Frickin PPTP Proxy
==================

Introduction
~~~~~~~~~~~~
PPTP uses two connections when creating a secure connection.  It needs
one tcp connection called Control Connection and one gre, generic
routing encapsulation, connection for the actual tunneled data.
Unfortunately the gre protocol has no knowledge of ports, instead each
gre packet is tagged with a Call-ID.  The Call-ID is used at the
endpoints to multiplex multiple connections, as most firewalls do not
understand the PPTP protocol they cannot make use of the Call-ID which
restricts you to one tunnel thru a NAT'ed firewall.

This is where you need a proxy, the proxy will parse the Control
channel and by doing so it can use the Call-ID in gre packets to
redirect them to their intended destination(s).


Build & Compile
~~~~~~~~~~~~~~~
Frickin should compile on any *BSD system simply by running 'make'.
It may compile on other systems as well but this is not supported and
has not been tested.


Installation
~~~~~~~~~~~~
Having successfully compiled Frickin you should move/copy the binary
to a suitable location on your server, eg. /usr/local/sbin/.  You will
also want to have Frickin to start on system boot but this will not be
covered in this text.

Setup 1:

   +-----+    +-----+    +--------+                    +-----------+
   |USER1|----|PROXY|----|FIREWALL|----- INTERNET -----|PPTP SERVER|
   +-----+   /+-----+    +--------+                    +-----------+
            /    |
   +-----+ /  +-----+
   |USER2|/   |USER3|
   +-----+    +-----+

In this setup we have users, behind a firewall, that need to connect
to an external PPTP server.  In this case it is not possible to run
the proxy on the firewall itself so the proxy is installed on a
machine on the inside.  This way all clients must connect to the IP of
the internal proxy machine which will forward all connections and data
to the real PPTP server.


Setup 2:

              +--------+
   +-----+    | PROXY  |                    +-----------+
   |USER1|----|FIREWALL|----- INTERNET -----|PPTP SERVER|
   +-----+   /+--------+                    +-----------+
            /    |
   +-----+ /  +-----+
   |USER2|/   |USER3|
   +-----+    +-----+

This setup is not very different from previous except that the proxy
can be run on the firewall itself.  Users still need to connect
directly to the proxy, in this case the internal IP of the firewall.


Setup 3:
               ___
   +-----+    (   )
   |USER1|====( R ) - INTERNET -
   +-----+    ( R )              \
              ( O )                \
   +-----+    ( X )                +-----------+
   |USER2|====( Y ) - INTERNET - - |PPTP SERVER|
   +-----+    (   )                +-----------+
              (   )                /
   +-----+    ( F )              /
   |USER3|====( W ) - INTERNET -
   +-----+    (___)

Here we have a firewall with the proxy running locally on the loopback
interface (127.0.0.1).  All users are connecting to the real IP of the
PPTP server which is redirected by the firewall to the loopback
interface.  This is the preferred installation method as the proxy
will be completely transparent to all users as there is no need to
connect to an internal IP.  If you can install the proxy directly on
your firewall and if it does support redirects of TCP and GRE packets
you should use this method.  It is not neccesary to bind on the
loopback interface for this setup, you can bind to any interface as
long as packets can be redirected there.


Verified operatingsystems
~~~~~~~~~~~~~~~~~~~~~~~~~
Frickin has been verified and tested on the following systems and setups:
FreeBSD 5.2.1		Setup 1 & 2
MacOS X 10.3.5		Setup 1 & 2
OpenBSD 3.5 - 3.6	Setup 1, 2 & 3

Additional configuration on OpenBSD
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
By default gre packets are not allowed to enter the ip stack and needs
to be enabled by hand.  This is done by setting the sysctl option
"net.inet.gre.allow" to 1.

	# sysctl -w net.inet.gre.allow=1

For this option to be enabled after reboot you should add it to
'/etc/sysctl.conf'.


Running
~~~~~~~
Frickin supports the following command line parameters:
	-s	Ip address of the PPTP server
	-l	Ip address on which to listen for incoming connections
		(default: 127.0.0.1)
	-c	The maximum number of concurrent tunnels (default: 20)
	-u	User to run the daemon as, you should specify an
		unprivileged user like 'nobody' here.


Support
~~~~~~~
If you are having problems with Frickin, found some bugs or just have
ideas for enhancements do not hesitate to contact me.  I will however
not provide you with any support on PPTP servers or clients, as long
as you have questions about the proxy I'll try my best to help.  


http://sourceforge.net/projects/frickin/
