| Both sides previous revisionPrevious revisionNext revision | Previous revision |
| computing:vpnserver-openwrt [2024/02/17 19:26] – oemb1905 | computing:vpnserver-openwrt [2026/08/19 14:03] (current) – oemb1905 |
|---|
| ------------------------------------------- | ------------------------------------------- |
| |
| This tutorial is for flashing a Netgear WNDR3800 router with openwrt and then building a vpn server on it with openvpn. The instructions here can easily be adapted to other hardware. First, download the stable release: | This tutorial was originally designed for using openvpn with openWRT on a Netgear WNDR3800 router. My current hardware, however, is the c7 Archer v5 by TP-Link. Regardless of what you use, however, this tutorial will help you use your openWRT router as a self-hosted VPN solution. First, download the stable release for you model. It's best to find the dedicated hardware page and check your exact variant, etc. Below, I have an example of the page for the Archer. I also included the link to all openWRT downloads and the supported hardware list. |
| | |
| | * [[https://openwrt.org/toh/tp-link/archer_c7|c7Archerv5]] |
| | * [[https://downloads.openwrt.org/|Downloads]] |
| | * [[https://openwrt.org/toh/start|Table of Hardware]] |
| |
| [[http://downloads.openwrt.org|OpenWrt]] | |
| |
| It is probably best to stop network manager; after that, assign a local ip address (on the same subnet as the router) to your network interface. | It is probably best to stop network manager; after that, assign a local ip address (on the same subnet as the router) to your network interface. |
| easyrsa --batch init-pki | easyrsa --batch init-pki |
| easyrsa --batch gen-dh | easyrsa --batch gen-dh |
| easyrsa --batch build-ca nopass | easyrsa --batch build-ca <ca-name> nopass |
| easyrsa --batch build-server-full <server> nopass | easyrsa --batch build-server-full <server> nopass |
| |
| It is now time to scp the key, certificate, and authority from the router to your home device: | It is now time to scp the key, certificate, and authority from the router to your home device: |
| |
| scp /etc/easy-rsa/pki/ca.crt /etc/easy-rsa/pki/private/clientname.key /etc/easy-rsa/pki/issued/clientname.crt root@10.10.10.100: | scp /etc/easy-rsa/pki/ca.crt root@10.10.10.100: |
| | scp /etc/easy-rsa/pki/private/clientname.key root@10.10.10.100: |
| | scp /etc/easy-rsa/pki/issued/clientname.crt root@10.10.10.100: |
| | scp /etc/easy-rsa/pki/ta.key root@10.10.10.100: |
| | |
| Obviously, I am using an example home subnet here (10.10.10.0), so change that address to match your workstation. Once you have all three of those files, create a directory on the client workstation that intends to connect to the vpn server. After you create that directory and place these files in it, you need to create a connect-to-vpn.ovpn file that openvpn will use to connect to the vpn server. | Obviously, I am using an example home subnet here (10.10.10.0), so change that address to match your workstation. Once you have all three of those files, create a directory on the client workstation that intends to connect to the vpn server. After you create that directory and place these files in it, you need to create a connect-to-vpn.ovpn file that openvpn will use to connect to the vpn server. |
| Since you did not suppress standard output, you should get the following the message, "Initialization Sequence Completed," to indicate a successful connection. Your vpn-server is now complete, and you can repeat the steps for building client keys stated above for other workstations/users. Also, if you need to automate the setup, you can use something like these scripts, which I tweaked a lot, from OpenWrt's wiki: | Since you did not suppress standard output, you should get the following the message, "Initialization Sequence Completed," to indicate a successful connection. Your vpn-server is now complete, and you can repeat the steps for building client keys stated above for other workstations/users. Also, if you need to automate the setup, you can use something like these scripts, which I tweaked a lot, from OpenWrt's wiki: |
| |
| * [[https://repo.haacksnetworking.com/oemb1905/haackingclub/-/blob/master/vpnstuff/vpn-server-script.sh|vpn-server-scripts.sh]] | * [[https://repo.haacksnetworking.org/haacknet/haackingclub/-/tree/main/scripts/openvpn/openvpn-openwrt?ref_type=heads|openWRT VPN client-server scripts]] |
| * [[https://repo.haacksnetworking.com/oemb1905/haackingclub/-/blob/master/vpnstuff/vpn-client-script.sh|vp-client-scripts.sh]] | |
| |
| -- -- -- -- -- | -- -- -- -- -- |
| Thanks to Jason Schaefer and Geoff Chesshire from [[http://schaeferconsulting.com|Schaefer IT Consulting]]. I am very grateful for their help with all of this. I also found the source documentation, [[https://openwrt.org/docs/guide-user/services/vpn/openvpn/basic|OpenWrt OpenVPN basic]], to be particularly helpful, especially when/if commands and config setups change in easy-rsa/openvpn. | Thanks to Jason Schaefer and Geoff Chesshire from [[http://schaeferconsulting.com|Schaefer IT Consulting]]. I am very grateful for their help with all of this. I also found the source documentation, [[https://openwrt.org/docs/guide-user/services/vpn/openvpn/basic|OpenWrt OpenVPN basic]], to be particularly helpful, especially when/if commands and config setups change in easy-rsa/openvpn. |
| |
| --- //[[webmaster@haacksnetworking.org|oemb1905]] 2024/02/17 19:26// | --- //[[alerts@haacksnetworking.org|oemb1905]] 2026/08/19 14:02// |
