We raise VPN + billing UTM5 on win2003
So, where to start implementing the VPN + UTM5 bundle on Windows Server 2003. Before you begin to configure RASS, you need to check whether IAS (Internet Authentication Service) is installed. To check this, you need to go to the installation / uninstallation of programs in the control panel in the INSTALLING WINDOWS COMONS section and see the composition of the Networking Services components. If this service is installed, then uncheck it (uninstall). This service is something else, like Windows-RADIUS. It is clear that 2 RADIUS servers (UTM-RADIUS and Windows-RADIUS) can not work on one computer, because Use the same ports for work. Accordingly, when the IAS service is installed, UTM-RADIUS simply does not start.
Another service that interferes with the proper operation of UTM, or Apache in particular, is the World Wide Web Service that is part of the Windows Application Server component in the IIS (Internet Information Services) service group. It also needs to be uninstalled, otherwise Apache does not start, because This service uses 80 port. If the server needs a WEB server, then it can successfully replace the same Apache, using the 80th port. UTM provides user access to statistics on the HTTPS protocol, and it connects to 443 port with encryption based on the certificate. You can, of course, install Apache on port 8080, but why should 2 WEB servers on one computer?
The server should not have SQL Server or MySQL installed.
After uninstalling these services, you can start installing and configuring RASS.
1. Installing and Configuring Routing and Remote Access
1.1. Run the RASS installation wizard.
1.2. We reject all standard schemes and choose the manual setting mode. It seems he is the last in the list of options offered by the master.
1.4. We go into the properties of the server RASS (right click on the server icon with a green arrow and select PROPERTIES).
1.5. On the GENERAL tab, select the LOCAL NETWORK AND BENCH ROUGHTER by REQUIREMENT and the REMOTE ACCESS SERVER, click OK and restart RASS.
1.6. Again, go to the properties of the RASS server on the SECURITY tab.
1.7. Here in the SERVICE OF INSPECTION
AUTHENTICATION we specify RADIUS Authentication and we press the SET button and in the opened window, we press the button ADD.
1.8. If UTM-RADIUS is installed on the same computer, then in the SERVER NAME field write - 127.0.0.1. If UTM-RADIUS is on another computer, then specify its IP.
1.9. In the SECRET field, let's press the CHANGE button and write - secret and confirm again.
1.10. We do not touch the time-out, the initial assessment and the port. The port must be 1812. Be sure to ALWAYS USE the MESSAGE CERTIFICATE and click OK.
1.12. In the appeared window press the button ADD.
1.13. SERVER NAME is also 127.0.0.1, secret is secret, port is 1813, timeout and initial rating is left by default, the RADIUS MESSAGE MESSAGE checkbox is not set to enable / disable accounting. Press OK.
1.14. We will use the PPTP protocol for VPN connections, so we will not be interested in RESOLVING USER IPSEC POLICIES FOR L2TP CONNECTION, and we do not.
1.15. Go to the IP tab. Here in general a very interesting thing.
1.16. First, we put all the checkboxes that are on this tab (there are three of them).
1.18. Now the most interesting. In order for the internal RASS interface to receive the IP that will be used as the IP server when connecting the VPN client over the PPTP tunnel using the PPP protocol, in the APPOINTING IP ADDRESSES section select the STATIC ADDRESS POINT and specify this IP here. But, the valorous firm Microsoft somehow decided that RASS will only work with Windows-RADIUS and with no more. Therefore, when specifying a static address pool, Microsoft wrote a check for the number of addresses in the pool and decided that there should be at least two of them. This is true only when working with Windows-RADIUS, where the IP addresses for the client and server are taken from this pool. In our case, only the address for the server is taken from this pool, and the address is assigned to the client by UTM. At first glance, there are no problems. If it were not for mean users. As practice shows, if one user gave another his login and password for VPN and they connect at the same time, the first one who connects from them receives IP from UTM, and the second one from this pool. The problem is that the traffic will be considered only on the IP that is registered in UTM, and the second user will sit for free. But it is not all that bad. Exit the properties of the server RASS (click the OK button below). We are waiting for the Start button, then Run and write the command
Netsh ras ip add range 192.168.2.254 192.168.2.254
Again we go into the properties of the RASS server in the IP tab and observe there a static pool from one address 192.168.2.254. The problem is solved. By the way, the network that we will use for VPN will be - 192.168.2.0/255.255.255.0.
1.19. Go to the PPP tab and remove the tick from the points MULTI-CHANNEL CONNECTIONS and SOFTWARE COMPRESSION. Put a check mark on the EXPANSION item of the COMMUNICATION CONTROL PROTOCOL (LCP).
1.20. Go to the JOURNAL MANAGEMENT tab. Choose the item NEW MAGAZINE ERRORS AND WARNINGS. It is necessary for informational purposes, to know who and when connected to RASS on VPN. The log of additional information is unnecessary.
1.21. Now you need to configure virtual ports for VPN connections.
1.22. Go to the properties of the ports (right click on the PORTS and select PROPERTIES).
1.23. Sequentially configure each type of port in the list. Select L2TP and poke in SETUP. Remove all the checkmarks and set the maximum number of ports to 0. Select PPPoE and click SETTING. We remove all the checkmarks. Choose PPTP, click SETUP. Set the checkbox ONLY INCOMING, uncheck the INPUT and OUTPUT. The maximum number of ports is set to 128. (This is how many people can connect to the VPN at the same time.) If you do not need that much, you can put less.) On the weather, this does not affect.) Select Direct Parallel and remove all the checkmarks. This item may not be if the server does not have a parallel port for the printer or it is disabled in the BIOS.
In the end, there must be such a picture.
1.24. Let's move on to IP routing.
1.25. Here we must immediately determine the firewall. If you have on the server is not a third-party firewall, then you need to understand it separately. If ISA costs, then it must be demolished. It does not need to work with VPN. The question with the firewall is very serious - the final decision which firewall to use - for you. I can only say that in the basic version, you can configure the built-in RASS firewall, although it is very kooky, but the task with the distribution of traffic performs almost completely.
1.26. Poke the mouse in the GENERAL in the left window and check which interfaces are present in the right window. There should be both network interfaces (which looks on the Internet and which looks to the local network), the Internal interface and the Closure to itself, i.e. In your case 4 interfaces. If they are missing or missing, add them by clicking on the empty space in the right window and selecting NEW INTERFACE.
1.27. In our case, IP routing should contain 3 items GENERAL, STATIC ROUTES and NAT / SIMPLE FIREWALL. If there is not something there or something else is present, then you need to delete the unnecessary, and add the necessary ones by clicking on the GENERAL and selecting the item NEW ROUTE PROTOCOL.
1.28. Item STATIC ROUTES we do not need. There must be empty. We can not remove it - it is an integral part of the RASS. We pass directly to NAT.
1.29. NAT is needed to convert global addresses to local addresses and vice versa. Poke the mouse in NAT. In the right window, add an interface that looks at the Internet and go into its properties (click on it with the right mouse button and select PROPERTIES)
1.30. We declare it as the common interface for connecting to the Internet and set the NAT ENABLE NAT ON this interface. The second tick ON MAIN FIREWALLER FOR THIS INTERFACE does not need to be set if you have a firewall. If the firewall is not present, then it must be installed, otherwise your server will be visible on the Internet. We press OK. More in NAT, you do not need to configure anything.
1.31. Now, if you have a firewall, the RASS setting can be considered complete. If you do not have it, you need to configure packet filters to block the distribution of the Internet over a local network and put it into the VPN.
1.32. For this, we poke on GENERAL and go into the properties of the interface that looks to the local network. Poke the OUTPUT FILTER button. In the opened window click the CREATE button. We put the INITIAL NETWORK tick and register our local network there. In your case 192.168.1.0/255.255.255.0. We say OK. We press the second time CREATE. We tick the source network and register the IP address of the VPN server there. In our case, 192.168.2.254/255.255.255.255. We say OK. We select the action of the filter in the top - DISCARD ALL PACKAGES, EXCEPT THOSE THAT RESPOND TO THE CASHNER BELOW CRETERIA and click OK.
1.33. ALL!!! Now RASS is tuned !!!
2. Installation of UTM.
2.1. Run the UTM5Setup. Language is chosen accordingly Russian.
2.2. First put the car JAVA.
2.3. We restart UTM5Setup. Now put the rest by unchecking JAVA. With further installation, there are no tricks. After the installation is complete, you need to go into the services and see that MySQL-NT and UTM5_CORE are started. If everything works, it's great.
2.4. Then we put RADIUS. With him, there never is a problem.
2.5. Now NDSAD. Here there are many problems. In order for NDSAD to collect traffic to the VPN, the WinPCAP driver must be version 3.1 and higher.
2.6. After the reboot, the ndsad service should start. If it does not start, then the server is busy port 9996, which ndsad uses to communicate with UTM.
2.7. Now install (if the service does not appear in the services) utm5_rfw. To do this, execute the command:
Utm5_rfw.exe --install.
After that utm5_rfw should appear in the services.
2.8. Now we need one more program that is not part of UTM, but without which you can not manage outages of VPN connections of users, the balance of which has passed through 0. This is utm5_kill_vpn.exe. When I first launched UTM, I found that when working with RASS Windows developers do not have a mechanism for disabling VPN connections. By the way, disabling the Internet is the most painful issue in most billing systems. It's good that they even wrote utm5_rfw, which allows you to transfer control to other programs, otherwise there would be a pipe. This program must be copied to the root of the disk c: The shutdown circuit works like this. UTM detects that the user's balance has become negative. It gives the command utm5_rfw, about disabling the user. Utm5_rfw calls utm5_kill_vpn and it gives the RASS Windows command to break the VPN connection for a certain user.
(In order for the automaton to happen GAP =) in UTM go to the FIREWALL RULES, click the UPDATE button. We delete everything except the first. First we call for editing. Put a tick - All users. User ID is 0, Group ID is 0, Tariff ID is 0, Turn on - do not write anything (should be empty), Shutdown is c: /utm5_kill_vpn.exe ULOGIN, Firewall ID is 1. The ULOGIN variable contains the name of the VPN connection and is transmitted Program utm5_kill_vpn.exe to disable the corresponding VPN.)
2.9. Like everything is installed. Now go to the settings.
3. Configuring UTM
3.1. Configuration files.
3.1.1. UTM5.CFG
Database_type = mysql - type of database
Database = utm5 - name of the database
Database_host = 127.0.0.1 - IP of the computer with the database
Database_login = root - login to the database
Database_password = - database password (no password)
Urfa_bind_host = 0.0.0.0 - IP from which we connect to the database (from any)
Urfa_lib_file = liburfa \ librpc.dll
Urfa_lib_file = liburfa \ liburfa_utils.dll
Urfa_lib_file = liburfa \ liburfa_card.dll
Urfa_lib_file = liburfa \ liburfa_hotspot.dll - libraries for running external modules
Urfa_lib_file = liburfa \ liburfa_graph.dll
Urfa_lib_file = liburfa \ liburfa_radius.dll
Nfbuffer_port = 9996 - NDSAD connection port
3.1.2. RADIUS5.CFG
Core_host = 127.0.0.1 - The IP on which UTM resides
Core_port = 11758 - port of connection to UTM
Radius_login = radius - system user login
Radius_password = radius - the password of the system user
Radius_auth_mppe = enable - VPN authorization
Radius_auth_vap = 1 - do not authorize with negative balance
Radius_ssl_type = none - Encryption type (disabled)
Radius_ippool_timeout = 0 - delay of reauthorization (immediately)
Radius_ippool_acct_timeout = 0 - release IP immediately after a VPN break
3.1.3. RFW5.CFG
Rfw_name = 127.0.0.1 - the name of the firewall (IP is used)
Firewall_type = local - firewall type (local)
Core_host = 127.0.0.1 - IP address of UTM
Core_port = 11758 - port for communication with UTM
Rfw_login = web - login of the system user
Rfw_password = web - system user password
3.1.4. NDSAD.CFG
Dummy all - disable the collection of statistics from any device, except those specified in the force command, i.e. Traffic will be collected only on the VPN
Force \ Device \ NPF_GenericDialupAdapter - the mode of collecting statistics on the VPN
Nf_lifetime 1 - instantly breaks sessions, when the user's balance passes through 0
3.1.5. WEB5.CFG
Core_host = 127.0.0.1 - IP address of UTM
Web_login = web - system user login
Web_password = web - system user password
3.1.6. After fixing the configuration files, you need to reboot the computer for all changes to take effect.
4. Files:
Name: NDSAD_setup_1_33.exe
Link for downloading the file: http://ifolder.ru/10599261
Name: utm5_kill_vpn.exe
Link for downloading the file: http://ifolder.ru/10599276
UTM5 can be downloaded at http://www.netup.ru/
Apache and muscle are also included in the kit of UTM. Also, to enter the web admin you have to put OpenSSL and sign certificates. Although I saw there are alternative versions of webmasters.
Comments
When commenting on, remember that the content and tone of your message can hurt the feelings of real people, show respect and tolerance to your interlocutors even if you do not share their opinion, your behavior in the conditions of freedom of expression and anonymity provided by the Internet, changes Not only virtual, but also the real world. All comments are hidden from the index, spam is controlled.