OpenVPN - Front Internal Wiki

Transcription

1 OpenVPN From Front Internal Wiki Please note that this file is a work in progress, we will continue to update it as new/better ways of doing things are found to make the process as easy as possible. Contents 1 Client Setup 1.1 A note about DNS and VPN. 1.2 Firewalls 1.3 Linux Users 1.4 Windows Users 1.5 Mac OSX Users 2 Routing 2.1 NAT Client Setup All users will be provided a tar file containing their user certificates, should you ever feel that these certificates may have been compromised please let us know and we will revoke and re-create you certificates straight away. The tar file will contain the following: An example configuration file: front-client.config A client certificate: <username>.crt A certificate authority certificate: ca.crt A user authentication key: <username>.key Any other files in the tar can be ignored and are included for completeness. A note about DNS and VPN. Currently front do not push DNS down to clients, instead clients need to connect to specific IP addresses or add the DNS servers themselves. Our two primary 1 of 6 16/07/10 11:13

2 DNS servers are: An alternative option is to edit your local hosts file to add specific systems using their front network ip addresses for ease of use. Alternatively useful IP's to know are: Ron: Arrakis: When you connect to front's VPN you will have a new virtual interface created which will use an ip in the range /24. You will be able to ping internal front ip addresses on the subnet from this range. Firewalls OpenVPN for front operates over UDP on port You need to ensure that your remote machine and remote network both allow traffic on this port. For most users this will not be an issue, however if you fail to connect to the front gateway ip ( ) then please check your firewall settings. Linux Users Install openvpn via your package manager. Alternatively network-manageropenvpn will be available for some distro's. Create a client config file: /etc/openvpn/client.vpn 2 of 6 16/07/10 11:13

3 client dev tun proto udp remote resolv-retry infinite nobind persist-key persist-tun keepalive ca /etc/openvpn/clients/front/ca.crt #Adjust these to match your name i.e. <name>.crt cert /etc/openvpn/clients/front/<username>.crt key /etc/openvpn/clients/front/<username>.key comp-lzo verb 3 Launch the client with: openvpn --config /etc/openvpn/client.vpn If you want to background the process then add --daemonize or add daemonize to the config file. Windows Users Install the openvpn client GUI by downloading from: Copy the crt and key files into a directory of your choosing. For this example I have used the Documents Folder: C:\Users\front\Documents\<username> Create a ovpn (configuration) text file using the configuration example provided for linux above: For this example the file is simply named <username>.ovpn NB: Textpad ( and notepad++ ( are good textfile editors if you do not already use them. 3 of 6 16/07/10 11:13

4 client dev tun proto udp remote resolv-retry infinite nobind persist-key persist-tun keepalive # NB Windows Paths must have "\" escaped with another "\" ca "C:\\Users\\front\\Documents\\<username>\\ca.crt" cert "C:\\Users\\front\\Documents\\<username>\\<username>.crt" key "C:\\Users\\front\\Documents\\<username>.key" comp-lzo verb 3 Launch the openvpn gui and choose "connection profiles", then import file. Import the ovpn file created above. Mac OSX Users 4 of 6 16/07/10 11:13

5 There are instructions for using OSX with openvpn at the URL below: how-to-connect-to-access-server-from-a-mac.html Most sites seem to suggest using Tunnelblick ( /p/tunnelblick/) as the client. Feedback would be appreciated on how well (or not) this works. Routing Not really openvpn but a good place to stick this also, if the target VPN server is a Gateway for devices on its network then you can also route through to local subnets on the GW host using: /sbin/route add -net netmask gw <your tunnel ip> or by device: /sbin/route add -net netmask dev tun0 The above can be completed much easier using push commands from openvpnserver i.e: push "route " NAT Example taken from: iptables -t nat -A POSTROUTING -s /24 -o eth0 -j MASQUERADE To push a gateway to the client for routing all traffic: push "redirect-gateway local def1" Finally you can also push DNS changes: 5 of 6 16/07/10 11:13

6 push "dhcp-option DNS " Retrieved from " Category: Network This page was last modified on 16 July 2010, at 10:12. Content is available under Attribution-NonCommercial-ShareAlike of 6 16/07/10 11:13