computing:vpnserver
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| computing:vpnserver [2018/11/25 01:32] – external edit 127.0.0.1 | computing:vpnserver [2023/05/21 19:57] (current) – removed oemb1905 | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| - | ------------------------------------------- | ||
| - | * **vpnserver** | ||
| - | * **Jonathan Haack** | ||
| - | * **Haack' | ||
| - | * **netcmnd@jonathanhaack.com** | ||
| - | ------------------------------------------- | ||
| - | |||
| - | // | ||
| - | |||
| - | ------------------------------------------- | ||
| - | |||
| - | Thanks to Jason Schaefer and Geoff Chesshire from [[http:// | ||
| - | |||
| - | In this tutorial, you will create a vpn server on a WNDR3800 router running LEDE, formerly and still partially known as OpenWrt. | ||
| - | |||
| - | https:// | ||
| - | http:// | ||
| - | | ||
| - | Add an address on the subnet of the router, and stop the network-manager from hijacking the connection. | ||
| - | |||
| - | sudo systemctl stop network-manager | ||
| - | ip a a 192.168.1.105/ | ||
| - | |||
| - | Put a paperclip in the reset button while device is off. Keeping it in, turn the device on, wait for flashing green. | ||
| - | | ||
| - | ping 192.168.1.1 | ||
| - | |||
| - | If you cannot successfully ping the router, then re-add your interface to the proper subnet and try again. | ||
| - | |||
| - | curl -T ~/ | ||
| - | curl -T ~/ | ||
| - | |||
| - | If you are flashing a router for the second or multiple times, you might need to remove the offending ssh known host entry as follows: | ||
| - | |||
| - | ssh-keygen -f "/ | ||
| - | |||
| - | Now that we have openWRT on the router, we should enable https for the web admin panel before proceeding with anything else. First, verify that you completed the above steps correctly by visiting 192.168.1.1 in your web browser of choice. | ||
| - | |||
| - | opkg update | ||
| - | opkg install luci-ssl nano | ||
| - | nano / | ||
| - | | ||
| - | config uhttpd ' | ||
| - | #list listen_http ' | ||
| - | #list listen_http ' | ||
| - | list listen_https ' | ||
| - | list listen_https ' | ||
| - | option redirect_https ' | ||
| - | option home '/ | ||
| - | option rfc1918_filter ' | ||
| - | option max_requests ' | ||
| - | option max_connections ' | ||
| - | option cert '/ | ||
| - | option key '/ | ||
| - | option cgi_prefix '/ | ||
| - | option script_timeout ' | ||
| - | option network_timeout ' | ||
| - | option http_keepalive ' | ||
| - | option tcp_keepalive ' | ||
| - | option ubus_prefix '/ | ||
| - | config cert ' | ||
| - | option days ' | ||
| - | option bits ' | ||
| - | option country ' | ||
| - | option state ' | ||
| - | option location ' | ||
| - | option commonname ' | ||
| - | | ||
| - | In the config file, one can see that the port 80 lines are commented out in order to reredirect the router to use TLS. Additionally, | ||
| - | | ||
| - | / | ||
| - | |||
| - | Now that we have https, we can begin to set up the vpn server on the WNDR. Using the template files in the directory openvpnconfig, | ||
| - | |||
| - | https:// | ||
| - | |||
| - | |||
| - | Method 1; copying the template directory from your host to the router. | ||
| - | |||
| - | scp -r openvpnconfig root@192.168.1.1:/ | ||
| - | ssh root@192.168.1.1 | ||
| - | | ||
| - | Method 2; using wget to download the directory into your router. | ||
| - | | ||
| - | ssh root@192.168.1.1 | ||
| - | opkg update | ||
| - | opkg install wget | ||
| - | wget https:// | ||
| - | |||
| - | If you use this template and the key and config building script inside it, be aware of what it is doing for you; it is zipping the two keys and certificate authority together with the client config in one .zip file for easy downloading using scp. It also uses stock configuration options that can be adjusted as needed. | ||
| - | |||
| - | opkg update | ||
| - | opkg install zip openvpn-easy-rsa openvpn-openssl nano wget nmap tcpdump curl luci-ssl | ||
| - | |||
| - | mv / | ||
| - | mv / | ||
| - | cd /etc/ | ||
| - | ln -s config/ | ||
| - | | ||
| - | Specify how you want the default key pairs to be built, and specify parameters for the certificate authority; example provided below the text editor command: | ||
| - | | ||
| - | nano / | ||
| - | | ||
| - | # easy-rsa parameter settings | ||
| - | # NOTE: If you installed from an RPM, | ||
| - | # don't edit this file in place in | ||
| - | # / | ||
| - | # instead, you should copy the whole | ||
| - | # easy-rsa directory to another location | ||
| - | # (such as / | ||
| - | # edits will not be wiped out by a future | ||
| - | # OpenVPN package upgrade. | ||
| - | # This variable should point to | ||
| - | # the top level of the easy-rsa | ||
| - | # tree. | ||
| - | export EASY_RSA="/ | ||
| - | # This variable should point to | ||
| - | # the requested executables | ||
| - | export OPENSSL=" | ||
| - | export PKCS11TOOL=" | ||
| - | export GREP=" | ||
| - | # This variable should point to | ||
| - | # the openssl.cnf file included | ||
| - | # with easy-rsa. | ||
| - | export KEY_CONFIG=`/ | ||
| - | # Edit this variable to point to | ||
| - | # your soon-to-be-created key | ||
| - | # directory. | ||
| - | # WARNING: clean-all will do | ||
| - | # a rm -rf on this directory | ||
| - | # so make sure you define | ||
| - | # it correctly! | ||
| - | export KEY_DIR=" | ||
| - | # Issue rm -rf warning | ||
| - | echo NOTE: If you run ./ | ||
| - | # PKCS11 fixes | ||
| - | export PKCS11_MODULE_PATH=" | ||
| - | export PKCS11_PIN=" | ||
| - | # Increase this to 2048 if you | ||
| - | # are paranoid. | ||
| - | # down TLS negotiation performance | ||
| - | # as well as the one-time DH parms | ||
| - | # generation process. | ||
| - | export KEY_SIZE=2048 | ||
| - | # In how many days should the root CA key expire? | ||
| - | export CA_EXPIRE=7305 | ||
| - | # In how many days should certificates expire? | ||
| - | export KEY_EXPIRE=7305 | ||
| - | # These are the default values for fields | ||
| - | # which will be placed in the certificate. | ||
| - | # Don't leave any of these fields blank. | ||
| - | export KEY_COUNTRY=" | ||
| - | export KEY_PROVINCE=" | ||
| - | export KEY_CITY=" | ||
| - | export KEY_ORG=" | ||
| - | export KEY_EMAIL=" | ||
| - | export KEY_OU=" | ||
| - | # X509 Subject Field | ||
| - | export KEY_NAME=" | ||
| - | # PKCS11 Smart Card | ||
| - | # export PKCS11_MODULE_PATH="/ | ||
| - | # export PKCS11_PIN=1234 | ||
| - | # If you'd like to sign all keys with the same Common Name, uncomment the KEY_CN export below | ||
| - | # You will also need to make sure your OpenVPN server config has the duplicate-cn option set | ||
| - | # export KEY_CN=" | ||
| - | | ||
| - | Enter parameters for your openvpn configuration; | ||
| - | | ||
| - | nano / | ||
| - | | ||
| - | float | ||
| - | port 1194 | ||
| - | proto udp | ||
| - | dev tun | ||
| - | comp-lzo yes | ||
| - | cipher AES-256-CBC | ||
| - | tls-version-min 1.2 | ||
| - | tls-cipher | ||
| - | dh | ||
| - | ca | ||
| - | key easy-rsa/ | ||
| - | cert easy-rsa/ | ||
| - | #crl-verify / | ||
| - | ifconfig-pool-persist / | ||
| - | client-config-dir clients | ||
| - | status / | ||
| - | ## | ||
| - | #server [192.xx.xx.0 255.255.255.0] | ||
| - | ##begin VPN options for static ip mode (mode server)## | ||
| - | mode server | ||
| - | tls-server | ||
| - | topology subnet | ||
| - | push " | ||
| - | ifconfig 192.xx.xx.1 255.255.255.0 | ||
| - | route-gateway 192.xx.xx.1 | ||
| - | push " | ||
| - | ifconfig-pool 192.xx.xx.100 10.xx.xx.150 255.255.255.0 | ||
| - | ##end VPN options for static ip## | ||
| - | ##general LAN options## | ||
| - | push "route 192.168.1.0 255.255.255.0" | ||
| - | push " | ||
| - | push " | ||
| - | client-to-client | ||
| - | mute 5 | ||
| - | log / | ||
| - | keepalive 10 120 | ||
| - | persist-key | ||
| - | persist-tun | ||
| - | | ||
| - | Specify where the openvpn configuration is to be found; example provided below the text editor command. | ||
| - | | ||
| - | nano / | ||
| - | | ||
| - | ##/ | ||
| - | package openvpn | ||
| - | config openvpn server | ||
| - | option enabled 1 | ||
| - | option config / | ||
| - | |||
| - | Now, time to build the certificate authority, the diffie helman key, and the key and certificate for the vpn server. | ||
| - | | ||
| - | build-ca | ||
| - | build-dh [takes a long time, see alternate method below] | ||
| - | build-key-server server | ||
| - | |||
| - | You can alternately choose to build the dh key on the **// | ||
| - | |||
| - | sudo openssl dhparam -out / | ||
| - | scp / | ||
| - | |||
| - | You can now use the script contained in the template directory that you zipped earlier to create your client keys and config file; you are back on the **// | ||
| - | |||
| - | / | ||
| - | | ||
| - | Or, if you did not use the template directory and the script, then change the vars file each time you need a key with the parameters that you desire, and then build the key, crt, and ca manually: | ||
| - | | ||
| - | nano / | ||
| - | pkitool [clientname] | ||
| - | |||
| - | If you chose not to use the template and script, then on each client you will need to create a config file with something like the following parameters; adjust these parameters as needed: | ||
| - | | ||
| - | nano / | ||
| - | | ||
| - | nobind | ||
| - | float | ||
| - | comp-lzo | ||
| - | cipher AES-256-CBC | ||
| - | dev tun | ||
| - | remote xx.xx.xx.xx 1194 udp | ||
| - | client | ||
| - | tls-exit | ||
| - | ca ca.crt | ||
| - | cert < | ||
| - | key < | ||
| - | remote-cert-tls server | ||
| - | mute 5 | ||
| - | resolv-retry infinite | ||
| - | # | ||
| - | keepalive 10 60 | ||
| - | ping-timer-rem | ||
| - | persist-tun | ||
| - | persist-key | ||
| - | # | ||
| - | |||
| - | You are now ready to set up the interfaces and firewall zones for the router using the web panel. | ||
| - | |||
| - | / | ||
| - | ps | grep openvpn | ||
| - | 1314 root 3896 S / | ||
| - | 31296 root 1356 S grep openvpn | ||
| - | |||
| - | If you did not get this output, then you should debug your configuration by running openvpn against your server configuration as follows, and use the output it provides to determine what you did wrong. | ||
| - | |||
| - | openvpn / | ||
| - | |||
| - | Now that the service is running and you have a client config, you can use the openWRT web page to create an interface and a firewall zone. Go to interfaces, add interface and name it VPN, select tun0 (unmanaged). | ||
| - | |||
| - | {{ : | ||
| - | {{ : | ||
| - | {{ : | ||
| - | |||
| - | Now that you have a client configuration file set up, and the interfaces and firewall zones set up, you can install openvpn on your host; and be aware of how to execute the client - server handshake, thus initiating the openvpn connection. | ||
| - | |||
| - | sudo apt install openvpn | ||
| - | cd ~/ | ||
| - | sudo openvpn clientconfigname.ovpn | ||
| - | |||
| - | To enable TLS and separately to enable a strong cipher, use these settings on the server configuration. | ||
| - | |||
| - | / | ||
| - | tls-version-min 1.2 | ||
| - | tls-cipher | ||
| - | cipher AES-256-CBC | ||
| - | |||
| - | Key, ca, and .ovpn permissions, | ||
| - | |||
| - | sudo chmod 600 clientname.key | ||
| - | sudo chmod 640 clientname.crt | ||
| - | sudo chmod 640 ca.crt | ||
| - | sudo chmod 640 clientconfigname.ovpn | ||
| - | |||
| - | Thanks! | ||
| - | |||
| - | Addenda | ||
| - | |||
| - | * dhcp-opkg. | ||
| - | * dropbear_rsa_host_key-opkg. | ||
| - | * dropbear-opkg. | ||
| - | |||
| - | |||
| - | search for / | ||
| - | change the " | ||
| - | |||
| - | add p flag to scp when copying openvpn back to new router image | ||
| - | |||
| - | 1) flash | ||
| - | 2) opkg upgraded with vi shit and made big string | ||
| - | 3) after that saw -opkg different files and compared, overwriting old ones with new, except be careful on dropbear with 0 kb one | ||
| - | 4) edit not just / | ||
| - | |||
| - | copy the etc/ | ||
| - | |||
| - | common package upgrades | ||
| - | |||
| - | base-files busybox dnsmasq dropbear firewall fstools fwtool hostapd-common ip6tables iptables iw iwinfo jshn jsonfilter kernel kmod-ath kmod-ath9k kmod-ath9k-common kmod-cfg80211 kmod-gpio-button-hotplug kmod-ip6tables kmod-ipt-conntrack kmod-ipt-core kmod-ipt-nat kmod-leds-wndr3700-usb kmod-lib-crc-ccitt kmod-mac80211 kmod-nf-conntrack kmod-nf-conntrack6 kmod-nf-ipt kmod-nf-ipt6 kmod-nf-nat kmod-nls-base kmod-ppp kmod-pppoe kmod-pppox kmod-slhc kmod-usb-core kmod-usb-ledtrig-usbport kmod-usb-ohci kmod-usb2 lede-keyring libblobmsg-json libc libgcc libip4tc libip6tc libiwinfo libiwinfo-lua libjson-c libjson-script liblua libnl-tiny libpthread libubox libubus libubus-lua libuci libuci-lua libuclient libxtables logd lua luci luci-app-firewall luci-base luci-lib-ip luci-lib-jsonc luci-lib-nixio luci-mod-admin-full luci-proto-ipv6 luci-proto-ppp luci-theme-bootstrap mtd netifd odhcp6c odhcpd opkg ppp ppp-mod-pppoe procd rpcd swconfig uboot-envtools ubox ubus ubusd uci uclient-fetch uhttpd uhttpd-mod-ubus usign wpad-mini | ||
| - | |||
| - | --- // | ||
computing/vpnserver.1543109573.txt.gz · Last modified: 2018/11/25 01:32 by 127.0.0.1
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: GNU Free Documentation License 1.3
