Any working PPTP VPN Server setup instructions out there?

[psherman]

@n4mwd

Most of the RAM was chewed up by samba not wireguard. Probably about 50MB worth. I've never seen Samba take that much before, but it did here.

I was surprised when you said that you were seeing such low amounts of free RAM. But clearly you have found that it is not WG that is responsible for the RAM usage. And yes, samba4 is much larger than 3.x, so this makes sense.

@n4mwd

Must not interfere with the normal operation of the wired router. So the router and its existing port forwards must operate locally just like they always did. Both LAN and WLAN devices must retain the same local static IP's they have now.

Not a problem.

@n4mwd

VPN Clients connected into the wired VPN server router will appear to the public like they are coming from the same public IP as the wired server router.

Also not a problem. You'll simply allow forwarding from the VPN to the WAN.

@n4mwd

The VPN clients will also have access to the wired router's LAN as if they were physically connected. So while they are connected to the VPN, they would have access to the router's web page 192.168.1.1 and printers, etc.. Most likely, but not required, this means they would get their local IP from the VPN server router.

Yes, but there is some nuance here. In most cases, you will indeed be able to connect to the systems as if you were local, but this needs to be done by hostname or IP address. MDNS and other 'autodiscovery'/'zero config' networking technologies do not work across subnets (generally speaking), so things like AirPrint or chromecast or Sonos controllers will not work -- these protocols are designed to only work on the local subnet. There are ways around this, but it may significantly increase the overhead/bandwidth of the VPN connection, and may not work universally. The other thing to know is that certain systems -- Windows in particular -- will have their firewalls set to only accept connections from the local subnet. That means that you may need to make adjustments to the firewalls on those devices to ensure that they will allow the connections from the remote VPN peers.

As far as the IP addressing of the VPN 'clients' is concerned - this is done as part of the configuration -- each peer will have an IP address that is known and consistent, but there isn't an automatic addressing method like DHCP.

@n4mwd

Incoming connections to the wired VPN router server will be selectively forwarded, based on port number, to the VPN client machine.

I haven't done this (yet) myself, but I am 99% positive that it will work properly. I now that this can be done.

@n4mwd

The VPN system must be able to effectively bypass the carrier grade NAT on the client side. This must be done in a way that doesn't run up the data bill on the client side.

This is one of the great things about WG -- it is not chatty and is very efficient. This means low data usage when there isn't any active data transmissions, and low overhead when you are moving data between the sites. And yes, because your 4G site will be a 'client', it will be able to connect back to the system on the wired ISP without any issues.

@n4mwd

The VPN system must not require static public IP addresses and must work, if required, with DDNS names.

Yup, this works without any issues. This is how I use mine.

@n4mwd

OpenWRT router that will connect only specific devices to the VPN

You'll use VPN Policy Based Routing to achieve this. Absolutely not an issue.

@n4mwd

Some of the VPN connected devices are dumb devices that have no concept of VPNs or IPv6. If a device is connected to the VPN, it is full time and will not be switched on and off the VPN.

The downstream devices don't need to have any knowledge of the VPN... it just works. The router will setup what amounts to a transparent tunnel.

@n4mwd

For client router devices that are not connected to this VPN, the OpenWRT router must pass normal traffic and act as a normal router including the ability to pass other peoples VPN traffic not related to our wired VPN router.

VPN PBR will handle this.

@n4mwd

Lastly, my security goals are not to hide my content, but rather to prevent unauthorized folks from getting in and messing with my stuff.

You can actually generally treat these as one and the same. And WG is good for this application.

@n4mwd

Did I say how much I miss Tomato's one click VPN?

DD-WRT has this (to a degree) as well. But Tomato and DD-WRT are not flexible systems... if your configuration doesn't fit neatly into the box, it won't work. OpenWrt is far more flexible.

@n4mwd

I hope the OpenWRT developers are reading this. It shouldn't be this hard to set up a VPN, or SSH, or Parental Controls, or guest access.

To a degree, this is about documentation more than development. Use any analogy you like here -- cars, computers, home theater setups, etc. -- there is a tradeoff here... typically systems that are optimized for ease of use have less flexibility and really work with a prescribed set of features/functions, where as the most flexible systems often cannot be as well optimized for ease of use because they allow the user to do all sorts of things that may not have been prescribed by the designers. No, you're not the only one who has trouble with setting this stuff up, but the forums exist to help. In time, you may learn enough (if you want to) to be like "yeah, I know how to do all of this stuff and I can even help others with different needs."