Openvpn - Revision history

Ryan52: /* Automate */

2013-05-07T22:11:36Z

Automate

2013-03-16T22:52:42Z

Network Manager: Add missing configuration option for HMAC Authentication

2012-04-18T20:36:09Z

Printing

2011-08-28T01:23:27Z

updated instructions to use network-manager

2010-07-06T22:58:22Z

categorized

2010-04-25T02:01:57Z

Setup: updated configuration examples

2009-09-06T17:59:47Z

So, now the keys

2008-10-18T01:13:43Z

Automate: with new versions of openvpn you have to set the script-security option to 2

2008-06-15T03:12:08Z

openvpn from internet instructions

2008-05-22T20:45:54Z

printing

← Older revision		Revision as of 22:11, 7 May 2013
Line 118:		Line 118:

	====Automate====		====Automate====
		+
		+	'''NOTE: You must change the hashbang to "#!/bin/bash" as these scripts will now contain bashisms.'''

	* edit /etc/network/if-up.d/openvpn to include the following at the end of the file:		* edit /etc/network/if-up.d/openvpn to include the following at the end of the file:

@@ Line 37: / Line 37: @@
   Private Key: ~/.openvpn/foo.key
-In the Advanced Settings, set the custom gateway port to 1193 if this is an internet connection (as opposed to using the default on the Free Geek wireless); turn on Use LZO Data Compression; on the security tab, set the cipher to BF-CBC; and on the TLS Authentication tab, enable using additional TLS authentication, set the key file to ~/.openvpn/ta.key , and set the key direction to 1.
+In the Advanced Settings, set the custom gateway port to 1193 if this is an internet connection (as opposed to using the default on the Free Geek wireless); turn on Use LZO Data Compression; on the security tab, set the cipher to BF-CBC and HMAC Authentication to SHA-1; and on the TLS Authentication tab, enable using additional TLS authentication, set the key file to ~/.openvpn/ta.key , and set the key direction to 1.
 Finally, you may need to restart network-manager before you can connect:

@@ Line 130: / Line 130: @@
 ==Printing==
 To allow access to the printserver, add "BrowseAddress ''your-tun0-ip''" to cupsd.conf on scribble and then restart cups.  You should get a consistent ip address, so this should be stable unless we need to change the keys.
 [[Category: Technocrats]]

@@ Line 2: / Line 2: @@
 OpenVPN is an open source Virtual Private Network (VPN), which allows one to establish a tunnel for any IP subnetwork or virtual ethernet adapter e.i. TUN/TAP kernel device over any UDP/TCP port.  At freegeek, we have one between our wireless and wired networks.
 ==Installation==
 *on debian
@@ Line 18: / Line 57: @@
 can be found here: http://openvpn.net/install.html
-==Setup==
+====Setup====
 Once installed you will need to set some things up.
@@ Line 78: / Line 117: @@
   resolvconf -u
-==So, now the keys==
+====Automate====
 * edit /etc/network/if-up.d/openvpn to include the following at the end of the file:
@@ Line 105: / Line 131: @@
 To allow access to the printserver, add "BrowseAddress ''your-tun0-ip''" to cupsd.conf on scribble and then restart cups.  You should get a consistent ip address, so this should be stable unless we need to change the keys.
-[[Category: Tech support]]
+[[Category: Technocrats]]

← Older revision		Revision as of 22:58, 6 July 2010
Line 104:		Line 104:
	==Printing==		==Printing==
	To allow access to the printserver, add "BrowseAddress ''your-tun0-ip''" to cupsd.conf on scribble and then restart cups. You should get a consistent ip address, so this should be stable unless we need to change the keys.		To allow access to the printserver, add "BrowseAddress ''your-tun0-ip''" to cupsd.conf on scribble and then restart cups. You should get a consistent ip address, so this should be stable unless we need to change the keys.
		+
		+	[[Category: Tech support]]

@@ Line 42: / Line 42: @@
   cipher BF-CBC
   comp-lzo
-  up /etc/openvpn/freegeek-up
+ # enable execution of up/down scripts:
-  down /etc/openvpn/freegeek-down
+ script-security 2
 For the ASK_A_SYSADMIN, use the firewall's wireless ip or its external ip, depending on whether this will be accessible from the internet.
 For internet accessible, use 1193 instead of 1194.
-Those last two lines refer to scripts, which you should copy from here:
+The commented out up/down lines refer to alternate scripts, which you could copy from here:
   #!/bin/bash

@@ Line 79: / Line 79: @@
   ./build-key ''clientname''
-and then securely copy over those, plus ca.crt and ta.key, to your computer and put them in an unreadable directory, '''/etc/openvpn/keys/''' .  don't leave any spare copies of those files lying around!
+These files will land in either ../keys or ../keys.internet, depending.
 ==Automate==

@@ Line 85: / Line 85: @@
 * edit /etc/network/if-up.d/openvpn to include the following at the end of the file:
    if grep -q 'ESSID:"freegeek"' <(iwconfig $IFACE); then
-     openvpn --daemon --config /etc/openvpn/client.conf
+     openvpn --daemon --config /etc/openvpn/client.conf --script-security 2
    fi
 * edit /etc/network/if-down.d/openvpn to include the following at the end of the file:

@@ Line 44: / Line 44: @@
   up /etc/openvpn/freegeek-up
   down /etc/openvpn/freegeek-down
 Those last two lines refer to scripts, which you should copy from here:
@@ Line 71: / Line 74: @@
 if you read that configuration file, you would have seen ca.crt, foo.crt, and foo.key, and later on ta.key.  you can't connect to the vpn without those files!
-so ask a sysadmin to run the following commands on our vpn server:
+so ask a sysadmin to run the following commands on our vpn server: (if this will be internet accessible, use vars.internet)
   cd /etc/openvpn/easy-rsa
   . ./vars

← Older revision		Revision as of 20:45, 22 May 2008
Line 88:		Line 88:
	exec killall -q openvpn		exec killall -q openvpn
	fi		fi
		+
		+	==Printing==
		+	To allow access to the printserver, add "BrowseAddress ''your-tun0-ip''" to cupsd.conf on scribble and then restart cups. You should get a consistent ip address, so this should be stable unless we need to change the keys.