OpenVPN

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 22:17, 4 March 2013 (edit)
Sash (Talk | contribs)
(Changeable Parameters)
← Previous diff
Revision as of 03:54, 5 May 2018 (edit) (undo)
Rocketboy235 (Talk | contribs)
(Authentication with username and password)
Next diff →
(48 intermediate revisions not shown.)
Line 2: Line 2:
OpenVPN is a full-featured SSL VPN solution which can accomodate a wide range of configurations, including road warrior access, home/office/campus telecommuting, WiFi security, secure branch office linking, and enterprise-scale remote access solutions with load balancing, failover, and fine-grained access-controls. OpenVPN is a full-featured SSL VPN solution which can accomodate a wide range of configurations, including road warrior access, home/office/campus telecommuting, WiFi security, secure branch office linking, and enterprise-scale remote access solutions with load balancing, failover, and fine-grained access-controls.
 +=Security=
 +
 +Interesting article about strength and security of PKI today [http://www.pro-linux.de/news/1/20246/roeckx-aktueller-stand-der-kryptografie.html Pro-Linux (german)]
=Support= =Support=
-There are a great variety of support options for OpenVPN which discuss all of the OpenVPN features in detail. If you have any questions, first check out these resources:+There are a great variety of support options for OpenVPN which discuss all of the OpenVPN features in detail. If you have any questions, first check out these resources:
* [http://openvpn.net/index.php/open-source/faq OpenVPN FAQ] * [http://openvpn.net/index.php/open-source/faq OpenVPN FAQ]
* [https://community.openvpn.net/openvpn/wiki/RelatedProjects#Services OpenVPN Related Project Services] * [https://community.openvpn.net/openvpn/wiki/RelatedProjects#Services OpenVPN Related Project Services]
 +
 +In doubt always refer to the OpenVPN documentation.
=Getting OpenVPN= =Getting OpenVPN=
Line 15: Line 20:
Please note that it consists of one binary for both client and server connections, so don't look for individually labeled client or server packages. Please note that it consists of one binary for both client and server connections, so don't look for individually labeled client or server packages.
 +
 +=OpenVPN authentication=
 +
 +You will have several possibilities to authenticate to an openvpn session. Some authentication methods are supported by the gui directly (should be preferred), others have to be set up in daemon mode. Which you will use depends on some things: how secure, easy to setup, easy to maintain
 +
 +==Public Key Infrastructure (PKI) [Certificates]==
 +
 +Follow these [http://openvpn.net/howto.html#pki instructions] to create the required certificates and keys. But there is also a Webmin module for linux servers to create your PKI infrastructure (OpenVPN CA). You begin by creating a key and certificate pair for the certificate authority (CA) you are establishing. Then for the server and each client, you create a private key and certificate pair and sign the certificates using the CA's key. Afterwards, you should have the following files:
 +
 + ca.crt
 + ca.key
 + dh{n}.pem
 + server.crt
 + server.key
 +
 +and a private key and certificate pair for each client. For example, if you have two clients, you should have:
 +
 + client1.crt
 + client1.key
 + client2.crt
 + client2.key
 +
 +'''Note: The CA private key (ca.key) is used only to sign the certificates. It should be kept securely and not be copied to the server or clients.
 +'''
 +
 +Per the following [https://www.dd-wrt.com/phpBB2/viewtopic.php?p=1104167] OpenVPN certs must be generated with SHA auth
 +
 +==Static Key==
 +
 +This method is only usable for connecting '''one''' client to a server! <br>
 +
 +On Linux you can create a pair of keys as easy as
 + openvpn --genkey --secret /home/"user"/static.key
 +
 +On Windows system you must already have openvpn installed. To create a pair of keys go to
 + programs -> openvpn -> generate a static openvpn key
 +
 +Copy the content of the keys to the ddwrt gui static key field and you're done.
 +
 +[http://openvpn.net/index.php/open-source/documentation/miscellaneous/78-static-key-mini-howto.html Info] <br>
 +[http://openmaniak.com/openvpn_static.php create keypair]
=OpenVPN in DD-WRT= =OpenVPN in DD-WRT=
In this section, it is assumed that you already have the DD-WRT installed in your router and that its a current build (newer than 01/2011). OpenVPN is only available on units with at least 8mb flash (except the Broadcom VPN build.) In this section, it is assumed that you already have the DD-WRT installed in your router and that its a current build (newer than 01/2011). OpenVPN is only available on units with at least 8mb flash (except the Broadcom VPN build.)
 +
 +The DD-WRT GUI Server and Client modes are very straight forward. So when defaults are left as is, it should run out of the box for 90% of the users.
# Using the [[Web_Interface|Web Interface]], go to the "Services" tab and then the "VPN" tab (for older versions of dd-wrt go to the "Administration" tab and then the "Services" sub-tab). # Using the [[Web_Interface|Web Interface]], go to the "Services" tab and then the "VPN" tab (for older versions of dd-wrt go to the "Administration" tab and then the "Services" sub-tab).
Line 24: Line 72:
# Click '''Apply Settings'''. # Click '''Apply Settings'''.
 +A guide on how to set up OpenVPN client where only specific traffic is routed via the VPN tunnel is available here:
 +[https://charleswilkinson.co.uk/2016/05/14/selective-routing-using-ddwrt-and-openvpn/ Selective Routing Using DD-WRT and OpenVPN]
 +
 +==CLI settings==
 +===Scramble Patch by clayface===
 +These posts adds a patch to openvpn which introduces forms of scrambling to the packet payload of any OpenVPN connection.
 +To use it you need both sides patched, server and client, and you introduce a new scramble password phrase in server and client config files
 +
 + “scramble password” – perform a simple xor operation the packet payload, using a string “password”, you choose password
 +
 + “scramble reverse” – This simply reverses all the data in the packet. This is enough to get past the regular expression detection in both China and Iran.
 +
 + “scramble xorptrpos” – This performs a xor operation, utilising the current position in the packet payload.
 +
 + “scramble obfuscate password” – This method is more secure. It utilises the 3 types of scrambling mentioned above. “password” is a string you choose.
==GUI: Client Mode== ==GUI: Client Mode==
===Fixed Parameters=== ===Fixed Parameters===
-There are default parameters that DD-WRT will always wite to the config file and which you '''cant''' change if you use GUI client mode:+There are default parameters that will always be written to the config file and which you '''cant''' change if you use GUI client mode:
ca /tmp/openvpncl/ca.crt ca /tmp/openvpncl/ca.crt
Line 56: Line 119:
;Port: port which OpenVPN server is listening on. {1194} [port xxx] ;Port: port which OpenVPN server is listening on. {1194} [port xxx]
;Tunnel Device (TUN/TAP): The mode of tunneling. TUN: routing (layer 3), TAP: bridgeing (layer 2. can be used for routing, too, but its not very common). [dev-type tun/tap] ;Tunnel Device (TUN/TAP): The mode of tunneling. TUN: routing (layer 3), TAP: bridgeing (layer 2. can be used for routing, too, but its not very common). [dev-type tun/tap]
-;Tunnel Protocoll (UDP/TCP): The subprotocol the connection will use on the real used tcp connection. {udp} [proto udp/tcp]+;Tunnel Protocoll (UDP/TCP): The subprotocol the connection will use on the connection. {udp} [proto udp/tcp]
;Encryption Cipher (None and Blowfish to AES512): The encryption algorithm that will be used for the tunnel. Blowfish "fastest" to AES512 "safest". {AES128} [cipher xxx] ;Encryption Cipher (None and Blowfish to AES512): The encryption algorithm that will be used for the tunnel. Blowfish "fastest" to AES512 "safest". {AES128} [cipher xxx]
;Hash Algorithm (None and MD4 to SHA512): The hash algorithm that will be used. MD4: fastest (maybe unsafe) to SHA512. {SHA256} [auth xxx] ;Hash Algorithm (None and MD4 to SHA512): The hash algorithm that will be used. MD4: fastest (maybe unsafe) to SHA512. {SHA256} [auth xxx]
-;nsCertType verification: Checks to see if the remote server is using a valid type of certificate meant for OpenVPN connections. As this is a security feature of OpenVPN, it should be left enabled. {checked} [] 
;Advanced options: Leave defaults as is if you dont know what you are doing. {disabled} [] ;Advanced options: Leave defaults as is if you dont know what you are doing. {disabled} []
 +;TLS Cipher: What encryption algorithm OpenVPN should use for encrypting its control channel. {disabled} []
;LZO Compression: Enables compression over VPN. This might speedup the connection. Must be the same value as on server. {adaptive} [comp-lzo yes/no/adaptive/disabled] ;LZO Compression: Enables compression over VPN. This might speedup the connection. Must be the same value as on server. {adaptive} [comp-lzo yes/no/adaptive/disabled]
-;NAT: Enable network address translation on the client side of the connection. Enables tne NAT-firewall to protect clients. {disabled}+;NAT: Enable network address translation on the client side of the connection. Enables the NAT-firewall to protect clients. {disabled}
;Bridge TAP to br0: Enable a transparent bridge across the tunnel to the local LAN. Works only in TAP mode with NAT disabled. {disabled} ;Bridge TAP to br0: Enable a transparent bridge across the tunnel to the local LAN. Works only in TAP mode with NAT disabled. {disabled}
;Local IP Address: In cases you will not get an ip from the server. Not very common. {empty) ;Local IP Address: In cases you will not get an ip from the server. Not very common. {empty)
;Subnet Mask: Subnet Mask for the IP Address. ;Subnet Mask: Subnet Mask for the IP Address.
;TUN MTU Setting: set the mtu of the tunnel {1500} [tun-mtu xxx] ;TUN MTU Setting: set the mtu of the tunnel {1500} [tun-mtu xxx]
-;MSS-Fix/Fragment across the tunnel: set mss-fix and fragmentaion accross the tunnel. {empty} [fragment xxx] [mssfix]+;UDP Fragment across the tunnel: set mss-fix and fragmentaion accross the tunnel. {empty} [fragment xxx]
-;TLS Cipher: What encryption algorithm OpenVPN should use for encrypting its control channel. {disabled} []+;UDP MSS-Fix: = value of Fragment. Only usen with udp. should be set on one side only. [mssfix]
-;TLS Auth Key: The static key OpenVPN should use for generating HMAC send/receive keys.+;nsCertType verification: Checks to see if the remote server is using a valid type of certificate meant for OpenVPN connections. As this is a security feature of OpenVPN, it should be left enabled. {checked} []
 +;TLS Auth Key: The static key OpenVPN should use for generating HMAC send/receive keys. {disabled} []
;Additional Config: Any additional configurations you want to define for the VPN connection. {empty} ;Additional Config: Any additional configurations you want to define for the VPN connection. {empty}
;Policy based Routing: allow only special clients to use the tunnel. Add IPs in the form 0.0.0.0/0 to force clients to use the tunnel as default gateway. One line per IP. {} [] ;Policy based Routing: allow only special clients to use the tunnel. Add IPs in the form 0.0.0.0/0 to force clients to use the tunnel as default gateway. One line per IP. {} []
Line 139: Line 203:
;Client connect script: . {empty} [] ;Client connect script: . {empty} []
;Additional Config: Any additional configurations you want to define for the VPN connection. {empty} ;Additional Config: Any additional configurations you want to define for the VPN connection. {empty}
-;Public Server Cert: Certificate of OpenVPN CA (not the server's public cert) in ''pem'' form; only part between (and including) <tt>-----BEGIN CERTIFICATE-----</tt> and <tt>-----END CERTIFICATE-----</tt> is necessary; as it is stored in [[nvram]], everything else from that file should be removed to conserve space.+;CA Cert: Certificate of OpenVPN CA in ''pem'' form (usually ca.crt); only part between (and including) <tt>-----BEGIN CERTIFICATE-----</tt> and <tt>-----END CERTIFICATE-----</tt> is necessary; as it is stored in [[nvram]], everything else from that file should be removed to conserve space.
-;Public Client Cert: Client certificate issued by CA for this particular router; also only part between 'BEGIN' and 'END' is required+;Public Server Cert: Server certificate issued by CA for this particular router (usually server.crt); also only part between 'BEGIN' and 'END' is required.
-;Private Client Key: Key associated with certificate above; should be kept secret because anybody who knows this key can successfully authenticate as this client+;Private Server Key: Key associated with certificate above (usually server.key); should be kept secret because anybody who knows this key can successfully authenticate client certificates.
 +;DH PEM: Diffie Hellman parameters generated for the OpenVPN server (usually dh1024.pem).
-===Additional Server Protection with usernames and passwords===+===Authentication with username and password===
-I wanted to make the access to my network easy but secure. Certificates are nice, but I still like username and password even more. You can use the following simple script to check for usernames/passwords. +Certificates are nice, but having usernames and passwords can complement certificates. You can use the following script below to check for usernames/passwords.
Add this to the config on the server and set the right path for the script: Add this to the config on the server and set the right path for the script:
 + script-security 2
auth-user-pass-verify /path/to/your/script/verify.sh via-file auth-user-pass-verify /path/to/your/script/verify.sh via-file
-This line tells openvpn server to check for passed username and password by calling the script verify.sh and passing the username and password in a tmp file+The script-security line is to resolve the issue where an external program may not be called due to setting of --script-security level
 +The auth-user-pass-verify line enables the OpenVPN server to check the passed username and password by calling the script verify.sh and passing the username and password in a tmp file.
- +Every client will need to have this in its config file to connect:
-Every client have to have this in its config file:+
auth-user-pass auth-user-pass
-This just tells openvpn client to ask the user for username and password or s/he will not be able to log in. You can also use "--auth-user-pass" (instead of the line in the config file) on the command line.+This tells OpenVPN client to ask the user for username and password or s/he will not be able to log in. You can also use "--auth-user-pass" (instead of the line in the config file) on the command line.
 +I have split up the functions into separate files compared to predecessors (See page history).
 +The verification done by the script may not work if OpenVPN is running in "daemon" mode (to be confirmed).
-This is a simple shell script called "verify.sh" which contains usernames and passwords in clear text. I wanted to encrypt passwords with "passwd", but command "passwd" is not available in dd-wrt (and I have no idea how dd-wrt encrypts root password for /etc/passwd). If someone knows how to encrypt passwords in dd-wrt, plese add it '''here'''.+[Edit by Rocketboy235 May 4 2018]
 +Script has been updated to be much more secure/efficient than the previous versions found in page history.
-[Edit by mrwizeman Dec 18 2011]+Verify.sh
-Hmm ok, I pasted a script here like 2 years ago which grtz was kind enough to modify to support multiple users+ 
-but after trying it, I couldnt get it to work and I couldnt really understand all of the bracketbracket if statements either so here is a modified version from me as well, which now has multiple users support as well as hash capabillity and it lowercases the username properly as well:+ <nowiki>
-users file should contain colon separated entries like this: <username>:<hash>+
- <nowiki>+
#!/bin/sh #!/bin/sh
-USERS=`cat ./users`+#verify.sh
-genhash() {+#This script was made with via-file in mind
- HASHPASS=`echo -n "$1$2" | md5sum | sed s'/\ -//'`+PATH=/usr/bin:/bin
- i=0+ 
- while [ $i -lt 10 ]; do+#Function used for generating MD5 hash value of password multiple times
- HASHPASS=`echo -n $HASHPASS$HASHPASS | md5sum | sed s'/\ -//'`+function hashround() {
- i=`expr $i + 1`+ local hash rest
- done+ read hash rest
- echo -n $HASHPASS+ printf '%s%s' "$hash" "$hash" | /usr/bin/md5sum
} }
-verify() {+ 
- Login=`echo $1 | awk '{print tolower($0)}'`+#Location of the Approved Username/Password File
- echo Logging in as: $Login+users="/location/of/the/file/for/users"
- #echo Password is: $2+ 
- [[ $# -eq 2 ]] || exit 1+#Check to see if generated OpenVPN login file has any special characters
- for i in $USERS; do+#Terminate script if special characters are used
- Name=${i%:*}+if /bin/grep -q '[^-_a-zA-Z0-9]' "$1"
- PassHash=${i#*:}+then
- Logincmp=`echo $Name | awk '{print tolower($0)}'`+ echo "Illegal characters found in username/password." >&2
- #echo Logincmp is: $Logincmp+ exit 1
- if [ "$Logincmp" == "$Login" ]+
- then+
- #echo "Login('$Login') is equal to Logincmp('$Logincmp')"+
- GENHASH=`genhash "$Login" "$2"`+
- #echo genhash returned $GENHASH+
- #echo and PassHash is: $PassHash+
- if [ "$GENHASH" == "$PassHash" ]+
- then+
- echo Password hashes match+
- exit 0+
- fi+
- fi+
- done+
-}+
-if [ "$1" == "--genhash" ]+
-then+
- Login=`echo $2 | awk '{print tolower($0)}'`+
- echo `genhash "$Login" "$3"`+
- exit 1+
fi fi
-verify `cat $*` 
-exit 1 
- </nowiki> 
-I had to wait for the time to update from 1970 until I create my users file+#1st line is the username
-so here is what my start script looks like in case someone wants to use it:+username=`/usr/bin/awk 'NR==1' "$1"`
 +#2nd line is the password
 +password=`/usr/bin/awk 'NR==2' "$1"`
- <nowiki>+#Generate MD5 hash of given password and loop it 10 times before comparing with hash value in users file
-YEAR="`date +%Y`"+hashpass=$(printf '%s%s' "$username" "$password" | /usr/bin/md5sum \
-COUNT=0+ | hashround | hashround | hashround | hashround | hashround \
-while [ "$YEAR" = "1970" ] && [ $COUNT -lt 60 ]; do+ | hashround | hashround | hashround | hashround | hashround \
- # System has not yet synchronized the date with ntp.+ | /usr/bin/cut -d' ' -f1)
- sleep 1+
- YEAR="`date +%Y`"+if /bin/grep -Fxq "$username:$hashpass" "$users"
- COUNT=$(($COUNT + 1))+then
-done+ echo "User Authenticated." >&2
-# A 60 second wait is long enough. If there is a problem still then+ exit 0
-# likely the router booted faster than the ISP CPE. Force a time sync.+
-if [ "$YEAR" = "1970" ] && [ $COUNT -ge 60 ]; then+
- # Initialize the date/time.+
- NTP_POOL_SERVER="`nvram get ntp_server`"+
- /usr/bin/killall ntpclient+
- ntpclient -l -h $NTP_POOL_SERVER+
-# stopservice process_monitor+
-# startservice process_monitor+
fi fi
- +echo "Login credentials failed." >&2
-openvpn --mktun --dev tap0+exit 1
-brctl addif br0 tap0+
-ifconfig tap0 0.0.0.0 promisc up+
-echo "user1:ababababababababababababababababa+
-user2:ababababababababababababababababa" > /tmp/users+
</nowiki> </nowiki>
-You may disregard whatever is written below this point , but im going to leave it here for history's sake... 
- 
-[Edit by mrwizeman Aug 31 2009] Ok so I put it '''here'''... here is a way I came up with that make this work with an encrypted password, now, let me explain how it works, I hash the username and password and then add the hash to itself, and hash that 10 times everytime I add the hashes together, I got that idea from the author of the passwd we use Poul-Henning Kamp but he does it 1000 times... 
-You can easily change this script to hash it 1000 times, but I think 10 is enough it will take a bruteforce program forever to first hash the user and pass and then hash the hashes 10 times, just to find out if it matches, and besides the weak ass processor of the routers we use will take forever to check our credentials if we do it that way... so anyway here it is: you have to run it in telnet the first time to figure out what your hash is, then change that in your script, the hash in the script I paste here is user: test and pass: test +Genhash.sh
-First the script to generate a hash for you: 
<nowiki> <nowiki>
#!/bin/sh #!/bin/sh
 +#genhash.sh
 +#Generate Hash for username/password
 +#Case sensitive and only allows a certain set of characters to be used
-genhash() {+function hashround() {
- echo You are generating a HASH for user: $1+ local hash rest
- echo with the password : $2+ read hash rest
- HASHPASS=`echo -n $1$2 | md5sum | sed s'/\ -//'`+ printf '%s%s' "$hash" "$hash" | /usr/bin/md5sum
- i=0+
- while [ $i != 10 ]; do+
- HASHPASS=`echo -n $HASHPASS$HASHPASS | md5sum | sed s'/\ -//'`+
- #echo [$i] HASHPASS=$HASHPASS+
- i=`expr $i + 1`+
- done+
- echo HASHPASS=$HASHPASS+
} }
-genhash $1 $2 
- </nowiki> 
-Then the actual script for your check: 
- <nowiki> 
-#!/bin/sh 
-HASH='1bbd7254581aaab10868ccfdc0860d68'+case "$1" in *[!-_a-zA-Z0-9]*) exit 1 ;; esac
-#echo HASH = $HASH+case "$2" in *[!-_a-zA-Z0-9]*) exit 1 ;; esac
-#echo param 1 = $1+
-#echo param 2 = $2+
-vpn_verify() {+hashpass=$(printf '%s%s' "$1" "$2" | /usr/bin/md5sum \
- if [[ ! $1 ]] || [[ ! $2 ]]; then+ | hashround | hashround | hashround | hashround | hashround \
- #echo "No username or password: $*"+ | hashround | hashround | hashround | hashround | hashround \
- exit 1+ | /usr/bin/cut -d' ' -f1)
- fi+
- HASHPASS=`echo -n $1$2 | md5sum | sed s'/\ -//'`+echo "Username: $1"
- #echo HASHPASS = $HASHPASS+echo "Password: $2"
- #if [ $HASH == $HASHPASS ]; then+echo "Password (MD5 Hashed): $hashpass"
- # echo MATCH!!+
- #else+
- # echo NO MATCH!!!+
- #fi+
- i=0+
- while [ $i != 10 ]; do+
- HASHPASS=`echo -n $HASHPASS$HASHPASS | md5sum | sed s'/\ -//'`+
- #echo [$i] HASHPASS=$HASHPASS+
- i=`expr $i + 1`+
- done+
- #echo HASHPASS=$HASHPASS+
- if [ $HASH == $HASHPASS ]; then+
- #echo MATCH!!+
- exit 0+
- else+
- #echo NO MATCH!!!+
- exit 1+
- fi+
-}+
-if [[ ! $1 ]] || [[ ! -e $1 ]]; then+
- #echo "No file"+
- exit 1+
-fi+
-vpn_verify `cat $1`+
-#echo "No user with this password found"+
-exit 1+
-</nowiki>+
-I suck at shellscripting, so if somone spots any errors or want to add support for multiple users that would be cool...+
- +echo "User added to approved user file"
-[Edit by grtz Sep 28 2010 ] Here is the optimized version with support for multiple users. Everything is in one file and smaller, little bit faster and more secure:+echo "$1:$hashpass" >> /tmp/users
- + </nowiki>
- <nowiki>#!/bin/sh+
- +
-USERS="test:556a2224e307429d714ed8a8134e68e0"+
-#USERS=`cat ./users`+
- +
-genhash() {+
- HASHPASS=`echo -n "$1$2" | md5sum | sed s'/\ -//'`+
- i=0+
- while [ $i -lt 10 ]; do+
- HASHPASS=`echo -n $HASHPASS$HASHPASS | md5sum | sed s'/\ -//'`+
- i=`expr $i + 1`+
- done+
- echo -n $1:$HASHPASS+
-}+
- +
-verify() {+
- [[ $# -eq 2 ]] || exit 1+
- for i in $USERS; do+
- [[ "$i" == `genhash "$1" "$2"` ]] && exit 0+
- done+
-}+
- +
-[[ $1 == "--genhash" ]] && echo `genhash "$2" "$3"`+
-[[ -e "$*" ]] || exit 1+
-verify `cat "$*"`+
-exit 1</nowiki>+
- +
- +
-You can as before put users in an external file in format "username1:encrypted_password1" (one per line):+
- +
- <nowiki>username1:encrypted_password1+
-username2:encrypted_password2</nowiki>+
- +
- +
-or put everything in USERS directly in verify.sh and split entries with space (like in the original script below):+
- <nowiki>USERS="username1:encrypted_password1 username2:encrypted_password2"</nowiki>+
- +
-Run "verify.sh --genhash username password" to create encrypted string. Copy the result in your file with users or directly in the script as shown above:+
- <nowiki>root@router:$ ./verify.sh --genhash test 12345+
-test:556a2224e307429d714ed8a8134e68e0</nowiki>+
- +
-or even easier if you use external file for users/password:+
- <nowiki>root@router:$ ./verify.sh --genhash test 12345 >> ./users</nowiki>+
---[[User:Grtz|Grtz]] 22:42, 28 September 2010 (CEST)+
- +
- +
- +
-Original authors script below, the one without encrypted pass:+
- <nowiki>#!/bin/sh+
- +
- ## format: username:password username:password ...+
- ## you can even have same usernames with different passwords+
- USERS='user1:pass1 user2:pass2 user3:pass3'+
- +
- ## you could put username:password in+
- ## a separate file and read it like this+
- #USERS=`cat file_with_users`+
- +
- vpn_verify() {+
- if [[ ! $1 ]] || [[ ! $2 ]]; then+
- #echo "No username or password: $*"+
- exit 1+
- fi+
- +
- ## it can also be done with grep or sed+
- for i in $USERS; do+
- if [[ "$i" == "$1:$2" ]]; then+
- +
- ## you can add here logging of users+
- ## if you have enough space for log file+
- #echo `date` $1:$2 >> your_log_file+
- +
- exit 0+
- fi+
- done+
- }+
- +
- if [[ ! $1 ]] || [[ ! -e $1 ]]; then+
- #echo "No file"+
- exit 1+
- fi+
- +
- ## $1 is file name which contains+
- ## passed username and password+
- vpn_verify `cat $1`+
- +
- #echo "No user with this password found"+
- exit 1</nowiki>+
- +
-You can delete all lines which begin with #. "echo" commands are here just for you to know what happens at that and they can be used for debugging.+
- +
-This verification with the script does not work if openvpn is running in "daemon" mode. I have no idea what is the reason for that, probably some wrong interpretation of the output ("exit 0" means user/pass OK, everything else means user/pass NOT OK). Thats why I am running openvpn server as a background process and all output is going to /dev/null:+
- +
- openvpn --config openvpn.conf >/dev/null 2>&1 &+
- +
---[[User:Comma|Comma]] 23:53, 11 August 2008 (CEST)+
- +
-I was getting the error+
- <nowiki>+
- openvpn_execve: external program may not be called due to setting of --script-security level+
- </nowiki>+
- +
-I had to add the following lines to my config file work in v24-SP2+
- <nowiki>+
- tmp-dir /tmp/openvpn+
- script-security 3+
- </nowiki>+
- +
-Additionally, the ">/dev/null 2>&1 &" hack wouldn't work but running from the command line did. I resorted to using the /tmp/myvpn symlink as well as --daemon in the command line. All works now with out an interactive shell.+
---[[User:JoeM|JoeM]] 23:28, 22 October 2008 (CEST)+
===Client Configuration=== ===Client Configuration===
Line 450: Line 332:
Notes: Notes:
* If you need to use TCP instead of UDP, set the protocol to ''tcp-client''. Clients must use the same protocol that the server does. * If you need to use TCP instead of UDP, set the protocol to ''tcp-client''. Clients must use the same protocol that the server does.
-* Mac OS X users need to add the line+* Client config also need match these server parameters: dev (tun/tap), cipher, auth, comp-lzo, tun-mtu.
 +* Mac OS X users and Linux users using TAP need to add the line
up "./vpn-up.sh" up "./vpn-up.sh"
-to the configuration file and create a script file ''vpn-up.sh'' in the same directory as the configuration file with the following contents:+to the configuration file and create a script file ''vpn-up.sh'' in the same directory as the configuration file with the following contents.
 + 
 +On Mac:
#!/bin/bash #!/bin/bash
Line 460: Line 345:
ipconfig set $1 DHCP ipconfig set $1 DHCP
-This script configures the TAP interface to request an IP address using DHCP. Make sure to make the script executable with 'chmod 755 vpn-up.sh'+On Linux:
 + 
 + #!/bin/bash
 + sleep 2
 + dhclient $1 &
 + 
 +This script configures the TAP interface to request an IP address using DHCP. Make sure to make the script executable with 'chmod 755 vpn-up.sh'.
3) Use the configuration file you just created with whatever OpenVPN client software you're using to establish a connection to your router. 3) Use the configuration file you just created with whatever OpenVPN client software you're using to establish a connection to your router.
Line 468: Line 359:
==Daemon Mode/Config File== ==Daemon Mode/Config File==
-[http://www.dd-wrt.com/wiki/index.php/OpenVPN-Site-to-Site-Bridged Bridge 2 Networks]+[http://www.dd-wrt.com/wiki/index.php/OpenVPN-Site-to-Site-Bridged Bridge 2 Networks]<br>
[http://www.dd-wrt.com/wiki/index.php/OpenVPN_-_Site-to-Site_routed_VPN_between_two_routers Route 2 Networks] [http://www.dd-wrt.com/wiki/index.php/OpenVPN_-_Site-to-Site_routed_VPN_between_two_routers Route 2 Networks]
-[http://www.beispiel.de Link-Text] 
-==Server mode with Static Key==+=Troubleshooting=
-''Note:'' with ''DD-WRT v23 SP1 Final (05/16/06) vpn'' this allows only 1 client connection!! [http://forum.bsr-clan.de/ftopic5111-0-asc-45.html]. See below for multiple connections.+==FAQ==
-===Server Configuration===+===MTU===
-1. Create a static.key file on your computer+One verycommon problem is the wrong setting of the mtu/fragment/mss-fix values. Ethernet's max frame size is 1500. In most cases where the Router is the gateway and the vpn connects to the outside world the values must be changed. WAN connections in general will have a lower frame size so the default setting will result in a dropping connection. mtu/fragment must be set the same on both sides!
-'''Unix:'''+On tcp connections only mtu can be set. Try setting the mtu to 1300 and see if it works.
- openvpn --genkey --secret static.key+
- +On udp connections enable mss-fix on '''one''' side of the link. Lower the fragemt size to 1300 and try if its working.
-'''Windows:''' (downloaded at http://www.openvpn.se)+
- Click on "Start > Programs ->OpenVPN -> Generate a static OpenVPN key"+
- +
-* Note: this will create a c:\Program Files\OpenVPN\config\key.txt file, you will want to rename it to static.key+
- +
- +
-2. Paste the command below into your router at "Administration > Commands > Commands text box" and replace the text "...INSERT YOUR STATIC KEY HERE..." with the static.key you just made. Click '''"Save Startup"''':+
- +
- openvpn --mktun --dev tap0+
- brctl addif br0 tap0+
- ifconfig tap0 0.0.0.0 promisc up+
- echo "+
- -----BEGIN OpenVPN Static key V1-----+
- ...INSERT YOUR STATIC KEY HERE...+
- -----END OpenVPN Static key V1-----+
- " > /tmp/static.key+
- ln -s /usr/sbin/openvpn /tmp/myvpn+
- /tmp/myvpn --dev tap0 --secret /tmp/static.key --comp-lzo --port 1194 --proto udp --verb 3 --daemon+
- +
- +
-3. Paste the command below into your router at "Administration > Commands > Commands text box" and click '''"Save firewall"''':+
- +
- iptables -I INPUT 1 -p udp --dport 1194 -j ACCEPT+
- +
-* For More Information on startup scripts see [[Startup_Scripts]]+
- +
- +
- +
-4. Reboot your router. Login with ssh and check that "myvpn" is running (ps | grep vpn)+
- +
- +
-You can also paste the "ps | grep vpn" command into the Administration > Commands box to see if it is running.+
- +
-===Client Configuration===+
- +
-1. Create an openvpn config file on your client computer using one of the following templates. For Windows clients, save it as a .ovpn file in the C:\Program Files\OpenVPN\config folder.+
- +
- # Use the following for simple connections:+
- remote XXXX.dyndns.org+
- port 1194+
- dev tap+
- secret static.key+
- proto udp+
- comp-lzo+
- +
- # Use the following to have your client computer send all traffic through your router+
- # (remote gateway)+
- remote XXXX.dyndns.org+
- port 1194+
- dev tap+
- secret static.key+
- proto udp+
- comp-lzo+
- route-gateway 192.168.1.1+
- redirect-gateway+
- +
- # Use the following if you have an office proxy:+
- remote XXXX.dyndns.org+
- http-proxy-retry+
- http-proxy my.office.proxy.server 8080+
- port 1194+
- dev tap+
- secret static.key+
- proto udp+
- comp-lzo+
- route-gateway 192.168.1.1+
- redirect-gateway+
- +
-* Reference: fgimenez's [http://forum.bsr-clan.de/viewtopic.php?p=40508#40508 post]+
- +
- +
-2. Try to connect +
- +
-Windows: right click the open vpn icon in your system tray and click connect.+
- +
- +
-That should do it. This has been tested on DD-WRT v23 SP1 Final vpn. +
- +
-If everything is working correctly you should receive an IP address from your router (if you have a running dhcp server) when you connect and that IP address will be in your internal LAN so now you just connect to your home PC the same way you would do it from inside your LAN.+
- +
-==Public Key Infrastructure (PKI) [Certificates]==+
- +
-Follow these [http://openvpn.net/howto.html#pki instructions] to create the required certificates and keys. But there is also a Webmin module for linux servers to create your PKI infrastructure (OpenVPN CA). You begin by creating a key and certificate pair for the certificate authority (CA) you are establishing. Then for the server and each client, you create a private key and certificate pair and sign the certificates using the CA's key. Afterwards, you should have the following files:+
- ca.crt+In both cases when the link is working u can try to raise the values again to the maximum which will be working.
- ca.key+
- dh{n}.pem+
- server.crt+
- server.key+
-and a private key and certificate pair for each client. For example, if you have two clients, you should have:+==Logs==
- client1.crt+logs are written to syslog and can be seen in the GUI: Status -> OpenVPN (not in daemon and script mode)
- client1.key+
- client2.crt+
- client2.key+
-'''Note: The CA private key (ca.key) is used only to sign the certificates. It should be kept securely and not be copied to the server or clients. 
-''' 
- 
-==Static Key== 
- 
-On Linux you can cerate a pair of keys as easy as  
- openvpn --genkey --secret /home/"user"/static.key 
- 
-On Windows system you must already have openvpn installed. To create a pair of keys go to 
- programms -> openvpn -> generate a static openvpn key 
- 
-Copy the content of the keys to the ddwrt gui static key field. 
- 
-[http://openvpn.net/index.php/open-source/documentation/miscellaneous/78-static-key-mini-howto.html Info] <br> 
-[http://openmaniak.com/openvpn_static.php create keypair] 
- 
-=Troubleshooting= 
===Correct time=== ===Correct time===
OpenVPN requires client and server to have more or less synchronized time. Therefore make sure that router has correct time. To check it use command <tt>date</tt> and if you get info about year 1970, you should enable [[NTP client]]. Also, ntp server has to be outside of your VPN as time should be corrected before VPN is established. If you have [[syslog]] enabled (to local server, or the server outside your VPN), errors like <tt>TLS Error: Unroutable control packet received from ''server_ip'':1194</tt> may indicate this problem. (This error message may appear if your certificates are not valid or have expired, too.) OpenVPN requires client and server to have more or less synchronized time. Therefore make sure that router has correct time. To check it use command <tt>date</tt> and if you get info about year 1970, you should enable [[NTP client]]. Also, ntp server has to be outside of your VPN as time should be corrected before VPN is established. If you have [[syslog]] enabled (to local server, or the server outside your VPN), errors like <tt>TLS Error: Unroutable control packet received from ''server_ip'':1194</tt> may indicate this problem. (This error message may appear if your certificates are not valid or have expired, too.)
Line 803: Line 586:
If this happens to you, you probably have a mismatch in the configuration between server and client on the "cipher"-option. (E.g.: cipher AES-128-CB / cipher AES-256-CB) If this happens to you, you probably have a mismatch in the configuration between server and client on the "cipher"-option. (E.g.: cipher AES-128-CB / cipher AES-256-CB)
This is not a problem of DD-WRT or OpenVPN but just a config issue which can happen if you follow some of those guidelines strictly without knowing what the config options mean. This is not a problem of DD-WRT or OpenVPN but just a config issue which can happen if you follow some of those guidelines strictly without knowing what the config options mean.
-In doubt refer to the OpenVPN documentation. 
- 
-=Old & unsupported instructions= 
- 
-==Installing into jffs partition (Deprecated)== 
- 
-old method only recommended for non-vpn firmware 
- 
-'''This no longer works with the latest firmware version, please download the new VPN inclusive version. !!However, with at least some new firmware versions (I'm using V23SP1 6/5/06 VOIP), the hurdle can be overcome with some extra effort ... details are provided below in the Troubleshooting section... 19:22, 30 Jun 2006 (CEST)!! ''' 
- 
-====Prerequisites==== 
- ''You should already have:'' 
- -a Linksys WRT54G/GS product 
- -DD-WRT installed as the firmware 
- -[[Telnet/SSH and the Command Line#SCP|SCP]] or some other way to copy files to and from your desktop setup 
- -some knowledge of using [[ipkg]] to install packages 
- -[[jffs]] already configured if you don't want to install to ram<br> 
- ''If you are running Windows on your desktop:'' 
- -[http://www.textpad.com/ TextPad] or [http://www.gena01.com/win32pad/win32pad_1_5_7.exe Win32Pad]<br> (or other *nix friendly text editor. DO NOT USE NOTEPAD) 
- 
-=====Install the OpenVPN ipkg package===== 
- -Find the '''openvpn''' package in the THIS LINK DOES NOT WORK ANY MORE [http://tracker.openwrt.org/ OpenWRT Package Tracker].<br> You will need the URI of package to install it.<br> 
- -telnet or ssh shell into the router 
- -run the command ipkg -d <dest_name> install <URI of package><br> 
- <dest_name> should be ''root'' to install to /jffs 
- <dest_name> should be ''ram'' to install to /tmp 
- *Remember, /tmp is deleted on router reboot* 
- Ex: ''ipkg -d root install http://nthill.free.fr/openwrt/ipkg/experimental/20050420/openvpn-static_2.0-1_mipsel.ipk'' 
- 
-'''EDIT: Can't find the right package?''' Yeah, neither can anyone else. Don't bother. The best strategy is to download and flash the distro with the built-in VPN and copy the binary off of that then re-flash with another distro and copy the binary to the jffs partition. The packages on the openWRT tracker don't seem to work for v23 on WRT54Gv3 ("Bus Error"). The version originally linked above and the version in the VPN firmware are statically compiled. I had to do it this way because the nvram startup script only ran the first command in the variable and I needed the VPN to survive a WRT reboot. Not enough room for jffs on all but the mini distro... so no shell scripts for me! YMMV. Note to the powers that be: How about posting this stuff with the mini firmware so we don't have to do it this way????? 
- 
-=====Create the openvpn config file===== 
- -Using your method of choice, copy the file /<dest_name>/etc/openvpn/office.conf<br> to your desktop machine 
- -Using a *nix friendly text editor, edit office.conf (the config file in my setup).<br>See http://openvpn.net for more informations and examples. 
- 
-19:16, 30 Jun 2006 (CEST) [http://www.dd-wrt.com/phpBB2/profile.php?mode=viewprofile&u=810 pagedude] 
- 
-- NOTE : openvpn is highly configurable. Distinct from the original writer of this portion of the wiki, I setup my configuration files much more along the lines of the earlier section in this Wiki on configuring the OpenVPN server with certificates in bridging mode. Certificates provide a more robust dynamic configuration scheme, but take a little bit more time up-front to generate (but the http://www.openvpn.net site has an excellent, easy-to-follow guide on how to generate them). Bridging mode is very convenient in that the remote VPN client effectively appears to be part of the remote(server) LAN, plus much less routing configuration (i.e. use of ifconfig, route etc.) is required on either the OpenVPN server or the OpenVPN client. 
- 
-19:16, 30 Jun 2006 (CEST) [http://www.dd-wrt.com/phpBB2/profile.php?mode=viewprofile&u=810 pagedude] 
- 
-?? BUT HOW WOULD YOU SET THIS UP (with Certificates and Bridging) IF YOU HAVE MULTIPLE CLIENTS? 
- 
-<pre> 
-############################################################################## 
-# this is a sample configuration file for openvpn 
-# it should be changed to contain your values and 
-# placed in /jffs/etc/openvpn 
-# 
-remote servername.domain.com 
-rport 5000 
-dev tap 
-ifconfig 10.0.1.2 255.255.255.252 
-secret /jffs/etc/openvpn/key.txt 
-ping 10 
-ping-restart 60 
-ping-timer-rem 
-persist-tun 
-persist-key 
-resolv-retry 86400 
-verb 1 
-mute 10 
-route-up "route add -net 192.168.1.0 netmask 255.255.255.0 gw 10.0.1.1" 
-# 
-############################################################################## 
-</pre> 
- 
-This is the OpenVPN config file of the other side (a Linux server or another WRT54G/GS) 
-<pre> 
-############################################################################## 
-# 
-dev tap 
-secret /etc/openvpn/key.txt 
-persist-key 
-persist-tun 
-ifconfig 10.0.1.1 255.255.255.252 
-ping-restart 60 
-ping 10 
-verb 5 
-mute 10 
-lport 5000 
-route-up "route add -net 192.168.2.0/24 gw 10.0.1.2" 
-# 
-############################################################################### 
-</pre> 
- 
-===Usage & Troubleshooting=== 
-====Launching the Client==== 
- -cd to the install folder (/<dest_name>/usr/sbin) 
- -run ''./openvpn --config ./../../etc/openvpn/office.conf'' --log openvpn.log 
- 
-See openvpn.log for debugging 
- 
-====Load on Router Startup==== 
--Using a *nix friendly text editor, create openvpn.startup as: 
-<pre> 
-#!/bin/sh 
-killall -q openvpn 
-/jffs/usr/sbin/openvpn --config /jffs/etc/openvpn/office.conf 
-</pre> 
- 
--Follow the instructions in [[Startup Scripts#Shell Script Method]] to make your script load on startup. 
- 
-===Additional notes for improved JFFS installation and security with public hotspots=== 
- 
-19:10, 30 Jun 2006 (CEST) [http://www.dd-wrt.com/phpBB2/profile.php?mode=viewprofile&u=810 pagedude] 
- 
-i) The instructions above confine the OpenVPN server configuration entirely into a rc_startup script. This is elegant when OpenVPN is installed in RAM, since there's no convenient place to put a configuration file for OpenVPN (RAM contents are not persistent). However, if the user instead installs OpenVPN into persistent storage, i.e. the jffs partition, then instead of configuring OpenVPN on the command line, a config file can be used. There are several advantages to doing this; not only is RAM usage minimized (key files don't need to be copied to rc_startup, command line options get transferred to the config file, etc.), but the config file allows the description of more complicated openvpn server configurations. 
- 
-ii) One interesting capability of the OpenVPN tunnel is to optionally allow the client to pass ''all'' traffic through the VPN tunnel when connected. For example, when you are using an unsecure WiFi hotspot, you might want to ensure that eavesdroppers are not able to monitor your WiFi traffic. One way to do this is to route all your WiFi traffic through the encrypted VPN tunnel, using the "redirect-gateway" option on the server or the client. When configured on the server, all clients will reroute all their traffic through the VPN. The "redirect-gateway" option requires pushing two pieces of information from the server to the client, the remote gateway and DNS IP addresses. 
- 
-Here are my example rc_startup, server, and client config files. Note that I installed OpenVPN in /jffs/tmp and copied the PKI files, ca.crt, server.crt, server.key, dh1024.pem, and the server config file, server.conf, there. 
- 
-rc_startup: 
-cd /jffs/tmp 
-./openvpn --mktun --dev tap0 
-brctl addif br0 tap0 
-ifconfig tap0 0.0.0.0 promisc up 
-sleep 5 
- 
-;I had to install this library, since my ddwrt distro didnt have it 
-;See Troubleshooting section at the bottom of this wiki for JFFS installations 
-export LD_PRELOAD=/jffs/sbin/libuClibc-0.9.28.so 
- 
-./openvpn --config server.conf --daemon 
-</pre> 
- 
-Note: With V23 SP2, I did not need the LD_PRELOAD statement. I did have to create a link: 
- 
- ln -s /usr/sbin/openvpn /jffs/tmp/myvpn 
- 
-and change the last part of the code above to: 
- 
- sleep 5 
- ./myvpn --config server.conf --daemon 
- 
-server.conf: 
-<pre>mode server 
-tls-server 
-port 1194 
-proto tcp-server 
-dev tap0 
- 
-ca ca.crt 
-cert server.crt 
-key server.key 
-dh dh1024.pem 
- 
-#These IP addresses need to be changed to be *your* ddwrt LAN addresses ... 
-push "route-gateway 192.168.3.1" 
-push "dhcp-option DNS 192.168.3.1" 
- 
-client-to-client 
- 
-keepalive 15 60 
- 
-comp-lzo 
-persist-key 
-persist-tun 
-status openvpn-status.log 
-verb 3 
-</pre> 
- 
-client.conf: 
-<pre>tls-client 
-dev tap 
-proto tcp-client 
-port 1194 
-resolv-retry infinite 
-nobind 
-persist-key 
-persist-tun 
-remote XXXX.dyndns.org 1194 
- 
-ca ca.crt 
-cert client.crt 
-key client.key 
-ns-cert-type server 
- 
-comp-lzo 
-verb 3 
- 
-#Pull info from server, viz. server-side LAN IP's for gateway and DNS 
-pull 
-# Uncomment the following to send all traffic through VPN 
-redirect-gateway 
-</pre> 
- 
-19:10, 30 Jun 2006 (CEST)  
- 
-==GUI Client Mode Custom Parameters== 
-If you want to set custom parameters (e.g. encryption settings, verbosity, ...) for OpenVPN, you'll have to re-create the <tt>/tmp/openvpn/openvpn.conf</tt> file and restart OpenVPN. 
- 
-For more detailed information on Startup Commands, please read the [[Startup_Scripts|Startup Scripts]] wiki entry. 
- 
-To do this, use the [[Web_Interface|Web Interface]], go to the "Administration" tab and the "Commands" sub-tab. 
- 
-In the box, enter the configuration how you'd want it, and echo it into <tt>/tmp/openvpn/openvpn.conf</tt>. 
- 
-Example (add this in the edit box at the top): 
-<pre> 
-echo "dev tap 
-link-mtu 1492 
-remote <remote-ip> 
-resolv-retry infinite 
- 
-ifconfig <local ip> <local netmask> 
-client 
-ca /tmp/openvpn/ca.crt 
-cert /tmp/openvpn/client.crt 
-key /tmp/openvpn/client.key 
-comp-lzo 
-persist-tun 
-persist-key 
-verb 3 
-cipher AES-256-CBC" > /tmp/openvpn/openvpn.conf 
- 
-killall openvpn 
-openvpn --config /tmp/openvpn/openvpn.conf</pre> 
- 
-Next, click the ''Save Startup'', et voila, it should now start openvpn using your custom configuration. 
- 
-''Note:'' In "v23 SP2 (09/13/06) vpn" I've found that the openvpn startup script can run after the above during startup, so I work around that by doing the echo to "/tmp/openvpn/myopenvpn.conf" and replacing the killall/openvpn commands with: 
- 
-( sleep 20 ; killall openvpn ; openvpn --config /tmp/openvpn/myopenvpn.conf --route-up /tmp/openvpn/route-up.sh --down /tmp/openvpn/route-down.sh --daemon ) & 
- 
-You may need to tune the amount of sleep time. Use "ps" to verify that the "openvpn" process you want to be running is running. 
- 
---[[User:Ripper42|Ripper42]] 19:42, 30 Sep 2006 (CEST) 
- 
- 
-''Note:'' In "v23 SP2" the /tmp/ directory exist a few seconds after booting. So the script cannot run 
-immediately during bootup. Also I added a cronjob to check the openvpn connection every 5 minutes. 
-Here is my startup Script thats work for me: 
- 
-<pre>#!/bin/sh 
-sleep 20 
-echo "tls-client 
-dev tun 
-... 
-cert /tmp/openvpn/client.crt 
-key /tmp/openvpn/client.key" > /tmp/openvpn/myopenvpn.conf  
-sleep 20 
-killall openvpn 
-/usr/sbin/openvpn --config /tmp/openvpn/myopenvpn.conf --route-up /tmp/openvpn/route-up.sh --down /tmp/openvpn/route-down.sh --daemon 
- 
-# install cronjob, which restart tunnel if not running, but dont install cronjob, if it is already active 
-if test -s /tmp/cron.d/openvpn_check_status; then echo "" ;else echo '*/5 * * * * root if [ `ps | grep -c "openvp[n]"openvp[n].*myopen"` -ne 1 ] ; then logger OpenVpn restart;. /tmp/.rc_startup ; fi' >> /tmp/cron.d/openvpn_check_status 
-# restart cron daemon 
-stopservice cron && startservice cron 
-fi  
-</pre> 
- 
---[[User:Thomas Eimers|notdefine]] 16:52, 26.02.2006 after 100 edits 
- 
-After looking at some posts and WiKi, I have simplified the process of using openVPN as a client. 
- 
-First, I enabled the openVPN client via the web interface and entered the 3 certificates/keys that are requested. Once I saved that, I disabled openVPN. This got the 3 certs/keys into nvram. I then ran the following 3 nvram commands in the command window at the same time: 
-<pre> 
-nvram set openvpn_tls=' 
------BEGIN OpenVPN Static key V1----- 
-... 
------END OpenVPN Static key V1----- 
-' 
-nvram set openvpn_cfg=' 
-remote remote_server_ip_address 
-dev tun0 
-tun-mtu 1500 
-fragment 1300 
-mssfix 
-tls-client 
-ca /tmp/myvpn/ca.crt 
-cert /tmp/myvpn/client.crt 
-key /tmp/myvpn/client.key 
-ns-cert-type server 
-tls-auth /tmp/myvpn/tls.key 
-ping-restart 60 
-ping-timer-rem 
-persist-tun 
-persist-key 
-resolv-retry 86400 
-ping 10 
-comp-lzo 
-' 
-nvram commit 
-</pre> 
-I then set the startup script to: 
-<pre> 
-/usr/sbin/openvpn --mktun --dev tun0 
-ifconfig tun0 192.168.tunnel.2 netmask 255.255.255.252 promisc up 
-route add -net 192.168.rlan.0 netmask 255.255.255.0 gw 192.168.tunnel.1 
-sleep 20 
-mkdir /tmp/myvpn 
-nvram get openvpn_ca >/tmp/myvpn/ca.crt 
-nvram get openvpn_client >/tmp/myvpn/client.crt 
-nvram get openvpn_key >/tmp/myvpn/client.key 
-nvram get openvpn_tls >/tmp/myvpn/tls.key 
-nvram get openvpn_cfg >/tmp/myvpn/remote.ovpn 
-/usr/sbin/openvpn --daemon --config /tmp/myvpn/remote.ovpn 
-</pre> 
-and firewall to: 
-<pre> 
-iptables -I INPUT 2 -p udp --dport 1194 -j ACCEPT 
-iptables -I FORWARD -i br0 -o tun0 -j ACCEPT 
-iptables -I FORWARD -i tun0 -o br0 -j ACCEPT 
-</pre> 
-Explanations:<br> 
-openvpn_tls is set to your TLS key.<br> 
-remote_server_ip_address = IP address of remote openVPN running in server mode.<br> 
-192.168.tunnel.2 = 192.168.x.x address of the local openVPN tunnel. Must be different subnet from remote and local LANs.<br> 
-192.168.tunnel.1 = 192.168.x.x address of the remote end ofl openVPN tunnel. Must be different subnet from remote and local LANs.<br> 
-192.168.rlan.0 = IP address range of remote LAN<br> 
-sleep 20 = wait period to ensure /tmp has been created. 
- 
-This disables the firewall and NAT on the VPN, uses TLS authentication, etc. Hope this helps some. It is easy to change nvram and was much easier for me to review than trying to put it all in startup scripts. 
- 
-This is working on a Buffalo WHR-G54S running 2.3 SP2. 
- 
---[[User:PeteSL|Pete]] 14:29, 5 May 2007 (CEST) 
- 
-==GUI Client Mode Disabling NAT== 
- 
-To have OpenVPN pass traffic normally without address translation, you'll want to turn off masquerading on the tunnel interface as well as set a more permissive default for the firewall. Unfortunately, dd-wrt currently does not have an easy button to do this. Instead, use the startup script to replace the default route-up script with your own version. 
- 
-To do this, use the [[Web_Interface|Web Interface]], go to the "Administration" tab and the "Commands" sub-tab, and add the following line to your [[Startup_Scripts|Startup Script]]: 
- 
- ( while [ ! -f /tmp/openvpn/route-up.sh ]; do sleep 1; done; \ 
- echo "iptables -t filter -I INPUT -i tun0 -j ACCEPT; iptables -t filter -I FORWARD -i tun0 -j ACCEPT" > /tmp/openvpn/route-up.sh ) & 
-  
-  
-Alternatively you may specifiy the following in the Firewall Script what is much <u>more efficient</u>: 
- 
-iptables -I FORWARD -i br0 -o tun0 -j ACCEPT<br> 
-iptables -I FORWARD -i tun0 -o br0 -j ACCEPT<br> 
-iptables -I INPUT -i tun0 -j ACCEPT 
- 
---- 
-'''IMPORTANT NOTE:''' I have tried the above workarounds to no avail. The first approach burns precious CPU cycles. The second one has no effect whatsoever. The reason being that in iptables, NAT table manipulations are applied after the routing chains are processed and there is no way of bypassing that with the above rules. 
-The problem is that the openVPN daemon is passed with immutable route up & down scripts on startup. My solution is based on the custom parameters already discussed above. Simply copy and paste the following script into the Command window and save it as the startup script: 
- 
-( sleep 20 ; killall openvpn ; iptables -t nat -F POSTROUTING ; openvpn --config /tmp/openvpn/openvpn.conf --daemon ) & 
- 
-Then restart the box and voila! 
---[[User:Narseh|Narseh]] 17:48, 16 December 2008 (CET) 
---- 
- 
-Narseh is correct about the top two scripts not working. 
- 
-I've examined the top-most script, and it would work if certain quote marks were preceded with a backslash. However if I fix this script, and users use it and fail to start up the openvpn client, the router will end up HUNG UP in the COMMAND, Startup script. So fixing the topmost script would not be of much benefit. 
- 
-For my router, I wanted a startup script that has a bit of smarts to it in terms of knowing whether or not the vpnclient is configured or not. I also wanted to just fix the route-up and route-down scripts with the route commands. 
- 
-'''Hint:''' 
-It would be great if the next release of dd-wrt could have selector to allow people to select whether they want the NAT turned on or not. It kinda defeats the whole idea of VPN to have only a one way vpn tunnel being created with no other option. 
- 
-Here is my routers ADMINISTRATION, COMMAND, Startup script. It looks rather complicated. I will explain the reasons why I did it this way are below. 
- 
- echo " 
- while [ ! -f /tmp/openvpncl/route-up.sh ]; do sleep 1; done; 
- cd /tmp/openvpncl 
- sleep 5 
- killall openvpn 
- sleep 5 
-  
- echo \"iptables -I FORWARD -i br0 -o tun0 -j ACCEPT; iptables -I FORWARD -i tun0 -o br0 -j ACCEPT; iptables -I INPUT -i tun0 -j ACCEPT\" >route-up.sh 
-  
- echo \"iptables -D FORWARD -i br0 -o tun0 -j ACCEPT; iptables -D FORWARD -i tun0 -o br0 -j ACCEPT; iptables -D INPUT -i tun0 -j ACCEPT\" >route-down.sh 
- chmod a+x *.sh 
-  
- /usr/sbin/openvpn --daemon --config /tmp/openvpncl/openvpn.conf --route-up /tmp/openvpncl/route-up.sh --down /tmp/openvpncl/route-down.sh 
- " >/tmp/vpnstartup.sh 
- chmod a+x /tmp/vpn*.sh 
-  
- /tmp/vpnstartup.sh & 
- 
-'''How the Command, Startup Script Works''' 
- 
-The router Command Startup script does three things. 
- 
-1. It writes /tmp/vpnstartup.sh 
- 
-2. It runs the script in background 
- 
-3. It then exits. 
- 
-In this way, if for some reason the openvpn client fails to start, we do not hang the COMMAND-STARTUP SCRIPT. Having a script wait forever here to have something happen that never does can create other annoyances. 
- 
-As such, if the openvpn client FAILS to start, we don't hangup. Rather we end up with the vpnstartup.sh running in background consuming a few cpu cycles. Better to do this then have a hung command startup script. 
- 
-'''Lets look at vpnstartup.sh and how it works''' 
- 
-The vpnstatup script then waits for signs that the router has configured and started openvpn. 
-This is the part that consumes a few CPU cycles if the VPN client fails to start. 
- 
-Once we see signs vpnclient client life... 
- 
-We wait another 5 seconds just to be sure vpn has had time to start. 
- 
-Next killall openvpn. 
- This causes route-down to startup, if route-up was run. This takes a few seconds to run. 
- 
-We wait another 5 seconds to allow route-down to run. 
- 
-We then rewrite a new route-up.sh and route-down.sh files with routing that is a bit more 'useful'. 
- 
-Next we startup openvpn. 
- 
-Last but not least we exit from vpnstartup.sh so as to not waste memory and cpu. 
- 
-'''Known Issues''' 
-As I do not know what command exactly that DD-WRT uses to start the vpnclient, I had to guess on a few things. It would be better if we knew the original openvpn command. Hope this helps folks... 
- 
---[[User:Rnthomas|Rnthomas]] 15:59, 18 March 2009 (CET) 
- 
- 
-'''Another simple workaround''' 
- 
-While i consider it really, really silly that there is no way to customize and/or disable this route-up.sh thing, my "solution" was to use the following as a StartUp Command: 
- 
-( while [ ! -f /tmp/openvpncl/route-up.sh ]; do sleep 1; done; \ 
-echo "#nothing here!" > /tmp/openvpncl/route-up.sh ) & 
- 
-( while [ ! -f /tmp/openvpncl/route-down.sh ]; do sleep 1; done; \ 
-echo "#nothing here!" > /tmp/openvpncl/route-down.sh ) & 
- 
-..... anybody know why the hell the route-down.sh ALSO enables NAT? 
- 
- 
---[[User:Schweini|Schweini]] 10:11, 3 February 2011 (CET) 
- 
- 
-'''Another even simpler and way cleaner workaround''' 
- 
-Use this as firewall rules (webinterface -> administration -> commands): 
- 
- iptables -N VPN 
- iptables -F VPN 
- iptables -I INPUT -i tun0 -j VPN 
- iptables -I FORWARD -i tun0 -j VPN 
- iptables -A VPN -i tun0 -o br0 -j ACCEPT 
- iptables -I POSTROUTING -t nat -o tun0 -j RETURN 
- 
-First we create a new chain called VPN and flush it. Then we tell iptables to send all packages coming from tun0 through that chain. In the VPN chain itself we simply accept all traffic - adjust that as needed. Finally we insert a rule to the beginning POSTROUTING chain, simply telling iptables not to nat anything going out through the tunnel. 
- 
---[[User:Acurus|Acurus]] 11:09, 5 March 2011 (CET) 
- 
- 
-==Server Configuration== 
- 
-*'''Warning:''' This Script EXCEEDS NVRAM - will semi-brick you router - JTAG required to recover. '''See first section.''' 
-*NOTE: This is only true for some (few) routers. To my knowledge it's been reported only for WRT54Gv1 & v2. Better to ask first if you are in doubt. 
-* UPDATE: Two people have bricked Buffalo WBR-G54 routers following this guide for OpenVPN with certificates (see http://www.dd-wrt.com/phpBB2/viewtopic.php?p=266750) so proceed with extreme caution if you are using this router. At a minimum I would use "nvram show | grep size" to check that your script is significantly smaller than the free NVRAM space. The "nvram show | grep size" output seemed to fall as expected when I was pasting my certs and keys in the client web config screen (following the wrong part of the guide by mistake :o). However, following a fresh firmware update just prior to bricking my WBR-G54, this command reported over 9.5KB free NVRAM and my router still bricked from a 4.38KB startup script. It might be best to stick to a static key, as the config file will be about 1.5KB smaller. 
- 
- 
-1. Install DD-WRT with VPN, v23 SP2 or later, on your router. 
- 
-2. Create a rc_startup script (temporarily prepare in a simple text editor, e.g. notepad or PSPad) 
- 
- cd /tmp 
- openvpn --mktun --dev tap0 
- brctl addif br0 tap0 
- ifconfig tap0 0.0.0.0 promisc up 
-  
- echo ' 
- # Tunnel options 
- mode server # Set OpenVPN major mode 
- proto udp # Setup the protocol (server) 
- port 1194 # TCP/UDP port number 
- dev tap0 # TUN/TAP virtual network device 
- keepalive 15 60 # Simplify the expression of --ping  
- daemon # Become a daemon after all initialization 
- verb 3 # Set output verbosity to n  
- comp-lzo # Use fast LZO compression  
-  
- # OpenVPN server mode options 
- client-to-client # tells OpenVPN to internally route client-to-client traffic  
- duplicate-cn # Allow multiple clients with the same common name 
-  
- # TLS Mode Options 
- tls-server # Enable TLS and assume server role during TLS handshake  
- ca ca.crt # Certificate authority (CA) file 
- dh dh1024.pem # File containing Diffie Hellman parameters  
- cert server.crt # Local peers signed certificate 
- key server.key # Local peers private key  
- ' > openvpn.conf 
-  
- echo ' 
- -----BEGIN CERTIFICATE----- 
- ...INSERT YOUR ca.crt HERE... 
- -----END CERTIFICATE----- 
- ' > ca.crt 
- echo ' 
- -----BEGIN RSA PRIVATE KEY----- 
- ...INSERT YOUR server.key HERE... 
- -----END RSA PRIVATE KEY----- 
- ' > server.key 
- chmod 600 server.key 
- echo ' 
- -----BEGIN CERTIFICATE----- 
- ...INSERT YOUR server.crt HERE... 
- -----END CERTIFICATE----- 
- ' > server.crt 
- echo ' 
- -----BEGIN DH PARAMETERS----- 
- ...INSERT YOUR dh1024.pem HERE... 
- -----END DH PARAMETERS----- 
- ' > dh1024.pem 
-  
- sleep 5 
- openvpn --config openvpn.conf --daemon 
- 
-Replace "...INSERT YOUR [FILE] HERE..." with the appropriate contents of the files you created earlier. Open these files in a simple text editor and paste contents between the BEGIN and END statements into this script. 
- 
-Notes: 
-* This script bridges the VPN with the LAN, so no routing is required so that clients can communicate with systems and devices on the LAN. 
-* The server is configured to use UDP packets since TCP over TCP can lead to poor performance. If you need to use TCP instead of UDP, specify ''tcp-server'' as the protocol. TCP is also required if you want your clients to be able to connect through a HTTP Proxy.  
-* Script was updated to change the " to '. The use of " in the script can break the rc_startup causing unpredictable behavior.  
-* Removed 2 ' in the words peers as they were causing the script not to execute completely with echo using '. 
-* You might need to change the last line of the script to (strongly recommended): 
-  
- ln -s /usr/sbin/openvpn /tmp/myvpn 
- /tmp/myvpn --config openvpn.conf  
- 
-The reason is that with the original command, [http://www.dd-wrt.com/phpBB2/viewtopic.php?t=5053 openvpn might start but mysteriously not stay open]. 
- 
-3. Add the following line to your rc_firewall script (create a new file in simple text editor that will temporarily hold your rc_firewall script): 
- 
- /usr/sbin/iptables -I INPUT -p udp --dport 1194 -j ACCEPT 
- 
-This command allows connections to the OpenVPN server. 
- 
-4. Use the [http://www.dd-wrt.com/wiki/index.php?title=Startup_Scripts#Web_Interface_Method web interface method] to store the rc_startup and rc_firewall scripts on the router. 
- 
-5. Enable NTP and uncheck ''Use Local Time'' in the router setup. Then reboot your router. 
- 
-''Note:'' As of V24-RC4 ''Use Local Time'' does not exist. Instead set ''Time Zone'' to "UTC" and ''Summer Time(DST)'' to "none". 
- 
-6. Login via ssh or telnet and execute the command 
- 
- ps | grep openvpn 
- 
-to verify that the OpenVPN process is running. 
- 
-====A little evolution of the so great rc_startup script==== 
-  
-Tested with WRT54GL V1.1 under DD-WRT v24-sp1 (07/27/08) vpn 
- 
- [ -d /tmp/openvpnsrv ] || mkdir /tmp/openvpnsrv 
- openvpn --mktun --dev tap0 
- brctl addif br0 tap0 
- ifconfig tap0 0.0.0.0 promisc up 
- echo " 
- dev tap0 
- port 54321 
- proto tcp-server 
- mode server 
- client-to-client 
- keepalive 15 60 
- comp-lzo 
- tls-server 
- tls-auth /tmp/openvpnsrv/ta.key 0 
- ca /tmp/openvpnsrv/ca.crt 
- cert /tmp/openvpnsrv/server.crt 
- key /tmp/openvpnsrv/server.key 
- dh /tmp/openvpnsrv/dh1024.pem 
- verb 3 
- " > /tmp/myvpnsrv.conf 
- echo " 
- -----BEGIN CERTIFICATE----- 
- ... 
- -----END CERTIFICATE----- 
- " > /tmp/openvpnsrv/ca.crt 
- echo " 
- -----BEGIN RSA PRIVATE KEY----- 
- ... 
- -----END RSA PRIVATE KEY----- 
- " > /tmp/openvpnsrv/server.key 
- echo " 
- -----BEGIN CERTIFICATE----- 
- ... 
- -----END CERTIFICATE----- 
- " > /tmp/openvpnsrv/server.crt 
- echo " 
- -----BEGIN DH PARAMETERS----- 
- ... 
- -----END DH PARAMETERS----- 
- " > /tmp/openvpnsrv/dh1024.pem 
- echo " 
- -----BEGIN OpenVPN Static key V1----- 
- ... 
- -----END OpenVPN Static key V1----- 
- " > /tmp/openvpnsrv/ta.key 
- ln -s /usr/sbin/openvpn /tmp/myvpn 
- sleep 5 
- chmod 400 /tmp/openvpnsrv/* 
- /tmp/myvpn --config /tmp/myvpnsrv.conf --daemon 
- 
-Do not forget the rc_firewall 
- 
- iptables -I INPUT 1 -p tcp --dport 54321 -j logaccept 
- 
-====Yet another evolution==== 
-''Tested with ASUS WL500gp v2 and DD-WRT v24-sp2 (07/21/09) mega (rev. 12533)'' 
-  
-Since support of OpenVPN seems to be slowly progressing in the webinterface and by help of NVRAM-variables I thought of a hybrid solution to make use of what is there while combining it with the special features of the bridge setup. This is what I came up with: 
- 
-Load variables into NVRAM: 
- 
-Via Webinterface (enable OpenVPN-Server radio-button and fill the text boxes, afterwards disable again) you can currently only upload openvpn_ca, openvpn_key and openvpn_client, while the other three variables don't get committed. (bug?) Anyway - to avoid those hazzles run the following on the command line (not all settings are meaningful to everybody - but this gives transparent bridging, DNSmasq is used to distribute IP-addresses, default route is suppressed by the "nogw" option): 
- nvram set openvpn_config='server-bridge nogw 
- proto udp 
- port 1194 
- dev tap0 
- keepalive 15 60 
- float 
- verb 3 
- comp-lzo 
- client-to-client 
- duplicate-cn 
- tls-auth /tmp/openvpnsrv/ta.key 0 
- ca /tmp/openvpnsrv/ca.crt 
- dh /tmp/openvpnsrv/dh1024.pem 
- cert /tmp/openvpnsrv/server.crt 
- key /tmp/openvpnsrv/server.key 
- ping-timer-rem 
- cipher AES-256-CBC 
- mssfix' 
- 
-Next we need all your fancy certs/keys as generated with easy-rsa. 
- 
-'''WARNING:''' The following commands might overflow your NVRAM. I myself had to throw away a WL500gp v2 after playing around with 2048bit keys once (and after I tried to recover it by shortening circuits). '''So please read how to check the remaining space in your NVRAM before doing this and make sure you don't exceed it.''' 
- #Certificate of CA 
- nvram set openvpn_ca='-----BEGIN CERTIFICATE----- 
- ... 
- -----END CERTIFICATE-----' 
-  
- #DH Parameters 
- nvram set openvpn_dh='-----BEGIN DH PARAMETERS----- 
- ... 
- -----END DH PARAMETERS-----' 
-  
- #Server Certificate 
- nvram set openvpn_client='-----BEGIN CERTIFICATE----- 
- ... 
- -----END CERTIFICATE-----' 
-  
- #Server Key 
- nvram set openvpn_key='-----BEGIN RSA PRIVATE KEY----- 
- ... 
- -----END RSA PRIVATE KEY-----' 
-  
- #Static TA key file (If appropriate, depends on individual paranoia: If not used disable in config!) 
- nvram set openvpn_tlsauth='-----BEGIN OpenVPN Static key V1----- 
- ... 
- -----END OpenVPN Static key V1-----' 
-  
- nvram commit 
- 
-Interesting enough - if you enable OpenVPN-Server in the Webinterface it will display all the values of the variables - you simply can't update all of them... 
- 
-Furthermore we need the rc_startup file (can be uploaded via the Webinterface, Administration -> Commands): 
- export PATH=/usr/bin:/bin:/usr/sbin:/sbin 
- sleep 30 
-  
- # OpenVPN Server 
- openvpn --mktun --dev tap0 
- brctl addif br0 tap0 
- ifconfig tap0 0.0.0.0 up 
- [ -d /tmp/openvpnsrv ] || mkdir /tmp/openvpnsrv 
- nvram get openvpn_config > /tmp/myvpnsrv.conf 
- nvram get openvpn_ca > /tmp/openvpnsrv/ca.crt 
- nvram get openvpn_key > /tmp/openvpnsrv/server.key 
- nvram get openvpn_client > /tmp/openvpnsrv/server.crt 
- nvram get openvpn_dh > /tmp/openvpnsrv/dh1024.pem 
- nvram get openvpn_tlsauth > /tmp/openvpnsrv/ta.key 
- ln -s /usr/sbin/openvpn /tmp/myvpn 
- chmod 700 /tmp/openvpnsrv 
- chmod 400 /tmp/openvpnsrv/* 
- sleep 5 
- /tmp/myvpn --config /tmp/myvpnsrv.conf --daemon 
-  
- # Firewall for OpenVPN - could be put into rc_firewall as well of course 
- iptables -I INPUT -p udp --dport 1194 -j logaccept 
- 
-'''The export of the PATH variable is essential.''' I found that even the previous script did not work for me without including "/sbin" into PATH. Without it I ran into a silently failing "ifconfig"-command - which again caused a very strange behavior of the setup as tap0 was included in the bridge but stayed down. 
- 
-After putting everything in place - reboot and you should be done. If in doubt add "log-append /tmp/myvpnsrv.log" to openvpn_config and reboot - this will give you extra logging. 
- 
-'''Optional side note:''' 
- 
-I came across this idea when I was connected to a public WLAN which was only allowing HTTP over a transparent proxy server, HTTPS (TCP port 443), DNS (UDP port 53), FTP (TCP port 21) and SSH (TCP port 22) connections. UDP port 1194 (the OpenVPN standard) was of course blocked... 
-This is probably not a very representative setup, but if you need to connect to your OpenVPN router at home and this is all you got --- Damn. :-) 
- 
-So I started to look into a solution: 
-I thought the ports with the highest likelyhood to be "usuable" in most public WLANs without PROXY and without a block on a firewall would be: 
- 
-UDP 53 and TCP 443 
- 
-Both services are usually used on our little favorite routers as they are running DNSMASQ for the internal network clients and an HTTPS webinterface to the inside as well. Moreover both of those services can not be convinced to listen only on the internal webinterface. For DNSMASQ I did a lot of investigation - this seems to be a bug on the version used in DD-WRT - the available options do not work. 
-This is not a problem in normal operations as the router's firewall does not allow access to those ports from the outside - so we are save. But if you now want to use one of those ports to the outside to bind OpenVPN to them you fail because the ports are taken --- Damn again. :-) 
- 
-Solution: 
-Let the firewall redirect all packets coming from the internet to the internal standard OpenVPN port, add this to your firewall script: 
- iptables -t nat -I PREROUTING -p udp -i vlan1 --dst samplehost.anydyndnsprovider.net --dport 53 -j REDIRECT --to-ports 1194 
-The value behind "--dst" of course needs to be replaced by your routers registered host name or, in case of a stable IP address this one can be used as well. 
-This works for the UDP configuration as shown above - of course if you want to use a redirect of TCP port 443 you need to change your config on the OpenVPN config file to "proto tcp" as well. 
-Now you can change the "port 1194" line on the client's configuration to 53 - basically the router now "listens" on two ports at the same time. 
- 
-====Yet another evolution - TUN - VPN on a virtual DMZ ==== 
-Config scripts to get TUN working so you can control the access to your home network with iptables. 
- 
-rc_firewall is '''VERY''' deppendant on v24sp1-vpn build defaults 
- 
-On this example: 
- 
-- All traffic from VPN to Internet is allowed. 
- 
-- All traffic from LAN to VPN is allowed 
- 
-- Only specific ports from VPN to LAN are allowed. 
- 
-rc_startup script: 
- sleep 5 
- cd /tmp 
- openvpn --mktun --dev tun0 
-  
- echo " 
- port 443 
- proto tcp-server 
- dev tun0 
- ca ca.crt 
- dh dh1024.pem 
- cert server.crt 
- key server.key 
- server 172.16.0.0 255.255.255.0 
- push \"route 192.168.1.0 255.255.255.0\" 
- keepalive 15 60 
- daemon 
- verb 3 
- comp-lzo 
- client-to-client 
- duplicate-cn 
- status /tmp/vpnstatus.log 
- " > openvpn.conf 
-  
- echo " 
- -----BEGIN CERTIFICATE----- 
- ... 
- -----END CERTIFICATE----- 
- " > ca.crt 
- echo " 
- -----BEGIN RSA PRIVATE KEY----- 
- ... 
- -----END RSA PRIVATE KEY----- 
- " > server.key 
- chmod 600 server.key 
- echo " 
- -----BEGIN CERTIFICATE----- 
- ... 
- -----END CERTIFICATE----- 
- " > server.crt 
- echo " 
- -----BEGIN DH PARAMETERS----- 
- ... 
- -----END DH PARAMETERS----- 
- " > dh1024.pem 
-  
- sleep 5 
- ln -s /usr/sbin/openvpn /tmp/myvpn 
- /tmp/myvpn --config openvpn.conf 
- 
- 
-rc_firewall: 
- iptables -I INPUT 4 -p udp --dport 520 -i tun0 -j DROP 
- iptables -I INPUT 1 -p tcp --dport 443 -j ACCEPT 
- iptables -I INPUT 11 -p tcp --dport 19150 -i tun0 -m state --state NEW -j logaccept 
- iptables -I INPUT 11 -p tcp --dport 22 -i tun0 -m state --state NEW -j logaccept 
- iptables -I INPUT 7 -p icmp -i tun0 -j ACCEPT 
- iptables -I FORWARD 15 -i tun0 -o vlan1 -m state --state NEW -j ACCEPT 
- iptables -I FORWARD 3 -i tun0 -o tun0 -j ACCEPT 
- iptables -I FORWARD 3 -i br0 -o tun0 -j logaccept 
- # Start of VPN-to-LAN allowed ports 
- iptables -I FORWARD 3 -i tun0 -o br0 -p tcp --dport 22 -j logaccept 
- iptables -I FORWARD 3 -i tun0 -o br0 -p tcp --dport 5060 -j logaccept 
- iptables -I FORWARD 3 -i tun0 -o br0 -p udp --dport 5060 -j logaccept 
- # End of VPN-to-LAN allowed ports 
- iptables -I FORWARD 3 -i tun0 -o br0 -m state --state RELATED,ESTABLISHED -j logaccept 
- iptables -I POSTROUTING 3 -t nat -o tun0 -s 172.16.0.0/24 -d 172.16.0.0/24 -j MASQUERADE 
- 
-[[Category:Tunneling]]+[[Category:OpenVPN]]
-[[Category:Advanced tutorials]]+

Revision as of 03:54, 5 May 2018

OpenVPN is a full-featured SSL VPN solution which can accomodate a wide range of configurations, including road warrior access, home/office/campus telecommuting, WiFi security, secure branch office linking, and enterprise-scale remote access solutions with load balancing, failover, and fine-grained access-controls.

Contents

Security

Interesting article about strength and security of PKI today Pro-Linux (german)

Support

There are a great variety of support options for OpenVPN which discuss all of the OpenVPN features in detail. If you have any questions, first check out these resources:

In doubt always refer to the OpenVPN documentation.

Getting OpenVPN

Before you begin, you'll need to obtain and install the OpenVPN client (with the GUI (for e.g. Windows)), Mac) for your client computer.

Please note that it consists of one binary for both client and server connections, so don't look for individually labeled client or server packages.

OpenVPN authentication

You will have several possibilities to authenticate to an openvpn session. Some authentication methods are supported by the gui directly (should be preferred), others have to be set up in daemon mode. Which you will use depends on some things: how secure, easy to setup, easy to maintain

Public Key Infrastructure (PKI) [Certificates]

Follow these instructions to create the required certificates and keys. But there is also a Webmin module for linux servers to create your PKI infrastructure (OpenVPN CA). You begin by creating a key and certificate pair for the certificate authority (CA) you are establishing. Then for the server and each client, you create a private key and certificate pair and sign the certificates using the CA's key. Afterwards, you should have the following files:

ca.crt
ca.key
dh{n}.pem
server.crt
server.key

and a private key and certificate pair for each client. For example, if you have two clients, you should have:

client1.crt
client1.key
client2.crt
client2.key

Note: The CA private key (ca.key) is used only to sign the certificates. It should be kept securely and not be copied to the server or clients.

Per the following [1] OpenVPN certs must be generated with SHA auth

Static Key

This method is only usable for connecting one client to a server!

On Linux you can create a pair of keys as easy as

openvpn --genkey --secret /home/"user"/static.key

On Windows system you must already have openvpn installed. To create a pair of keys go to

programs -> openvpn -> generate a static openvpn key

Copy the content of the keys to the ddwrt gui static key field and you're done.

Info
create keypair

OpenVPN in DD-WRT

In this section, it is assumed that you already have the DD-WRT installed in your router and that its a current build (newer than 01/2011). OpenVPN is only available on units with at least 8mb flash (except the Broadcom VPN build.)

The DD-WRT GUI Server and Client modes are very straight forward. So when defaults are left as is, it should run out of the box for 90% of the users.

  1. Using the Web Interface, go to the "Services" tab and then the "VPN" tab (for older versions of dd-wrt go to the "Administration" tab and then the "Services" sub-tab).
  2. Enable OpenVPN Daemon or OpenVPN Client. If further options do not appear, click Apply Settings.
  3. Fill in needed parameters (see below). Everything else not mentioned here is taken care of automatically (e.g. firewall)
  4. Click Apply Settings.

A guide on how to set up OpenVPN client where only specific traffic is routed via the VPN tunnel is available here: Selective Routing Using DD-WRT and OpenVPN

CLI settings

Scramble Patch by clayface

These posts adds a patch to openvpn which introduces forms of scrambling to the packet payload of any OpenVPN connection. To use it you need both sides patched, server and client, and you introduce a new scramble password phrase in server and client config files

   “scramble password” – perform a simple xor operation the packet payload, using a string “password”, you choose password
   “scramble reverse” – This simply reverses all the data in the packet. This is enough to get past the regular expression detection in both China and Iran.
   “scramble xorptrpos” – This performs a xor operation, utilising the current position in the packet payload.
   “scramble obfuscate password” – This method is more secure. It utilises the 3 types of scrambling mentioned above. “password” is a string you choose. 

GUI: Client Mode

Fixed Parameters

There are default parameters that will always be written to the config file and which you cant change if you use GUI client mode:

ca /tmp/openvpncl/ca.crt
cert /tmp/openvpncl/client.crt
key /tmp/openvpncl/client.key
management 127.0.0.1 16
management-log-cache 50
verb 4
mute 5
syslog
writepid /var/run/openvpncl.pid
client
resolv-retry infinite
nobind
persist-key
persist-tun
script-security 2
tls-client
fast-io

Changeable Parameters

DD-WRT default settings in {}
OpenVPN config language in []

Server IP/Name (e.g. 192.168.1.1)
IP address/hostname of the OpenVPN server you want to connect to. [remote xxx]
Port
port which OpenVPN server is listening on. {1194} [port xxx]
Tunnel Device (TUN/TAP)
The mode of tunneling. TUN: routing (layer 3), TAP: bridgeing (layer 2. can be used for routing, too, but its not very common). [dev-type tun/tap]
Tunnel Protocoll (UDP/TCP)
The subprotocol the connection will use on the connection. {udp} [proto udp/tcp]
Encryption Cipher (None and Blowfish to AES512)
The encryption algorithm that will be used for the tunnel. Blowfish "fastest" to AES512 "safest". {AES128} [cipher xxx]
Hash Algorithm (None and MD4 to SHA512)
The hash algorithm that will be used. MD4: fastest (maybe unsafe) to SHA512. {SHA256} [auth xxx]
Advanced options
Leave defaults as is if you dont know what you are doing. {disabled} []
TLS Cipher
What encryption algorithm OpenVPN should use for encrypting its control channel. {disabled} []
LZO Compression
Enables compression over VPN. This might speedup the connection. Must be the same value as on server. {adaptive} [comp-lzo yes/no/adaptive/disabled]
NAT
Enable network address translation on the client side of the connection. Enables the NAT-firewall to protect clients. {disabled}
Bridge TAP to br0
Enable a transparent bridge across the tunnel to the local LAN. Works only in TAP mode with NAT disabled. {disabled}
Local IP Address
In cases you will not get an ip from the server. Not very common. {empty)
Subnet Mask
Subnet Mask for the IP Address.
TUN MTU Setting
set the mtu of the tunnel {1500} [tun-mtu xxx]
UDP Fragment across the tunnel
set mss-fix and fragmentaion accross the tunnel. {empty} [fragment xxx]
UDP MSS-Fix
= value of Fragment. Only usen with udp. should be set on one side only. [mssfix]
nsCertType verification
Checks to see if the remote server is using a valid type of certificate meant for OpenVPN connections. As this is a security feature of OpenVPN, it should be left enabled. {checked} []
TLS Auth Key
The static key OpenVPN should use for generating HMAC send/receive keys. {disabled} []
Additional Config
Any additional configurations you want to define for the VPN connection. {empty}
Policy based Routing
allow only special clients to use the tunnel. Add IPs in the form 0.0.0.0/0 to force clients to use the tunnel as default gateway. One line per IP. {} []
Public Server Cert
Certificate of OpenVPN CA (not the server's public cert) in pem form; only part between (and including) -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- is necessary; as it is stored in nvram, everything else from that file should be removed to conserve space.
CA Cert
CA certificate; also only part between 'BEGIN' and 'END' is required.
Private Client Key
Key associated with certificate above; should be kept secret because anybody who knows this key can successfully authenticate as this client.
DH PEM
Diffie Hellmann parameter.
Static Key
used for p2p links. No pki needed.

GUI: Server Configuration

This section describes how to configure an OpenVPN server that uses SSL certificates for client authentication, which is recommended. The method offers better security than using a static key and allows multiple clients to connect at the same time.



Fixed Parameters

There are default parameters that DD-WRT will always wite to the config file and which you cant change if you use the GUI server mode:

dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem
keepalive 10 120
verb 4
mute 5
log-append /var/log/openvpn
writepid /var/run/openvpnd.pid
management 127.0.0.1 5002
management-log-cache 50
mtu-disc yes
topology subnet
client-config-dir /tmp/openvpn/ccd
script-security 2
ifconfig-pool-persist /tmp/openvpn/ip-pool 86400
fast-io
passtos

Customizable Parameters

DD-WRT default settings in {}
OpenVPN config language in []

Start Type
use "System". "WAN Up" doesnt work. {}
Config via (GUI/config file)
GUI {}
Server Mode (TUN/TAP)
The mode of tunneling. TUN: routing (layer 3), TAP: bridging networks (layer 2). {} [dev-type tun/tap]
DHCP-Proxy mode
Only in bridge mode. Let the clients use the network dhcp server not the openvpn dhcp. {} []
Pool start Ip
1st ip of the ip pool used (Only in bridge mode). []
Pool end IP
Last ip of the ip pool used (Only in bridge mode). []
Gateway
Default gateway to use (Only in bridge mode). []
Network (e.g. 10.10.10.0)
Network to use for the tunnel (Only in routing mode). []
Netmask (e.g. 255.255.255.0)
Netmask of the used network. []
Block DHCP accross the tunnel
Dont allow DHCP requests across tunnel (Only in bridge mode).
Port
port which OpenVPN server listens on. {1194} [port xxx]
Tunnel Protocoll (UDP/TCP)
The subprotocol the connection will use on the real used tcp connection. {udp} [proto udp/tcp]
Encryption Cipher (None and Blowfish to AES512)
The encryption algorithm that will be used for the tunnel. Blowfish: fastest to AES512 safest. {AES128} [cipher xxx]
Hash Algorithm (None and MD4 to SHA512)
The hash algorithm that will be used. MD4: fastest (maybe unsafe) to SHA512. {SHA256} [auth xxx]
Advanced options
Leave defaults as is if you dont know what you are doing. {disabled}
LZO Compression
Enables compression over VPN. This might speedup the connection. Must be the same value as on server. {yes} [comp-lzo yes/no/adaptive/disabled]
Redirect default Gateway
Force the clients to use the tunnel as default gateway. {disabled} []
Allow Client to Client
Allow clients to see each other. {disabled} [client-to-client]
Allow duplicate cn
allow to use 1 client cert to use on multiple clients (security risc)
TUN MTU Setting
set the mtu of the tunnel {1500} [tun-mtu xxx]
MSS-Fix/Fragment across the tunnel
set mss-fix and fragmentaion accross the tunnel. {empty} [fragment xxx] [mssfix]
TLS Cipher
What encryption algorithm OpenVPN should use for encrypting its control channel. {disabled} []
TLS Auth Key
The static key OpenVPN should use for generating HMAC send/receive keys.
Client connect script
. {empty} []
Additional Config
Any additional configurations you want to define for the VPN connection. {empty}
CA Cert
Certificate of OpenVPN CA in pem form (usually ca.crt); only part between (and including) -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- is necessary; as it is stored in nvram, everything else from that file should be removed to conserve space.
Public Server Cert
Server certificate issued by CA for this particular router (usually server.crt); also only part between 'BEGIN' and 'END' is required.
Private Server Key
Key associated with certificate above (usually server.key); should be kept secret because anybody who knows this key can successfully authenticate client certificates.
DH PEM
Diffie Hellman parameters generated for the OpenVPN server (usually dh1024.pem).

Authentication with username and password

Certificates are nice, but having usernames and passwords can complement certificates. You can use the following script below to check for usernames/passwords.

Add this to the config on the server and set the right path for the script:

script-security 2
auth-user-pass-verify /path/to/your/script/verify.sh via-file

The script-security line is to resolve the issue where an external program may not be called due to setting of --script-security level The auth-user-pass-verify line enables the OpenVPN server to check the passed username and password by calling the script verify.sh and passing the username and password in a tmp file.

Every client will need to have this in its config file to connect:

auth-user-pass

This tells OpenVPN client to ask the user for username and password or s/he will not be able to log in. You can also use "--auth-user-pass" (instead of the line in the config file) on the command line.

I have split up the functions into separate files compared to predecessors (See page history). The verification done by the script may not work if OpenVPN is running in "daemon" mode (to be confirmed).

[Edit by Rocketboy235 May 4 2018] Script has been updated to be much more secure/efficient than the previous versions found in page history.

Verify.sh

 
#!/bin/sh
#verify.sh
#This script was made with via-file in mind

PATH=/usr/bin:/bin

#Function used for generating MD5 hash value of password multiple times
function hashround() {
    local hash rest
    read hash rest
    printf '%s%s' "$hash" "$hash" | /usr/bin/md5sum
}

#Location of the Approved Username/Password File
users="/location/of/the/file/for/users"

#Check to see if generated OpenVPN login file has any special characters
#Terminate script if special characters are used
if /bin/grep -q '[^-_a-zA-Z0-9]' "$1"
then 
	echo "Illegal characters found in username/password." >&2
	exit 1
fi

#1st line is the username
username=`/usr/bin/awk 'NR==1' "$1"`
#2nd line is the password
password=`/usr/bin/awk 'NR==2' "$1"`

#Generate MD5 hash of given password and loop it 10 times before comparing with hash value in users file
hashpass=$(printf '%s%s' "$username" "$password" | /usr/bin/md5sum \
           | hashround | hashround | hashround | hashround | hashround \
           | hashround | hashround | hashround | hashround | hashround \
           | /usr/bin/cut -d' ' -f1)
		
if /bin/grep -Fxq "$username:$hashpass" "$users"
then
	echo "User Authenticated." >&2
	exit 0
fi

echo "Login credentials failed." >&2
exit 1
 

Genhash.sh

#!/bin/sh
#genhash.sh
#Generate Hash for username/password
#Case sensitive and only allows a certain set of characters to be used

function hashround() {
    local hash rest
    read hash rest
    printf '%s%s' "$hash" "$hash" | /usr/bin/md5sum
}

case "$1" in *[!-_a-zA-Z0-9]*) exit 1 ;; esac
case "$2" in *[!-_a-zA-Z0-9]*) exit 1 ;; esac

hashpass=$(printf '%s%s' "$1" "$2" | /usr/bin/md5sum \
           | hashround | hashround | hashround | hashround | hashround \
           | hashround | hashround | hashround | hashround | hashround \
           | /usr/bin/cut -d' ' -f1)
		   
echo "Username: $1"
echo "Password: $2"
echo "Password (MD5 Hashed): $hashpass"

echo "User added to approved user file"
echo "$1:$hashpass" >> /tmp/users
 

Client Configuration

1) Copy the CA certificate and a private key and certificate pair to the client.

2) Create an OpenVPN configuration file on your client computer:

client
dev tap
proto udp
remote router-address 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client1.crt
key client1.key
ns-cert-type server
comp-lzo
verb 3

Replace router-address in the fourth line with your router's IP address or host name and, obviously, use the appropriate file names in the script for the client's certificate and key. On Windows, save this script using notepad as a file with extension .ovpn and copy it into \Program Files\OpenVPN\config (along with the files ca.crt, clientX.crt and clientX.key created earlier.)

Notes:

  • If you need to use TCP instead of UDP, set the protocol to tcp-client. Clients must use the same protocol that the server does.
  • Client config also need match these server parameters: dev (tun/tap), cipher, auth, comp-lzo, tun-mtu.
  • Mac OS X users and Linux users using TAP need to add the line
up "./vpn-up.sh"

to the configuration file and create a script file vpn-up.sh in the same directory as the configuration file with the following contents.

On Mac:

#!/bin/bash 
sleep 2
ipconfig set $1 DHCP

On Linux:

#!/bin/bash 
sleep 2
dhclient $1 & 

This script configures the TAP interface to request an IP address using DHCP. Make sure to make the script executable with 'chmod 755 vpn-up.sh'.

3) Use the configuration file you just created with whatever OpenVPN client software you're using to establish a connection to your router.

If everything works, you will be connected to your internal LAN. If your router is running a DHCP server, the TAP interface will be assigned an IP address on your internal LAN. At this point, you just connect to your home PC the same way you would do it from inside your LAN.

Daemon Mode/Config File

Bridge 2 Networks
Route 2 Networks

Troubleshooting

FAQ

MTU

One verycommon problem is the wrong setting of the mtu/fragment/mss-fix values. Ethernet's max frame size is 1500. In most cases where the Router is the gateway and the vpn connects to the outside world the values must be changed. WAN connections in general will have a lower frame size so the default setting will result in a dropping connection. mtu/fragment must be set the same on both sides!

On tcp connections only mtu can be set. Try setting the mtu to 1300 and see if it works.

On udp connections enable mss-fix on one side of the link. Lower the fragemt size to 1300 and try if its working.

In both cases when the link is working u can try to raise the values again to the maximum which will be working.

Logs

logs are written to syslog and can be seen in the GUI: Status -> OpenVPN (not in daemon and script mode)

Correct time

OpenVPN requires client and server to have more or less synchronized time. Therefore make sure that router has correct time. To check it use command date and if you get info about year 1970, you should enable NTP client. Also, ntp server has to be outside of your VPN as time should be corrected before VPN is established. If you have syslog enabled (to local server, or the server outside your VPN), errors like TLS Error: Unroutable control packet received from server_ip:1194 may indicate this problem. (This error message may appear if your certificates are not valid or have expired, too.) If you get an error message saying that your certificate is not yet valid, set the dd-wrt clock to UTC time (in the first configuration page).

To set the time manually connect via telnet or ssh and issue the following command at the prompt:
date MMDDHHMMYYYY


Connecting to DD-WRT OpenVPN Server via Mac Client

Currently, there are two OpenVPN clients for OS X

Viscosity has a more user friendly gui but is a commercial product. It can also import settings created for the Tunnelblick application.

PROBLEM: When I used the sample client.conf file above, nothing happened when I clicked connect on Tunnelblick.

Tunnelblick is a GUI OpenVPN application for the Mac. The last official release is 2.0.1, but I am going to explain how to connect using version 3.0rc3. This version has everything in one app and requires no extra components to be installed.

NOTE: I used certificates to connect my MacBook Pro to the OpenVPN server. You can find documentation on how to do this further up in this page. Remember to place your certificate files in the same directory as the client.conf file. Tunnelblick looks for the files in ~/Library/openvpn.

Download Tunnelblick and drag it to the Applications folder. It will say that you don't have a client.conf file and will make one for you. You can examine the sample client.conf file that Tunnelblick makes and find that it does a few things differently than the example provided above. Set up your client.conf file using the sample I have provided below, and Tunnelblick should connect properly now.

The file I have provided is the same as the sample, except with a few things disabled and a few things added to make it do what we want. The reason I disabled a few things using the # line is that I didn't want to delete anything, so I just disabled them.

You might notice that the command

up "./vpn-up.sh"

This is a fix that I found here.

You will need to make a script called vpn-up.sh and place it in the same directory as the client.conf file. Make the files contents:

#!/bin/bash
sleep 2
ipconfig set tap0 DHCP

client.conf:

##############################################
# Sample client-side OpenVPN 2.0 config file #
# for connecting to multi-client server.     #
#                                            #
# This configuration can be used by multiple #
# clients, however each client should have   #
# its own cert and key files.                #
#                                            #
# On Windows, you might want to rename this  #
# file so it has a .ovpn extension           #
##############################################

# Specify that we are a client and that we
# will be pulling certain config file directives
# from the server.
client

# Use the same setting as you are using on
# the server.
# On most systems, the VPN will not function
# unless you partially or fully disable
# the firewall for the TUN/TAP interface.
dev tap 

# Windows needs the TAP-Win32 adapter name
# from the Network Connections panel
# if you have more than one.  On XP SP2,
# you may need to disable the firewall
# for the TAP adapter.
#dev-node MyTap
 
# Are we connecting to a TCP or
# UDP server?  Use the same setting as
# on the server.
proto tcp

# The hostname/IP and port of the server.
# You can have multiple remote entries
# to load balance between the servers.
remote xxxxxxxxx.dyndns.org 1194 

# Choose a random host from the remote
# list for load-balancing.  Otherwise
# try hosts in the order specified.
#remote-random 

# Keep trying indefinitely to resolve the
# host name of the OpenVPN server.  Very useful
# on machines which are not permanently connected
# to the internet such as laptops.
resolv-retry infinite

# Most clients don't need to bind to
# a specific local port number.
nobind

# Downgrade privileges after initialization (non-Windows only)
user nobody
group nobody

# Try to preserve some state across restarts.
persist-key
persist-tun

# If you are connecting through an
# HTTP proxy to reach the actual OpenVPN
# server, put the proxy server/IP and
# port number here.  See the man page
# if your proxy server requires
# authentication.
#http-proxy-retry # retry on connection failures
#http-proxy [proxy server] [proxy port #]

# Wireless networks often produce a lot
# of duplicate packets.  Set this flag
# to silence duplicate packet warnings.
mute-replay-warnings

# SSL/TLS parms.
# See the server config file for more
# description.  It's best to use
# a separate .crt/.key file pair
# for each client.  A single ca
# file can be used for all clients.
ca ca.crt
cert client1.crt
key client1.key

up "./vpn-up.sh"

# Verify server certificate by checking
# that the certicate has the nsCertType
# field set to "server".  This is an
# important precaution to protect against
# a potential attack discussed here:
# http://openvpn.net/howto.html#mitm

# To use this feature, you will need to generate
# your server certificates with the nsCertType
# field set to "server".  The build-key-server
# script in the easy-rsa folder will do this.
ns-cert-type server

# If a tls-auth key is used on the server
# then every client must also have the key.
#tls-auth ta.key 1

# Select a cryptographic cipher.
# If the cipher option is used on the server
# then you must also specify it here.
#cipher x

# Enable compression on the VPN link.
# Don't enable this unless it is also
# enabled in the server config file.
comp-lzo

# Set log file verbosity.
verb 3

# Silence repeating messages
;mute 20


UPDATE Sept 1, 2009
The most recent release of Tunnelblick is 3.0rc14. It seems as though the previously mention bash script does not work anymore. The following python script does work, however:

#!/usr/bin/python
import os, sys
try:
    tun_dev, tun_mtu, link_mtu = sys.argv[1:4]
except:
    sys.exit(0)
if tun_dev[0:3] == 'tap'
    os.system('/usr/sbin/ipconfig set "%s" DHCP' % os.environ['dev'])

Can't Load DH Parameters

If you get the following:

Tue Jan 23 03:03:05 2007 OpenVPN 2.0.7 mipsel-unknown-linux [SSL] [LZO] [EPOLL] built on Jan 15 2007
Tue Jan 23 03:03:05 2007 Cannot load DH parameters from dh1024.pem: error:0906D064:lib(9):func(109):reason(100)
Tue Jan 23 03:03:05 2007 Exiting

you should check your certificates. Did you paste them correctly?

Note: you must include new lines.

Connection reset by peer (WSAECONNRESET) (code=10054)

If you received error when trying to connect to your VPN server verify the following:

  • Make sure the tap-device was successfully "up'ed". It is, if you find it in the list when running "ifconfig" without further arguments. If it is not displayed in the list of available interfaces have a look at "Yet another evolution" above.
  • Make sure the protocol is the same on the server and client, ie UDP/TCP
  • Verify the port number is the same on the client and server; Default port is UDP 1194
  • Check to see if the port is open on the server by using nMap or another utility

Incoming Packet Rejected

If you get incoming packets being rejected when trying to connect with the VPN client (OpenVPN) make sure that you are forwarding the 1194 port (if configured to use that port) to the proper server/router (usually 192.168.1.1).

Example TCP/UDP Rejection:

  • [Date] TCP/UDP: Incoming packet rejected from 192.168.1.1:1194[2], expected peer address: w.x.y.z:1194 (allow this incoming source address/port by removing --remote or adding --float)

Port Forwarding is configured on v24 SP 2 under 'NAT / Qos'.

Authenticate/Decrypt failure

Error: Authenticate/Decrypt packet error: cipher final failed

If this happens to you, you probably have a mismatch in the configuration between server and client on the "cipher"-option. (E.g.: cipher AES-128-CB / cipher AES-256-CB) This is not a problem of DD-WRT or OpenVPN but just a config issue which can happen if you follow some of those guidelines strictly without knowing what the config options mean.