1################################################################# 2# 3# PPP Sample Configuration File 4# 5# Originally written by Toshiharu OHNO 6# 7# 8################################################################# 9 10# This file is separated into sections. Each section is named with 11# a label starting in column 0 and followed directly by a ``:''. The 12# section continues until the next label. Blank lines and characters 13# after a ``#'' are ignored (a literal ``#'' must be escaped with a ``\'' 14# or quoted with ""). All commands inside sections that do not begin 15# with ``!'' (e.g., ``!include'') *must* be indented by at least one 16# space or tab or they will not be recognized! 17# 18# Lines beginning with "!include" will ``include'' another file. You 19# may want to ``!include ~/.ppp.conf'' for backwards compatibility. 20# 21 22# Default setup. Always executed when PPP is invoked. 23# This section is *not* pre-loaded by the ``load'' or ``dial'' commands. 24# 25# This is the best place to specify your modem device, its DTR rate, 26# your dial script and any logging specification. Logging specs should 27# be done first so that the results of subsequent commands are logged. 28# 29default: 30 set log Phase Chat LCP IPCP CCP tun command 31 set device /dev/cuau1 32 set speed 115200 33 set dial "ABORT BUSY ABORT NO\\sCARRIER TIMEOUT 5 \"\" AT \ 34 OK-AT-OK ATE1Q0 OK \\dATDT\\T TIMEOUT 40 CONNECT" 35 36# Client side PPP 37# 38# Although the PPP protocol is a peer to peer protocol, we normally 39# consider the side that initiates the connection as the client and 40# the side that receives the connection as the server. Authentication 41# is required by the server either using a unix-style login procedure 42# or by demanding PAP or CHAP authentication from the client. 43# 44 45# An on demand example where we have dynamic IP addresses and wish to 46# use a unix-style login script: 47# 48# If the peer assigns us an arbitrary IP (most ISPs do this) and we 49# can't predict what their IP will be either, take a wild guess at 50# some IPs that you can't currently route to. Ppp can change this 51# when the link comes up. 52# 53# The /0 bit in "set ifaddr" says that we insist on 0 bits of the 54# specified IP actually being correct, therefore, the other side can assign 55# any IP number. 56# 57# The fourth arg to "set ifaddr" makes us send "0.0.0.0" as our requested 58# IP number, forcing the peer to make the decision. This is necessary 59# when negotiating with some (broken) ppp implementations. 60# 61# This entry also works with static IP numbers or when not in -auto mode. 62# The ``add'' line adds a `sticky' default route that will be updated if 63# and when any of the IP numbers are changed in IPCP negotiations. 64# The "set ifaddr" is required in -auto mode only. 65# It's better to put the ``add'' line in ppp.linkup when not in -auto mode. 66# 67# Finally, the ``enable dns'' line tells ppp to ask the peer for the 68# nameserver addresses that should be used. This isn't always supported 69# by the other side, but if it is, ppp will update /etc/resolv.conf with 70# the correct nameserver values at connection time. 71# 72# The login script shown says that you're expecting ``ogin:''. If you 73# don't receive that, send a ``\n'' and expect ``ogin:'' again. When 74# it's received, send ``ppp'', expect ``word:'' then send ``ppp''. 75# You *MUST* customise this login script according to your local 76# requirements. 77# 78pmdemand: 79 set phone 1234567 80 set login "ABORT NO\\sCARRIER TIMEOUT 5 ogin:--ogin: ppp word: ppp" 81 set timeout 120 82 set ifaddr 10.0.0.1/0 10.0.0.2/0 255.255.255.0 0.0.0.0 83 add default HISADDR 84 enable dns 85 86# If you want to use PAP or CHAP instead of using a unix-style login 87# procedure, do the following. Note, the peer suggests whether we 88# should send PAP or CHAP. By default, we send whatever we're asked for. 89# 90# You *MUST* customise ``MyName'' and ``MyKey'' below. 91# 92PAPorCHAPpmdemand: 93 set phone 1234567 94 set login 95 set authname "MyName" 96 set authkey "MyKey" 97 set timeout 120 98 set ifaddr 10.0.0.1/0 10.0.0.2/0 255.255.255.0 0.0.0.0 99 add default HISADDR 100 enable dns 101 102# On demand dialup example with static IP addresses: 103# Here, the local side uses 192.244.185.226 and the remote side 104# uses 192.244.176.44. 105# 106# # ppp -auto ondemand 107# 108# With static IP numbers, our setup is similar to dynamic: 109# Remember, ppp.linkup is searched for a "192.244.176.44" label, then 110# an "ondemand" label, and finally the "MYADDR" label. 111# 112ondemand: 113 set phone 1234567 114 set login "ABORT NO\\sCARRIER TIMEOUT 5 ogin:--ogin: ppp word: ppp" 115 set timeout 120 116 set ifaddr 192.244.185.226 192.244.176.44 117 add default HISADDR 118 enable dns 119 120# An on-demand dialup example using an external Terminal Adapter (TA) 121# that supports multi-link ppp itself. 122# 123# This may be specific to the AETHRA TA. 124# 125TA: 126 set phone 12345678 # Replace this with your ISPs phone number 127 128 set authname "somename" # Replace these with your login name & password. 129 set authkey "somepasswd" # This profile assumes you're using PAP or CHAP. 130 131 enable lqr echo 132 set reconnect 3 5 133 set redial 3 10 134 set lqrperiod 45 135 disable pred1 deflate mppe 136 deny pred1 deflate mppe 137 138 set dial "ABORT BUSY ABORT NO\\sCARRIER TIMEOUT 5 \"\" ATB41CL2048 \ 139 OK-AT-OK ATB40&J3E1Q0 OK \\dATDT\\T TIMEOUT 40 CONNECT" 140 set login 141 set logout 142 set hangup 143 144 set timeout 60 300 # The minimum charge period is 5 minutes, so don't 145 # hangup before then 146 147 set device /dev/cuau0 # Or whatever 148 set speed 115200 # Use as high a speed as possible 149 150 enable dns # Ask the peer what to put in resolv.conf 151 152 # Take a wild guess at an IP number and let the other side decide 153 set ifaddr 172.16.0.1/0 212.0.0.0/0 0 0 154 add! default hisaddr 155 156 set mru 1504 # Some extra room for the MP header 157 158 set server /var/run/ppp/ppp-TA "" 0177 # The diagnostic port (-rw-------) 159 160 161# Example segments 162# 163# The following lines may be included as part of your configuration 164# section and aren't themselves complete. They're provided as examples 165# of how to achieve different things. 166 167examples: 168# Multi-phone example. Numbers separated by a : are used sequentially. 169# Numbers separated by a | are used if the previous dial or login script 170# failed. Usually, you will prefer to use only one of | or :, but both 171# are allowed. 172# 173 set phone 12345678|12345679:12345670|12345671 174# 175# Some phone numbers may include # characters - don't forget to escape 176# (or quote) them: 177# 178 set phone "12345##678" 179# 180# Ppp can accept control instructions from the ``pppctl'' program. 181# First, you must set up your control socket. It's safest to use 182# a UNIX domain socket, and watch the permissions: 183# 184 set server /var/run/ppp/internet MySecretPassword 0177 185# 186# Although a TCP port may be used if you want to allow control 187# connections from other machines: 188# 189 set server 6670 MySecretpassword 190# 191# If you don't like ppp's builtin chat, use an external one: 192# 193 set login "\"!chat \\-f /etc/ppp/ppp.dev.chat\"" 194# 195# If we have a ``strange'' modem that must be re-initialized when we 196# hangup: 197# 198 set hangup "\"\" AT OK-AT-OK ATZ OK" 199# 200# To adjust logging without blowing away the setting in default: 201# 202 set log -command +tcp/ip 203# 204# To see log messages on the screen in interactive mode: 205# 206 set log local LCP IPCP CCP 207# 208# If you're seeing a lot of magic number problems and failed connections, 209# try this (see the man page): 210# 211 set openmode active 5 212# 213# For noisy lines, we may want to reconnect (up to 20 times) after loss 214# of carrier, with 3 second delays between each attempt: 215# 216 set reconnect 3 20 217# 218# When playing server for M$ clients, tell them who our NetBIOS name 219# servers are: 220# 221 set nbns 10.0.0.1 10.0.0.2 222# 223# Inform the client if they ask for our DNS IP numbers: 224# 225 enable dns 226# 227# If you don't want to tell them what's in your /etc/resolv.conf file 228# with `enable dns', override the values: 229# 230 set dns 10.0.0.1 10.0.0.2 231# 232# Some people like to prioritize DNS packets: 233# 234 set urgent udp +53 235# 236# If we're using the -nat switch, redirect ftp and http to an internal 237# machine: 238# 239 nat port tcp 10.0.0.2:ftp ftp 240 nat port tcp 10.0.0.2:http http 241# 242# or don't trust the outside at all 243# 244 nat deny_incoming yes 245# 246# I trust user brian to run ppp, so this goes in the `default' section: 247# 248 allow user brian 249# 250# But label `internet' contains passwords that even brian can't have, so 251# I empty out the user access list in that section so that only root can 252# have access: 253# 254 allow users 255# 256# I also may wish to set up my ppp login script so that it asks the client 257# for the label they wish to use. I may only want user ``dodgy'' to access 258# their own label in direct mode: 259# 260dodgy: 261 allow user dodgy 262 allow mode direct 263# 264# We don't want certain packets to keep our connection alive 265# 266 set filter alive 0 deny udp src eq 520 # routed 267 set filter alive 1 deny udp dst eq 520 # routed 268 set filter alive 2 deny udp src eq 513 # rwhod 269 set filter alive 3 deny udp src eq 525 # timed 270 set filter alive 4 deny udp src eq 137 # NetBIOS name service 271 set filter alive 5 deny udp src eq 138 # NetBIOS datagram service 272 set filter alive 6 deny tcp src eq 139 # NetBIOS session service 273 set filter alive 7 deny udp dst eq 137 # NetBIOS name service 274 set filter alive 8 deny udp dst eq 138 # NetBIOS datagram service 275 set filter alive 9 deny tcp dst eq 139 # NetBIOS session service 276 set filter alive 10 deny 0/0 MYADDR icmp # Ping to us from outside 277 set filter alive 11 permit 0/0 0/0 278# 279# And in auto mode, we don't want certain packets to cause a dialup 280# 281 set filter dial 0 deny udp src eq 513 # rwhod 282 set filter dial 1 deny udp src eq 525 # timed 283 set filter dial 2 deny udp src eq 137 # NetBIOS name service 284 set filter dial 3 deny udp src eq 138 # NetBIOS datagram service 285 set filter dial 4 deny tcp src eq 139 # NetBIOS session service 286 set filter dial 5 deny udp dst eq 137 # NetBIOS name service 287 set filter dial 6 deny udp dst eq 138 # NetBIOS datagram service 288 set filter dial 7 deny tcp dst eq 139 # NetBIOS session service 289 set filter dial 8 deny tcp finrst # Badly closed TCP channels 290 set filter dial 9 permit 0 0 291# 292# Once the line's up, allow these connections 293# 294 set filter in 0 permit tcp dst eq 113 # ident 295 set filter out 0 permit tcp src eq 113 # ident 296 set filter in 1 permit tcp src eq 23 estab # telnet 297 set filter out 1 permit tcp dst eq 23 # telnet 298 set filter in 2 permit tcp src eq 21 estab # ftp 299 set filter out 2 permit tcp dst eq 21 # ftp 300 set filter in 3 permit tcp src eq 20 dst gt 1023 # ftp-data 301 set filter out 3 permit tcp dst eq 20 # ftp-data 302 set filter in 4 permit udp src eq 53 # DNS 303 set filter out 4 permit udp dst eq 53 # DNS 304 set filter in 5 permit 192.244.191.0/24 0/0 # Where I work 305 set filter out 5 permit 0/0 192.244.191.0/24 # Where I work 306 set filter in 6 permit icmp # pings 307 set filter out 6 permit icmp # pings 308 set filter in 7 permit udp dst gt 33433 # traceroute 309 set filter out 7 permit udp dst gt 33433 # traceroute 310 311# 312# ``dodgynet'' is an example intended for an autodial configuration which 313# is connecting a local network to a host on an untrusted network. 314dodgynet: 315 set log Phase # Log link uptime 316 allow mode auto # For autoconnect only 317 set device /dev/cuau1 # Define modem device and speed 318 set speed 115200 319 deny lqr # Don't support LQR 320 set phone 0W1194 # Remote system phone number, 321 set authname "pppLogin" # login 322 set authkey "MyPassword" # and password 323 set dial "ABORT BUSY ABORT NO\\sCARRIER \ # Chat script to dial the peer 324 TIMEOUT 5 \"\" ATZ OK-ATZ-OK \ 325 ATE1Q0M0 OK \\dATDT\\T \ 326 TIMEOUT 40 CONNECT" 327 set login "TIMEOUT 10 \"\" \"\" \ # And to login to remote system 328 gin:--gin: \\U word: \\P" 329 330 # Drop the link after 15 minutes of inactivity 331 # Inactivity is defined by the `set filter alive' line below 332 set timeout 900 333 334 # Hard-code remote system to appear within local subnet and use proxy arp 335 # to make this system the gateway for the rest of the local network 336 set ifaddr 172.17.20.247 172.17.20.248 255.255.240.0 337 enable proxy 338 339 # Allow any TCP packet to keep the link alive 340 set filter alive 0 permit tcp 341 342 # Only allow dialup to be triggered by http, rlogin, rsh, telnet, ftp or 343 # private TCP ports 24 and 4000 344 set filter dial 0 7 0 0 tcp dst eq http 345 set filter dial 1 7 0 0 tcp dst eq login 346 set filter dial 2 7 0 0 tcp dst eq shell 347 set filter dial 3 7 0 0 tcp dst eq telnet 348 set filter dial 4 7 0 0 tcp dst eq ftp 349 set filter dial 5 7 0 0 tcp dst eq 24 350 set filter dial 6 deny ! 0 0 tcp dst eq 4000 351 352 # From hosts on a couple of local subnets to the remote peer 353 # If the remote host allowed IP forwarding and we wanted to use it, the 354 # following rules could be split into two groups to separately validate 355 # the source and destination addresses. 356 set filter dial 7 permit 172.17.16.0/20 172.17.20.248 357 set filter dial 8 permit 172.17.36.0/22 172.17.20.248 358 set filter dial 9 permit 172.17.118.0/26 172.17.20.248 359 set filter dial 10 permit 10.123.5.0/24 172.17.20.248 360 361 # Once the link's up, limit outgoing access to the specified hosts 362 set filter out 0 4 172.17.16.0/20 172.17.20.248 363 set filter out 1 4 172.17.36.0/22 172.17.20.248 364 set filter out 2 4 172.17.118.0/26 172.17.20.248 365 set filter out 3 deny ! 10.123.5.0/24 172.17.20.248 366 367 # Allow established TCP connections 368 set filter out 4 permit 0 0 tcp estab 369 370 # And new connections to http, rlogin, rsh, telnet, ftp and ports 371 # 24 and 4000 372 set filter out 5 permit 0 0 tcp dst eq http 373 set filter out 6 permit 0 0 tcp dst eq login 374 set filter out 7 permit 0 0 tcp dst eq shell 375 set filter out 8 permit 0 0 tcp dst eq telnet 376 set filter out 9 permit 0 0 tcp dst eq ftp 377 set filter out 10 permit 0 0 tcp dst eq 24 378 set filter out 11 permit 0 0 tcp dst eq 4000 379 380 # And outgoing icmp 381 set filter out 12 permit 0 0 icmp 382 383 # Once the link's up, limit incoming access to the specified hosts 384 set filter in 0 4 172.17.20.248 172.17.16.0/20 385 set filter in 1 4 172.17.20.248 172.17.36.0/22 386 set filter in 2 4 172.17.20.248 172.17.118.0/26 387 set filter in 3 deny ! 172.17.20.248 10.123.5.0/24 388 389 # Established TCP connections and non-PASV FTP 390 set filter in 4 permit 0/0 0/0 tcp estab 391 set filter in 5 permit 0/0 0/0 tcp src eq 20 392 393 # Useful ICMP messages 394 set filter in 6 permit 0/0 0/0 icmp src eq 3 395 set filter in 7 permit 0/0 0/0 icmp src eq 4 396 set filter in 8 permit 0/0 0/0 icmp src eq 11 397 set filter in 9 permit 0/0 0/0 icmp src eq 12 398 399 # Echo reply (local systems can ping the remote host) 400 set filter in 10 permit 0/0 0/0 icmp src eq 0 401 402 # And the remote host can ping the local gateway (only) 403 set filter in 11 permit 0/0 172.17.20.247 icmp src eq 8 404 405 406# Server side PPP 407# 408# If you want the remote system to authenticate itself, you must insist 409# that the peer uses CHAP or PAP with the "enable" keyword. Both CHAP and 410# PAP are disabled by default. You may enable either or both. If both 411# are enabled, CHAP is requested first. If the client doesn't agree, PAP 412# will then be requested. 413# 414# Note: If you use the getty/login process to authenticate users, you 415# don't need to enable CHAP or PAP, but the user that has logged 416# in *MUST* be a member of the ``network'' group (in /etc/group). 417# 418# Note: Chap80 and chap81 are Microsoft variations of standard chap (05). 419# 420# If you wish to allow any user in the passwd database ppp access, you 421# can ``enable passwdauth'', but this will only work with PAP. 422# 423# When the peer authenticates itself, we use ppp.secret for verification 424# (although refer to the ``set radius'' command below for an alternative). 425# 426# Note: We may supply a third field in ppp.secret specifying the IP 427# address for that user, a fourth field to specify the 428# ppp.link{up,down} label to use and a fifth field to specify 429# callback characteristics. 430# 431# The easiest way to allow transparent LAN access to your dialin users 432# is to assign them a number from your local LAN and tell ppp to make a 433# ``proxy'' arp entry for them. In this example, we have a local LAN 434# with IP numbers 10.0.0.1 - 10.0.0.99, and we assign numbers to our 435# ppp clients between 10.0.0.100 and 10.0.0.199. It is possible to 436# override the dynamic IP number with a static IP number specified in 437# ppp.secret. 438# 439# Ppp is launched with: 440# # ppp -direct server 441# 442server: 443 enable chap chap80 chap81 pap passwdauth 444 enable proxy 445 set ifaddr 10.0.0.1 10.0.0.100-10.0.0.199 446 accept dns 447 448# Example of a RADIUS configuration: 449# If there are one or more radius servers available, we can use them 450# instead of the ppp.secret file. Simply put then in a radius 451# configuration file (usually /etc/radius.conf) and give ppp the 452# file name. 453# Ppp will use the FRAMED characteristics supplied by the radius server 454# to configure the link. 455 456radius-server: 457 load server # load in the server config from above 458 set radius /etc/radius.conf 459 460 461# Example to connect using a null-modem cable: 462# The important thing here is to allow the lqr packets on both sides. 463# Without them enabled, we can't tell if the line's dropped - there 464# should always be carrier on a direct connection. 465# Here, the server sends lqr's every 10 seconds and quits if five in a 466# row fail. 467# 468# Make sure you don't have "deny lqr" in your default: on the client ! 469# If the peer denies LQR, we still send ECHO LQR packets at the given 470# lqrperiod interval (ppp-style-pings). 471# 472direct-client: 473 set dial 474 set device /dev/cuau0 475 set sp 115200 476 set timeout 900 477 set lqrperiod 10 478 set log Phase Chat LQM 479 set login "ABORT NO\\sCARRIER TIMEOUT 5 ogin:--ogin: ppp word: ppp HELLO" 480 set ifaddr 10.0.4.2 10.0.4.1 481 enable lqr echo 482 accept lqr 483 484direct-server: 485 set timeout 0 486 set lqrperiod 10 487 set log Phase LQM 488 set ifaddr 10.0.4.1 10.0.4.2 489 enable lqr echo 490 accept lqr 491 492 493# Example to connect via compuserve 494# Compuserve insists on 7 bits even parity during the chat phase. Modem 495# parity is always reset to ``none'' after the link has been established. 496# 497compuserve: 498 set phone 1234567 499 set parity even 500 set login "TIMEOUT 100 \"\" \"\" Name: CIS ID: 999999,9999/go:pppconnect \ 501 word: XXXXXXXX PPP" 502 set timeout 300 503 set ifaddr 10.0.0.1/0 10.0.0.2/0 255.255.255.0 0.0.0.0 504 delete ALL 505 add default HISADDR 506 507 508# Example for PPP over TCP. 509# We assume that inetd on tcpsrv.mynet has been 510# configured to run "ppp -direct tcp-server" when it gets a connection on 511# port 1234 with an entry something like this in /etc/inetd.conf.: 512# 513# ppp stream tcp nowait root /usr/sbin/ppp ppp -direct tcp-server 514# 515# with this in /etc/services: 516# 517# ppp 6671/tcp 518# 519# Read the man page for further details. 520# 521# Note, we assume we're using a binary-clean connection. If something 522# such as `rlogin' is involved, you may need to ``set escape 0xff'' 523# 524tcp-client: 525 set device tcpsrv.mynet:6671 526 set dial 527 set login 528 set ifaddr 10.0.5.1 10.0.4.1 255.255.255.0 529 530tcp-server: 531 set ifaddr 10.0.4.1 10.0.5.1 255.255.255.0 532 533 534# Using UDP is also possible with this in /etc/inetd.conf: 535# 536# ppp dgram udp wait root /usr/sbin/ppp ppp -direct udp-server 537# 538# and this in /etc/services: 539# 540# ppp 6671/udp 541# 542udp-client: 543 set device udpsrv.mynet:6671/udp 544 set dial 545 set login 546 set ifaddr 10.0.5.1 10.0.4.1 255.255.255.0 547 548udp-server: 549 set ifaddr 10.0.4.1 10.0.5.1 255.255.255.0 550 551 552# Example for PPP testing. 553# If you want to test ppp, do it through the loopback interface: 554# 555# Requires a line in /etc/services: 556# ppploop 6671/tcp # loopback ppp daemon 557# 558# and a line in /etc/inetd.conf: 559# ppploop stream tcp nowait root /usr/sbin/ppp ppp -direct inet-loop-in 560# 561inet-loop: 562 set timeout 0 563 set log phase chat connect lcp ipcp command 564 set device localhost:ppploop 565 set dial 566 set login 567 set ifaddr 127.0.0.2 127.0.0.3 568 set server /var/run/ppp/loop "" 0177 569 570inet-loop-in: 571 set timeout 0 572 set log phase lcp ipcp command 573 allow mode direct 574 575# Example of a VPN. 576# If you're going to create a tunnel through a public network, your VPN 577# should be set up something like this: 578# 579# You should already have set up ssh using ssh-agent & ssh-add. 580# 581sloop: 582 load inet-loop 583 # Passive mode allows ssh plenty of time to establish the connection 584 set openmode passive 585 set device "!ssh whatevermachine /usr/sbin/ppp -direct inet-loop-in" 586 587 588# or a better VPN solution (which doesn't run IP over a reliable 589# protocol like tcp) may be: 590# 591vpn-client: 592 set device udpsrv.mynet:1234/udp # PPP over UDP 593 set dial 594 set login 595 set ifaddr 10.0.5.1 10.0.4.1 255.255.255.0 596 disable deflate pred1 597 deny deflate pred1 598 enable MPPE # With encryption 599 accept MPPE 600 601vpn-server: 602 set ifaddr 10.0.4.1 10.0.5.1 255.255.255.0 603 disable deflate pred1 604 deny deflate pred1 605 enable MPPE 606 accept MPPE 607 enable chap81 # Required for MPPE 608 609# Example of non-PPP callback. 610# If you wish to connect to a server that will dial back *without* using 611# the ppp callback facility (rfc1570), take advantage of the fact that 612# ppp doesn't look for carrier 'till `set login' is complete: 613# 614# Here, we expect the server to say DIALBACK then disconnect after 615# we've authenticated ourselves. When this has happened, we wait 616# 60 seconds for a RING. 617# 618# Note, it's important that we tell ppp not to expect carrier, otherwise 619# we'll drop out at the ``NO CARRIER'' stage. 620# 621dialback: 622 set dial "ABORT BUSY ABORT NO\\sCARRIER TIMEOUT 5 \"\" ATZ OK-ATZ-OK \ 623 ATDT\\T TIMEOUT 60 CONNECT" 624 set cd off 625 set login "TIMEOUT 5 ogin:--ogin: ppp word: ppp TIMEOUT 15 DIALBACK \ 626 \"\" NO\\sCARRIER \"\" TIMEOUT 60 RING ATA CONNECT" 627 628# Example of PPP callback. 629# Alternatively, if the peer is using the PPP callback protocol, we're 630# happy either with ``auth'' style callback where the server dials us 631# back based on what we authenticate ourselves with, ``cbcp'' style 632# callback (invented by Microsoft but not agreed by the IETF) where 633# we negotiate callback *after* authentication or E.164 callback where 634# we specify only a phone number. I would recommend only ``auth'' and/or 635# ``cbcp'' callback methods. 636# For ``cbcp'', we insist that we choose ``1234567'' as the number that 637# the server must call back. 638# 639callback: 640 load pmdemand # load in the pmdemand config 641 set callback auth cbcp e.164 1234567 642 set cbcp 1234567 643 644# If we're running a ppp server that wants to only call back microsoft 645# clients on numbers configured in /etc/ppp/ppp.secret (the 5th field): 646# 647callback-server: 648 load server 649 set callback cbcp 650 set cbcp 651 set log +cbcp 652 set redial 3 1 653 set device /dev/cuau0 654 set speed 115200 655 set dial "TIMEOUT 10 \"\" AT OK-AT-OK ATDT\\T CONNECT" 656 657# Or if we want to allow authenticated clients to specify their own 658# callback number: 659# 660callback-server-client-decides: 661 load callback-server 662 set cbcp * 663 664# Multilink mode is available (rfc1990). 665# To enable multi-link capabilities, you must specify a MRRU. 1500 is 666# a reasonable value. To create new links, use the ``clone'' command 667# to duplicate an existing link. If you already have more than one 668# link, you must specify which link you wish to run the command on via 669# the ``link'' command. 670# 671# It's worth increasing your MTU and MRU slightly in multi-link mode to 672# prevent full packets from being fragmented. 673# 674# You can now ``dial'' specific links, or even dial all links at the 675# same time. The `dial' command may also be prefixed with a specific 676# link that should do the dialing. 677# 678mloop: 679 load loop 680 set device /dev/cuau0 /dev/cuau1 /dev/cuau2 # Use any of these devices 681 set mode interactive 682 set mrru 1500 683 set mru 1504 # Room for the MP header 684 clone 1 2 3 685 link deflink remove 686 # dial 687 # link 2 dial 688 # link 3 dial 689 690mloop-in: 691 set timeout 0 # No idle timer 692 set log tun phase 693 allow mode direct 694 set mrru 1500 695 set mru 1504 # Room for the MP header 696 697# User supplied authentication: 698# It's possible to run ppp in the background while specifying a 699# program to use to obtain authentication details on demand. 700# This program would usually be a simple GUI that presents a 701# prompt to a known user. The ``chap-auth'' program is supplied 702# as an example (and requires tcl version 8.0). 703# 704CHAPprompt: 705 load PAPorCHAPpmdemand 706 set authkey !/usr/share/examples/ppp/chap-auth 707 708# It's possible to do the same sort of thing at the login prompt. 709# Here, after sending ``brian'' in response to the ``name'' prompt, 710# we're prompted with ``code:''. A window is then displayed on the 711# ``keep:0.0'' display and the typed response is sent to the peer 712# as the password. We then expect to see ``MTU'' and ``.'' in the 713# servers response. 714# 715loginprompt: 716 load pmdemand 717 set authname "brian" 718 set login "ABORT NO\\sCARRIER TIMEOUT 15 \"\" \"\" name:--name: \\U \ 719 code: \"!/usr/share/examples/ppp/login-auth -display keep:0.0 \ 720 AUTHNAME\" MTU \\c ." 721 722# ppp supports ppp over ethernet (PPPoE). Beware, many PPP servers cache 723# the MAC address that connects to them, making it impossible to switch 724# your PPPoE connection between machines. 725# 726# The current implementation requires Netgraph, so it doesn't work with 727# OpenBSD or NetBSD. 728# 729# The client should be something like this: 730# 731pppoe: 732 set device PPPoE:de0:pppoe-in 733 enable lqr echo 734 set cd 5 735 set dial 736 set login 737 set redial 0 0 738 739# And the server should be running 740# 741# /usr/libexec/pppoed -p pppoe-in fxp0 742# 743# See rc.conf(5) 744# 745pppoe-in: 746 allow mode direct # Only for use on server-side 747 enable lqr echo proxy # Enable LQR and proxy-arp 748 enable chap pap passwdauth # Force client authentication 749 set ifaddr 10.0.0.1 10.0.0.100-10.0.0.199 # Hand out up to 100 IP numbers 750 accept dns # Allow DNS negotiation 751 752# It's possible to run ppp back-to-back with itself. This is useful 753# for testing. 754# 755# When testing scalability and concurrency, the following profile might 756# be used. 757# 758# Note, you'll have to make some other machine adjustments: 759# 760# o Bump maxusers in your kernel configuration to about 256 so that there 761# are enough process table slots. 762# o Bump system file descriptors with ``sysctl kern.maxfiles=20480''. You'll 763# need 3 descriptors per ppp process (assuming no server socket). 764# 765# You can now create 2000 processes (1000 pairs) with: 766# 767# n=0 768# while [ $n -lt 1000 ]; do ppp -b loop; n=$(($n + 1)); done 769# 770# If you want to test concurrency, try using ``ppp -dd loop'' instead. 771# 772loop: 773 set timeout 0 774 set log 775 set device "!ppp -direct loop-in" 776 set dial 777 set login 778 set ifaddr 10.0.1.1/0 10.0.10.1-10.0.19.255 779 disable deflate pred1 mppe 780 deny deflate pred1 mppe 781 782loop-in: 783 set timeout 0 784 set log 785 allow mode direct 786 set ifaddr 10.0.10.1/0 10.0.1.1-10.0.9.255 787 disable deflate pred1 mppe 788 deny deflate pred1 mppe 789