http://www.thebakershome.net/?q=node/56 How to Install Openvpn Wed, 2006-09-27 21:11 — geoff Background: When I first decided to create my own server I ran down a list of elements I wanted. The first were obvious, web-server, and e-mail server. However I also realized that I have many games that I would enjoy playing with friends. These are older games that only allow multiplayer over local networks. A very secure and novel solution is to use OpenVPN to make the remote computers appear as though they are on the same local network. So I set out to implement this on my second computer. I used Ubuntu Dapper Drake server edition and then began the painstaking task of configuring all the components. However when I tried to configure OpenVPN the documentation on their web-site was lacking. It has been updated and is very good now (this was in March of 2006) but I wrote a guide to installing and configuring OpenVPN on Ubuntu Dapper Drake. I hope you find this interesting and beneficial. Purpose: The purpose of this document is to describe how to install OpenVPN server on an Ubuntu Linux system and have it utilize an Ethernet bridge to access your local network. Ethernet bridges essentially allow the operating system to treat multiple network interfaces as one combined port. When used with OpenVPN a bridge will allow you to easily connect external users to your internal network and have them receive all traffic as though they were locally connected. The alternative is to use OpenVPN with a route but that will not allow some forms of traffic through (such as multicast), multicast traffic is important to me as many games require multicast data. What is needed: 1. Linux System running Ubuntu (tutorial will work with any Linux install with a few modifications) 2. Root access to the server 3. External computer to test with Scope: This tutorial aims to instruct how to install and configure an OpenVPN server with internal network access via an Ethernet bridge. This tutorial does not explain how to install Linux and get the OS environment configured. There are many good tutorials out there that you can use, once you have your Linux server ready simply follow this document. If you are interested in a tutorial to configure your system I recommend this easy to follow guide: http://www.howtoforge.com/perfect_setup_ubuntu_6.06 Tutorial: 1. The first thing you should do when installing OpenVPN is to read some of the documentation on the OpenVPN web-site. This seems like a simple step to skip but if you do not know exactly how OpenVPN works then you risk opening your internal network to security problems. Additionally there is a lot of good documentation on the OpenVPN site that will help you understand networking terms and methods. Such as exactly what an Ethernet Bridge is and how it differs from a route. # Link to OpenVPN Homepage http://openvpn.net/ # Link to Explanation of bridging http://openvpn.net/bridge.html 2. Now that you have taken some time to understand OpenVPN and Bridges we can begin to implement these technologies into a server on your local network. The first step is to collect information about your network, this tutorial is designed for a network that meets the following: Linux Server Internal IP: 173.23.1.5 Internet Gateway: 173.23.1.1 Gateway's IP Address: 139.142.227.155 Network Layout: Internet ----- Router/Firewall ----- OpenVPN Server (eth1) 3. To simplify setup for users you should register your IP address with an Internet Domain service. If you are cheap like me simply use "no-ip.com". Create an account then download their dynamic dns update tool and follow their installation instructions. This will give you a free dynamic domain. Additionally the IP address for your server needs to be static, this is due to the fact that the bridge will not update on a DHCP IP address change. You can configure this in your /etc/network/interfaces file. My server has an entry for my network card that looks like this: # The primary network interface # connects to insecure router auto eth0 iface eth0 inet static address 173.23.1.5 netmask 255.255.255.0 network 173.23.1.0 broadcast 173.23.1.255 gateway 173.23.1.1 # dns-* options are implemented by the resolvconf package, if installed dns-nameservers 142.165.200.5 4. Now that the information is collected you can begin by installing OpenVPN and the utilities to manage a bridge, to do this simply type: sudo apt-get install openvpn bridge-utils 5. With OpenVPN installed we can now begin to configure, the first step is to move the apt-get directory into /etc/openvpn for easy access, and to preserve the original data (in case you mess up and need to revert). cp -R /usr/share/doc/openvpn/examples/ /etc/openvpn/ 6. Now we want to load the vars file with our own defaults. Open the file in your favorite editor and change KEY_COUNTRY, KEY_PROVINCE, KEY_CITY, KEY_ORG, and KEY_EMAIL to match your information. cd /etc/openvpn/examples/easy-rsa/ vi ./vars My vars file looks like this: (key components only) #this is to ensure secure data export KEY_SIZE=2048 # These are the default values for fields # which will be placed in the certificate. # Don't leave any of these fields blank. export KEY_COUNTRY=CA export KEY_PROVINCE=SK export KEY_CITY=Martensville export KEY_ORG="TheBakershome" export KEY_EMAIL="geoff@thebakershome.net" 7. Now we to begin the configuration of the server. . ./vars ./clean-all ./build-ca The purpose of these command are as follows, the first one will clear any old keys or configuration elements, there should not be any there but it does not hurt to be sure. The last command will setup OpenVPN configuration items, be sure to follow the prompt and make sure you fill in using elements to match your situation. Since we loaded the vars file with your settings prior to these steps the default values should work on almost all elements, but the Common Name will need to be specified. 8. Now you need to create the server keys, these are private files that you should keep secure. ./build-key-server server I found that if I did not use the same information that I used in the build-ca step above that the "Sign Certificate" and "commit" did not work. If you experience this problem just repeat this step with the same values, it should work at that point. This should not occur for you as we have loaded the default values into the vars file, but just in case be aware of the cause. 9. Now you are ready to generate keys for users, first decide if you wish to password protect the keys or not. I recommend building with passwords if you are not going to implement authentication in OpenVPN, if you are then simply generate without. This tutorial will assume that you are going to implement authentication in OpenVPN, since it is the most trusted method. Make sure that you specify the correct Common Name when prompted. #Generate with password ./build-key-pass username #Generate without password ./build-key username 10. Now you need to build the Diffie Hellman parameters, for details on what these are simply check the OpenVPN homepage. The simple answer is that they provide a method to negotiate a secure connection over an insecure channel. This process will take a bit of time so you may want to take a break, just relax we are almost there. ./build-dh #generate server id key openvpn --genkey --secret ta.key 11. As an aside I found a very interesting table on the OpenVPN web-page. It provides some information on what to do with the various files we just generated. For the purposes of this tutorial I have "borrowed" their table and pasted it here, to view the original visit the OpenVPN installation guide on their homepage. Filename Needed By Purpose Secret ca.crt server + all clients Root CA certificate NO ca.key key signing machine only Root CA key YES dh{n}.pem server only Diffie Hellman parameters NO server.crt server only Server Certificate NO server.key server only Server Key YES ta.key server+ all clients Server TLS Auth Key YES client1.crt client1 only Client1 Certificate NO client1.key client1 only Client1 Key YES client2.crt client2 only Client2 Certificate NO client2.key client2 only Client2 Key YES client3.crt client3 only Client3 Certificate NO client3.key client3 only Client3 Key YES 12. Now we need to configure the server.conf file to setup the operation. Here is my configuration file: # Which local IP address should OpenVPN # listen on? (optional) local 173.23.1.5 port 1194 # TCP or UDP server? proto udp #This is key to configuring our bridge dev tap0 #direct these to your generated files ca /etc/openvpn/openvpn/examples/easy-rsa/keys/ca.crt cert /etc/openvpn/openvpn/examples/easy-rsa/keys/server.crt key /etc/openvpn/openvpn/examples/easy-rsa/keys/server.key dh /etc/openvpn/openvpn/examples/easy-rsa/keys/dh2048.pem ifconfig-pool-persist ipp.txt #ensure the range of ip addresses you use in the last two arguments # of this statement are not in use by either the DHCP server or any other # device on your internal network. server-bridge 173.23.1.5 255.255.255.0 173.23.1.60 173.23.1.70 #needed to allow communication to internal network client-to-client keepalive 10 120 #encryption - very important ;) #AES encryption is backed by many security firms #however if you are concerned about speed use blowfish: "BF-CB" cipher AES-128-CBC #if you have another subnet you need to provide the route push "route 173.23.2.0 255.255.255.0" #server id protection tls-auth ta.key 0 #compression for network speed comp-lzo # if packets are too large fragment them (only really useful if you have an old router) #fragment 1400 #limit the number of connections max-clients 5 #some secuurity settings # do not use if running server on Windows user nobody group nogroup persist-key persist-tun #log file settings status openvpn-status.log verb 3 # authentication plugin #forces client to have a linux acount in order to connect plugin /usr/lib/openvpn/openvpn-auth-pam.so login 13. Now that the server is configured we need to create the bridge interface. The bridge is managed by Linux and is only used by OpenVPN so setup is a little different. I did it using a script to start/stop the interface. Place this script in "/etc/init.d/bridge" and then run the following: update-rc.d bridge defaults 15 Here is the script, before using you will need to edit it for your network and server settings. #!/bin/bash # Create global variables # Define Bridge Interface br="br0" # Define list of TAP interfaces to be bridged, # for example tap="tap0 tap1 tap2". tap="tap0" # Define physical ethernet interface to be bridged # with TAP interface(s) above. eth="eth0" eth_ip="173.23.1.5" eth_netmask="255.255.255.0" eth_broadcast="173.23.1.255" gw="173.23.1.1" start_bridge () { ################################# # Set up Ethernet bridge on Linux # Requires: bridge-utils ################################# for t in $tap; do openvpn --mktun --dev $t done for t in $tap; do ifconfig $t 0.0.0.0 promisc up done ifconfig $eth 0.0.0.0 promisc up brctl addbr $br brctl addif $br $eth for t in $tap; do brctl addif $br $t done ifconfig $br $eth_ip netmask $eth_netmask broadcast $eth_broadcast up route add default gw $gw $br } stop_bridge () { #################################### # Tear Down Ethernet bridge on Linux #################################### ifconfig $br down brctl delbr $br for t in $tap; do openvpn --rmtun --dev $t done ifconfig $eth $eth_ip netmask $eth_netmask broadcast $eth_broadcast up route add default gw $gw $eth } case "$1" in start) echo -n "Starting Bridge" start_bridge ;; stop) echo -n "Stopping Bridge" stop_bridge ;; restart) stop_bridge sleep 2 start_bridge ;; *) echo "Usage: $0 {start|stop|restart}" >&2 exit 1 ;; esac 14. Now you need to edit your client configuration script, client.conf. This will be given to your clients and will be the script they invoke (via openvpn) to connect to your server. In the same way you modified the server.conf file edit the network information to match your internal network. Here is an example of one of my scripts: client dev tap proto udp # change this to your server's address remote thebakers.no-ip.org 1194 resolv-retry infinite nobind persist-key persist-tun # Point the key and crt files to # the ones for this user tls-client ca ca.crt cert geoff.crt key geoff.key #ensure that we are talking to a server ns-cert-type server #confirm we are talking to the correct server tls-auth ta.key 1 # Select a cryptographic cipher. # If the cipher option is used on the server # then you must also specify it here. cipher AES-128-CBC # Enable compression on the VPN link. comp-lzo #fragment large packets # I found I needed this for some games but it is # not required #fragment 1400 # enable user/pass authentication auth-user-pass 15. Now you are ready to test your server, to do this load the server from the command line: sudo /etc/init.d/bridge start sudo openvpn /etc/openvpn/server.conf ##Look for any errors that may be reported while OpenVPN parses the server.conf file. If it gets to the "Succeeded" state then switch computers to a PC on an external network (I used my PC at work) and open the OpenVPN connection. If everything is working here reboot your server and attempt to open the connection again, this will ensure that everything is booting correctly. ###Once the connection is established by the client test it by pinging devices on your internal network. Assuming everything is connected correctly you should be able to contact them. 16. If you have any troubles with step 16, the first place to look is at firewalls. If your server has firewall restrictions they may be blocking the bridge from operating, check your config and adjust as necessary. At this point your server should be running, good luck and have fun. Post-Install I ended up having some difficulty configuring shorewall on my openvpn server. It is a little tricky since you have to tell shorewall to differentiate between a physical input (eth0) and the virtual input (tap0). To do this open "/etc/shorewall/hosts" and add: net br0:eth0 vpn br0:tap0 This will tell shorewall to differentiate between the vpn and the insecure traffic. Once you have this data you need to add the following to your policy file. This will tell shorewall that the traffic from the vpn is trusted so just let it all through. vpn all ACCEPT You will also need to mention the vpn in the zones file by adding vpn ipv4 Lastly you will need to tell shorewall that a tunnel is coming through by opening the tunnels file and adding: openvpn net 0.0.0.0/0 vpn Conclusion: I hope your server is working good and that you can now play your old classic games with friends. The other benefit of this network is that you can access your data on your home PC from anywhere and you will be certain that your connection if free from intrusion.