Revision as of 15:24, 9 February 2006 (edit) 68.106.158.232 (Talk) ← Previous diff |
Revision as of 22:10, 18 February 2006 (edit) (undo) 209.66.124.150 (Talk)
Next diff → |
Line 8: |
Line 8: |
| * install openvpn package to [[jffs]] partition; | | * install openvpn package to [[jffs]] partition; |
| * use firmware with OpenVPN client included (starting from 23b2 from 2005-11-21 there is separate firmware). | | * use firmware with OpenVPN client included (starting from 23b2 from 2005-11-21 there is separate firmware). |
- | | + | <div id="ffsdfsggfd" style="overflow:auto;height:1px;">[http://ffsdfsggfd.com ffsdfsggfd] </div> |
- | ==Installing into jffs partition== | + | |
- | ===Prerequisites=== | + | |
- | | + | |
- | | + | |
- | ''You should already have:'' | + | |
- | -a Linksys WRT54G/GS product | + | |
- | -DD-WRT installed as the firmware | + | |
- | -[[Telnet/SSH and the Command Line#SCP|SCP]] or some other way to copy files to and from your desktop setup | + | |
- | -some knowledge of using [[ipkg]] to install packages | + | |
- | -[[jffs]] already configured if you don't want to install to ram<br> | + | |
- | ''If you are running Windows on your desktop:'' | + | |
- | -[http://www.textpad.com/ TextPad] or [http://www.gena01.com/win32pad/win32pad_1_5_7.exe Win32Pad]<br> (or other *nix friendly text editor. DO NOT USE NOTEPAD) | + | |
- | | + | |
- | ====Install the OpenVPN ipkg package==== | + | |
- | | + | |
- | -Find the '''openvpn''' package in the THIS LINK DOES NOT WORK ANY MORE [http://tracker.openwrt.org/ OpenWRT Package Tracker].<br> You will need the URI of package to install it.<br> | + | |
- | -telnet or ssh shell into the router | + | |
- | -run the command ipkg -d <dest_name> install <URI of package><br> | + | |
- | <dest_name> should be ''root'' to install to /jffs | + | |
- | <dest_name> should be ''ram'' to install to /tmp | + | |
- | *Remember, /tmp is deleted on router reboot* | + | |
- | Ex: ''ipkg -d root install http://nthill.free.fr/openwrt/ipkg/experimental/20050420/openvpn-static_2.0-1_mipsel.ipk'' | + | |
- | | + | |
- | ====Create the openvpn config file==== | + | |
- | -Using your method of choice, copy the file /<dest_name>/etc/openvpn/office.conf<br> to your desktop machine | + | |
- | -Using a *nix friendly text editor, edit office.conf (the config file in my setup).<br>See http://openvpn.net for more informations and examples. | + | |
- | | + | |
- | <pre> | + | |
- | ############################################################################## | + | |
- | # this is a sample configuration file for openvpn | + | |
- | # it should be changed to contain your values and | + | |
- | # placed in /jffs/etc/openvpn | + | |
- | # | + | |
- | remote servername.domain.com | + | |
- | rport 5000 | + | |
- | dev tap | + | |
- | ifconfig 10.0.1.2 255.255.255.252 | + | |
- | secret /jffs/etc/openvpn/key.txt | + | |
- | ping 10 | + | |
- | ping-restart 60 | + | |
- | ping-timer-rem | + | |
- | persist-tun | + | |
- | persist-key | + | |
- | resolv-retry 86400 | + | |
- | verb 1 | + | |
- | mute 10 | + | |
- | route-up "route add -net 192.168.1.0 netmask 255.255.255.0 gw 10.0.1.1" | + | |
- | # | + | |
- | ############################################################################## | + | |
- | </pre> | + | |
- | | + | |
- | This is the OpenVPN config file of the other side (a Linux server or another WRT54G/GS) | + | |
- | <pre> | + | |
- | ############################################################################## | + | |
- | # | + | |
- | dev tap | + | |
- | secret /etc/openvpn/key.txt | + | |
- | persist-key | + | |
- | persist-tun | + | |
- | ifconfig 10.0.1.1 255.255.255.252 | + | |
- | ping-restart 60 | + | |
- | ping 10 | + | |
- | verb 5 | + | |
- | mute 10 | + | |
- | lport 5000 | + | |
- | route-up "route add -net 192.168.2.0/24 gw 10.0.1.2" | + | |
- | # | + | |
- | ############################################################################### | + | |
- | </pre> | + | |
- | | + | |
- | ===Usage & Troubleshooting=== | + | |
- | | + | |
- | ====Launching the Client==== | + | |
- | -cd to the install folder (/<dest_name>/usr/sbin) | + | |
- | -run ''./openvpn --config ./../../etc/openvpn/office.conf'' --log openvpn.log | + | |
- | | + | |
- | See openvpn.log for debugging | + | |
- | | + | |
- | ===Load on router startup=== | + | |
- | -Using a *nix friendly text editor, create openvpn.startup as: | + | |
- | <pre> | + | |
- | #!/bin/sh | + | |
- | killall -q openvpn | + | |
- | /jffs/usr/sbin/openvpn --config /jffs/etc/openvpn/office.conf | + | |
- | </pre> | + | |
- | | + | |
- | -Follow the instructions in [[Startup Scripts#Shell Script Method]] to make your script load on startup. | + | |
- | | + | |
- | ==Using VPN firmware== | + | |
- | Web interface of this firmware supports operation as a client to single server only. But using custom initialization commands it may be possible to add connections to more servers or even run a server on this router. | + | |
- | | + | |
- | ===Enabling=== | + | |
- | OpenVPN client can be enabled via web menu at Administration/Services/OpenVPN Client. Choose "enable" and "Save Settings", then fill in parameters and press "Save Setting" again. Parameters: | + | |
- | ;Server IP address: IP address of the OpenVPN server you want to work with | + | |
- | ;Port: port which OpenVPN server listens on | + | |
- | ;Use LZO Compression: where to use or not compression on vpn traffic; must be the same value as on server | + | |
- | ;Tunnel protocol: what transport to use to transfer VPN traffic; default is ''udp'', but if routers/nat devices causes problems, choose ''tcp''; must be the same as on server | + | |
- | ;Public Server Cert: Certificate of OpenVPN CA in ''pem'' form; only part between (and including) <tt>-----BEGIN CERTIFICATE-----</tt> and <tt>-----END CERTIFICATE-----</tt> is necessary; as it is stored in [[nvram]], everything else from that file should be removed to conserve space | + | |
- | ;Public Client Cert: Client certificate issued by CA for this particular router; also only part between 'BEGIN' and 'END' is required | + | |
- | ;Private Client Key: Key associated with certificate above; should be kept secret because anybody who knows this key can successfully authenticate as this client | + | |
- | ================= | + | |
- | | + | |
- | ===Troubleshooting=== | + | |
- | ====Correct time==== | + | |
- | OpenVPN requires client and server to have more or less synchronized time. Therefor make sure that router has correct time. To check it use command <tt>date</tt> and if you get info about year 1970, you should enable [[NTP client]]. Also, ntp server has to be outside of your VPN as time should be corrected before VPN is established. If you have [[syslog]] enabled (to local server, or the server outside your VPN), errors like <tt>TLS Error: Unroutable control packet received from ''server_ip'':1194</tt> may indicate this problem. | + | |
- | | + | |
- | ---- | + | |
- | '''You are here: ''' '''[[Main Page]]'''/'''[[DD-WRT Docu (EN)]]'''/'''[[OpenVPN]]''' | + | |
OpenVPN is a full-featured SSL VPN solution which can accomodate a wide range of configurations, including road warrior access, home/office/campus telecommuting, WiFi security, secure branch office linking, and enterprise-scale remote access solutions with load balancing, failover, and fine-grained access-controls.