没仔细看，是从59.65.196.0/24没法访问到192.168.0.0/16这里。 你在vpn服务器从iptables做一个转发应该就可以了。
Feng Lu 写道: > 各位好，再次打搅，小弟去年就遇到这个问题一直未找到解决办法（汗……） > > 利用 Debian + PPTP 作 VPN 服务，客户端能正常登录分配到合法的地址，并能 > 访问VPN服务器所在网段( 59.65.196.0/24 <http://59.65.196.0/24> ) > 但是无法访问VPN服务器外的网段（单位服务器属一个网段，全是公网地址，其 > 它网络设备――如交换机――和用户个人电脑都是内网地址 192.168.x.x） > 这样的话就无法通过VPN远程管理交换机了，关键时候（内部网络故障）起不了作用 > 请帮忙分析是何原因，非常感谢！ > > 我自己感觉是少配置了什么东西，但是在网上也没有找到相应的说明。 > 当时配置基本上是参照这两篇文章：http://pigtail.net/nicholas/pptp/ > http://www.yxyr.com/post/344.html > > 我的配置如下： > > # cat /etc/pptpd.conf > ####... > option /etc/ppp/pptpd-options > ###.... > logwtmp > ####... > localip 59.65.196.63 > remoteip 59.65.196.250-254 > > # cat /etc/ppp/pptpd-options > # Authentication > name pptpd > > # Encryption > # Debian: on systems with a kernel built with the package > # kernel-patch-mppe >= 2.4.2 and using ppp >= 2.4.2, ... > # {{{ > refuse-pap > refuse-chap > refuse-mschap > # Require the peer to authenticate itself using MS-CHAPv2 [Microsoft > # Challenge Handshake Authentication Protocol, Version 2] authentication. > require-mschap-v2 > # Require MPPE 128-bit encryption > # (note that MPPE requires the use of MSCHAP-V2 during authentication) > require-mppe-128 > # }}} > > # Network and Routing > > # If pppd is acting as a server for Microsoft Windows clients, this > # option allows pppd to supply one or two DNS (Domain Name Server) > # addresses to the clients. The first instance of this option > # specifies the primary DNS address; the second instance (if given) > # specifies the secondary DNS address. > # Attention! This information may not be taken into account by a Windows > # client. See KB311218 in Microsoft's knowledge base for more information. > #ms-dns 10.0.0.1 > #ms-dns 10.0.0.2 > > # If pppd is acting as a server for Microsoft Windows or "Samba" > # clients, this option allows pppd to supply one or two WINS (Windows > # Internet Name Services) server addresses to the clients. The first > # instance of this option specifies the primary WINS address; the > # second instance (if given) specifies the secondary WINS address. > #ms-wins 10.0.0.3 > #ms-wins 10.0.0.4 > > # Add an entry to this system's ARP [Address Resolution Protocol] > # table with the IP address of the peer and the Ethernet address of this > # system. This will have the effect of making the peer appear to other > # systems to be on the local ethernet. > # (you do not need this if your PPTP server is responsible for routing > # packets to the clients -- James Cameron) > proxyarp > > # Debian: do not replace the default route > nodefaultroute > > # Miscellaneous > > # Create a UUCP-style lock file for the pseudo-tty to ensure exclusive > # access. > lock > > # Disable BSD-Compress compression > nobsdcomp > > # cat /etc/sysctl.conf > # Uncomment the next line to enable packet forwarding for IPv4 > net.ipv4.conf.default.forwarding=1 > > -- > 0000 > MININEWS.INFO <http://MININEWS.INFO> > mininews是一个业界微新闻站点，添加xiaohua...@hotmail.com > <mailto:xiaohua...@hotmail.com>为MSN好友 > 做最敏捷的媒体，人人都可以是记者，关注身边正在发生的事。[M] -- To UNSUBSCRIBE, email to debian-chinese-gb-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
