OpenVPN

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 19:03, 22 May 2006 (edit)
Krikkit (Talk | contribs)
(Enabling OpenVPN in server mode (DD-Wrt acts as OpenVPN server))
← Previous diff
Revision as of 20:38, 25 May 2006 (edit) (undo)
Gerrys (Talk | contribs)

Next diff →
Line 170: Line 170:
===Correct time=== ===Correct time===
OpenVPN requires client and server to have more or less synchronized time. Therefore make sure that router has correct time. To check it use command <tt>date</tt> and if you get info about year 1970, you should enable [[NTP client]]. Also, ntp server has to be outside of your VPN as time should be corrected before VPN is established. If you have [[syslog]] enabled (to local server, or the server outside your VPN), errors like <tt>TLS Error: Unroutable control packet received from ''server_ip'':1194</tt> may indicate this problem. (This error message may appear if your certificates are not valid or have expired, too.) OpenVPN requires client and server to have more or less synchronized time. Therefore make sure that router has correct time. To check it use command <tt>date</tt> and if you get info about year 1970, you should enable [[NTP client]]. Also, ntp server has to be outside of your VPN as time should be corrected before VPN is established. If you have [[syslog]] enabled (to local server, or the server outside your VPN), errors like <tt>TLS Error: Unroutable control packet received from ''server_ip'':1194</tt> may indicate this problem. (This error message may appear if your certificates are not valid or have expired, too.)
- 
----- 
-'''You are here: ''' '''[[Main Page]]'''/'''[[DD-WRT Docu (EN)]]'''/'''[[OpenVPN]]''' 
- 

Revision as of 20:38, 25 May 2006

Contents

Introduction

OpenVPN is a full-featured SSL VPN solution which can accomodate a wide range of configurations, including road warrior access, home/office/campus telecommuting, WiFi security, secure branch office linking, and enterprise-scale remote access solutions with load balancing, failover, and fine-grained access-controls.

There are two methods how to get OpenVPN on your router:

  • install openvpn package to jffs partition;
  • use firmware with OpenVPN client included (starting from 23b2 from 2005-11-21 there is separate firmware).

Using VPN firmware

Web interface of this firmware supports operation as a client to single server only. But using custom initialization commands it may be possible to add connections to more servers or even run a server on this router.

Enabling OpenVPN in Client mode (DD-Wrt connects to remote OpenVPN server)

OpenVPN client can be enabled via web menu at Administration/Services/OpenVPN Client. Choose "enable" and "Save Settings", then fill in parameters and press "Save Setting" again. Parameters:

Server IP address
IP address of the OpenVPN server you want to work with
Port
port which OpenVPN server listens on
Use LZO Compression
where to use or not compression on vpn traffic; must be the same value as on server
Tunnel protocol
what transport to use to transfer VPN traffic; default is udp, but if routers/nat devices causes problems, choose tcp; must be the same as on server
Public Server Cert
Certificate of OpenVPN CA in pem form; only part between (and including) -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- is necessary; as it is stored in nvram, everything else from that file should be removed to conserve space
Public Client Cert
Client certificate issued by CA for this particular router; also only part between 'BEGIN' and 'END' is required
Private Client Key
Key associated with certificate above; should be kept secret because anybody who knows this key can successfully authenticate as this client


Enabling OpenVPN in server mode (DD-Wrt acts as OpenVPN server)

The easyest way is to use bridging. Basically this is what you need to do:

1) Create a static.key file on your computer Code:

openvpn --genkey --secret static.key


2) Take the rc_firewall script from my post: http://forum.bsr-clan.de/viewtopic.php?p=40508#40508 Code:

iptables -I INPUT 1 -p tcp --dport 443 -j ACCEPT
openvpn --mktun --dev tap0
brctl addif br0 tap0
ifconfig tap0 0.0.0.0 promisc up
echo "
-----BEGIN OpenVPN Static key V1-----
...INSERT YOUR OWN CONTENT HERE...
-----END OpenVPN Static key V1-----
" > /tmp/static.key
ln -s /usr/sbin/openvpn /tmp/myvpn
/tmp/myvpn --dev tap0 --secret /tmp/static.key --comp-lzo --port 443 --proto tcp-server --verb 3 --daemon


3) Change the "...INSERT YOUR OWN CONTENT HERE..." with the content from the file you created on step 1

4) Use the web method to set the rc_firewall script on the router. See this: http://wrt-wiki.bsr-clan.de/index.php?title=Startup_Scripts

5) reboot your router. Login with ssh and check that "myvpn" is running (ps -fe | grep vpn)

6) Create an openvpn config file on your computer with the content from my post. You need to replace the "XXXX.dyndns.org" with your router's internet address (or a dynamic dns hostname pointing to that address). http://forum.bsr-clan.de/viewtopic.php?p=40508#40508 Code:

remote XXXX.dyndns.org
port 443
dev tap
secret static.key
proto tcp-client
comp-lzo


7) try to connect


That should do it. (i have tested this on DD-WRT v23 SP1 Final (05/16/06) vpn) --Krikkit 21:01, 22 May 2006 (CEST)

If everything is ok you should get an IP address from your router when you connect and that IP address will be in your internal LAN so now you just connect to your home PC the same way you would do it from inside your LAN.


Installing into jffs partition

old method only recommended for non-vpn firmware

Prerequisites

You should already have:
-a Linksys WRT54G/GS product
-DD-WRT installed as the firmware
-SCP or some other way to copy files to and from your desktop setup
-some knowledge of using ipkg to install packages
-jffs already configured if you don't want to install to ram
If you are running Windows on your desktop: -TextPad or Win32Pad
(or other *nix friendly text editor. DO NOT USE NOTEPAD)

Install the OpenVPN ipkg package

-Find the openvpn package in the THIS LINK DOES NOT WORK ANY MORE OpenWRT Package Tracker.
You will need the URI of package to install it.
-telnet or ssh shell into the router -run the command ipkg -d <dest_name> install <URI of package>
<dest_name> should be root to install to /jffs <dest_name> should be ram to install to /tmp *Remember, /tmp is deleted on router reboot* Ex: ipkg -d root install http://nthill.free.fr/openwrt/ipkg/experimental/20050420/openvpn-static_2.0-1_mipsel.ipk

EDIT: Can't find the right package? Yeah, neither can anyone else. Don't bother. The best strategy is to download and flash the distro with the built-in VPN and copy the binary off of that then re-flash with the mini distro and copy the binary to the jffs site. The packages on the openWRT tracker don't seem to work for v23 on WRT54Gv3 ("Bus Error"). The version originally linked above and the version in the VPN firmware are statically compiled. I had to do it this way because the nvram startup script only ran the first command in the variable and I needed the VPN to survive a WRT reboot. Not enough room for jffs on all but the mini distro... so no shell scripts for me! YMMV. Note to the powers that be: How about posting this stuff with the mini firmware so we don't have to do it this way?????

Create the openvpn config file

-Using your method of choice, copy the file /<dest_name>/etc/openvpn/office.conf
to your desktop machine -Using a *nix friendly text editor, edit office.conf (the config file in my setup).
See http://openvpn.net for more informations and examples.
##############################################################################
# this is a sample configuration file for openvpn
# it should be changed to contain your values and
# placed in /jffs/etc/openvpn
#
remote servername.domain.com
rport 5000
dev tap
ifconfig 10.0.1.2 255.255.255.252
secret /jffs/etc/openvpn/key.txt
ping 10
ping-restart 60
ping-timer-rem
persist-tun
persist-key
resolv-retry 86400
verb 1
mute 10
route-up "route add -net 192.168.1.0 netmask 255.255.255.0 gw 10.0.1.1"
#
##############################################################################

This is the OpenVPN config file of the other side (a Linux server or another WRT54G/GS)

##############################################################################
#
dev tap
secret /etc/openvpn/key.txt
persist-key
persist-tun
ifconfig 10.0.1.1 255.255.255.252
ping-restart 60
ping 10
verb 5
mute 10
lport 5000
route-up "route add -net 192.168.2.0/24 gw 10.0.1.2"
#
###############################################################################

Usage & Troubleshooting

Launching the Client

-cd to the install folder (/<dest_name>/usr/sbin)
-run ./openvpn --config ./../../etc/openvpn/office.conf --log openvpn.log

See openvpn.log for debugging

Load on router startup

-Using a *nix friendly text editor, create openvpn.startup as:

#!/bin/sh
killall -q openvpn
/jffs/usr/sbin/openvpn --config /jffs/etc/openvpn/office.conf

-Follow the instructions in Startup Scripts#Shell Script Method to make your script load on startup.

Troubleshooting

Correct time

OpenVPN requires client and server to have more or less synchronized time. Therefore make sure that router has correct time. To check it use command date and if you get info about year 1970, you should enable NTP client. Also, ntp server has to be outside of your VPN as time should be corrected before VPN is established. If you have syslog enabled (to local server, or the server outside your VPN), errors like TLS Error: Unroutable control packet received from server_ip:1194 may indicate this problem. (This error message may appear if your certificates are not valid or have expired, too.)