Difference between revisions of "Openvpn"
Stillflame (talk | contribs) (new howto) |
Stillflame (talk | contribs) (→So, now the keys: no copy needed) |
||
Line 63: | Line 63: | ||
so ask a sysadmin to run the following commands on our vpn server: | so ask a sysadmin to run the following commands on our vpn server: | ||
− | + | cd /etc/openvpn/easy-rsa | |
. ./vars | . ./vars | ||
./build-key ''clientname'' | ./build-key ''clientname'' |
Revision as of 19:26, 28 December 2007
Introduction
OpenVPN is an open source Virtual Private Network (VPN), which allows one to establish a tunnel for any IP subnetwork or virtual ethernet adapter e.i. TUN/TAP kernel device over any UDP/TCP port. At freegeek, we have one between our wireless and wired networks.
Installation
- on debian
apt-get install openvpn openssl resolvconf
- gentoo
echo "ssl examples" >> /etc/portage/package.use emerge -av openvpn resolvconf-gentoo
- Other
can be found here: http://openvpn.net/install.html
Setup
Once installed you will need to set some things up.
Here is a sample config (though you will need to edit a few lines). Copy and save this as /etc/openvpn/client.conf .
# both '#' and ';' act as comments client dev tun proto udp # change this to your server's address remote ASK_A_SYSADMIN 1194 resolv-retry infinite nobind persist-key persist-tun tls-client ca /etc/openvpn/keys/ca.crt cert /etc/openvpn/keys/my.crt key /etc/openvpn/keys/my.key ns-cert-type server tls-auth /etc/openvpn/keys/ta.key 1 cipher BF-CBC comp-lzo up /etc/openvpn/freegeek-up.sh
That last line refers to a script, which you should copy from here:
#!/bin/bash TEMPFILE=`mktemp /tmp/resolv.conf.XXXXXX` echo search fglan >> $TEMPFILE for DHCPOPTVAR in ${!foreign_option*} ; do DHCPOPT="${!DHCPOPTVAR}" if echo $DHCPOPT | grep -qe '^dhcp-option.DNS' ; then echo $DHCPOPT | sed -re 's/dhcp-option.DNS.([0-9.]+)$/nameserver \1/' >> $TEMPFILE fi done cat $TEMPFILE | resolvconf -a $dev rm $TEMPFILE
So, now the keys
if you read that configuration file, you would have seen ca.crt, foo.crt, and foo.key, and later on ta.key. you can't connect to the vpn without those files!
so ask a sysadmin to run the following commands on our vpn server:
cd /etc/openvpn/easy-rsa . ./vars ./build-key clientname
and then securely copy over those, plus ca.crt and ta.key, to your computer and put them in an unreadable directory, /etc/openvpn/keys/ . don't leave any spare copies of those files lying around!
TODO
- teach the computers to run the following automatically on connecting to freegeek's wireless:
openvpn --config /etc/openvpn/client.conf