OpenVPN

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 11:12, 20 March 2008 (edit)
Soulstace (Talk | contribs)
(Undo revision 19696 by Eowyn (Talk))
← Previous diff
Revision as of 01:00, 9 May 2008 (edit) (undo)
Jas649 (Talk | contribs)
(Enabling VPN)
Next diff →
Line 9: Line 9:
=Enabling VPN= =Enabling VPN=
-==Client Mode==+YOUR CODE CREATES BRICKS
-# Using the [[Web_Interface|Web Interface]], go to the "Administration" tab and the "Services" sub-tab.+
-# Enable the "Open VPN Client" If new options do not appear, Apply Settings.+
-# Fill in parameters (see below)+
-# Apply Settings+
-===Client Mode Parameters===+DELETED FOR THE SANITY OF ALL
-;192.168.1.1: IP address of the OpenVPN server you want to work with+
-;80: port which OpenVPN server listens on+
-;Use LZO Compression: where to use or not compression on vpn traffic; must be the same value as on server+
-;Tunnel protocol: what transport to use to transfer VPN traffic; default is ''udp'', but if routers/nat devices causes problems, choose ''tcp''; must be the same as on server+
-;Public Server Cert: Certificate of OpenVPN CA in ''pem'' form; only part between (and including) <tt>-----BEGIN CERTIFICATE-----</tt> and <tt>-----END CERTIFICATE-----</tt> is necessary; as it is stored in [[nvram]], everything else from that file should be removed to conserve space+
-;Public Client Cert: Client certificate issued by CA for this particular router; also only part between 'BEGIN' and 'END' is required+
-;Private Client Key: Key associated with certificate above; should be kept secret because anybody who knows this key can successfully authenticate as this client+
-===Parameters===+MAY YOU SHOULD THINK AGAIN BEFORE POSTING INSTRUCTIONS
-If you want to set custom parameters (e.g. encryption settings, verbosity, ...) for OpenVPN, you'll have to re-create the <tt>/tmp/openvpn/openvpn.conf</tt> file and restart OpenVPN.+
-For more detailed information on Startup Commands, please read the [[Startup_Scripts|Startup Scripts]] wiki entry.+NVRAM IS TOO SMALL FOR THAT SCRIPT
-To do this, use the [[Web_Interface|Web Interface]], go to the "Administration" tab and the "Commands" sub-tab.+- GOD
- +
-In the box, enter the configuration how you'd want it, and echo it into <tt>/tmp/openvpn/openvpn.conf</tt>.+
- +
-Example (add this in the edit box at the top):+
-<pre>+
-echo "dev tap+
-link-mtu 1492+
-remote <remote-ip>+
-resolv-retry infinite+
- +
-ifconfig <local ip> <local netmask>+
-client+
-ca /tmp/openvpn/ca.crt+
-cert /tmp/openvpn/client.crt+
-key /tmp/openvpn/client.key+
-comp-lzo+
-persist-tun+
-persist-key+
-verb 3+
-cipher AES-256-CBC" > /tmp/openvpn/openvpn.conf+
- +
-killall openvpn+
-openvpn --config /tmp/openvpn/openvpn.conf</pre>+
- +
-Next, click the ''Save Startup'', et voila, it should now start openvpn using your custom configuration.+
- +
-''Note:'' In "v23 SP2 (09/13/06) vpn" I've found that the openvpn startup script can run after the above during startup, so I work around that by doing the echo to "/tmp/openvpn/myopenvpn.conf" and replacing the killall/openvpn commands with:+
- +
-( sleep 20 ; killall openvpn ; openvpn --config /tmp/openvpn/myopenvpn.conf --route-up /tmp/openvpn/route-up.sh --down /tmp/openvpn/route-down.sh --daemon ) &+
- +
-You may need to tune the amount of sleep time. Use "ps" to verify that the "openvpn" process you want to be running is running.+
- +
---[[User:Ripper42|Ripper42]] 19:42, 30 Sep 2006 (CEST)+
- +
- +
-''Note:'' In "v23 SP2" the /tmp/ directory exist a few seconds after booting. So the script cannot run+
-immediately during bootup. Also I added a cronjob to check the openvpn connection every 5 minutes.+
-Here is my startup Script thats work for me:+
- +
-<pre>#!/bin/sh+
-sleep 20+
-echo "tls-client+
-dev tun+
-...+
-cert /tmp/openvpn/client.crt+
-key /tmp/openvpn/client.key" > /tmp/openvpn/myopenvpn.conf +
-sleep 20+
-killall openvpn+
-/usr/sbin/openvpn --config /tmp/openvpn/myopenvpn.conf --route-up /tmp/openvpn/route-up.sh --down /tmp/openvpn/route-down.sh --daemon+
- +
-# install cronjob, which restart tunnel if not running, but dont install cronjob, if it is already active+
-if test -s /tmp/cron.d/openvpn_check_status; then echo "" ;else echo '*/5 * * * * root if [ `ps | grep -c "openvp[n]"openvp[n].*myopen"` -ne 1 ] ; then logger OpenVpn restart;. /tmp/.rc_startup ; fi' >> /tmp/cron.d/openvpn_check_status+
-# restart cron daemon+
-stopservice cron && startservice cron+
-fi +
-</pre>+
- +
---[[User:Thomas Eimers|notdefine]] 16:52, 26.02.2006 after 100 edits+
- +
-After looking at some posts and WiKi, I have simplified the process of using openVPN as a client.+
- +
-First, I enabled the openVPN client via the web interface and entered the 3 certificates/keys that are requested. Once I saved that, I disabled openVPN. This got the 3 certs/keys into nvram. I then ran the following 3 nvram commands in the command window at the same time:+
-<pre>+
-nvram set openvpn_tls='+
------BEGIN OpenVPN Static key V1-----+
-...+
------END OpenVPN Static key V1-----+
-'+
-nvram set openvpn_cfg='+
-remote remote_server_ip_address+
-dev tun0+
-tun-mtu 1500+
-fragment 1300+
-mssfix+
-tls-client+
-ca /tmp/myvpn/ca.crt+
-cert /tmp/myvpn/client.crt+
-key /tmp/myvpn/client.key+
-ns-cert-type server+
-tls-auth /tmp/myvpn/tls.key+
-ping-restart 60+
-ping-timer-rem+
-persist-tun+
-persist-key+
-resolv-retry 86400+
-ping 10+
-comp-lzo+
-'+
-nvram commit+
-</pre>+
-I then set the startup script to:+
-<pre>+
-/usr/sbin/openvpn --mktun --dev tun0+
-ifconfig tun0 192.168.tunnel.2 netmask 255.255.255.252 promisc up+
-route add -net 192.168.rlan.0 netmask 255.255.255.0 gw 192.168.tunnel.1+
-sleep 20+
-mkdir /tmp/myvpn+
-nvram get openvpn_ca >/tmp/myvpn/ca.crt+
-nvram get openvpn_client >/tmp/myvpn/client.crt+
-nvram get openvpn_key >/tmp/myvpn/client.key+
-nvram get openvpn_tls >/tmp/myvpn/tls.key+
-nvram get openvpn_cfg >/tmp/myvpn/remote.ovpn+
-/usr/sbin/openvpn --daemon --config /tmp/myvpn/remote.ovpn+
-</pre>+
-and firewall to:+
-<pre>+
-iptables -I INPUT 2 -p udp --dport 1194 -j ACCEPT+
-iptables -I FORWARD -i br0 -o tun0 -j ACCEPT+
-iptables -I FORWARD -i tun0 -o br0 -j ACCEPT+
-</pre>+
-Explanations:<br>+
-openvpn_tls is set to your TLS key.<br>+
-remote_server_ip_address = IP address of remote openVPN running in server mode.<br>+
-192.168.tunnel.2 = 192.168.x.x address of the local openVPN tunnel. Must be different subnet from remote and local LANs.<br>+
-192.168.tunnel.1 = 192.168.x.x address of the remote end ofl openVPN tunnel. Must be different subnet from remote and local LANs.<br>+
-192.168.rlan.0 = IP address range of remote LAN<br>+
-sleep 20 = wait period to ensure /tmp has been created.+
- +
-This disables the firewall and NAT on the VPN, uses TLS authentication, etc. Hope this helps some. It is easy to change nvram and was much easier for me to review than trying to put it all in startup scripts.+
- +
-This is working on a Buffalo WHR-G54S running 2.3 SP2.+
- +
---[[User:PeteSL|Pete]] 14:29, 5 May 2007 (CEST)+
- +
-===Disabling NAT===+
-To have OpenVPN pass traffic normally without address translation, you'll want to turn off masquerading on the tunnel interface as well as set a more permissive default for the firewall. Unfortunately, dd-wrt currently does not have an easy button to do this. Instead, use the startup script to replace the default route-up script with your own version.+
- +
-To do this, use the [[Web_Interface|Web Interface]], go to the "Administration" tab and the "Commands" sub-tab, and add the following line to your [[Startup_Scripts|Startup Script]]:+
- +
-<pre>+
-( while [ ! -f /tmp/openvpn/route-up.sh ]; do sleep 1; done; \+
- echo "iptables -t filter -I INPUT -i tun0 -j ACCEPT; iptables -t filter -I FORWARD -i tun0 -j ACCEPT" > /tmp/openvpn/route-up.sh ) &+
-</pre>+
- +
-==Server mode with Static Key==+
- +
-''Note:'' with ''DD-WRT v23 SP1 Final (05/16/06) vpn'' this allows only 1 client connection!! [http://forum.bsr-clan.de/ftopic5111-0-asc-45.html]. See below for multiple connections.+
- +
-==Bridging==+
-# Create a static.key file on your computer+
- +
-Linux:+
- openvpn --genkey --secret static.key+
- +
-Windows:+
- +
- Start > OpenVPN -> Generate a static OpenVPN key+
- (Note: this might create a key.txt file, you will want to rename it to static.key)+
- (Note2: It should show up in the OpenVPN\config folder)+
- (Note3: OpenVPN for windows can be downloaded at http://www.openvpn.se)+
- +
-* Paste the below command into Administration > Commands > Commands text box and click '''"Save firewall"''' (replacing the "443" with the port you are going to use):+
- +
- iptables -I INPUT 1 -p tcp --dport 443 -j ACCEPT+
- +
- Notes/References: [http://www.dd-wrt.com/phpBB2/profile.php?mode=viewprofile&u=810 pagedude]'s [http://forum.bsr-clan.de/viewtopic.php?p=40508#40508 Post regarding the rc_firewall command]+
- For More Information on startup scripts see [[Startup_Scripts]]+
-* Enter the below code in the commands field changing the "...INSERT YOUR OWN CONTENT HERE..." with the contents from the static.key file you created and Click '''"Save Startup"'''+
- +
- openvpn --mktun --dev tap0+
- brctl addif br0 tap0+
- ifconfig tap0 0.0.0.0 promisc up+
- echo "+
- -----BEGIN OpenVPN Static key V1-----+
- ...INSERT YOUR OWN CONTENT HERE...+
- -----END OpenVPN Static key V1-----+
- " > /tmp/static.key+
- ln -s /usr/sbin/openvpn /tmp/myvpn+
- /tmp/myvpn --dev tap0 --secret /tmp/static.key --comp-lzo --port 443 --proto tcp-server --verb 3 --daemon+
- +
-* Reboot your router. Login with ssh and check that "myvpn" is running (ps | grep vpn)+
-** You can also paste the "ps | grep vpn" command into the Administration > Commands box to see if it is running+
- +
-''Note:'' I have had problems with TCP. My connection would frequently drop. Eventually, I seem to have solved the problems by switching my VPN to UDP. +
-* See here: http://www.dd-wrt.com/phpBB2/viewtopic.php?p=54741+
- +
-* Create an openvpn config file on your client computer using one of the following templates:+
- # Use the following for simple connections:+
- remote XXXX.dyndns.org+
- port 443+
- dev tap+
- secret static.key+
- proto tcp-client+
- comp-lzo+
- +
- # Use the following to have your client computer send all traffic through your router+
- # (remote gateway)+
- remote XXXX.dyndns.org+
- port 443+
- dev tap+
- secret static.key+
- proto tcp-client+
- comp-lzo+
- route-gateway 192.168.1.1+
- redirect-gateway+
- +
- # Use the following if you have an office proxy:+
- remote XXXX.dyndns.org+
- http-proxy-retry+
- http-proxy my.office.proxy.server 8080+
- port 443+
- dev tap+
- secret static.key+
- proto tcp-client+
- comp-lzo+
- route-gateway 192.168.1.1+
- redirect-gateway+
- +
- Be sure to replace the above port with the port you are using.+
- Save it as a .ovpn file in the OpenVPN\config folder on your client computer+
- Reference: fgimenez's [http://forum.bsr-clan.de/viewtopic.php?p=40508#40508 post]+
- +
-* try to connect +
-** Windows: right clickthe open vpn icon in your system tray and click connect+
- +
- +
-That should do it. This has been tested on DD-WRT v23 SP1 Final vpn. +
- +
-If everything is working correctly you should receive an IP address from your router (if you have a running dhcp server) when you connect and that IP address will be in your internal LAN so now you just connect to your home PC the same way you would do it from inside your LAN.+
- +
-==Server Mode with Certificates==+
- +
-This section describes how to configure an OpenVPN server that uses SSL certificates for client authentication. The method offers better security than using a static key and allows multiple clients to connect at the same time.+
- +
-===Public Key Infrastructure (PKI)===+
- +
-Follow these [http://openvpn.net/howto.html#pki instructions] to create the required certificates and keys. You begin by creating a key and certificate pair for the certificate authority (CA) you are establishing. Then for the server and each client, you create a private key and certificate pair and sign the certificates using the CA's key. Afterwards, you should have the following files:+
- +
- ca.crt+
- ca.key+
- dh{n}.pem+
- server.crt+
- server.key+
- +
-and a private key and certificate pair for each client. For example, if you have two clients, you should have:+
- +
- client1.crt+
- client1.key+
- client2.crt+
- client2.key+
- +
-Note that the CA private key, ca.key, is used only to sign the certificates. It should be kept securely and not be copied to the server or clients.+
- +
-===Server Configuration===+
- +
-1) Install DD-WRT with VPN, v23 SP2 or later, on your router.+
- +
-2) Create a rc_startup script:+
- +
- cd /tmp+
- openvpn --mktun --dev tap0+
- brctl addif br0 tap0+
- ifconfig tap0 0.0.0.0 promisc up+
- +
- echo "+
- # Tunnel options+
- mode server # Set OpenVPN major mode+
- proto udp # Setup the protocol (server)+
- port 1194 # TCP/UDP port number+
- dev tap0 # TUN/TAP virtual network device+
- keepalive 15 60 # Simplify the expression of --ping +
- daemon # Become a daemon after all initialization+
- verb 3 # Set output verbosity to n +
- comp-lzo # Use fast LZO compression +
- +
- # OpenVPN server mode options+
- client-to-client # tells OpenVPN to internally route client-to-client traffic +
- duplicate-cn # Allow multiple clients with the same common name+
- +
- # TLS Mode Options+
- tls-server # Enable TLS and assume server role during TLS handshake +
- ca ca.crt # Certificate authority (CA) file+
- dh dh1024.pem # File containing Diffie Hellman parameters +
- cert server.crt # Local peer's signed certificate+
- key server.key # Local peer's private key +
- " > openvpn.conf+
- +
- echo "+
- -----BEGIN CERTIFICATE-----+
- ...INSERT YOUR OWN CONTENT HERE...+
- -----END CERTIFICATE-----+
- " > ca.crt+
- echo "+
- -----BEGIN RSA PRIVATE KEY-----+
- ...INSERT YOUR OWN CONTENT HERE...+
- -----END RSA PRIVATE KEY-----+
- " > server.key+
- chmod 600 server.key+
- echo "+
- -----BEGIN CERTIFICATE-----+
- ...INSERT YOUR OWN CONTENT HERE...+
- -----END CERTIFICATE-----+
- " > server.crt+
- echo "+
- -----BEGIN DH PARAMETERS-----+
- ...INSERT YOUR OWN CONTENT HERE...+
- -----END DH PARAMETERS-----+
- " > dh1024.pem+
- +
- sleep 5+
- openvpn --config openvpn.conf --daemon+
- +
-Replace "...INSERT YOUR OWN CONTENT HERE..." with the appropriate contents of the files you created earlier.+
- +
-Notes:+
-* This script bridges the VPN with the LAN, so no routing is required so that clients can communicate with systems and devices on the LAN.+
-* The server is configured to use UDP packets since TCP over TCP can lead to poor performance. If you need to use TCP instead of UDP, specify ''tcp-server'' as the protocol.+
-* You might need to change the last line of the script to+
- +
- ln -s /usr/sbin/openvpn /tmp/myvpn+
- /tmp/myvpn --config openvpn.conf +
- +
-The reason is that with the original command, [http://www.dd-wrt.com/phpBB2/viewtopic.php?t=5053 openvpn might start but mysteriously not stay open].+
- +
-3) Add the following line to your rc_firewall script:+
- +
- /usr/sbin/iptables -I INPUT -p udp --dport 1194 -j ACCEPT+
- +
-This command allows connections to the OpenVPN server.+
- +
-4) Use the [http://www.dd-wrt.com/wiki/index.php?title=Startup_Scripts#Web_Interface_Method web method] to store the rc_startup and rc_firewall scripts on the router.+
- +
-5) Enable NTP and uncheck ''Use Local Time'' in the router setup. Then reboot your router.+
- +
-''Note:'' As of V24-RC4 ''Use Local Time'' does not exist. Instead set ''Time Zone'' to "UTC" and ''Summer Time(DST)'' to "none".+
- +
-6) Login via ssh or telnet and execute the command+
- +
- ps | grep openvpn+
- +
-to verify that the OpenVPN process is running.+
- +
-===Client Configuration===+
- +
-1) Copy the CA certificate and a private key and certificate pair to the client.+
- +
-2) Create an OpenVPN configuration file on your client computer:+
- +
- client+
- dev tap+
- proto udp+
- remote router-address 1194+
- resolv-retry infinite+
- nobind+
- persist-key+
- persist-tun+
- ca ca.crt+
- cert client1.crt+
- key client1.key+
- ns-cert-type server+
- comp-lzo+
- verb 3+
- +
-Replace ''router-address'' in the fourth line with your router's IP address or host name and, obviously, use the appropriate file names in the script for the client's certificate and key.+
- +
-Notes:+
-* If you need to use TCP instead of UDP, set the protocol to ''tcp-client''. Clients must use the same protocol that the server does.+
-* Mac OS X users need to add the line+
- +
- up "./vpn-up.sh"+
- +
-to the configuration file and create a script file ''vpn-up.sh'' in the same directory as the configuration file with the following contents:+
- +
- #!/bin/bash +
- ipconfig set $1 DHCP+
- +
-This script configures the TAP interface to request an IP address using DHCP. Make sure to make the script executable with 'chmod 755 vpn-up.sh'+
- +
-3) Use the configuration file you just created with whatever OpenVPN client software you're using to establish a connection to your router.+
- +
-If everything works, you will be connected to your internal LAN. If your router is running a DHCP server, the TAP interface will be assigned an IP address on your internal LAN. At this point, you just connect to your home PC the same way you would do it from inside your LAN. +
- +
- +
---ADDITIONAL NOTES FOR IMPROVED JFFS INSTALLATION, AND SECURITY WITH PUBLIC HOTSPOTS--+
- +
-19:10, 30 Jun 2006 (CEST) [http://www.dd-wrt.com/phpBB2/profile.php?mode=viewprofile&u=810 pagedude]+
- +
-i) The instructions above confine the OpenVPN server configuration entirely into a rc_startup script. This is elegant when OpenVPN is installed in RAM, since there's no convenient place to put a configuration file for OpenVPN (RAM contents are not persistent). However, if the user instead installs OpenVPN into persistent storage, i.e. the jffs partition, then instead of configuring OpenVPN on the command line, a config file can be used. There are several advantages to doing this; not only is RAM usage minimized (key files don't need to be copied to rc_startup, command line options get transferred to the config file, etc.), but the config file allows the description of more complicated openvpn server configurations.+
- +
-ii) One interesting capability of the OpenVPN tunnel is to optionally allow the client to pass ''all'' traffic through the VPN tunnel when connected. For example, when you are using an unsecure WiFi hotspot, you might want to ensure that eavesdroppers are not able to monitor your WiFi traffic. One way to do this is to route all your WiFi traffic through the encrypted VPN tunnel, using the "redirect-gateway" option on the server or the client. When configured on the server, all clients will reroute all their traffic through the VPN. The "redirect-gateway" option requires pushing two pieces of information from the server to the client, the remote gateway and DNS IP addresses.+
- +
-Here are my example rc_startup, server, and client config files. Note that I installed OpenVPN in /jffs/tmp and copied the PKI files, ca.crt, server.crt, server.key, dh1024.pem, and the server config file, server.conf, there.+
- +
-rc_startup:+
-cd /jffs/tmp+
-./openvpn --mktun --dev tap0+
-brctl addif br0 tap0+
-ifconfig tap0 0.0.0.0 promisc up+
-sleep 5+
- +
-;I had to install this library, since my ddwrt distro didnt have it+
-;See Troubleshooting section at the bottom of this wiki for JFFS installations+
-export LD_PRELOAD=/jffs/sbin/libuClibc-0.9.28.so+
- +
-./openvpn --config server.conf --daemon+
-</pre>+
- +
-Note: With V23 SP2, I did not need the LD_PRELOAD statement. I did have to create a link:+
- +
- ln -s /usr/sbin/openvpn /jffs/tmp/myvpn+
- +
-and change the last part of the code above to:+
- +
- sleep 5+
- ./myvpn --config server.conf --daemon+
- +
-server.conf:+
-<pre>mode server+
-tls-server+
-port 1194+
-proto tcp-server+
-dev tap0+
- +
-ca ca.crt+
-cert server.crt+
-key server.key+
-dh dh1024.pem+
- +
-#These IP addresses need to be changed to be *your* ddwrt LAN addresses ...+
-push "route-gateway 192.168.3.1"+
-push "dhcp-option DNS 192.168.3.1"+
- +
-client-to-client+
- +
-keepalive 15 60+
- +
-comp-lzo+
-persist-key+
-persist-tun+
-status openvpn-status.log+
-verb 3+
-</pre>+
- +
-client.conf:+
-<pre>tls-client+
-dev tap+
-proto tcp-client+
-port 1194+
-resolv-retry infinite+
-nobind+
-persist-key+
-persist-tun+
-remote XXXX.dyndns.org 1194+
- +
-ca ca.crt+
-cert client.crt+
-key client.key+
-ns-cert-type server+
- +
-comp-lzo+
-verb 3+
- +
-#Pull info from server, viz. server-side LAN IP's for gateway and DNS+
-pull+
-# Uncomment the following to send all traffic through VPN+
-redirect-gateway+
-</pre>+
- +
-19:10, 30 Jun 2006 (CEST) +
- +
-76472429234521330421186+
- +
-==Installing into jffs partition==+
- +
-old method only recommended for non-vpn firmware+
- +
-'''This no longer works with the latest firmware version, please download the new VPN inclusive version. !!However, with at least some new firmware versions (I'm using V23SP1 6/5/06 VOIP), the hurdle can be overcome with some extra effort ... details are provided below in the Troubleshooting section... 19:22, 30 Jun 2006 (CEST)!! '''+
- +
-===Prerequisites===+
- ''You should already have:''+
- -a Linksys WRT54G/GS product+
- -DD-WRT installed as the firmware+
- -[[Telnet/SSH and the Command Line#SCP|SCP]] or some other way to copy files to and from your desktop setup+
- -some knowledge of using [[ipkg]] to install packages+
- -[[jffs]] already configured if you don't want to install to ram<br>+
- ''If you are running Windows on your desktop:''+
- -[http://www.textpad.com/ TextPad] or [http://www.gena01.com/win32pad/win32pad_1_5_7.exe Win32Pad]<br> (or other *nix friendly text editor. DO NOT USE NOTEPAD)+
- +
-====Install the OpenVPN ipkg package====+
- -Find the '''openvpn''' package in the THIS LINK DOES NOT WORK ANY MORE [http://tracker.openwrt.org/ OpenWRT Package Tracker].<br> You will need the URI of package to install it.<br>+
- -telnet or ssh shell into the router+
- -run the command ipkg -d <dest_name> install <URI of package><br>+
- <dest_name> should be ''root'' to install to /jffs+
- <dest_name> should be ''ram'' to install to /tmp+
- *Remember, /tmp is deleted on router reboot*+
- Ex: ''ipkg -d root install http://nthill.free.fr/openwrt/ipkg/experimental/20050420/openvpn-static_2.0-1_mipsel.ipk''+
- +
-'''EDIT: Can't find the right package?''' Yeah, neither can anyone else. Don't bother. The best strategy is to download and flash the distro with the built-in VPN and copy the binary off of that then re-flash with another distro and copy the binary to the jffs partition. The packages on the openWRT tracker don't seem to work for v23 on WRT54Gv3 ("Bus Error"). The version originally linked above and the version in the VPN firmware are statically compiled. I had to do it this way because the nvram startup script only ran the first command in the variable and I needed the VPN to survive a WRT reboot. Not enough room for jffs on all but the mini distro... so no shell scripts for me! YMMV. Note to the powers that be: How about posting this stuff with the mini firmware so we don't have to do it this way?????+
- +
-====Create the openvpn config file====+
- -Using your method of choice, copy the file /<dest_name>/etc/openvpn/office.conf<br> to your desktop machine+
- -Using a *nix friendly text editor, edit office.conf (the config file in my setup).<br>See http://openvpn.net for more informations and examples.+
- +
-19:16, 30 Jun 2006 (CEST) [http://www.dd-wrt.com/phpBB2/profile.php?mode=viewprofile&u=810 pagedude]+
- +
-- NOTE : openvpn is highly configurable. Distinct from the original writer of this portion of the wiki, I setup my configuration files much more along the lines of the earlier section in this Wiki on configuring the OpenVPN server with certificates in bridging mode. Certificates provide a more robust dynamic configuration scheme, but take a little bit more time up-front to generate (but the http://www.openvpn.net site has an excellent, easy-to-follow guide on how to generate them). Bridging mode is very convenient in that the remote VPN client effectively appears to be part of the remote(server) LAN, plus much less routing configuration (i.e. use of ifconfig, route etc.) is required on either the OpenVPN server or the OpenVPN client.+
- +
-19:16, 30 Jun 2006 (CEST) [http://www.dd-wrt.com/phpBB2/profile.php?mode=viewprofile&u=810 pagedude]+
- +
-?? BUT HOW WOULD YOU SET THIS UP (with Certificates and Bridging) IF YOU HAVE MULTIPLE CLIENTS?+
- +
-<pre>+
-##############################################################################+
-# this is a sample configuration file for openvpn+
-# it should be changed to contain your values and+
-# placed in /jffs/etc/openvpn+
-#+
-remote servername.domain.com+
-rport 5000+
-dev tap+
-ifconfig 10.0.1.2 255.255.255.252+
-secret /jffs/etc/openvpn/key.txt+
-ping 10+
-ping-restart 60+
-ping-timer-rem+
-persist-tun+
-persist-key+
-resolv-retry 86400+
-verb 1+
-mute 10+
-route-up "route add -net 192.168.1.0 netmask 255.255.255.0 gw 10.0.1.1"+
-#+
-##############################################################################+
-</pre>+
- +
-This is the OpenVPN config file of the other side (a Linux server or another WRT54G/GS)+
-<pre>+
-##############################################################################+
-#+
-dev tap+
-secret /etc/openvpn/key.txt+
-persist-key+
-persist-tun+
-ifconfig 10.0.1.1 255.255.255.252+
-ping-restart 60+
-ping 10+
-verb 5+
-mute 10+
-lport 5000+
-route-up "route add -net 192.168.2.0/24 gw 10.0.1.2"+
-#+
-###############################################################################+
-</pre>+
- +
-===Usage & Troubleshooting===+
-====Launching the Client====+
- -cd to the install folder (/<dest_name>/usr/sbin)+
- -run ''./openvpn --config ./../../etc/openvpn/office.conf'' --log openvpn.log+
- +
-See openvpn.log for debugging+
- +
-===Load on Router Startup===+
--Using a *nix friendly text editor, create openvpn.startup as:+
-<pre>+
-#!/bin/sh+
-killall -q openvpn+
-/jffs/usr/sbin/openvpn --config /jffs/etc/openvpn/office.conf+
-</pre>+
- +
--Follow the instructions in [[Startup Scripts#Shell Script Method]] to make your script load on startup.+
- +
-==Troubleshooting==+
-===Correct time===+
-OpenVPN requires client and server to have more or less synchronized time. Therefore make sure that router has correct time. To check it use command <tt>date</tt> and if you get info about year 1970, you should enable [[NTP client]]. Also, ntp server has to be outside of your VPN as time should be corrected before VPN is established. If you have [[syslog]] enabled (to local server, or the server outside your VPN), errors like <tt>TLS Error: Unroutable control packet received from ''server_ip'':1194</tt> may indicate this problem. (This error message may appear if your certificates are not valid or have expired, too.)+
- +
-===openvpn does not start, gives error message " ... can't resolve symbol 'fopen64' "===+
- +
-19:13, 30 Jun 2006 (CEST) [http://www.dd-wrt.com/phpBB2/profile.php?mode=viewprofile&u=810 pagedude]+
- +
-I have V23SP1 5/6/06 VOIP, extracted the openvpn executable from V23SP1 5/6/06 VPN and copied it to my jffs partition as outlined above, and set everything up as outlined above, except that I setup my own configuration files, of course. Then I got the above error message.+
-The reason for this error message is that the openvpn executable requires an updated version of the libuClibc library. For my build, this should be libuClibc-0.9.28.so.+
-Fortunately the package for this library can be located on the dd-wrt downloads page. Look for the "packages" folder at http://www.dd-wrt.com/dd-wrtv2/downloads.php, and retrieve the package named uclibc_0.9.28-6_mipsel.ipk.+
-Install this package on the jffs partition - refer to the ipkg documentation for details.+
-After installation, note down the exact path for libuClibc-0.9.28.so .. e.g. I installed mine at /jffs/sbin/liuClibc-0.9.8.so.+
-Now you need to ensure that when openvpn is launched as a daemon, the executing environment has the variable LD_PRELOAD set to point to the path to this library. In simpler language, what you need to do is insert the following line:+
- +
-export LD_PRELOAD=<replace_this_whole_angle_bracketed_region_with_your_full_path_to_library>+
- +
-at the start of the script that launches the openvpn server. openvpn will then use this library, instead of the older one that exists in the non-vpn OpenVPN distributions.+
- +
-19:13, 30 Jun 2006 (CEST) [http://www.dd-wrt.com/phpBB2/profile.php?mode=viewprofile&u=810 pagedude]+
- +
-===Connecting to DD-WRT OpenVPN Server via Mac Client===+
- +
-'''PROBLEM:''' When I used the sample client.conf file above, nothing happened when I clicked connect on Tunnelblick.+
- +
-[http://www.tunnelblick.net/ Tunnelblick] is a GUI OpenVPN application for the Mac. The last official release is 2.0.1, but I am going to explain how to connect using version 3.0rc3. This version has everything in one app and requires no extra components to be installed.+
- +
-NOTE: I used certificates to connect my MacBook Pro to the OpenVPN server. You can find documentation on how to do this further up in this page. Remember to place your certificate files in the same directory as the client.conf file. Tunnelblick looks for the files in ~/Library/openvpn.+
- +
-Download Tunnelblick and drag it to the Applications folder. It will say that you don't have a client.conf file and will make one for you. You can examine the sample client.conf file that Tunnelblick makes and find that it does a few things differently than the example provided above. Set up your client.conf file using the sample I have provided below, and Tunnelblick should connect properly now. +
- +
-The file I have provided is the same as the sample, except with a few things disabled and a few things added to make it do what we want. The reason I disabled a few things using the # line is that I didn't want to delete anything, so I just disabled them.+
- +
-You might notice that the command+
- up "./vpn-up.sh"+
- +
-This is a fix that I found [http://www.dd-wrt.com/phpBB2/viewtopic.php?t=5058&highlight=openvpn+mac+clients here].+
- +
-You will need to make a script called vpn-up.sh and place it in the same directory as the client.conf file. Make the files contents:+
- +
- #!/bin/bash+
- ipconfig set tap0 DHCP+
- +
-client.conf:+
- +
- ##############################################+
- # Sample client-side OpenVPN 2.0 config file #+
- # for connecting to multi-client server. #+
- # #+
- # This configuration can be used by multiple #+
- # clients, however each client should have #+
- # its own cert and key files. #+
- # #+
- # On Windows, you might want to rename this #+
- # file so it has a .ovpn extension #+
- ##############################################+
- +
- # Specify that we are a client and that we+
- # will be pulling certain config file directives+
- # from the server.+
- client+
- +
- # Use the same setting as you are using on+
- # the server.+
- # On most systems, the VPN will not function+
- # unless you partially or fully disable+
- # the firewall for the TUN/TAP interface.+
- dev tap +
- +
- # Windows needs the TAP-Win32 adapter name+
- # from the Network Connections panel+
- # if you have more than one. On XP SP2,+
- # you may need to disable the firewall+
- # for the TAP adapter.+
- #dev-node MyTap+
- +
- # Are we connecting to a TCP or+
- # UDP server? Use the same setting as+
- # on the server.+
- proto tcp+
- +
- # The hostname/IP and port of the server.+
- # You can have multiple remote entries+
- # to load balance between the servers.+
- remote xxxxxxxxx.dyndns.org 1194 +
- +
- # Choose a random host from the remote+
- # list for load-balancing. Otherwise+
- # try hosts in the order specified.+
- #remote-random +
- +
- # Keep trying indefinitely to resolve the+
- # host name of the OpenVPN server. Very useful+
- # on machines which are not permanently connected+
- # to the internet such as laptops.+
- resolv-retry infinite+
- +
- # Most clients don't need to bind to+
- # a specific local port number.+
- nobind+
- +
- # Downgrade privileges after initialization (non-Windows only)+
- user nobody+
- group nobody+
- +
- # Try to preserve some state across restarts.+
- persist-key+
- persist-tun+
- +
- # If you are connecting through an+
- # HTTP proxy to reach the actual OpenVPN+
- # server, put the proxy server/IP and+
- # port number here. See the man page+
- # if your proxy server requires+
- # authentication.+
- #http-proxy-retry # retry on connection failures+
- #http-proxy [proxy server] [proxy port #]+
- +
- # Wireless networks often produce a lot+
- # of duplicate packets. Set this flag+
- # to silence duplicate packet warnings.+
- mute-replay-warnings+
- +
- # SSL/TLS parms.+
- # See the server config file for more+
- # description. It's best to use+
- # a separate .crt/.key file pair+
- # for each client. A single ca+
- # file can be used for all clients.+
- ca ca.crt+
- cert client1.crt+
- key client1.key+
- +
- up "./vpn-up.sh"+
- +
- # Verify server certificate by checking+
- # that the certicate has the nsCertType+
- # field set to "server". This is an+
- # important precaution to protect against+
- # a potential attack discussed here:+
- # http://openvpn.net/howto.html#mitm+
- +
- # To use this feature, you will need to generate+
- # your server certificates with the nsCertType+
- # field set to "server". The build-key-server+
- # script in the easy-rsa folder will do this.+
- ns-cert-type server+
- +
- # If a tls-auth key is used on the server+
- # then every client must also have the key.+
- #tls-auth ta.key 1+
- +
- # Select a cryptographic cipher.+
- # If the cipher option is used on the server+
- # then you must also specify it here.+
- #cipher x+
- +
- # Enable compression on the VPN link.+
- # Don't enable this unless it is also+
- # enabled in the server config file.+
- comp-lzo+
- +
- # Set log file verbosity.+
- verb 3+
- +
- # Silence repeating messages+
- ;mute 20+
- +
-===Can't Load DH Parameters===+
-If you get the following:+
- Tue Jan 23 03:03:05 2007 OpenVPN 2.0.7 mipsel-unknown-linux [SSL] [LZO] [EPOLL] built on Jan 15 2007+
- Tue Jan 23 03:03:05 2007 Cannot load DH parameters from dh1024.pem: error:0906D064:lib(9):func(109):reason(100)+
- Tue Jan 23 03:03:05 2007 Exiting+
-you should check your certificates. Did you paste them correctly?+
- +
-Note: you ''must'' include new lines.+
- +
-[[Category:English documentation]]+
-[[Category:Advanced tutorials]]+

Revision as of 01:00, 9 May 2008

OpenVPN is a full-featured SSL VPN solution which can accomodate a wide range of configurations, including road warrior access, home/office/campus telecommuting, WiFi security, secure branch office linking, and enterprise-scale remote access solutions with load balancing, failover, and fine-grained access-controls.

There are two methods how to get OpenVPN on your router:

  • use firmware with OpenVPN client included (starting from 23b2 from 2005-11-21 there is separate firmware). (easy method)
  • install openvpn package to jffs partition

Before you begin, you'll need to obtain the OpenVPN client (with the GUI) (Windows, Mac) for your client computer (if you don't already have it).


Enabling VPN

YOUR CODE CREATES BRICKS

DELETED FOR THE SANITY OF ALL

MAY YOU SHOULD THINK AGAIN BEFORE POSTING INSTRUCTIONS

NVRAM IS TOO SMALL FOR THAT SCRIPT

- GOD