 7.2) if you want.
echo 1 > /proc/sys/net/ipv4/ip_forward
echo 1 > /proc/sys/net/ipv4/conf/ppp1 /forwarding |
- Of course, you need to replace ppp1 with the appropriate VPN interface
(the interface associated with SERVER_IFIPADDR or CLIENT_IFIPADDR
depending on if you're doing this on the server or the client).
On all computers in the subnet, you need to set up the local VPN host as the
gateway to all the networks on the other side of the tunnel.
This just tells the
computers "if you have any packets destined for the opposite side of
the VPN, send them to the local VPN host".
Note that if the VPN host
is already the default gateway for all the computers, then you don't need
to worry about this step -- the packets will be forwarded automatically.
In the example below, my VPN host has IP address 192.168.1.1 on the local network.
and IP address 192.168.3.2 on the VPN network. The VPN network, containing both
the client and server VPN interfaces and all computers on the opposite side of the
link, is 192.168.3.0/24.
Therefore, on every local computer that I want to be able to send packets through
the VPN, I need to run the following command:
# route add -net 192.168.3.0 netmask 255.255.255.0 gw 192.168.1.1 |
Now, any packet destined for the 192.168.3.0/24 network on the local machine
will be relayed to host 192.168.1.1 on the local network to be forwarded through
the VPN.
There should be no need to set up custom routing -- pppd
tries to do it all for you. However, if you find that pppd
doesn't cover your needs, the place for your routing commands is in
the vpn-pppssh script itself. To change the routing on the client,
simply run route. To change the route on the server, use
ssh to send those commands to the server.
Here's an example:
route add -net $NET1 gw $SERVER_IFIPADDR
ssh -o Batchmode=yes $SERVER_HOSTNAME -l$SERVER_USERNAME route add -net $NET2 gw $CLIENT_IFIPADDR |
You can even set up one or both hosts to masquerade all
connections through the VPN tunnel.
See the IP Masquerade HOWTO for more.
# ipchains -A forward -i ppp1 -s 192.168.0.0/24 -j MASQ |
That should be all you need to forward packets from subnets
connected to the client or server to the opposite machine.
May your PPP-SSH VPNs serve you quietly and reliably for many
years to come.
Free eBook: 
