ppp.conf.sample revision 50476
1290000Sglebius################################################################# 2132451Sroberto# 3132451Sroberto# PPP Sample Configuration File 4290000Sglebius# 5290000Sglebius# Originally written by Toshiharu OHNO 6132451Sroberto# 7132451Sroberto# $FreeBSD: head/share/examples/ppp/ppp.conf.sample 50476 1999-08-28 00:22:10Z peter $ 8132451Sroberto# 9132451Sroberto################################################################# 10132451Sroberto 11132451Sroberto# This file is separated into sections. Each section is named with 12132451Sroberto# a label starting in column 0 and followed directly by a ``:''. The 13132451Sroberto# section continues until the next section. Blank lines and lines 14132451Sroberto# beginning with ``#'' are ignored. 15132451Sroberto# 16132451Sroberto# Lines beginning with "!include" will ``include'' another file. You 17182007Sroberto# may want to ``!include ~/.ppp.conf'' for backwards compatibility. 18182007Sroberto# 19182007Sroberto 20132451Sroberto# Default setup. Always executed when PPP is invoked. 21290000Sglebius# This section is *not* pre-loaded by the ``load'' or ``dial'' commands. 22290000Sglebius# 23290000Sglebius# This is the best place to specify your modem device, it's DTR rate, 24132451Sroberto# your dial script and any logging specification. Logging specs should 25290000Sglebius# be done first so that the results of subsequent commands are logged. 26290000Sglebius# 27290000Sglebiusdefault: 28290000Sglebius set log Phase Chat LCP IPCP CCP tun command 29290000Sglebius set device /dev/cuaa1 30290000Sglebius set speed 115200 31290000Sglebius set dial "ABORT BUSY ABORT NO\\sCARRIER TIMEOUT 5 \"\" AT \ 32290000Sglebius OK-AT-OK ATE1Q0 OK \\dATDT\\T TIMEOUT 40 CONNECT" 33290000Sglebius 34290000Sglebius# Client side PPP 35290000Sglebius# 36290000Sglebius# Although the PPP protocol is a peer to peer protocol, we normally 37290000Sglebius# consider the side that initiates the connection as the client and 38290000Sglebius# the side that receives the connection as the server. Authentication 39290000Sglebius# is required by the server either using a unix-style login procedure 40290000Sglebius# or by demanding PAP or CHAP authentication from the client. 41290000Sglebius# 42290000Sglebius 43290000Sglebius# An on demand example where we have dynamic IP addresses and wish to 44290000Sglebius# use a unix-style login script: 45290000Sglebius# 46290000Sglebius# If the peer assigns us an arbitrary IP (most ISPs do this) and we 47290000Sglebius# can't predict what their IP will be either, take a wild guess at 48290000Sglebius# some IPs that you can't currently route to. Ppp can change this 49290000Sglebius# when the link comes up. 50290000Sglebius# 51290000Sglebius# The /0 bit in "set ifaddr" says that we insist on 0 bits of the 52290000Sglebius# specified IP actually being correct, therefore, the other side can assign 53290000Sglebius# any IP number. 54290000Sglebius# 55290000Sglebius# The forth arg to "set ifaddr" makes us send "0.0.0.0" as our requested 56290000Sglebius# IP number, forcing the peer to make the decision. This is necessary 57290000Sglebius# when negotiating with some (broken) ppp implementations. 58290000Sglebius# 59290000Sglebius# This entry also works with static IP numbers or when not in -auto mode. 60290000Sglebius# The ``add'' line adds a `sticky' default route that will be updated if 61290000Sglebius# and when any of the IP numbers are changed in IPCP negotiations. 62290000Sglebius# The "set ifaddr" is required in -auto mode. 63290000Sglebius# 64290000Sglebius# Finally, the ``enable dns'' line tells ppp to ask the peer for the 65290000Sglebius# nameserver addresses that should be used. This isn't always supported 66290000Sglebius# by the other side, but if it is, ppp will update /etc/resolv.conf with 67290000Sglebius# the correct nameserver values at connection time. 68290000Sglebius# 69290000Sglebius# The login script shown says that you're expecting ``ogin:''. If you 70290000Sglebius# don't receive that, send a ``\n'' and expect ``ogin:'' again. When 71290000Sglebius# it's received, send ``ppp'', expect ``word:'' then send ``ppp''. 72290000Sglebius# You *MUST* customise this login script according to your local 73290000Sglebius# requirements. 74290000Sglebius# 75290000Sglebiuspmdemand: 76290000Sglebius set phone 1234567 77290000Sglebius set login "ABORT NO\\sCARRIER TIMEOUT 5 ogin:--ogin: ppp word: ppp" 78290000Sglebius set timeout 120 79290000Sglebius set ifaddr 10.0.0.1/0 10.0.0.2/0 255.255.255.0 0.0.0.0 80132451Sroberto add default HISADDR 81200576Sroberto enable dns 82132451Sroberto 83200576Sroberto# If you want to use PAP or CHAP instead of using a unix-style login 84132451Sroberto# procedure, do the following. Note, the peer suggests whether we 85132451Sroberto# should send PAP or CHAP. By default, we send whatever we're asked for. 86132451Sroberto# 87132451Sroberto# You *MUST* customise ``MyName'' and ``MyKey'' below. 88132451Sroberto# 89132451SrobertoPAPorCHAPpmdemand: 90132451Sroberto set phone 1234567 91132451Sroberto set login 92132451Sroberto set authname MyName 93132451Sroberto set authkey MyKey 94132451Sroberto set timeout 120 95132451Sroberto set ifaddr 10.0.0.1/0 10.0.0.2/0 255.255.255.0 0.0.0.0 96132451Sroberto add default HISADDR 97132451Sroberto enable dns 98290000Sglebius 99290000Sglebius# On demand dialup example with static IP addresses: 100290000Sglebius# Here, the local side uses 192.244.185.226 and the remote side 101290000Sglebius# uses 192.244.176.44. 102290000Sglebius# 103182007Sroberto# # ppp -auto ondemand 104182007Sroberto# 105182007Sroberto# With static IP numbers, our setup is similar to dynamic: 106290000Sglebius# Remember, ppp.linkup is searched for a "192.244.176.44" label, then 107290000Sglebius# a "ondemand" label, and finally the "MYADDR" label. 108290000Sglebius# 109290000Sglebiusondemand: 110290000Sglebius set phone 1234567 111290000Sglebius set login "ABORT NO\\sCARRIER TIMEOUT 5 ogin:--ogin: ppp word: ppp" 112290000Sglebius set timeout 120 113290000Sglebius set ifaddr 192.244.185.226 192.244.176.44 114290000Sglebius add default HISADDR 115290000Sglebius enable dns 116290000Sglebius 117290000Sglebius# Example segments 118290000Sglebius# 119290000Sglebius# The following lines may be included as part of your configuration 120290000Sglebius# section and aren't themselves complete. They're provided as examples 121290000Sglebius# of how to achieve different things. 122290000Sglebius 123290000Sglebiusexamples: 124290000Sglebius# Multi-phone example. Numbers separated by a : are used sequentially. 125290000Sglebius# Numbers separated by a | are used if the previous dial or login script 126290000Sglebius# failed. Usually, you will prefer to use only one of | or :, but both 127290000Sglebius# are allowed. 128290000Sglebius# 129301301Sdelphij set phone 12345678|12345679:12345670|12345671 130301301Sdelphij# 131301301Sdelphij# Ppp can accept control instructions from the ``pppctl'' program. 132182007Sroberto# First, you must set up your control socket. It's safest to use 133182007Sroberto# a UNIX domain socket, and watch the permissions: 134290000Sglebius# 135290000Sglebius set server /var/tmp/internet MySecretPassword 0177 136182007Sroberto# 137200576Sroberto# Although a TCP port may be used if you want to allow control 138182007Sroberto# connections from other machines: 139182007Sroberto# 140182007Sroberto set server 6670 MySecretpassword 141200576Sroberto# 142290000Sglebius# If you don't like ppp's builtin chat, use an external one: 143290000Sglebius# 144290000Sglebius set login "\"!chat \\\\-f /etc/ppp/ppp.dev.chat\"" 145290000Sglebius# 146290000Sglebius# If we have a ``strange'' modem that must be re-initialized when we 147290000Sglebius# hangup: 148290000Sglebius# 149290000Sglebius set hangup "\"\" AT OK-AT-OK ATZ OK" 150182007Sroberto# 151290000Sglebius# To adjust logging withouth blasting the setting in default: 152290000Sglebius# 153290000Sglebius set log -command +tcp/ip 154290000Sglebius# 155290000Sglebius# To see log messages on the screen in interactive mode: 156290000Sglebius# 157290000Sglebius set log local LCP IPCP CCP 158290000Sglebius# 159290000Sglebius# If you're seeing a lot of magic number problems and failed connections, 160182007Sroberto# try this (see the man page): 161182007Sroberto# 162182007Sroberto set openmode active 5 163290000Sglebius# 164290000Sglebius# For noisy lines, we may want to reconnect (up to 20 times) after loss 165290000Sglebius# of carrier, with 3 second delays between each attempt: 166290000Sglebius# 167290000Sglebius set reconnect 3 20 168290000Sglebius# 169290000Sglebius# When playing server for M$ clients, tell them who our NetBIOS name 170290000Sglebius# servers are: 171290000Sglebius# 172290000Sglebius set nbns 10.0.0.1 10.0.0.2 173290000Sglebius# 174290000Sglebius# Inform the client if they ask for our DNS IP numbers: 175290000Sglebius# 176290000Sglebius enable dns 177290000Sglebius# 178290000Sglebius# If you don't want to tell them what's in your /etc/resolf.conf file 179290000Sglebius# with `enable dns', override the values: 180290000Sglebius# 181290000Sglebius set dns 10.0.0.1 10.0.0.2 182290000Sglebius# 183200576Sroberto# If we're using the -alias switch, redirect ftp and http to an internal 184290000Sglebius# machine: 185182007Sroberto# 186200576Sroberto alias port 10.0.0.2:ftp ftp 187182007Sroberto alias port 10.0.0.2:http http 188182007Sroberto# 189290000Sglebius# or don't trust the outside at all 190290000Sglebius# 191290000Sglebius alias deny_incoming yes 192290000Sglebius# 193290000Sglebius# I trust user brian to run ppp, so this goes in the `default' section: 194290000Sglebius# 195290000Sglebius allow user brian 196290000Sglebius# 197182007Sroberto# But label `internet' contains passwords that even brian can't have, so 198290000Sglebius# I empty out the user access list in that section so that only root can 199290000Sglebius# have access: 200290000Sglebius# 201290000Sglebius allow users 202290000Sglebius# 203290000Sglebius# I also may wish to set up my ppp login script so that it asks the client 204290000Sglebius# for the label they wish to use. I may only want user ``dodgy'' to access 205290000Sglebius# their own label in direct mode: 206290000Sglebius# 207290000Sglebiusdodgy: 208290000Sglebius allow user dodgy 209290000Sglebius allow mode direct 210290000Sglebius# 211290000Sglebius# If we don't want ICMP and DNS packets to keep the connection alive: 212290000Sglebius# 213290000Sglebius set filter alive 0 deny icmp 214290000Sglebius set filter alive 1 deny udp src eq 53 215290000Sglebius set filter alive 2 deny udp dst eq 53 216290000Sglebius set filter alive 3 permit 0 0 217290000Sglebius# 218290000Sglebius# And we don't want ICMPs to cause a dialup: 219290000Sglebius# 220200576Sroberto set filter dial 0 deny icmp 221200576Sroberto set filter dial 1 permit 0 0 222200576Sroberto# 223200576Sroberto# or any TCP SYN or RST packets (badly closed TCP channels): 224200576Sroberto# 225200576Sroberto set filter dial 2 deny 0 0 tcp syn finrst 226200576Sroberto# 227200576Sroberto# Once the line's up, allow connections for ident (113), telnet (23), 228200576Sroberto# ftp (20 & 21), DNS (53), my place of work (192.244.191.0/24), 229200576Sroberto# ICMP (ping) and traceroute (>33433). 230200576Sroberto# 231200576Sroberto# Anything else is blocked by default 232200576Sroberto# 233200576Sroberto set filter in 0 permit tcp dst eq 113 234200576Sroberto set filter out 0 permit tcp src eq 113 235200576Sroberto set filter in 1 permit tcp src eq 23 estab 236200576Sroberto set filter out 1 permit tcp dst eq 23 237200576Sroberto set filter in 2 permit tcp src eq 21 estab 238200576Sroberto set filter out 2 permit tcp dst eq 21 239200576Sroberto set filter in 3 permit tcp src eq 20 dst gt 1023 240200576Sroberto set filter out 3 permit tcp dst eq 20 241290000Sglebius set filter in 4 permit udp src eq 53 242290000Sglebius set filter out 4 permit udp dst eq 53 243290000Sglebius set filter in 5 permit 192.244.191.0/24 0/0 244290000Sglebius set filter out 5 permit 0/0 192.244.191.0/24 245290000Sglebius set filter in 6 permit icmp 246290000Sglebius set filter out 6 permit icmp 247182007Sroberto set filter in 7 permit udp dst gt 33433 248290000Sglebius set filter out 7 permit udp dst gt 33433 249182007Sroberto 250290000Sglebius# 251290000Sglebius# ``dodgynet'' is an example intended for an autodial configuration which 252290000Sglebius# is connecting a local network to a host on an untrusted network. 253200576Srobertododgynet: 254200576Sroberto # Log link uptime 255290000Sglebius set log Phase 256290000Sglebius # For autoconnect only 257290000Sglebius allow modes auto 258290000Sglebius # Define modem device and speed 259290000Sglebius set device /dev/cuaa1 260290000Sglebius set speed 115200 261290000Sglebius # Don't support LQR 262290000Sglebius deny lqr 263290000Sglebius # Remote system phone number, login and password 264290000Sglebius set phone 0W1194 265290000Sglebius set authname pppLogin 266290000Sglebius set authkey MyPassword 267290000Sglebius # Chat script to dial remote system 268290000Sglebius set dial "ABORT BUSY ABORT NO\\sCARRIER TIMEOUT 5 \"\" ATZ OK-ATZ-OK \ 269290000Sglebius ATE1Q0M0 OK \\dATDT\\T TIMEOUT 40 CONNECT" 270290000Sglebius # Chat script to login to remote Unix system 271290000Sglebius set login "TIMEOUT 10 \"\" \"\" gin:--gin: \\U word: \\P" 272290000Sglebius # Drop the link after 15 minutes of inactivity 273290000Sglebius # Inactivity is defined by the `set filter alive' line below 274290000Sglebius set timeout 900 275290000Sglebius # Hard-code remote system to appear within local subnet and use proxy arp 276290000Sglebius # to make this system the gateway 277290000Sglebius set ifaddr 172.17.20.247 172.17.20.248 255.255.240.0 278290000Sglebius enable proxy 279182007Sroberto 280182007Sroberto # Allow any TCP packet to keep the link alive 281290000Sglebius set filter alive 0 permit tcp 282290000Sglebius 283290000Sglebius # Only allow dialup to be triggered by http, rlogin, rsh, telnet, ftp or 284290000Sglebius # private TCP ports 24 and 4000 285290000Sglebius set filter dial 0 7 0 0 tcp dst eq http 286290000Sglebius set filter dial 1 7 0 0 tcp dst eq login 287290000Sglebius set filter dial 2 7 0 0 tcp dst eq shell 288290000Sglebius set filter dial 3 7 0 0 tcp dst eq telnet 289290000Sglebius set filter dial 4 7 0 0 tcp dst eq ftp 290290000Sglebius set filter dial 5 7 0 0 tcp dst eq 24 291290000Sglebius set filter dial 6 deny ! 0 0 tcp dst eq 4000 292290000Sglebius # From hosts on a couple of local subnets to the remote peer 293290000Sglebius # If the remote host allowed IP forwarding and we wanted to use it, the 294290000Sglebius # following rules could be split into two groups to separately validate 295290000Sglebius # the source and destination addresses. 296290000Sglebius set filter dial 7 permit 172.17.16.0/20 172.17.20.248 297290000Sglebius set filter dial 8 permit 172.17.36.0/22 172.17.20.248 298290000Sglebius set filter dial 9 permit 172.17.118.0/26 172.17.20.248 299290000Sglebius set filter dial 10 permit 10.123.5.0/24 172.17.20.248 300290000Sglebius 301182007Sroberto # Once the link's up, limit outgoing access to the specified hosts 302182007Sroberto set filter out 0 4 172.17.16.0/20 172.17.20.248 303182007Sroberto set filter out 1 4 172.17.36.0/22 172.17.20.248 304182007Sroberto set filter out 2 4 172.17.118.0/26 172.17.20.248 305290000Sglebius set filter out 3 deny ! 10.123.5.0/24 172.17.20.248 306290000Sglebius # Allow established TCP connections 307290000Sglebius set filter out 4 permit 0 0 tcp estab 308290000Sglebius # And new connections to http, rlogin, rsh, telnet, ftp and ports 309290000Sglebius # 24 and 4000 310290000Sglebius set filter out 5 permit 0 0 tcp dst eq http 311200576Sroberto set filter out 6 permit 0 0 tcp dst eq login 312200576Sroberto set filter out 7 permit 0 0 tcp dst eq shell 313200576Sroberto set filter out 8 permit 0 0 tcp dst eq telnet 314200576Sroberto set filter out 9 permit 0 0 tcp dst eq ftp 315200576Sroberto set filter out 10 permit 0 0 tcp dst eq 24 316200576Sroberto set filter out 11 permit 0 0 tcp dst eq 4000 317200576Sroberto # And outgoing icmp 318200576Sroberto set filter out 12 permit 0 0 icmp 319200576Sroberto 320200576Sroberto # Once the link's up, limit incoming access to the specified hosts 321200576Sroberto set filter in 0 4 172.17.20.248 172.17.16.0/20 322200576Sroberto set filter in 1 4 172.17.20.248 172.17.36.0/22 323200576Sroberto set filter in 2 4 172.17.20.248 172.17.118.0/26 324200576Sroberto set filter in 3 deny ! 172.17.20.248 10.123.5.0/24 325200576Sroberto # Established TCP connections and non-PASV FTP 326200576Sroberto set filter in 4 permit 0/0 0/0 tcp estab 327200576Sroberto set filter in 5 permit 0/0 0/0 tcp src eq 20 328200576Sroberto # Useful ICMP messages 329200576Sroberto set filter in 6 permit 0/0 0/0 icmp src eq 3 330200576Sroberto set filter in 7 permit 0/0 0/0 icmp src eq 4 331200576Sroberto set filter in 8 permit 0/0 0/0 icmp src eq 11 332200576Sroberto set filter in 9 permit 0/0 0/0 icmp src eq 12 333200576Sroberto # Echo reply (local systems can ping the remote host) 334200576Sroberto set filter in 10 permit 0/0 0/0 icmp src eq 0 335200576Sroberto # And the remote host can ping the local gateway (only) 336182007Sroberto set filter in 11 permit 0/0 172.17.20.247 icmp src eq 8 337182007Sroberto 338290000Sglebius 339182007Sroberto# Server side PPP 340290000Sglebius# 341290000Sglebius# If you want the remote system to authenticate itself, you must insist 342182007Sroberto# that the peer uses CHAP or PAP with the "enable" keyword. Both CHAP and 343132451Sroberto# PAP are disabled by default. You may enable either or both. If both 344290000Sglebius# are enabled, CHAP is requested first. If the client doesn't agree, PAP 345132451Sroberto# will then be requested. 346290000Sglebius# 347182007Sroberto# Note: If you use the getty/login process to authenticate users, you 348132451Sroberto# don't need to enable CHAP or PAP, but the user that has logged 349132451Sroberto# in *MUST* be a member of the ``network'' group (in /etc/group). 350132451Sroberto# 351132451Sroberto# If you wish to allow any user in the passwd database ppp access, you 352290000Sglebius# can ``enable passwdauth''. 353290000Sglebius# 354290000Sglebius# When the peer authenticates itself, we use ppp.secret for verification 355290000Sglebius# (although refer to the ``set radius'' command below for an alternative). 356290000Sglebius# 357290000Sglebius# Note: We may supply a third field in ppp.secret specifying the IP 358132451Sroberto# address for that user, a forth field to specify the 359132451Sroberto# ppp.link{up,down} label to use and a fifth field to specify 360132451Sroberto# callback characteristics. 361290000Sglebius# 362290000Sglebius# The easiest way to allow transparent LAN access to your dialin users 363132451Sroberto# is to assign them a number from your local LAN and tell ppp to make a 364132451Sroberto# ``proxy'' arp entry for them. In this example, we have a local LAN 365290000Sglebius# with IP numbers 10.0.0.1 - 10.0.0.99, and we assign numbers to our 366290000Sglebius# ppp clients between 10.0.0.100 and 10.0.0.199. It is possible to 367290000Sglebius# override the dynamic IP number with a static IP number specified in 368290000Sglebius# ppp.secret. 369290000Sglebius# 370290000Sglebius# Ppp is launched with: 371132451Sroberto# # ppp -direct server 372132451Sroberto# 373132451Srobertoserver: 374290000Sglebius enable chap 375290000Sglebius enable pap 376290000Sglebius enable passwdauth 377132451Sroberto enable proxy 378132451Sroberto set ifaddr 10.0.0.1 10.0.0.100-10.0.0.199 379132451Sroberto accept dns 380290000Sglebius 381132451Sroberto# Example of a RADIUS configuration: 382132451Sroberto# If there are one or more radius servers available, we can use them 383290000Sglebius# instead of the ppp.secret file. Simply put then in a radius 384200576Sroberto# configuration file (usually /etc/radius.conf) and give ppp the 385290000Sglebius# file name. 386290000Sglebius# Ppp will use the FRAMED characteristics supplied by the radius server 387290000Sglebius# to configure the link. 388290000Sglebius 389290000Sglebiusradius-server: 390200576Sroberto load server 391200576Sroberto set radius /etc/radius.conf 392132451Sroberto 393132451Sroberto 394132451Sroberto# Example to connect using a null-modem cable: 395132451Sroberto# The important thing here is to allow the lqr packets on both sides. 396290000Sglebius# Without them enabled, we can't tell if the line's dropped - there 397290000Sglebius# should always be carrier on a direct connection. 398290000Sglebius# Here, the server sends lqr's every 10 seconds and quits if five in a 399290000Sglebius# row fail. 400290000Sglebius# 401132451Sroberto# Make sure you don't have "deny lqr" in your default: on the client ! 402290000Sglebius# If the peer denies LQR, we still send ECHO LQR packets at the given 403290000Sglebius# lqrperiod interval (ppp-style-pings). 404290000Sglebius# 405132451Srobertodirect-client: 406182007Sroberto set dial "" 407182007Sroberto set device /dev/cuaa0 408182007Sroberto set sp 115200 409132451Sroberto set timeout 900 410182007Sroberto set lqrperiod 10 411290000Sglebius set log Phase Chat LQM 412290000Sglebius set login "ABORT NO\\sCARRIER TIMEOUT 5 ogin:--ogin: ppp word: ppp HELLO" 413290000Sglebius set ifaddr 10.0.4.2 10.0.4.1 414182007Sroberto enable lqr 415290000Sglebius accept lqr 416132451Sroberto 417132451Srobertodirect-server: 418290000Sglebius set timeout 0 419290000Sglebius set lqrperiod 10 420200576Sroberto set log Phase LQM 421290000Sglebius set ifaddr 10.0.4.1 10.0.4.2 422290000Sglebius enable lqr 423290000Sglebius accept lqr 424290000Sglebius 425290000Sglebius 426290000Sglebius# Example to connect via compuserve 427290000Sglebius# Compuserve insists on 7 bits even parity during the chat phase. Modem 428290000Sglebius# parity is always reset to ``none'' after the link has been established. 429290000Sglebius# 430290000Sglebiuscompuserve: 431290000Sglebius set phone 1234567 432290000Sglebius set parity even 433290000Sglebius set login "TIMEOUT 100 \"\" \"\" Name: CIS ID: 999999,9999/go:pppconnect \ 434290000Sglebius word: XXXXXXXX PPP" 435290000Sglebius set timeout 300 436290000Sglebius set ifaddr 10.0.0.1/0 10.0.0.2/0 255.255.255.0 0.0.0.0 437290000Sglebius delete ALL 438290000Sglebius add default HISADDR 439290000Sglebius 440290000Sglebius 441290000Sglebius# Example for PPP over TCP. 442290000Sglebius# We assume that inetd on tcpsrv.mynet has been 443290000Sglebius# configured to run "ppp -direct tcp-server" when it gets a connection on 444290000Sglebius# port 1234. Read the man page for further details 445290000Sglebius# 446290000Sglebius# Note, we assume we're using a binary-clean connection. If something 447290000Sglebius# such as `rlogin' is involved, you may need to ``set escape 0xff'' 448290000Sglebius# 449290000Sglebiustcp-client: 450290000Sglebius set device tcpsrv.mynet:1234 451290000Sglebius set dial 452290000Sglebius set login 453290000Sglebius set ifaddr 10.0.5.1 10.0.4.1 255.255.255.0 454290000Sglebius 455290000Sglebiustcp-server: 456290000Sglebius set ifaddr 10.0.4.1 10.0.5.1 255.255.255.0 457290000Sglebius 458290000Sglebius# Example for PPP testing. 459290000Sglebius# If you want to test ppp, do it through the loopback interface: 460290000Sglebius# 461290000Sglebius# Requires a line in /etc/services: 462290000Sglebius# ppploop 6671/tcp # loopback ppp daemon 463290000Sglebius# 464290000Sglebius# and a line in /etc/inetd.conf: 465290000Sglebius# ppploop stream tcp nowait root /usr/sbin/ppp ppp -direct loop-in 466290000Sglebius# 467290000Sglebiusloop: 468290000Sglebius set timeout 0 469290000Sglebius set log phase chat connect lcp ipcp command 470290000Sglebius set device localhost:ppploop 471290000Sglebius set dial 472290000Sglebius set login 473290000Sglebius set ifaddr 127.0.0.2 127.0.0.3 474290000Sglebius set server /var/tmp/loop "" 0177 475290000Sglebius 476290000Sglebiusloop-in: 477290000Sglebius set timeout 0 478290000Sglebius set log phase lcp ipcp command 479290000Sglebius allow mode direct 480132451Sroberto 481290000Sglebius# Example of a VPN. 482290000Sglebius# If you're going to create a tunnel through a public network, your VPN 483132451Sroberto# should be set up something like this: 484132451Sroberto# 485132451Sroberto# You should already have set up ssh using ssh-agent & ssh-add. 486132451Sroberto# 487132451Srobertosloop: 488200576Sroberto load loop 489132451Sroberto # Passive mode allows ssh plenty of time to establish the connection 490290000Sglebius set openmode passive 491132451Sroberto set device "!ssh whatevermachine /usr/sbin/ppp -direct loop-in" 492290000Sglebius 493290000Sglebius# Example of non-PPP callback. 494290000Sglebius# If you wish to connect to a server that will dial back *without* using 495182007Sroberto# the ppp callback facility (rfc1570), take advantage of the fact that 496290000Sglebius# ppp doesn't look for carrier 'till `set login' is complete: 497132451Sroberto# 498132451Sroberto# Here, we expect the server to say DIALBACK then disconnect after 499290000Sglebius# we've authenticated ourselves. When this has happened, we wait 500290000Sglebius# 60 seconds for a RING. 501290000Sglebius# 502290000Sglebiusdialback: 503290000Sglebius set dial "ABORT BUSY ABORT NO\\sCARRIER TIMEOUT 5 \"\" ATZ OK-ATZ-OK \ 504290000Sglebius ATDT\\T TIMEOUT 60 CONNECT" 505290000Sglebius set login "TIMEOUT 5 ogin:--ogin: ppp word: ppp TIMEOUT 15 DIALBACK \ 506132451Sroberto \"\" NO\\sCARRIER \"\" TIMEOUT 60 RING ATA CONNECT" 507290000Sglebius 508290000Sglebius# Example of PPP callback. 509290000Sglebius# Alternatively, if the peer is using the PPP callback protocol, we're 510290000Sglebius# happy either with ``auth'' style callback where the server dials us 511290000Sglebius# back based on what we authenticate ourselves with, ``cbcp'' style 512290000Sglebius# callback (invented by Microsoft but not agreed by the IETF) where 513290000Sglebius# we negotiate callback *after* authentication or E.164 callback where 514290000Sglebius# we specify only a phone number. I would recommend only ``auth'' and/or 515290000Sglebius# ``cbcp'' callback methods. 516290000Sglebius# For ``cbcp'', we insist that we choose ``1234567'' as the number that 517290000Sglebius# the server must call back. 518290000Sglebius# 519290000Sglebiuscallback: 520290000Sglebius load pmdemand 521290000Sglebius set callback auth cbcp e.164 1234567 522132451Sroberto set cbcp 1234567 523290000Sglebius 524200576Sroberto# If we're running a ppp server that wants to only call back microsoft 525200576Sroberto# clients on numbers configured in /etc/ppp/ppp.secret (the 5th field): 526200576Sroberto# 527200576Srobertocallback-server: 528290000Sglebius load server 529132451Sroberto set callback cbcp 530290000Sglebius set cbcp 531290000Sglebius set log +cbcp 532132451Sroberto set redial 3 1 533132451Sroberto set device /dev/cuaa0 534132451Sroberto set speed 115200 535182007Sroberto set dial "TIMEOUT 10 \"\" AT OK-AT-OK ATDT\\T CONNECT" 536182007Sroberto 537290000Sglebius# Or if we want to allow authenticated clients to specify their own 538132451Sroberto# callback number: 539132451Sroberto# 540132451Srobertocallback-server-client-decides: 541132451Sroberto load callback-server 542132451Sroberto set cbcp * 543200576Sroberto 544132451Sroberto# Multilink mode is available (rfc1990). 545200576Sroberto# To enable multilink capabilities, you must specify a MRRU. 1500 is 546200576Sroberto# a reasonable value. To create new links, use the ``clone'' command 547200576Sroberto# to duplicate an existing link. If you already have more than one 548132451Sroberto# link, you must specify which link you wish to run the command on via 549132451Sroberto# the ``link'' command. 550132451Sroberto# 551132451Sroberto# You can now ``dial'' specific links, or even dial all links at the 552132451Sroberto# same time. The `dial' command may also be prefixed with a specific 553132451Sroberto# link that should do the dialing. 554200576Sroberto# 555132451Srobertomloop: 556132451Sroberto load loop 557132451Sroberto set mode interactive 558132451Sroberto set mrru 1500 559132451Sroberto clone 1 2 3 560200576Sroberto link deflink remove 561132451Sroberto # dial 562132451Sroberto # link 2 dial 563182007Sroberto # link 3 dial 564132451Sroberto 565200576Srobertomloop-in: 566132451Sroberto set timeout 0 567132451Sroberto set log tun phase 568200576Sroberto allow mode direct 569132451Sroberto set mrru 1500 570132451Sroberto 571200576Sroberto# User supplied authentication: 572290000Sglebius# It's possible to run ppp in the background while specifying a 573132451Sroberto# program to use to obtain authentication details on demand. 574132451Sroberto# This program would usually be a simple GUI that presents a 575200576Sroberto# prompt to a known user. The ``chap-auth'' program is supplied 576200576Sroberto# as an example (and requires tcl version 8.0). 577200576Sroberto# 578290000SglebiusCHAPprompt: 579182007Sroberto load PAPorCHAPpmdemand 580290000Sglebius set authkey !/usr/share/examples/ppp/chap-auth 581290000Sglebius 582290000Sglebius# It's possible to do the same sort of thing at the login prompt. 583290000Sglebius# Here, after sending ``brian'' in response to the ``name'' prompt, 584290000Sglebius# we're prompted with ``code:''. A window is then displayed on the 585290000Sglebius# ``keep:0.0'' display and the typed response is sent to the peer 586290000Sglebius# as the password. We then expect to see ``MTU'' and ``.'' in the 587290000Sglebius# servers response. 588290000Sglebius# 589290000Sglebiusloginprompt: 590290000Sglebius load pmdemand 591290000Sglebius set authname brian 592290000Sglebius set login "ABORT NO\\sCARRIER TIMEOUT 15 \"\" \"\" name:--name: \\U \ 593290000Sglebius code: \"!/usr/share/examples/ppp/login-auth -display keep:0.0 \ 594290000Sglebius AUTHNAME\" MTU \\c ." 595290000Sglebius