各位好，再次打搅，小弟去年就遇到这个问题一直未找到解决办法（汗……）
利用 Debian + PPTP 作 VPN 服务，客户端能正常登录分配到合法的地址，并能访问VPN服务器所在网段( 59.65.196.0/24 ) 但是无法访问VPN服务器外的网段（单位服务器属一个网段，全是公网地址，其它网络设备――如交换机――和用户个人电脑都是内网地址 192.168.x.x） 这样的话就无法通过VPN远程管理交换机了，关键时候（内部网络故障）起不了作用 请帮忙分析是何原因，非常感谢！ 我自己感觉是少配置了什么东西，但是在网上也没有找到相应的说明。 当时配置基本上是参照这两篇文章：http://pigtail.net/nicholas/pptp/ http://www.yxyr.com/post/344.html 我的配置如下： # cat /etc/pptpd.conf ####... option /etc/ppp/pptpd-options ###.... logwtmp ####... localip 59.65.196.63 remoteip 59.65.196.250-254 # cat /etc/ppp/pptpd-options # Authentication name pptpd # Encryption # Debian: on systems with a kernel built with the package # kernel-patch-mppe >= 2.4.2 and using ppp >= 2.4.2, ... # {{{ refuse-pap refuse-chap refuse-mschap # Require the peer to authenticate itself using MS-CHAPv2 [Microsoft # Challenge Handshake Authentication Protocol, Version 2] authentication. require-mschap-v2 # Require MPPE 128-bit encryption # (note that MPPE requires the use of MSCHAP-V2 during authentication) require-mppe-128 # }}} # Network and Routing # If pppd is acting as a server for Microsoft Windows clients, this # option allows pppd to supply one or two DNS (Domain Name Server) # addresses to the clients. The first instance of this option # specifies the primary DNS address; the second instance (if given) # specifies the secondary DNS address. # Attention! This information may not be taken into account by a Windows # client. See KB311218 in Microsoft's knowledge base for more information. #ms-dns 10.0.0.1 #ms-dns 10.0.0.2 # If pppd is acting as a server for Microsoft Windows or "Samba" # clients, this option allows pppd to supply one or two WINS (Windows # Internet Name Services) server addresses to the clients. The first # instance of this option specifies the primary WINS address; the # second instance (if given) specifies the secondary WINS address. #ms-wins 10.0.0.3 #ms-wins 10.0.0.4 # Add an entry to this system's ARP [Address Resolution Protocol] # table with the IP address of the peer and the Ethernet address of this # system. This will have the effect of making the peer appear to other # systems to be on the local ethernet. # (you do not need this if your PPTP server is responsible for routing # packets to the clients -- James Cameron) proxyarp # Debian: do not replace the default route nodefaultroute # Miscellaneous # Create a UUCP-style lock file for the pseudo-tty to ensure exclusive # access. lock # Disable BSD-Compress compression nobsdcomp # cat /etc/sysctl.conf # Uncomment the next line to enable packet forwarding for IPv4 net.ipv4.conf.default.forwarding=1 -- 0000 MININEWS.INFO mininews是一个业界微新闻站点，添加[email protected]为msn好友 做最敏捷的媒体，人人都可以是记者，关注身边正在发生的事。[M]
