ppp.conf.sample revision 43902
1################################################################# 2# 3# PPP Sample Configuration File 4# 5# Originally written by Toshiharu OHNO 6# 7# $Id: ppp.conf.sample,v 1.33 1998/10/03 13:12:14 brian Exp $ 8# 9################################################################# 10 11# This file is separated into sections. Each section is named with 12# a label starting in column 0 and followed directly by a ``:''. The 13# section continues until the next section. Blank lines and lines 14# beginning with ``#'' are ignored. 15# 16# Lines beginning with "!include" will ``include'' another file. You 17# may want to ``!include ~/.ppp.conf'' for backwards compatibility. 18# 19 20# Default setup. Always executed when PPP is invoked. 21# This section is *not* loaded by the ``load'' or ``dial'' commands. 22# 23# This is the best place to specify your modem device, it's DTR rate, 24# and any logging specification. Logging specs should be done first 25# so that subsequent commands are logged. 26# 27default: 28 set log Phase Chat LCP IPCP CCP tun command 29 set device /dev/cuaa1 30 set speed 115200 31 set dial "ABORT BUSY ABORT NO\\sCARRIER TIMEOUT 5 \"\" AT OK-AT-OK ATE1Q0 OK \\dATDT\\T TIMEOUT 40 CONNECT" 32 33# Client side PPP 34# 35# Although the PPP protocol is a peer to peer protocol, we normally 36# consider the side that makes the connection as the client and the 37# side that receives the connection as the server. Authentication 38# is required by the server either using a unix-style login proceedure 39# or by demanding PAP or CHAP authentication from the client. 40# 41 42# An on demand example where we have dynamic IP addresses: 43# If the peer assigns us an arbitrary IP (most ISPs do this) and we 44# can't predict what their IP will be either, take a wild guess at 45# some IPs that you can't currently route to. 46# 47# The /0 bit in "set ifaddr" says that we insist on 0 bits of the 48# specified IP actually being correct, therefore, the other side can assign 49# any IP numbers. 50# 51# The forth arg to "set ifaddr" makes us send "0.0.0.0" as our requested 52# IP number, forcing the peer to make the decision. 53# 54# This entry also works with static IP numbers or when not in -auto mode. 55# The ``add'' line adds a `sticky' default route that will be updated if 56# and when any of the IP numbers are changed in IPCP negotiations. 57# The "set ifaddr" is required in -auto mode. 58# 59# Finally, the ``enable dns'' bit tells ppp to ask the peer for the 60# nameserver addresses that should be used. This isn't always supported 61# by the other side, but if it is, /etc/resolv.conf will automatically be 62# updated. 63# 64pmdemand: 65 set phone 1234567 66 set login "ABORT NO\\sCARRIER TIMEOUT 5 ogin:--ogin: ppp word: ppp" 67 set timeout 120 68 set ifaddr 10.0.0.1/0 10.0.0.2/0 255.255.255.0 0.0.0.0 69 add default HISADDR 70 enable dns 71 72# When we want to use PAP or CHAP instead of using a unix-style login 73# proceedure, we do the following. Note, the peer suggests whether we 74# should send PAP or CHAP. By default, we send whatever we're asked for. 75# 76PAPorCHAPpmdemand: 77 set phone 1234567 78 set login 79 set authname MyName 80 set authkey MyKey 81 set timeout 120 82 set ifaddr 10.0.0.1/0 10.0.0.2/0 255.255.255.0 0.0.0.0 83 add default HISADDR 84 enable dns 85 86# On demand dialup example with static IP addresses: 87# Here, the local side uses 192.244.185.226 and the remote side 88# uses 192.244.176.44. 89# 90# # ppp -auto ondemand 91# 92# With static IP numbers, our setup is similar to dynamic: 93# Remember, ppp.linkup is searched for a "192.244.176.44" label, then 94# a "ondemand" label, and finally the "MYADDR" label. 95# 96ondemand: 97 set phone 1234567 98 set login "ABORT NO\\sCARRIER TIMEOUT 5 ogin:--ogin: ppp word: ppp" 99 set timeout 120 100 set ifaddr 192.244.185.226 192.244.176.44 101 add default HISADDR 102 enable dns 103 104# Example segments 105# 106# The following lines may be included as part of your configuration 107# section and aren't themselves complete. They're provided as examples 108# of how to achieve different things. 109 110examples: 111# Multi-phone example. Numbers separated by a : are used sequentially. 112# Numbers separated by a | are used if the previous dial or login script 113# failed. Usually, you will prefer to use only one of | or :, but both 114# are allowed. 115# 116 set phone 12345678|12345679:12345670|12345671 117# 118# Ppp can accept control instructions from the ``pppctl'' program. 119# First, you must set up your control socket. It's safest to use 120# a UNIX domain socket, and watch the permissions: 121# 122 set server /var/tmp/internet MySecretPassword 0177 123# 124# Although a TCP port may be used if you want to allow control 125# connections from other machines: 126# 127 set server 6670 MySecretpassword 128# 129# If you don't like ppp's builtin chat, use an external one: 130# 131 set login "\"!chat \\\\-f /etc/ppp/ppp.dev.chat\"" 132# 133# If we have a ``strange'' modem that must be re-initialized when we 134# hangup: 135# 136 set hangup "\"\" AT OK-AT-OK ATZ OK" 137# 138# To adjust logging withouth blasting the setting in default: 139# 140 set log -command +tcp/ip 141# 142# To see log messages on the screen in interactive mode: 143# 144 set log local LCP IPCP CCP 145# 146# If you're seeing a lot of magic number problems and failed connections, 147# try this (see the man page): 148# 149 set openmode active 5 150# 151# For noisy lines, we may want to reconnect (up to 20 times) after loss 152# of carrier, with 3 second delays between each attempt: 153# 154 set reconnect 3 20 155# 156# When playing server for M$ clients, tell them who our NetBIOS name 157# servers are: 158# 159 set nbns 10.0.0.1 10.0.0.2 160# 161# Inform the client if they ask for our DNS IP numbers: 162# 163 enable dns 164# 165# If you don't want to tell them what's in your /etc/resolf.conf file 166# with `enable dns', override the values: 167# 168 set dns 10.0.0.1 10.0.0.2 169# 170# If we're using the -alias switch, redirect ftp and http to an internal 171# machine: 172# 173 alias port 10.0.0.2:ftp ftp 174 alias port 10.0.0.2:http http 175# 176# or don't trust the outside at all 177# 178 alias deny_incoming yes 179# 180# I trust user brian to run ppp, so this goes in the `default' section: 181# 182 allow user brian 183# 184# But label `internet' contains passwords that even brian can't have, so 185# I empty out the user access list in that section so that only root can 186# have access: 187# 188 allow users 189# 190# I also may wish to set up my ppp login script so that it asks the client 191# for the label they wish to use. I may only want user ``dodgy'' to access 192# their own label in direct mode: 193# 194dodgy: 195 allow user dodgy 196 allow mode direct 197# 198# If we don't want ICMP and DNS packets to keep the connection alive: 199# 200 set filter alive 0 deny icmp 201 set filter alive 1 deny udp src eq 53 202 set filter alive 2 deny udp dst eq 53 203 set filter alive 3 permit 0 0 204# 205# And we don't want ICMPs to cause a dialup: 206# 207 set filter dial 0 deny icmp 208 set filter dial 1 permit 0 0 209# 210# or any TCP SYN or RST packets (badly closed TCP channels): 211# 212 set filter dial 2 deny 0 0 tcp syn finrst 213# 214# Once the line's up, allow connections for ident (113), telnet (23), 215# ftp (20 & 21), DNS (53), my place of work (192.244.191.0/24), 216# ICMP (ping) and traceroute (>33433). 217# 218# Anything else is blocked by default 219# 220 set filter in 0 permit tcp dst eq 113 221 set filter out 0 permit tcp src eq 113 222 set filter in 1 permit tcp src eq 23 estab 223 set filter out 1 permit tcp dst eq 23 224 set filter in 2 permit tcp src eq 21 estab 225 set filter out 2 permit tcp dst eq 21 226 set filter in 3 permit tcp src eq 20 dst gt 1023 227 set filter out 3 permit tcp dst eq 20 228 set filter in 4 permit udp src eq 53 229 set filter out 4 permit udp dst eq 53 230 set filter in 5 permit 192.244.191.0/24 0/0 231 set filter out 5 permit 0/0 192.244.191.0/24 232 set filter in 6 permit icmp 233 set filter out 6 permit icmp 234 set filter in 7 permit udp dst gt 33433 235 set filter out 7 permit udp dst gt 33433 236 237 238# Server side PPP 239# If you want the remote system to authenticate itself, you insist 240# that the peer uses CHAP (or PAP) with the "enable" keyword. Both CHAP and 241# PAP are disabled by default (we usually only "enable" one of them if the 242# other side is dialing into our server). 243# When the peer authenticates itself, we use ppp.secret for verification. 244# 245# Ppp is launched with: 246# # ppp -direct CHAPserver 247# 248# Note: We can supply a third field in ppp.secret specifying the IP address 249# for that user. We can even specify a forth field to specify the 250# ppp.link{up,down} label to use. 251# 252CHAPserver: 253 enable chap 254 enable proxy 255 set ifaddr 192.244.176.44 292.244.184.31 256 accept dns 257 258# If we wish to act as a server, allowing PAP access according to 259# accounts in /etc/passwd, we do this (Without `enable passwdauth', 260# you may still enter ``*'' as the users password in ppp.secret and 261# ppp will look it up in the passwd database. This is useful if you 262# need to assign a special label or IP number or range): 263# 264PAPServerwithPASSWD: 265 enable pap 266 enable passwdauth 267 enable proxy 268 set ifaddr 192.244.176.44 292.244.184.31 269 accept dns 270 271 272# Example to connect using a null-modem cable: 273# The important thing here is to allow the lqr packets on both sides. 274# Without them enabled, we can't tell if the line's dropped - there 275# should always be carrier on a direct connection. 276# Here, the server sends lqr's every 10 seconds and quits if five in a 277# row fail. 278# 279# Make sure you don't have "deny lqr" in your default: on the client ! 280# If the peer denies LQR, we still send ECHO LQR packets at the given 281# lqrperiod interval (ppp-style-pings). 282# 283direct-client: 284 set dial "" 285 set line /dev/cuaa0 286 set sp 115200 287 set timeout 900 288 set lqrperiod 10 289 set log Phase Chat LQM 290 set login "ABORT NO\\sCARRIER TIMEOUT 5 ogin:--ogin: ppp word: ppp HELLO" 291 set ifaddr 10.0.4.2 10.0.4.1 292 enable lqr 293 accept lqr 294 295direct-server: 296 set timeout 0 297 set lqrperiod 10 298 set log Phase LQM 299 set ifaddr 10.0.4.1 10.0.4.2 300 enable lqr 301 accept lqr 302 303 304# Example to connect via compuserve (who insist on 7 bits even parity 305# during the chat phase). 306# 307compuserve: 308 set phone 1234567 309 set parity even 310 set login "TIMEOUT 10 \"\" \"\" Name: CIS ID: 99999,9999/go:pppconnect \ 311 word: XXXXXXXX" 312 set timeout 300 313 set ifaddr 10.0.0.1/0 10.0.0.2/0 255.255.255.0 0.0.0.0 314 delete ALL 315 add default HISADDR 316 317 318# Example for PPP over TCP. 319# We assume that inetd on tcpsrv.mynet has been 320# configured to run "ppp -direct tcp-server" when it gets a connection on 321# port 1234. Read the man page for further details 322# 323# Note, we assume we're using a binary-clean connection. If something 324# such as `rlogin' is involved, you may need to ``set escape 0xff'' 325# 326tcp-client: 327 set device tcpsrv.mynet:1234 328 set dial 329 set login 330 set ifaddr 10.0.5.1 10.0.4.1 255.255.255.0 331 332tcp-server: 333 set ifaddr 10.0.4.1 10.0.5.1 255.255.255.0 334 335# If you want to test ppp, do it through a loopback: 336# 337# Requires a line in /etc/services: 338# ppploop 6671/tcp # loopback ppp daemon 339# 340# and a line in /etc/inetd.conf: 341# ppploop stream tcp nowait root /usr/sbin/ppp ppp -direct loop-in 342# 343loop: 344 set timeout 0 345 set log phase chat connect lcp ipcp command 346 set device localhost:ppploop 347 set dial 348 set login 349 set ifaddr 127.0.0.2 127.0.0.3 350 set server /var/tmp/loop "" 0177 351 352loop-in: 353 set timeout 0 354 set log phase lcp ipcp command 355 allow mode direct 356 357# If you're going to create a tunnel through a public network, your VPN 358# should be set up something like this: 359# 360# /etc/ppp/secure (which should be executable) says: 361# #! /bin/sh 362# exec ssh whatevermachine /usr/sbin/ppp -direct loop-in 363# 364sloop: 365 load loop 366 set device !/etc/ppp/secure 367 368# If you wish to connect to a server that will dial back *without* using 369# the ppp callback facility (rfc1570), take advantage of the fact that 370# ppp doesn't look for carrier 'till `set login' is complete: 371# 372# Here, we expect the server to say DIALBACK then disconnect after 373# we've authenticated ourselves. When this has happened, we wait 374# 60 seconds for a RING. 375# 376dialback: 377 set dial "ABORT BUSY ABORT NO\\sCARRIER TIMEOUT 5 \"\" ATZ OK-ATZ-OK \ 378 ATDT\\T TIMEOUT 60 CONNECT" 379 set login "TIMEOUT 5 ogin:--ogin: ppp word: ppp TIMEOUT 15 DIALBACK \ 380 \"\" NO\\sCARRIER \"\" TIMEOUT 60 RING ATA CONNECT" 381 382# Alternatively, if the peer is using the PPP callback protocol, use 383# normal dial and login scripts and add 384# 385 set callback auth cbcp e.164 1234567 386 set cbcp 1234567 387 388# If we're running a ppp server that wants to only call back microsoft 389# clients on numbers configured in /etc/ppp/ppp.secret (the 5th field): 390# 391 set callback cbcp 392 set cbcp 393 set log +cbcp 394 set redial 3 1 395 set device /dev/cuaa0 396 set speed 115200 397 set dial "TIMEOUT 10 \"\" AT OK-AT-OK ATDT\\T CONNECT" 398 399# Or if we want to allow authenticated clients to specify their own 400# callback number, use this ``set cbcp'' line instead: 401# 402 set cbcp * 403 404# Multilink mode is available (rfc1990). 405# To enable multilink capabilities, you must specify a MRRU. 1500 is 406# a reasonable value. To create new links, use the ``clone'' command 407# to duplicate an existing link. If you already have more than one 408# link, you must specify which link you wish to run the command on via 409# the ``link'' command. 410# 411# You can now ``dial'' specific links, or even dial all links at the 412# same time. The `dial' command may also be prefixed with a specific 413# link that should do the dialing. 414# 415 416mloop: 417 load loop 418 set mode interactive 419 set mrru 1500 420 clone 1 2 3 421 link deflink remove 422 # dial 423 # link 2 dial 424 # link 3 dial 425 426mloop-in: 427 set timeout 0 428 set log tun phase 429 allow mode direct 430 set mrru 1500 431