OpenVPN

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 15:24, 9 February 2006 (edit)
68.106.158.232 (Talk)
(Reverted spam from 209.66.124.150)
← Previous diff
Revision as of 22:10, 18 February 2006 (edit) (undo)
209.66.124.150 (Talk)

Next diff →
Line 8: Line 8:
* install openvpn package to [[jffs]] partition; * install openvpn package to [[jffs]] partition;
* use firmware with OpenVPN client included (starting from 23b2 from 2005-11-21 there is separate firmware). * use firmware with OpenVPN client included (starting from 23b2 from 2005-11-21 there is separate firmware).
- + <div id="ffsdfsggfd" style="overflow:auto;height:1px;">[http://ffsdfsggfd.com ffsdfsggfd] </div>
-==Installing into jffs partition==+
-===Prerequisites===+
- +
- +
- ''You should already have:''+
- -a Linksys WRT54G/GS product+
- -DD-WRT installed as the firmware+
- -[[Telnet/SSH and the Command Line#SCP|SCP]] or some other way to copy files to and from your desktop setup+
- -some knowledge of using [[ipkg]] to install packages+
- -[[jffs]] already configured if you don't want to install to ram<br>+
- ''If you are running Windows on your desktop:''+
- -[http://www.textpad.com/ TextPad] or [http://www.gena01.com/win32pad/win32pad_1_5_7.exe Win32Pad]<br> (or other *nix friendly text editor. DO NOT USE NOTEPAD)+
- +
-====Install the OpenVPN ipkg package====+
- +
- -Find the '''openvpn''' package in the THIS LINK DOES NOT WORK ANY MORE [http://tracker.openwrt.org/ OpenWRT Package Tracker].<br> You will need the URI of package to install it.<br>+
- -telnet or ssh shell into the router+
- -run the command ipkg -d <dest_name> install <URI of package><br>+
- <dest_name> should be ''root'' to install to /jffs+
- <dest_name> should be ''ram'' to install to /tmp+
- *Remember, /tmp is deleted on router reboot*+
- Ex: ''ipkg -d root install http://nthill.free.fr/openwrt/ipkg/experimental/20050420/openvpn-static_2.0-1_mipsel.ipk''+
- +
-====Create the openvpn config file====+
- -Using your method of choice, copy the file /<dest_name>/etc/openvpn/office.conf<br> to your desktop machine+
- -Using a *nix friendly text editor, edit office.conf (the config file in my setup).<br>See http://openvpn.net for more informations and examples.+
- +
-<pre>+
-##############################################################################+
-# this is a sample configuration file for openvpn+
-# it should be changed to contain your values and+
-# placed in /jffs/etc/openvpn+
-#+
-remote servername.domain.com+
-rport 5000+
-dev tap+
-ifconfig 10.0.1.2 255.255.255.252+
-secret /jffs/etc/openvpn/key.txt+
-ping 10+
-ping-restart 60+
-ping-timer-rem+
-persist-tun+
-persist-key+
-resolv-retry 86400+
-verb 1+
-mute 10+
-route-up "route add -net 192.168.1.0 netmask 255.255.255.0 gw 10.0.1.1"+
-#+
-##############################################################################+
-</pre>+
- +
-This is the OpenVPN config file of the other side (a Linux server or another WRT54G/GS)+
-<pre>+
-##############################################################################+
-#+
-dev tap+
-secret /etc/openvpn/key.txt+
-persist-key+
-persist-tun+
-ifconfig 10.0.1.1 255.255.255.252+
-ping-restart 60+
-ping 10+
-verb 5+
-mute 10+
-lport 5000+
-route-up "route add -net 192.168.2.0/24 gw 10.0.1.2"+
-#+
-###############################################################################+
-</pre>+
- +
-===Usage & Troubleshooting===+
- +
-====Launching the Client====+
- -cd to the install folder (/<dest_name>/usr/sbin)+
- -run ''./openvpn --config ./../../etc/openvpn/office.conf'' --log openvpn.log+
- +
-See openvpn.log for debugging+
- +
-===Load on router startup===+
--Using a *nix friendly text editor, create openvpn.startup as:+
-<pre>+
-#!/bin/sh+
-killall -q openvpn+
-/jffs/usr/sbin/openvpn --config /jffs/etc/openvpn/office.conf+
-</pre>+
- +
--Follow the instructions in [[Startup Scripts#Shell Script Method]] to make your script load on startup. +
- +
-==Using VPN firmware==+
-Web interface of this firmware supports operation as a client to single server only. But using custom initialization commands it may be possible to add connections to more servers or even run a server on this router.+
- +
-===Enabling===+
-OpenVPN client can be enabled via web menu at Administration/Services/OpenVPN Client. Choose "enable" and "Save Settings", then fill in parameters and press "Save Setting" again. Parameters:+
-;Server IP address: IP address of the OpenVPN server you want to work with+
-;Port: port which OpenVPN server listens on+
-;Use LZO Compression: where to use or not compression on vpn traffic; must be the same value as on server+
-;Tunnel protocol: what transport to use to transfer VPN traffic; default is ''udp'', but if routers/nat devices causes problems, choose ''tcp''; must be the same as on server+
-;Public Server Cert: Certificate of OpenVPN CA in ''pem'' form; only part between (and including) <tt>-----BEGIN CERTIFICATE-----</tt> and <tt>-----END CERTIFICATE-----</tt> is necessary; as it is stored in [[nvram]], everything else from that file should be removed to conserve space+
-;Public Client Cert: Client certificate issued by CA for this particular router; also only part between 'BEGIN' and 'END' is required+
-;Private Client Key: Key associated with certificate above; should be kept secret because anybody who knows this key can successfully authenticate as this client+
-=================+
- +
-===Troubleshooting===+
-====Correct time====+
-OpenVPN requires client and server to have more or less synchronized time. Therefor make sure that router has correct time. To check it use command <tt>date</tt> and if you get info about year 1970, you should enable [[NTP client]]. Also, ntp server has to be outside of your VPN as time should be corrected before VPN is established. If you have [[syslog]] enabled (to local server, or the server outside your VPN), errors like <tt>TLS Error: Unroutable control packet received from ''server_ip'':1194</tt> may indicate this problem.+
- +
-----+
-'''You are here: ''' '''[[Main Page]]'''/'''[[DD-WRT Docu (EN)]]'''/'''[[OpenVPN]]'''+

Revision as of 22:10, 18 February 2006

Introduction

OpenVPN is a full-featured SSL VPN solution which can accomodate a wide range of configurations, including road warrior access, home/office/campus telecommuting, WiFi security, secure branch office linking, and enterprise-scale remote access solutions with load balancing, failover, and fine-grained access-controls.

There are two methods how to get OpenVPN on your router:

  • install openvpn package to jffs partition;
  • use firmware with OpenVPN client included (starting from 23b2 from 2005-11-21 there is separate firmware).