# try to config PF + finckin PPTP passthrough



## alanbaka (Nov 10, 2013)

I try to make my pf enable PPTP passthrough.
I have installed finckin and config pf:

```
rdr on $int_if proto tcp from any to any port pptp -> 127.0.0.1 port pptp
rdr on $int_if proto gre from any to any -> 127.0.0.1
pass in quick proto tcp from any to any port pptp flags S/SA keep state
pass out quick proto tcp from any to any port pptp flags S/SA keep state
pass in quick proto gre from any to any
pass out quick proto gre from any to any
```

When I try to connect to a PPTP server in Windows, the Connecting to vpn server windows will show up:

```
|
V
Verifying user name and password
|
V
Wait about 30 seconds ...
|
V
Disconnected
Error 619: A connection to the remote computer could not be established.so the port used for this connection was closed .........
```

When establishing the connect, pf show the connect at 1723 port and gre proto looks like the protocol can talk to the PPTP server. 

```
gate2# pfctl -ss | grep gre
all gre 1.36.xxx.xxx -> 58.153.xxx.xxx       MULTIPLE:MULTIPLE
all gre 58.153.xxx.xxx -> 192.168.10.100       MULTIPLE:MULTIPLE
all gre 192.168.10.100 -> 58.153.xxx.xxx       SINGLE:NO_TRAFFIC
gate2# pfctl -ss | grep :1723
all tcp 127.0.0.1:1723 <- 58.153.xxx.xxx:1723 <- 192.168.10.100:59323       ESTABLISHED:ESTABLISHED
all tcp 1.36.xxx.xxx:62339 -> 58.153.xxx.xxx:1723       ESTABLISHED:ESTABLISHED
```

I have tested with the PPTP server by using a normal home router with PPTP passthrough on, it can establish the connection.

What config am I missing?
I saw on the internet it look like the finckin works perfect with pf.


----------



## hshh (Nov 12, 2013)

I have never made finckin work. I have to NAT protocol GRE by IPFW instead of PF. As my post on pfSense forum, http://forum.pfsense.org/index.php?topic=46172.0, you can try it.


```
ipfw enable in-kernel nat, kernel conf:
options LIBALIAS
options IPFIREWALL_NAT
or load module, kldload libalias; kldload ipfw_nat


pf rules:
no nat on $ext_if proto gre from any to any

ipfw rules:
ipfw nat 1 config if $ext_if same_ports reset unreg_only
ipfw add 1000 nat 1 gre from any to any

now, outbound pptp can be simultaneous.
```


----------

