NetworkManager and PPTP in Intepid Ibex

Of all the things that I love about our campus, trying to connect to our Microsoft VPN with a vanilla installation of Ubuntu seems to top the list. Inevitably, I forget all of the specifics of what comprises a “Microsoft VPN” connection, and am overwhelmed by the myriad of shit thrown at my by the NetworkManager VPN interface. To add to it, I seem to suffer from “VPN failed to connect” ad nauseum trying find the right combination of settings that will work.

Well, here it is – documented for all time.

Setup:

From a vanilla installation of Intrepid Ibex, you will first need to install VPN support to be able to setup this connection. To do this, fire up Synaptic Package Manager (under System -> Administration), and search for “network-manager-pptp” (or from a terminal: “sudo network-manager-pptp”). Once this is installed, you will need to issue a command to restart NetworkManager with its new plugin: “sudo NetworkManager restart”.

For the maintainers of Ubuntu / NetworkManager / PPTP let me point out a few things:

• Ubuntu should ship with network-manager-pptp by default.
• NetworkManager should be accessible using a lower-cased entry inside of “/usr/sbin/” .
• There should be a script for NetworkManager in “/etc/init.d/” like for everything else.

Moving along – now VPN should be available in NetworkManager. Click on “Add” and setup your information. Take special care to observe the following issues:

• The gateway is just the DNS name – no “http://”, etc
• The username should by your Microsoft domain name, followed by a backslash, then your username.
• Leave the password blank here – it is buggy and doesn’t integrate into the Gnome Keyring as it should.
• Leave the Domain field blank – this was taken care of by the username.

Click on “Advanced”, and check that the option for MPPE is checked. If your network requires Protected EAP (PEAP), then you will need to do one additional step (horribly not accessible from the GUI):

For PEAP, run “gconf-editor” from a terminal, and navigate to “system” -> “networking” -> “connections” -> “1”, or “2”, etc -> “vpn”. Locate the entry that corresponds to your VPN connection in question. Create a new key under this connection called, “refuse-eap”.  Make it of type “string”, and its value should be set to “yes”.

Now choose to connect to the VPN connection, and type in your password, and optionally select to remember the password in the Gnome Keyring. This is a work-around for it not saving in the keyring earlier.

Routing:

Is your VPN connection slow? Wouldn’t it be nice if you could just use the VPN for work resources, and leave the rest of the Internet accessible through your local connection? Welcome to the magic of routes. Despite the intimidating name, they are fairly easy to setup.

To see what routes are available, run the following from a terminal: “sudo route -n”. See the network connections (eth0, etc), and your “ppp0” connection if you have connected to a VPN? The connection with the destination of 0.0.0.0 is your “default” route – in other words, where all outbound traffic goes unless otherwise specified in this list.

Try toggling your VPN connection and looking at the output to make more sense of it.

The old NetworkManager had a place where you could specify an IP address range. For our campus network, it was “168.28.0.0/16”. See this post for more information.

In the lastest NetworkManager (0.7.0), this “easy” configuration has been swapped out for one that is more confusing IMO. Go back to the VPN configuration screen, then click on the “IPv4” tab. Click on the “Routes” button. Enter in the following values if you wanted to convert “168.28.0.0/16” into the new format:

• Address: 168.28.0.0
• Prefix: 16
• Gateway: 0.0.0.0
• Metric: 0

Disconnect, then reconnect from the VPN server to have the changes take effect. Running “sudo route -n” should now show the new “ppp0” not as default, but as the new route for “168.28.0.0” addresses.

More suggestions for the maintainers:

• For the Ubuntu maintainer: How about shipping with pre-configured VPN profiles?
• Can the new “Routes” interface optionally include either format?
• For the NetworkManager / PPTP maintainers: Is it possible to have less verbose, but more relevant output? Is it possible to run a check against a VPN domain and find out what settings are supported / required?