Skip to main content


Install a VPN server on FreeBSD 10.0-Release on Amazon EC2.



  • pkg install mpd5


  • portmaster net/mpd5


VPN Configuraion

  • cp /usr/local/etc/mpd5/mpd.conf.sample /usr/local/etc/mpd5/mpd.conf
  • set user hwchiu 123456 used to config the admin's accoutn and password of the web page.
  • set web self 5006 is the listen ip address and port of the web page.
# configure mpd users
set user hwchiu 123456
# configure the console
set console self 5005
set console open
# configure the web server
set web self 5006
set web open
  • comment the dialup and add pptp_server, we will config the options of pptp_server later.
#load dialup
load pptp_server
  • set ippool add pool1 ip_start, ip_end is used to set the private ip range for vpn user. the name ippool and pool1 must be the same as set ipcp ranges ippool pool1
  • set ipcp ranges ippool pool1 is the ip address of the server.
  • set ipcp dns is used to set the dns server. In my case, since my machine is behind the EC2, i used the same configuration in my FreeBSD.
  • set ipcp nbns used to for windows client.
  • set pptp self You should set your ip address which is shown on the network interface.
# Define dynamic IP address pool.
set ippool add pool1
# Create clonable bundle template named B
create bundle template B
set iface enable proxy-arp
set iface idle 1800
set iface enable tcpmssfix
set ipcp yes vjcomp
# Specify IP address pool for dynamic assigment.
set ipcp ranges ippool pool1
set ipcp dns
set ipcp nbns
# The five lines below enable Microsoft Point-to-Point encryption
# (MPPE) using the ng_mppc(8) netgraph node type.
set bundle enable compression
set ccp yes mppc
set mppc yes e40
set mppc yes e128
set mppc yes stateless
# Create clonable link template named L
create link template L pptp
# Set bundle template to use
set link action bundle B
# Multilink adds some overhead, but gives full 1500 MTU.
set link enable multilink
set link yes acfcomp protocomp
set link no pap chap eap
set link enable chap
# We can use use RADIUS authentication/accounting by including
# another config section with label 'radius'.
# load radius
set link keep-alive 10 60
# We reducing link mtu to avoid GRE packet fragmentation.
set link mtu 1460
# Configure PPTP
set pptp self
# Allow to accept calls
set link enable incoming

Use configuration

  • cp /usr/local/etc/mpd5/mpd.secret.sample /usr/local/etc/mpd5/mpd.secret The format of mpd.secret is username password ip_address per line.
  • Example
fred            "fred-pw"
joe "foobar"

System configuration

  • sysctl net.inet.ip.forwarding=1
  • Pf configuraion
    1. use NAT for internal private network.
    2. skip the lo interface.
    3. block adll traffic adn log all packet by default.
    4. pass in tcp for port 1723 (PPTP)
    5. pass in protocol gre
    6. pass in from any to internal private network and vice versa.
    7. Use the pfctl -f file to reload the pf instead of /etc/rc.d/pf restart, the latter will disconnect all exist connection.
my_int = "xn0"
internal_net = ""
external_addr = ""
nat on $my_int from $internal_net to any -> $external_addr
set skip on lo
block in log all
pass in on $my_int proto tcp from any to any port 1723 keep state
pass in on $my_int proto tcp from any to any port 443 keep state
pass in quick on $my_int proto icmp all keep state
pass in proto gre all keep state
pass in from any to $internal_net
pass in from $internal_net to any
pass out proto { gre, tcp, udp, icmp } all keep state

Log configuration.

  • Edit /etc/syslog.conf
*.* /var/log/mpd.log
  • Touch /var/log/mpd.log
  • Restart syslog


  • /usr/local/etc/rc.d/mpd5 start