Introduction
In some countries webpages get blocked because they do not suffice to the rules (moral, ethical, religious) of that country.
But sometimes other sites who shouldn't be blocked are not available.
This is possible to circumvent (all traffic will pass through your home OpenVPN server) and all traffic will be encrypted (until it arrives home).
So no possibility of local evesdropping.
This also comes in handy to transfer files safely between computers or secure any insecure UPD/TCP protocol.
You also DONT NEED ANY EXTRA HARDWARE:) isn't that cool?
This howto shows how you do it.
Network Setup
OpenVPN can work in bridged mode or in tun mode. In this setup I use tun.
If you want to know the difference read these:
http://openvpn.net/faq.html#tunnel-principal
http://openvpn.net/faq.html#bridge
http://openvpn.net/faq.html#bridge1
http://openvpn.net/faq.html#bridge2
http://openvpn.net/faq.html#bridge3
http://openvpn.net/howto.html#vpntype
As you see on the image my setup is probably almost identically to yours.
The OpenVPN server is connected to the router as like all other hosts.
NAT is applied to outgoing packets.
Incoming connections are not allowed by the standard firewall configuration.
The OpenVPN server has FreeBSD 6.2 installed and the client Debian Lenny.
What to do
Configure static IP for OpenVPN server (FreeBSD)
First we have to configure the range of IP addresses given to hosts.
I configered from 192.168.33.10 to 192.168.33.20.
Look in the manual of your router where you can configure this.
Edit /etc/rc.conf and add a line like this:
Do correct the "re0" to whatever the name is for your network interface.
For example interface vr0 would be ifconfig_vr0.
To point to what DNS should be used execute the following:
This will only be applied after rebooting(or restart your network service). I hate rebooting... so lets do it manually :p
Configure OpenVPN server and client
Add to the /etc/rc.conf file to start the openvpn server automatically when booting the server:
Place this config(/usr/local/etc/openvpn/server.conf) at the server
(NOTE: ONLY try root and wheel group for testing if you are expecting permissions to be the problem! Normally you can usenobody as user and group):
Create the log directory:
The config for the client(/etc/openvpn/client.conf) is almost the same:
Also create the log directory:
OpenVPN is delivered with a nice tool to create the necessary keys and certificates called easy-rsa.
Be sure you have openssl installed.
First edit the settings in the "vars" file to your likings (I recommend you keep the standard setting, or only highten the Diffie Hellman key size to 2048)
Execute:
First the settings get read. Then clean-all creates the key dir, the serial file and the index.txt file.
Build-ca creates a Certificate Authority.
Build-key-server creates a key for the server. For one OpenVPN server you have to do this only once.
After this for each client you have, you execute build-key client1, buildkey client2, ...
Be sure that the Common Name is unique.
Build-dh does create Diffie Hellman parameters.
Copy the files dh1024.pem, ca.crt, server.crt and server.key to the /usr/local/etc/openvpn/keys directory on the server (create it).
Copy ca.crt, client1.crt and client1.key to the /etc/openvpn/keys directory on the client side.
Open firewall and forward port on router
I have a Linux based router (US Robotics). I configured the firewall using SSH login.(you can enable this in the graphical interface)
First allow packets that are arriving from the internet on the router to be forwarded to your OpenVPN server.
Forward the packets that have as destination port 1194 to your OpenVPN server:
Enable packet forwarding in the kernel:
Test the basic VPN
After all this configuration, let's check if it works.
Start openvpn on the server:
Start openvpn on the client:
Normally you should see scrolling text on the logs of both, with at the end ... "Completed".
(It may be easier to remove the lines about logging in the configuration file: log-append, status. Then the output will be printed in the terminal)
This is my log-file after starting the server:
And this gets added to it when I stop openvpn:
Look at the output of ifconfig if there are extra interfaces:
This should be what you see on the server (The number in tun0 could be different).
Notice the IP address: 192.168.100.1
The 192.168.100.2 is not of any use for you.
On the client you will see almost the same.
For example 192.168.100.6 as IP (always the first one)
Now we can ping to see if transmission is possible:
From the client:
From the server:
Both should give you a reply. (If not, be sure your firewalls do not block ICMP echo requests)
Reply == You did it:D
Do mind, that on Debian, OpenVPN gets automatically restarted if you boot. So if you can't go online anymore if the OpenVPN is not available then first try to shutdown the service:
You still can't go online through your VPN. See the next step how to do this last step.
Troubleshooting the OpenVPN tunnel
If you want more detailed information about your tunnel, you can change "verb 3" to "verb 5" in the config file.
Configure NAT on the OpenVPN server
Because the router is in the 192.168.33.1/24 range and the OpenVPN client is 192.168.100.6, the OpenVPN server(192.168.33.3) is not able to receive responses because the 192.168.100.6 can't be routed in the local network(network where OpenVPN server is). This means you need NAT for this.
So every packet coming from 192.168.100.6 will look as if it comes from the OpenVPN server (192.168.33.3). After the response it received on the OpenVPN server, NAT will correct the IP address and the port number of the packet and will send it to the OpenVPN client.
Because there is also NAT on the router this seems confusing. But in the end it is very logical. I also wondered if my OpenVPN traffic would be NATed. The solution for this is to only NAT the traffic coming from 192.168.100.6.
Setting up NAT in this case is very easy:
Put those NAT rules into /etc/ipnat.rules
re0 is your interface where the packets leave to the internal network (192.168.1.0/24) or the internet.
Correct the range (192.168.100/24)
NOTE: I only used one physical NIC to do this. The OpenVPN creates it's own virtual device: tun0. As long as the NAT rules are correct this shouldn't give you any problem.
NOTE: packets that have 192.168.100.1 (server end in the OpenVPN) will not be NATted because they are not destined for another host.
Now start ipnat:
The last thing is allowing packets to be forwarded by the host:
! Important: you need the following in the OpenVPN server config:
Try to ping google for example
Troubleshooting you can do with tcpdump:
(you can do this on all hosts and interfaces(physical and virtual: re0 and tun0 in this example) to understand how the traffic is flowing)
or
for looking at the ipnat mappings and nat rules.
Now lets automate it:
Add the following to /etc/rc.conf
In some countries webpages get blocked because they do not suffice to the rules (moral, ethical, religious) of that country.
But sometimes other sites who shouldn't be blocked are not available.
This is possible to circumvent (all traffic will pass through your home OpenVPN server) and all traffic will be encrypted (until it arrives home).
So no possibility of local evesdropping.
This also comes in handy to transfer files safely between computers or secure any insecure UPD/TCP protocol.
You also DONT NEED ANY EXTRA HARDWARE:) isn't that cool?
This howto shows how you do it.
Network Setup
OpenVPN can work in bridged mode or in tun mode. In this setup I use tun.
If you want to know the difference read these:
http://openvpn.net/faq.html#tunnel-principal
http://openvpn.net/faq.html#bridge
http://openvpn.net/faq.html#bridge1
http://openvpn.net/faq.html#bridge2
http://openvpn.net/faq.html#bridge3
http://openvpn.net/howto.html#vpntype
As you see on the image my setup is probably almost identically to yours.
The OpenVPN server is connected to the router as like all other hosts.
NAT is applied to outgoing packets.
Incoming connections are not allowed by the standard firewall configuration.
The OpenVPN server has FreeBSD 6.2 installed and the client Debian Lenny.
What to do
- Configure static IP for OpenVPN server
- Configure OpenVPN server and client (and generate authentication keys and certificates)
- Open firewall and forward port on router
- Test the basic VPN
- Configure NAT on the OpenVPN server
Configure static IP for OpenVPN server (FreeBSD)
First we have to configure the range of IP addresses given to hosts.
I configered from 192.168.33.10 to 192.168.33.20.
Look in the manual of your router where you can configure this.
Edit /etc/rc.conf and add a line like this:
Code:
ifconfig_re0="inet 192.168.33.3 netmask 255.255.255.0"
defaultrouter="192.168.33.1"
Do correct the "re0" to whatever the name is for your network interface.
For example interface vr0 would be ifconfig_vr0.
To point to what DNS should be used execute the following:
Code:
echo "nameserver 192.168.33.1" > /etc/resolv.conf
This will only be applied after rebooting(or restart your network service). I hate rebooting... so lets do it manually :p
Code:
ifconfig re0 192.168.33.3 netmask 255.255.255.0
route add default gateway 192.168.33.1
Configure OpenVPN server and client
Add to the /etc/rc.conf file to start the openvpn server automatically when booting the server:
Code:
openvpn_enable="YES"
(NOTE: ONLY try root and wheel group for testing if you are expecting permissions to be the problem! Normally you can use
Code:
# This is OpenVPN server, over UDP(better performance because of less overhead) with a tun device(routing).
proto udp
dev tun
mode server
# Authentication with OpenSSL
tls-server
tls-auth keys/ta.key 0
dh keys/dh1024.pem
ca keys/ca.crt
cert keys/server.crt
key keys/server.key
duplicate-cn
# Configure the IP range of the VPN clients
server 192.168.100.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1" # this will make all traffic go through the VPN (web requests for example do not go directly to the internet, but the OpenVPN server sends them outside.)
user root
group wheel
ping 15
verb 5
log-append /var/log/openvpn/openvpn.log
status /var/log/openvpn/status.log
#comp-lzo # Compression to get better performance
#persist-key
#persist-tun
Code:
mkdir /var/log/openvpn
Code:
proto udp
dev tun
remote 213.219.138.69 # host to connect to
tls-client
tls-auth keys/ta.key 1
ca keys/ca.crt
cert keys/client1.crt
key keys/client1.key
pull # this will execute the "push" options shown in the server config.
port 1194
user root
group root
ping 15
verb 5
log-append /var/log/openvpn/openvpn.log
status /var/log/openvpn/status.log
#persist-key
#persist-tun
#comp-lzo
Code:
mkdir /var/log/openvpn
Code:
cd /usr/local/share/doc/openvpn/easy-rsa/
First edit the settings in the "vars" file to your likings (I recommend you keep the standard setting, or only highten the Diffie Hellman key size to 2048)
Execute:
Code:
. vars
./clean-all
./build-ca
./build-key-server server
./build-key client1
./build-dh
First the settings get read. Then clean-all creates the key dir, the serial file and the index.txt file.
Build-ca creates a Certificate Authority.
Build-key-server creates a key for the server. For one OpenVPN server you have to do this only once.
After this for each client you have, you execute build-key client1, buildkey client2, ...
Be sure that the Common Name is unique.
Build-dh does create Diffie Hellman parameters.
Copy the files dh1024.pem, ca.crt, server.crt and server.key to the /usr/local/etc/openvpn/keys directory on the server (create it).
Copy ca.crt, client1.crt and client1.key to the /etc/openvpn/keys directory on the client side.
Open firewall and forward port on router
I have a Linux based router (US Robotics). I configured the firewall using SSH login.(you can enable this in the graphical interface)
First allow packets that are arriving from the internet on the router to be forwarded to your OpenVPN server.
Code:
iptables -I FORWARD 1 -d 192.168.33.3 -p tcp --dport 1194 -j ACCEPT
Code:
iptables -t nat -A PREROUTING -p udp --dport 1194 -j DNAT --to 192.168.33.3:1194
Code:
echo 1 > /proc/sys/net/ipv4/ip_forward
Test the basic VPN
After all this configuration, let's check if it works.
Start openvpn on the server:
Code:
cd /usr/local/etc/openvpn
openvpn/openvpn server.conf
Code:
cd /etc/openvpn/
openvpn client.conf
Normally you should see scrolling text on the logs of both, with at the end ... "Completed".
(It may be easier to remove the lines about logging in the configuration file: log-append, status. Then the output will be printed in the terminal)
This is my log-file after starting the server:
Code:
Thu Dec 20 07:59:01 2007 us=619831 Current Parameter Settings:
Thu Dec 20 07:59:01 2007 us=621081 config = 'server.conf'
Thu Dec 20 07:59:01 2007 us=621192 mode = 1
Thu Dec 20 07:59:01 2007 us=621255 show_ciphers = DISABLED
Thu Dec 20 07:59:01 2007 us=621314 show_digests = DISABLED
Thu Dec 20 07:59:01 2007 us=621373 show_engines = DISABLED
Thu Dec 20 07:59:01 2007 us=621431 genkey = DISABLED
Thu Dec 20 07:59:01 2007 us=621488 key_pass_file = '[UNDEF]'
Thu Dec 20 07:59:01 2007 us=621547 show_tls_ciphers = DISABLED
Thu Dec 20 07:59:01 2007 us=621605 proto = 0
Thu Dec 20 07:59:01 2007 us=621663 local = '[UNDEF]'
Thu Dec 20 07:59:01 2007 us=621721 remote_list = NULL
Thu Dec 20 07:59:01 2007 us=621782 remote_random = DISABLED
Thu Dec 20 07:59:01 2007 us=621840 local_port = 1194
Thu Dec 20 07:59:01 2007 us=621900 remote_port = 1194
Thu Dec 20 07:59:01 2007 us=621958 remote_float = DISABLED
Thu Dec 20 07:59:01 2007 us=622017 ipchange = '[UNDEF]'
Thu Dec 20 07:59:01 2007 us=622075 bind_local = ENABLED
Thu Dec 20 07:59:01 2007 us=622134 dev = 'tun'
Thu Dec 20 07:59:01 2007 us=622204 dev_type = '[UNDEF]'
Thu Dec 20 07:59:01 2007 us=622264 dev_node = '[UNDEF]'
Thu Dec 20 07:59:01 2007 us=622322 tun_ipv6 = DISABLED
Thu Dec 20 07:59:01 2007 us=622381 ifconfig_local = '192.168.100.1'
Thu Dec 20 07:59:01 2007 us=622441 ifconfig_remote_netmask = '192.168.100.2'
Thu Dec 20 07:59:01 2007 us=622499 ifconfig_noexec = DISABLED
Thu Dec 20 07:59:01 2007 us=622558 ifconfig_nowarn = DISABLED
Thu Dec 20 07:59:01 2007 us=622616 shaper = 0
Thu Dec 20 07:59:01 2007 us=622675 tun_mtu = 1500
Thu Dec 20 07:59:01 2007 us=622732 tun_mtu_defined = ENABLED
Thu Dec 20 07:59:01 2007 us=622791 link_mtu = 1500
Thu Dec 20 07:59:01 2007 us=622849 link_mtu_defined = DISABLED
Thu Dec 20 07:59:01 2007 us=622908 tun_mtu_extra = 0
Thu Dec 20 07:59:01 2007 us=622967 tun_mtu_extra_defined = DISABLED
Thu Dec 20 07:59:01 2007 us=623026 fragment = 0
Thu Dec 20 07:59:01 2007 us=623084 mtu_discover_type = -1
Thu Dec 20 07:59:01 2007 us=623262 mtu_test = 0
Thu Dec 20 07:59:01 2007 us=623331 mlock = DISABLED
Thu Dec 20 07:59:01 2007 us=623390 keepalive_ping = 0
Thu Dec 20 07:59:01 2007 us=623449 keepalive_timeout = 0
Thu Dec 20 07:59:01 2007 us=623508 inactivity_timeout = 0
Thu Dec 20 07:59:01 2007 us=623568 ping_send_timeout = 15
Thu Dec 20 07:59:01 2007 us=623627 ping_rec_timeout = 0
Thu Dec 20 07:59:01 2007 us=623686 ping_rec_timeout_action = 0
Thu Dec 20 07:59:01 2007 us=623745 ping_timer_remote = DISABLED
Thu Dec 20 07:59:01 2007 us=623804 remap_sigusr1 = 0
Thu Dec 20 07:59:01 2007 us=623863 explicit_exit_notification = 0
Thu Dec 20 07:59:01 2007 us=623921 persist_tun = DISABLED
Thu Dec 20 07:59:01 2007 us=623980 persist_local_ip = DISABLED
Thu Dec 20 07:59:01 2007 us=624039 persist_remote_ip = DISABLED
Thu Dec 20 07:59:01 2007 us=624097 persist_key = DISABLED
Thu Dec 20 07:59:01 2007 us=624156 mssfix = 1450
Thu Dec 20 07:59:01 2007 us=624229 passtos = DISABLED
Thu Dec 20 07:59:01 2007 us=624289 resolve_retry_seconds = 1000000000
Thu Dec 20 07:59:01 2007 us=624348 connect_retry_seconds = 5
Thu Dec 20 07:59:01 2007 us=624407 username = 'root'
Thu Dec 20 07:59:01 2007 us=624466 groupname = 'wheel'
Thu Dec 20 07:59:01 2007 us=624525 chroot_dir = '[UNDEF]'
Thu Dec 20 07:59:01 2007 us=624584 cd_dir = '[UNDEF]'
Thu Dec 20 07:59:01 2007 us=624670 writepid = '[UNDEF]'
Thu Dec 20 07:59:01 2007 us=624730 up_script = './server.up'
Thu Dec 20 07:59:01 2007 us=624789 down_script = '[UNDEF]'
Thu Dec 20 07:59:01 2007 us=624848 down_pre = DISABLED
Thu Dec 20 07:59:01 2007 us=624906 up_restart = DISABLED
Thu Dec 20 07:59:01 2007 us=624965 up_delay = DISABLED
Thu Dec 20 07:59:01 2007 us=625023 daemon = DISABLED
Thu Dec 20 07:59:01 2007 us=625082 inetd = 0
Thu Dec 20 07:59:01 2007 us=625140 log = ENABLED
Thu Dec 20 07:59:01 2007 us=625211 suppress_timestamps = DISABLED
Thu Dec 20 07:59:01 2007 us=625271 nice = 0
Thu Dec 20 07:59:01 2007 us=625331 verbosity = 5
Thu Dec 20 07:59:01 2007 us=625443 mute = 0
Thu Dec 20 07:59:01 2007 us=625512 gremlin = 0
Thu Dec 20 07:59:01 2007 us=625572 status_file = '/var/log/openvpn/status.log'
Thu Dec 20 07:59:01 2007 us=625632 status_file_version = 1
Thu Dec 20 07:59:01 2007 us=625691 status_file_update_freq = 60
Thu Dec 20 07:59:01 2007 us=625751 occ = ENABLED
Thu Dec 20 07:59:01 2007 us=625812 rcvbuf = 65536
Thu Dec 20 07:59:01 2007 us=625873 sndbuf = 65536
Thu Dec 20 07:59:01 2007 us=625934 socks_proxy_server = '[UNDEF]'
Thu Dec 20 07:59:01 2007 us=625996 socks_proxy_port = 0
Thu Dec 20 07:59:01 2007 us=626056 socks_proxy_retry = DISABLED
Thu Dec 20 07:59:01 2007 us=626116 fast_io = DISABLED
Thu Dec 20 07:59:01 2007 us=626226 comp_lzo = ENABLED
Thu Dec 20 07:59:01 2007 us=626294 comp_lzo_adaptive = ENABLED
Thu Dec 20 07:59:01 2007 us=626356 route_script = '[UNDEF]'
Thu Dec 20 07:59:01 2007 us=626416 route_default_gateway = '[UNDEF]'
Thu Dec 20 07:59:01 2007 us=626476 route_noexec = DISABLED
Thu Dec 20 07:59:01 2007 us=626536 route_delay = 0
Thu Dec 20 07:59:01 2007 us=626596 route_delay_window = 30
Thu Dec 20 07:59:01 2007 us=626656 route_delay_defined = DISABLED
Thu Dec 20 07:59:01 2007 us=626721 route 192.168.100.0/255.255.255.0/nil/nil
Thu Dec 20 07:59:01 2007 us=626783 management_addr = '[UNDEF]'
Thu Dec 20 07:59:01 2007 us=626845 management_port = 0
Thu Dec 20 07:59:01 2007 us=626904 management_user_pass = '[UNDEF]'
Thu Dec 20 07:59:01 2007 us=626967 management_log_history_cache = 250
Thu Dec 20 07:59:01 2007 us=627028 management_echo_buffer_size = 100
Thu Dec 20 07:59:01 2007 us=627089 management_query_passwords = DISABLED
Thu Dec 20 07:59:01 2007 us=627150 management_hold = DISABLED
Thu Dec 20 07:59:01 2007 us=627226 shared_secret_file = '[UNDEF]'
Thu Dec 20 07:59:01 2007 us=627287 key_direction = 1
Thu Dec 20 07:59:01 2007 us=627348 ciphername_defined = ENABLED
Thu Dec 20 07:59:01 2007 us=627409 ciphername = 'BF-CBC'
Thu Dec 20 07:59:01 2007 us=627469 authname_defined = ENABLED
Thu Dec 20 07:59:01 2007 us=627580 authname = 'SHA1'
Thu Dec 20 07:59:01 2007 us=627649 keysize = 0
Thu Dec 20 07:59:01 2007 us=627710 engine = DISABLED
Thu Dec 20 07:59:01 2007 us=627769 replay = ENABLED
Thu Dec 20 07:59:01 2007 us=627830 mute_replay_warnings = DISABLED
Thu Dec 20 07:59:01 2007 us=627890 replay_window = 64
Thu Dec 20 07:59:01 2007 us=627950 replay_time = 15
Thu Dec 20 07:59:01 2007 us=628011 packet_id_file = '[UNDEF]'
Thu Dec 20 07:59:01 2007 us=628071 use_iv = ENABLED
Thu Dec 20 07:59:01 2007 us=628132 test_crypto = DISABLED
Thu Dec 20 07:59:01 2007 us=628209 tls_server = ENABLED
Thu Dec 20 07:59:01 2007 us=628271 tls_client = DISABLED
Thu Dec 20 07:59:01 2007 us=628333 key_method = 2
Thu Dec 20 07:59:01 2007 us=628394 ca_file = 'keys/ca.crt'
Thu Dec 20 07:59:01 2007 us=628456 dh_file = 'keys/dh1024.pem'
Thu Dec 20 07:59:01 2007 us=628517 cert_file = 'keys/server.crt'
Thu Dec 20 07:59:01 2007 us=628578 priv_key_file = 'keys/server.key'
Thu Dec 20 07:59:01 2007 us=628640 pkcs12_file = '[UNDEF]'
Thu Dec 20 07:59:01 2007 us=628700 cipher_list = '[UNDEF]'
Thu Dec 20 07:59:01 2007 us=628761 tls_verify = '[UNDEF]'
Thu Dec 20 07:59:01 2007 us=628822 tls_remote = '[UNDEF]'
Thu Dec 20 07:59:01 2007 us=628884 crl_file = '[UNDEF]'
Thu Dec 20 07:59:01 2007 us=628945 ns_cert_type = 0
Thu Dec 20 07:59:01 2007 us=629006 tls_timeout = 2
Thu Dec 20 07:59:01 2007 us=629068 renegotiate_bytes = 0
Thu Dec 20 07:59:01 2007 us=629130 renegotiate_packets = 0
Thu Dec 20 07:59:01 2007 us=629206 renegotiate_seconds = 3600
Thu Dec 20 07:59:01 2007 us=629269 handshake_window = 60
Thu Dec 20 07:59:01 2007 us=629331 transition_window = 3600
Thu Dec 20 07:59:01 2007 us=629391 single_session = DISABLED
Thu Dec 20 07:59:01 2007 us=629453 tls_exit = DISABLED
Thu Dec 20 07:59:01 2007 us=629514 tls_auth_file = 'keys/ta.key'
Thu Dec 20 07:59:01 2007 us=629594 server_network = 192.168.100.0
Thu Dec 20 07:59:01 2007 us=629666 server_netmask = 255.255.255.0
Thu Dec 20 07:59:01 2007 us=629796 server_bridge_ip = 0.0.0.0
Thu Dec 20 07:59:01 2007 us=629876 server_bridge_netmask = 0.0.0.0
Thu Dec 20 07:59:01 2007 us=629947 server_bridge_pool_start = 0.0.0.0
Thu Dec 20 07:59:01 2007 us=630019 server_bridge_pool_end = 0.0.0.0
Thu Dec 20 07:59:01 2007 us=630083 push_list = 'redirect-gateway def1,route 192.168.100.1'
Thu Dec 20 07:59:01 2007 us=630144 ifconfig_pool_defined = ENABLED
Thu Dec 20 07:59:01 2007 us=630233 ifconfig_pool_start = 192.168.100.4
Thu Dec 20 07:59:01 2007 us=630306 ifconfig_pool_end = 192.168.100.251
Thu Dec 20 07:59:01 2007 us=630376 ifconfig_pool_netmask = 0.0.0.0
Thu Dec 20 07:59:01 2007 us=630439 ifconfig_pool_persist_filename = 'ipp.txt'
Thu Dec 20 07:59:01 2007 us=630502 ifconfig_pool_persist_refresh_freq = 600
Thu Dec 20 07:59:01 2007 us=630564 ifconfig_pool_linear = DISABLED
Thu Dec 20 07:59:01 2007 us=630625 n_bcast_buf = 256
Thu Dec 20 07:59:01 2007 us=630685 tcp_queue_limit = 64
Thu Dec 20 07:59:01 2007 us=630747 real_hash_size = 256
Thu Dec 20 07:59:01 2007 us=630807 virtual_hash_size = 256
Thu Dec 20 07:59:01 2007 us=630868 client_connect_script = '[UNDEF]'
Thu Dec 20 07:59:01 2007 us=630929 learn_address_script = '[UNDEF]'
Thu Dec 20 07:59:01 2007 us=630990 client_disconnect_script = '[UNDEF]'
Thu Dec 20 07:59:01 2007 us=631051 client_config_dir = '[UNDEF]'
Thu Dec 20 07:59:01 2007 us=631112 ccd_exclusive = DISABLED
Thu Dec 20 07:59:01 2007 us=631185 tmp_dir = '[UNDEF]'
Thu Dec 20 07:59:01 2007 us=631248 push_ifconfig_defined = DISABLED
Thu Dec 20 07:59:01 2007 us=631318 push_ifconfig_local = 0.0.0.0
Thu Dec 20 07:59:01 2007 us=631387 push_ifconfig_remote_netmask = 0.0.0.0
Thu Dec 20 07:59:01 2007 us=631449 enable_c2c = DISABLED
Thu Dec 20 07:59:01 2007 us=631508 duplicate_cn = ENABLED
Thu Dec 20 07:59:01 2007 us=631569 cf_max = 0
Thu Dec 20 07:59:01 2007 us=631628 cf_per = 0
Thu Dec 20 07:59:01 2007 us=631689 max_clients = 1024
Thu Dec 20 07:59:01 2007 us=631750 max_routes_per_client = 256
Thu Dec 20 07:59:01 2007 us=631858 client_cert_not_required = DISABLED
Thu Dec 20 07:59:01 2007 us=631925 username_as_common_name = DISABLED
Thu Dec 20 07:59:01 2007 us=631986 auth_user_pass_verify_script = '[UNDEF]'
Thu Dec 20 07:59:01 2007 us=632048 auth_user_pass_verify_script_via_file = DISABLED
Thu Dec 20 07:59:01 2007 us=632110 client = DISABLED
Thu Dec 20 07:59:01 2007 us=632183 pull = DISABLED
Thu Dec 20 07:59:01 2007 us=632247 auth_user_pass_file = '[UNDEF]'
Thu Dec 20 07:59:01 2007 us=632314 OpenVPN 2.0.6 i386-portbld-freebsd6.2 [SSL] [LZO] built on Oct 15 2006
Thu Dec 20 07:59:01 2007 us=632618 IMPORTANT: OpenVPN's default port number is now 1194, based on an official port number assignment by IANA. OpenVPN 2.0-beta16 and earlier used 5000 as the default port.
Thu Dec 20 07:59:01 2007 us=632700 WARNING: --ping should normally be used with --ping-restart or --ping-exit
Thu Dec 20 07:59:01 2007 us=632754 WARNING: you are using user/group/chroot without persist-key/persist-tun -- this may cause restarts to fail
Thu Dec 20 07:59:01 2007 us=632807 WARNING: --ifconfig-pool-persist will not work with --duplicate-cn
Thu Dec 20 07:59:01 2007 us=632858 WARNING: --keepalive option is missing from server config
Thu Dec 20 07:59:01 2007 us=682193 Diffie-Hellman initialized with 1024 bit key
Thu Dec 20 07:59:01 2007 us=698533 Control Channel Authentication: using 'keys/ta.key' as a OpenVPN static key file
Thu Dec 20 07:59:01 2007 us=698745 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Dec 20 07:59:01 2007 us=698844 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Dec 20 07:59:01 2007 us=698937 TLS-Auth MTU parms [ L:1542 D:166 EF:66 EB:0 ET:0 EL:0 ]
Thu Dec 20 07:59:01 2007 us=699549 gw 192.168.1.1
Thu Dec 20 07:59:01 2007 us=700008 TUN/TAP device /dev/tun0 opened
Thu Dec 20 07:59:01 2007 us=700181 /sbin/ifconfig tun0 192.168.100.1 192.168.100.2 mtu 1500 netmask 255.255.255.255 up
Thu Dec 20 07:59:01 2007 us=720889 ./server.up tun0 1500 1542 192.168.100.1 192.168.100.2 init
Thu Dec 20 07:59:01 2007 us=742528 /sbin/route add -net 192.168.100.0 192.168.100.2 255.255.255.0
add net 192.168.100.0: gateway 192.168.100.2
Thu Dec 20 07:59:01 2007 us=759919 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Thu Dec 20 07:59:01 2007 us=763642 GID set to wheel
Thu Dec 20 07:59:01 2007 us=763810 UID set to root
Thu Dec 20 07:59:01 2007 us=763942 Socket Buffers: R=[42080->65536] S=[9216->65536]
Thu Dec 20 07:59:01 2007 us=764033 UDPv4 link local (bound): [undef]:1194
Thu Dec 20 07:59:01 2007 us=764098 UDPv4 link remote: [undef]
Thu Dec 20 07:59:01 2007 us=764210 MULTI: multi_init called, r=256 v=256
Thu Dec 20 07:59:01 2007 us=764382 IFCONFIG POOL: base=192.168.100.4 size=62
Thu Dec 20 07:59:01 2007 us=764487 IFCONFIG POOL LIST
Thu Dec 20 07:59:01 2007 us=764683 Initialization Sequence Completed
And this gets added to it when I stop openvpn:
Code:
Thu Dec 20 07:59:36 2007 us=859158 event_wait : Interrupted system call (code=4)
Thu Dec 20 07:59:36 2007 us=860092 TCP/UDP: Closing socket
Thu Dec 20 07:59:36 2007 us=860316 /sbin/route delete -net 192.168.100.0 192.168.100.2 255.255.255.0
delete net 192.168.100.0: gateway 192.168.100.2
Thu Dec 20 07:59:36 2007 us=880020 Closing TUN/TAP interface
Thu Dec 20 07:59:36 2007 us=880585 SIGINT[hard,] received, process exiting
Look at the output of ifconfig if there are extra interfaces:
Code:
ifconfig
Code:
tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:192.168.100.1 P-t-P:192.168.100.2 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)
This should be what you see on the server (The number in tun0 could be different).
Notice the IP address: 192.168.100.1
The 192.168.100.2 is not of any use for you.
On the client you will see almost the same.
For example 192.168.100.6 as IP (always the first one)
Now we can ping to see if transmission is possible:
From the client:
Code:
ping 192.168.100.1
From the server:
Code:
ping 192.168.100.6
Both should give you a reply. (If not, be sure your firewalls do not block ICMP echo requests)
Reply == You did it:D
Do mind, that on Debian, OpenVPN gets automatically restarted if you boot. So if you can't go online anymore if the OpenVPN is not available then first try to shutdown the service:
Code:
/etc/init.d/openvpn stop
Troubleshooting the OpenVPN tunnel
If you want more detailed information about your tunnel, you can change "verb 3" to "verb 5" in the config file.
Configure NAT on the OpenVPN server
Because the router is in the 192.168.33.1/24 range and the OpenVPN client is 192.168.100.6, the OpenVPN server(192.168.33.3) is not able to receive responses because the 192.168.100.6 can't be routed in the local network(network where OpenVPN server is). This means you need NAT for this.
So every packet coming from 192.168.100.6 will look as if it comes from the OpenVPN server (192.168.33.3). After the response it received on the OpenVPN server, NAT will correct the IP address and the port number of the packet and will send it to the OpenVPN client.
Because there is also NAT on the router this seems confusing. But in the end it is very logical. I also wondered if my OpenVPN traffic would be NATed. The solution for this is to only NAT the traffic coming from 192.168.100.6.
Setting up NAT in this case is very easy:
Code:
kldload ipl
Put those NAT rules into /etc/ipnat.rules
Code:
map re0 192.168.100.0/24 -> 0/32 portmap tcp/udp 30001:40000 map re0 192.168.100.0/24 -> 0/32
re0 is your interface where the packets leave to the internal network (192.168.1.0/24) or the internet.
Correct the range (192.168.100/24)
NOTE: I only used one physical NIC to do this. The OpenVPN creates it's own virtual device: tun0. As long as the NAT rules are correct this shouldn't give you any problem.
NOTE: packets that have 192.168.100.1 (server end in the OpenVPN) will not be NATted because they are not destined for another host.
Now start ipnat:
Code:
/etc/rc.d/ipnat start ipnat -f /etc/ipnat.rules
The last thing is allowing packets to be forwarded by the host:
Code:
sysctl net.inet.ip.forwarding=1
! Important: you need the following in the OpenVPN server config:
Code:
push "redirect-gateway def1"
Try to ping google for example
Troubleshooting you can do with tcpdump:
Code:
tcpdump -tt -i re0
(you can do this on all hosts and interfaces(physical and virtual: re0 and tun0 in this example) to understand how the traffic is flowing)
or
Code:
ipnat -l
for looking at the ipnat mappings and nat rules.
Now lets automate it:
Add the following to /etc/rc.conf
Code:
gateway_enable="YES"
firewall_enable="YES"
firewall_type="open"
ipnat_enable="YES" # Set to YES to enable ipnat functionality
ipnat_program="/sbin/ipnat" # where the ipnat program lives
ipnat_rules="/etc/ipnat.rules" # rules definition file for ipnat
