首先因为你用了nodefaultroute参数，你一定要在客户端添加经由pptp连接到192.168.x.x的路由，这个openvpn有个push route可以在服务器端设定自动进行，pptp不知道有没有。另外也要保证你公司的192段回传路由能到达你的PPTP客户端。
或者不要用nodefaultroute参数（这个也可以在客户端设置使用远程默认网关），让所有路由经由PPTP服务器，但也要保证回传路由。 或者如果你要访问的IP只有很少个，可以在PPTP服务器上做DNAT到要访问的机器，用一个59.65.196.0/24段的地址端口映射到要访问的IP端口。 2009/3/26 Feng Lu <0...@mininews.info>: > 各位好，再次打搅，小弟去年就遇到这个问题一直未找到解决办法（汗……） > > 利用 Debian + PPTP 作 VPN 服务，客户端能正常登录分配到合法的地址，并能访问VPN服务器所在网段( 59.65.196.0/24 ) > 但是无法访问VPN服务器外的网段（单位服务器属一个网段，全是公网地址，其它网络设备——如交换机——和用户个人电脑都是内网地址 192.168.x.x） > 这样的话就无法通过VPN远程管理交换机了，关键时候（内部网络故障）起不了作用 > 请帮忙分析是何原因，非常感谢！ > > 我自己感觉是少配置了什么东西，但是在网上也没有找到相应的说明。 > 当时配置基本上是参照这两篇文章：http://pigtail.net/nicholas/pptp/ > http://www.yxyr.com/post/344.html > > 我的配置如下： > > # cat /etc/pptpd.conf > ####... > option /etc/ppp/pptpd-options > ###.... > logwtmp > ####... > localip 59.65.196.63 > remoteip 59.65.196.250-254 > > # cat /etc/ppp/pptpd-options > # Authentication > name pptpd > > # Encryption > # Debian: on systems with a kernel built with the package > # kernel-patch-mppe >= 2.4.2 and using ppp >= 2.4.2, ... > # {{{ > refuse-pap > refuse-chap > refuse-mschap > # Require the peer to authenticate itself using MS-CHAPv2 [Microsoft > # Challenge Handshake Authentication Protocol, Version 2] authentication. > require-mschap-v2 > # Require MPPE 128-bit encryption > # (note that MPPE requires the use of MSCHAP-V2 during authentication) > require-mppe-128 > # }}} > > # Network and Routing > > # If pppd is acting as a server for Microsoft Windows clients, this > # option allows pppd to supply one or two DNS (Domain Name Server) > # addresses to the clients. The first instance of this option > # specifies the primary DNS address; the second instance (if given) > # specifies the secondary DNS address. > # Attention! This information may not be taken into account by a Windows > # client. See KB311218 in Microsoft's knowledge base for more information. > #ms-dns 10.0.0.1 > #ms-dns 10.0.0.2 > > # If pppd is acting as a server for Microsoft Windows or "Samba" > # clients, this option allows pppd to supply one or two WINS (Windows > # Internet Name Services) server addresses to the clients. The first > # instance of this option specifies the primary WINS address; the > # second instance (if given) specifies the secondary WINS address. > #ms-wins 10.0.0.3 > #ms-wins 10.0.0.4 > > # Add an entry to this system's ARP [Address Resolution Protocol] > # table with the IP address of the peer and the Ethernet address of this > # system. This will have the effect of making the peer appear to other > # systems to be on the local ethernet. > # (you do not need this if your PPTP server is responsible for routing > # packets to the clients -- James Cameron) > proxyarp > > # Debian: do not replace the default route > nodefaultroute > > # Miscellaneous > > # Create a UUCP-style lock file for the pseudo-tty to ensure exclusive > # access. > lock > > # Disable BSD-Compress compression > nobsdcomp > > # cat /etc/sysctl.conf > # Uncomment the next line to enable packet forwarding for IPv4 > net.ipv4.conf.default.forwarding=1 > > -- > 0000 > MININEWS.INFO > mininews是一个业界微新闻站点，添加xiaohua...@hotmail.com为msn好友 > 做最敏捷的媒体，人人都可以是记者，关注身边正在发生的事。[M] >
