OpenVPN

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 17:42, 30 September 2006 (edit)
Ripper42 (Talk | contribs)
(Add note about startup script not running after openvpn startup.)
← Previous diff
Revision as of 04:04, 9 October 2006 (edit) (undo)
Whiteboy (Talk | contribs)

Next diff →
Line 1: Line 1:
-==Introduction== 
- 
- 
- 
OpenVPN is a full-featured SSL VPN solution which can accomodate a wide range of configurations, including road warrior access, home/office/campus telecommuting, WiFi security, secure branch office linking, and enterprise-scale remote access solutions with load balancing, failover, and fine-grained access-controls. OpenVPN is a full-featured SSL VPN solution which can accomodate a wide range of configurations, including road warrior access, home/office/campus telecommuting, WiFi security, secure branch office linking, and enterprise-scale remote access solutions with load balancing, failover, and fine-grained access-controls.
Line 11: Line 7:
Before you begin, you'll need to obtain the [http://www.openvpn.se OpenVPN client (with the GUI)] for your client computer (if you don't already have it). Before you begin, you'll need to obtain the [http://www.openvpn.se OpenVPN client (with the GUI)] for your client computer (if you don't already have it).
-== Enabling VPN ==+=Enabling VPN=
- +==Client Mode==
-=== Client Mode===+
- +
# Using the [[Web_Interface|Web Interface]], go to the "Administration" tab and the "Services" sub-tab. # Using the [[Web_Interface|Web Interface]], go to the "Administration" tab and the "Services" sub-tab.
# Enable the "Open VPN Client" If new options do not appear, Apply Settings. # Enable the "Open VPN Client" If new options do not appear, Apply Settings.
Line 20: Line 14:
# Apply Settings # Apply Settings
-==== Client Mode Parameters ====+===Client Mode Parameters===
- +
;Server IP address: IP address of the OpenVPN server you want to work with ;Server IP address: IP address of the OpenVPN server you want to work with
;Port: port which OpenVPN server listens on ;Port: port which OpenVPN server listens on
Line 30: Line 23:
;Private Client Key: Key associated with certificate above; should be kept secret because anybody who knows this key can successfully authenticate as this client ;Private Client Key: Key associated with certificate above; should be kept secret because anybody who knows this key can successfully authenticate as this client
-==== Custom Parameters ====+===Parameters===
- +
If you want set custom parameters (e.g. encryption settings, verbosity, ...) for OpenVPN, you'll have to re-create the <tt>/tmp/openvpn/openvpn.conf</tt> file and restart OpenVPN. If you want set custom parameters (e.g. encryption settings, verbosity, ...) for OpenVPN, you'll have to re-create the <tt>/tmp/openvpn/openvpn.conf</tt> file and restart OpenVPN.
Line 63: Line 55:
Next, click the ''Save Startup'', et voila, it should now start openvpn using your custom configuration. Next, click the ''Save Startup'', et voila, it should now start openvpn using your custom configuration.
----+''Note:'' In "v23 SP2 (09/13/06) vpn" I've found that the openvpn startup script can run after the above during startup, so I work around that by doing the echo to "/tmp/openvpn/myopenvpn.conf" and replacing the killall/openvpn commands with:
- +
-NOTE: In "v23 SP2 (09/13/06) vpn" I've found that the openvpn startup script can run after the above during startup, so I work around that by doing the echo to "/tmp/openvpn/myopenvpn.conf" and replacing the killall/openvpn commands with:+
( sleep 20 ; killall openvpn ; openvpn --config /tmp/openvpn/myopenvpn.conf --route-up /tmp/openvpn/route-up.sh --down /tmp/openvpn/route-down.sh --daemon ) & ( sleep 20 ; killall openvpn ; openvpn --config /tmp/openvpn/myopenvpn.conf --route-up /tmp/openvpn/route-up.sh --down /tmp/openvpn/route-down.sh --daemon ) &
Line 73: Line 63:
--[[User:Ripper42|Ripper42]] 19:42, 30 Sep 2006 (CEST) --[[User:Ripper42|Ripper42]] 19:42, 30 Sep 2006 (CEST)
----+==Server mode with Static Key==
-=== Server mode with Static Key ===+''Note:'' with ''DD-WRT v23 SP1 Final (05/16/06) vpn'' this allows only 1 client connection!! [http://forum.bsr-clan.de/ftopic5111-0-asc-45.html]. SEe below for multiple connections.
- +
-'''NOTE:''' with ''DD-WRT v23 SP1 Final (05/16/06) vpn'' this allows only 1 client connection!! [http://forum.bsr-clan.de/ftopic5111-0-asc-45.html]. SEe below for multiple connections.+
- +
-==== Bridging ====+
 +==Bridging==
# Create a static.key file on your computer # Create a static.key file on your computer
Line 158: Line 145:
If everything is working correctly you should receive an IP address from your router (if you have a running dhcp server) when you connect and that IP address will be in your internal LAN so now you just connect to your home PC the same way you would do it from inside your LAN. If everything is working correctly you should receive an IP address from your router (if you have a running dhcp server) when you connect and that IP address will be in your internal LAN so now you just connect to your home PC the same way you would do it from inside your LAN.
-=== Server mode with Certificates ===+==Server mode with Certificates==
This describes howto enable openvpn server mode with the use of certificates, for better security than with static key, it also allows multiple client connections... This describes howto enable openvpn server mode with the use of certificates, for better security than with static key, it also allows multiple client connections...
Line 165: Line 152:
'''*** Please NOTE ***''' '''*** Please NOTE ***'''
There was a period of time (mid June - August 2006) during which the brctl command was either broken or missing, which made it impossible to configure openVPN for certificates. Use one of the newer SP2 builds in the [http://www.dd-wrt.com/dd-wrtv2/downloads/untested_alpha_unstable/dd-wrt.v23+SP2 downloads] section. --jstrauss 3 Sept 2006 There was a period of time (mid June - August 2006) during which the brctl command was either broken or missing, which made it impossible to configure openVPN for certificates. Use one of the newer SP2 builds in the [http://www.dd-wrt.com/dd-wrtv2/downloads/untested_alpha_unstable/dd-wrt.v23+SP2 downloads] section. --jstrauss 3 Sept 2006
- 
''The following directions were tested on dd-wrt.v23_vpn_wrt54g.bin build 30-08-06 --jstrauss 3 Sept 2006''<br> ''The following directions were tested on dd-wrt.v23_vpn_wrt54g.bin build 30-08-06 --jstrauss 3 Sept 2006''<br>
''also tested on dd-wrt v.23 SP2 FINAL --[[User:Krikkit|Krikkit]] 16:27, 20 Sep 2006 (CEST) ''also tested on dd-wrt v.23 SP2 FINAL --[[User:Krikkit|Krikkit]] 16:27, 20 Sep 2006 (CEST)
- 
- 
Basically this is what you need to do: Basically this is what you need to do:
Line 277: Line 261:
If everything is ok you should get an IP address from your router (if your router is running a dhcp server) when you connect and that IP address will be in your internal LAN so now you just connect to your home PC the same way you would do it from inside your LAN. If everything is ok you should get an IP address from your router (if your router is running a dhcp server) when you connect and that IP address will be in your internal LAN so now you just connect to your home PC the same way you would do it from inside your LAN.
- 
--ADDITIONAL NOTES FOR IMPROVED JFFS INSTALLATION, AND SECURITY WITH PUBLIC HOTSPOTS-- --ADDITIONAL NOTES FOR IMPROVED JFFS INSTALLATION, AND SECURITY WITH PUBLIC HOTSPOTS--
Line 355: Line 338:
19:10, 30 Jun 2006 (CEST) 19:10, 30 Jun 2006 (CEST)
----- 
76472429234521330421186 76472429234521330421186
Line 365: Line 347:
===Prerequisites=== ===Prerequisites===
- 
''You should already have:'' ''You should already have:''
-a Linksys WRT54G/GS product -a Linksys WRT54G/GS product
Line 376: Line 357:
====Install the OpenVPN ipkg package==== ====Install the OpenVPN ipkg package====
- 
-Find the '''openvpn''' package in the THIS LINK DOES NOT WORK ANY MORE [http://tracker.openwrt.org/ OpenWRT Package Tracker].<br> You will need the URI of package to install it.<br> -Find the '''openvpn''' package in the THIS LINK DOES NOT WORK ANY MORE [http://tracker.openwrt.org/ OpenWRT Package Tracker].<br> You will need the URI of package to install it.<br>
-telnet or ssh shell into the router -telnet or ssh shell into the router
Line 441: Line 421:
===Usage & Troubleshooting=== ===Usage & Troubleshooting===
- 
====Launching the Client==== ====Launching the Client====
-cd to the install folder (/<dest_name>/usr/sbin) -cd to the install folder (/<dest_name>/usr/sbin)
Line 448: Line 427:
See openvpn.log for debugging See openvpn.log for debugging
-===Load on router startup===+===Load on Router Startup===
-Using a *nix friendly text editor, create openvpn.startup as: -Using a *nix friendly text editor, create openvpn.startup as:
<pre> <pre>
Line 479: Line 458:
19:13, 30 Jun 2006 (CEST) [http://www.dd-wrt.com/phpBB2/profile.php?mode=viewprofile&u=810 pagedude] 19:13, 30 Jun 2006 (CEST) [http://www.dd-wrt.com/phpBB2/profile.php?mode=viewprofile&u=810 pagedude]
 +[[Category:English documentation]]
[[Category:advanced HOWTO]] [[Category:advanced HOWTO]]
- 
-[[Category:English documentation]] 

Revision as of 04:04, 9 October 2006

OpenVPN is a full-featured SSL VPN solution which can accomodate a wide range of configurations, including road warrior access, home/office/campus telecommuting, WiFi security, secure branch office linking, and enterprise-scale remote access solutions with load balancing, failover, and fine-grained access-controls.

There are two methods how to get OpenVPN on your router:

  • use firmware with OpenVPN client included (starting from 23b2 from 2005-11-21 there is separate firmware). (easy method)
  • install openvpn package to jffs partition

Before you begin, you'll need to obtain the OpenVPN client (with the GUI) for your client computer (if you don't already have it).

Contents

Enabling VPN

Client Mode

  1. Using the Web Interface, go to the "Administration" tab and the "Services" sub-tab.
  2. Enable the "Open VPN Client" If new options do not appear, Apply Settings.
  3. Fill in parameters (see below)
  4. Apply Settings

Client Mode Parameters

Server IP address
IP address of the OpenVPN server you want to work with
Port
port which OpenVPN server listens on
Use LZO Compression
where to use or not compression on vpn traffic; must be the same value as on server
Tunnel protocol
what transport to use to transfer VPN traffic; default is udp, but if routers/nat devices causes problems, choose tcp; must be the same as on server
Public Server Cert
Certificate of OpenVPN CA in pem form; only part between (and including) -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- is necessary; as it is stored in nvram, everything else from that file should be removed to conserve space
Public Client Cert
Client certificate issued by CA for this particular router; also only part between 'BEGIN' and 'END' is required
Private Client Key
Key associated with certificate above; should be kept secret because anybody who knows this key can successfully authenticate as this client

Parameters

If you want set custom parameters (e.g. encryption settings, verbosity, ...) for OpenVPN, you'll have to re-create the /tmp/openvpn/openvpn.conf file and restart OpenVPN.

For more detailed information on Startup Commands, please read the Startup Scripts wiki entry.

To do this, use the Web Interface, go to the "Administration" tab and the "Commands" sub-tab.

In the box, enter the configuration how you'd want it, and echo it into /tmp/openvpn/openvpn.conf.

Example (add this in the edit box at the top):

echo "dev tap
link-mtu 1492
remote <remote-ip>
resolv-retry infinite

ifconfig <local ip> <local netmask>
client
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/client.crt
key /tmp/openvpn/client.key
comp-lzo
persist-tun
persist-key
verb 3
cipher AES-256-CBC" > /tmp/openvpn/openvpn.conf

killall openvpn
openvpn --config /tmp/openvpn/openvpn.conf

Next, click the Save Startup, et voila, it should now start openvpn using your custom configuration.

Note: In "v23 SP2 (09/13/06) vpn" I've found that the openvpn startup script can run after the above during startup, so I work around that by doing the echo to "/tmp/openvpn/myopenvpn.conf" and replacing the killall/openvpn commands with:

( sleep 20 ; killall openvpn ; openvpn --config /tmp/openvpn/myopenvpn.conf --route-up /tmp/openvpn/route-up.sh --down /tmp/openvpn/route-down.sh --daemon ) &

You may need to tune the amount of sleep time. Use "ps" to verify that the "openvpn" process you want to be running is running.

--Ripper42 19:42, 30 Sep 2006 (CEST)

Server mode with Static Key

Note: with DD-WRT v23 SP1 Final (05/16/06) vpn this allows only 1 client connection!! [1]. SEe below for multiple connections.

Bridging

  1. Create a static.key file on your computer

Linux:

   openvpn --genkey --secret static.key

Windows:

   Start > OpenVPN -> Generate a static OpenVPN key
   (Note: this might create a key.txt file, you will want to rename it to static.key)
   (Note2: It should show up in the OpenVPN\config folder)
   (Note3: OpenVPN for windows can be downloaded at http://www.openvpn.se)
  • Paste the below command into Administration > Commands > Commands text box and click "Save firewall" (replacing the "443" with the port you are going to use):
   iptables -I INPUT 1 -p tcp --dport 443 -j ACCEPT
   Notes/References: pagedude's Post regarding the rc_firewall command
   For More Information on startup scripts see Startup_Scripts
  • Enter the below code in the commands field changing the "...INSERT YOUR OWN CONTENT HERE..." with the contents from the file you created on step and Click "Save Startup"
   openvpn --mktun --dev tap0
   brctl addif br0 tap0
   ifconfig tap0 0.0.0.0 promisc up
   echo "
   -----BEGIN OpenVPN Static key V1-----
   ...INSERT YOUR OWN CONTENT HERE...
   -----END OpenVPN Static key V1-----
   " > /tmp/static.key
   ln -s /usr/sbin/openvpn /tmp/myvpn
   /tmp/myvpn --dev tap0 --secret /tmp/static.key --comp-lzo --port 443 --proto tcp-server --verb 3 --daemon
  • Reboot your router. Login with ssh and check that "myvpn" is running (ps | grep vpn)
    • You can also paste the "ps | grep vpn" command into the Administration > Commands box to see if it is running
  • Create an openvpn config file on your client computer using one of the following templates:
   # Use the following for simple connections:
   remote XXXX.dyndns.org
   port 443
   dev tap
   secret static.key
   proto tcp-client
   comp-lzo
   # Use the following to have your client computer send all traffic through your router
   # (remote gateway)
   remote XXXX.dyndns.org
   port 443
   dev tap
   secret static.key
   proto tcp-client
   comp-lzo
   route-gateway 192.168.1.1
   redirect-gateway
   # Use the following if you have an office proxy:
   remote XXXX.dyndns.org
   http-proxy-retry
   http-proxy my.office.proxy.server 8080
   port 443
   dev tap
   secret static.key
   proto tcp-client
   comp-lzo
   route-gateway 192.168.1.1
   redirect-gateway
   Be sure to replace the above port with the port you are using.
   Save it as a .ovpn file in the OpenVPN\config folder on your client computer
   Reference: fgimenez's post
  • try to connect
    • Windows: right clickthe open vpn icon in your system tray and click connect


That should do it. This has been tested on DD-WRT v23 SP1 Final vpn.

If everything is working correctly you should receive an IP address from your router (if you have a running dhcp server) when you connect and that IP address will be in your internal LAN so now you just connect to your home PC the same way you would do it from inside your LAN.

Server mode with Certificates

This describes howto enable openvpn server mode with the use of certificates, for better security than with static key, it also allows multiple client connections... we use bridging to integrate the clients into the local lan, so we need no routes...

*** Please NOTE *** There was a period of time (mid June - August 2006) during which the brctl command was either broken or missing, which made it impossible to configure openVPN for certificates. Use one of the newer SP2 builds in the downloads section. --jstrauss 3 Sept 2006


The following directions were tested on dd-wrt.v23_vpn_wrt54g.bin build 30-08-06 --jstrauss 3 Sept 2006
also tested on dd-wrt v.23 SP2 FINAL --Krikkit 16:27, 20 Sep 2006 (CEST)

Basically this is what you need to do:

1) Create all the required certificates and keys. You should create a set of keys for each individual client that will connect to your OpenVPN server. Basically you follow this guide: http://openvpn.net/howto.html#pki

afterwards you should have the following files:

ca.crt
ca.key
dh{n}.pem
server.crt
server.key
client1.crt
client1.key
client2.crt
client2.key

2) Use the web method to create the rc_startup & rc_firewall scripts defined below.

3) Create a rc_startup script:

cd /tmp
openvpn --mktun --dev tap0
brctl addif br0 tap0
ifconfig tap0 0.0.0.0 promisc up

echo "
# Tunnel options
mode server       # Set OpenVPN major mode
proto tcp-server  # Setup the protocol (server)
port 1194         # TCP/UDP port number
dev tap0          # TUN/TAP virtual network device
keepalive 15 60   # Simplify the expression of --ping 
daemon            # Become a daemon after all initialization
verb 3            # Set output verbosity to n 
comp-lzo          # Use fast LZO compression 

# OpenVPN server mode options
client-to-client  # tells OpenVPN to internally route client-to-client traffic 
duplicate-cn      # Allow multiple clients with the same common name

# TLS Mode Options
tls-server        # Enable TLS and assume server role during TLS handshake 
ca ca.crt         # Certificate authority (CA) file
dh dh1024.pem     # File containing Diffie Hellman parameters 
cert server.crt   # Local peer's signed certificate
key server.key    # Local peer's private key 
" > openvpn.conf

echo "
-----BEGIN CERTIFICATE-----
...INSERT YOUR OWN CONTENT HERE...
-----END CERTIFICATE-----
" > ca.crt
echo "
-----BEGIN RSA PRIVATE KEY-----
...INSERT YOUR OWN CONTENT HERE...
-----END RSA PRIVATE KEY-----
" > server.key
chmod 600 server.key
echo "
-----BEGIN CERTIFICATE-----
...INSERT YOUR OWN CONTENT HERE...
-----END CERTIFICATE-----
" > server.crt
echo "
-----BEGIN DH PARAMETERS-----
...INSERT YOUR OWN CONTENT HERE...
-----END DH PARAMETERS-----
" > dh1024.pem

sleep 5
openvpn --config openvpn.conf

4) Add the following to your rc_firewall script:

/usr/sbin/iptables -I INPUT -p tcp --dport 1194 -j ACCEPT

this allows connections from the outside to the openvpn server

5) Change the "...INSERT YOUR OWN CONTENT HERE..." with the content from the files you created in step 1

6) reboot your router. Login with ssh/telnet and check that "openvpn --config openvpn.conf" process is running (ps | grep openvpn)

7) Create an openvpn config file on your client-computer with the content from below. You need to replace the "XXXX.dyndns.org" with your router's internet address (or a dynamic dns hostname pointing to that address). Code:

tls-client
dev tap
proto tcp-client
remote XXXX.dyndns.org 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client1.crt
key client1.key
ns-cert-type server
comp-lzo
verb 3

8) try to connect

That should do it.

If everything is ok you should get an IP address from your router (if your router is running a dhcp server) when you connect and that IP address will be in your internal LAN so now you just connect to your home PC the same way you would do it from inside your LAN.

--ADDITIONAL NOTES FOR IMPROVED JFFS INSTALLATION, AND SECURITY WITH PUBLIC HOTSPOTS--

19:10, 30 Jun 2006 (CEST) pagedude

i) The instructions above confine the OpenVPN server configuration entirely into a rc_startup script. This is elegant when openvpn is installed in RAM, since there's no convenient place to put a configuration file for openvpn (RAM contents are not persistent). However, if the user instead installs openvpn into persistent storage (e.g. the jffs partition), then instead of configuring OpenVPN on the command-line, a config file can be used. There are several advantages to doing this; not only is RAM space usage minimized (key files dont need to be copied to rc_startup, command line options get transferred to the config file etc.), but the config file allows the description of more complicated openvpn server configurations .. e.g. ii) below ...

ii) One interesting capability of the openvpn tunnel is to optionally allow the client to pass *all* traffic through the VPN when connected. (E.g. when you are at an unsecure WIFI hotspot, you might want to ensure that eavesdroppers are not able to monitor your wifi traffic; one way to do this is to ensure all your wifi traffic flows through the encrypted VPN tunnel). This is achievable via the "redirect-gateway" option, definable on either the server or client. When defined on the server, all clients *always* reroute all their traffic through the VPN. When defined on just the client, clients have the choice to act either way. However, "redirect-gateway" requires the "pushing" of two pieces of information from the server to the client, viz. the remote gateway and DNS IP's. My example config file below in iii) shows how to do this ...

iii) Here are my example rc_startup, server and client config files. Note that I installed openvpn in /jffs/tmp, and copied the certificate/key files ca.crt, server.crt, server.key, dh1024.pem and the server config file server.conf there.

rc_startup:

cd /jffs/tmp
./openvpn --mktun --dev tap0
brctl addif br0 tap0
ifconfig tap0 0.0.0.0 promisc up
sleep 5

;I had to install this library, since my ddwrt distro didnt have it
;See Troubleshooting section at the bottom of this wiki for JFFS installations
export LD_PRELOAD=/jffs/sbin/libuClibc-0.9.28.so

./openvpn --config server.conf --daemon

server.conf:

mode server
tls-server
port 44044
proto tcp-server
dev tap0

ca ca.crt
cert server.crt
key server.key
dh dh1024.pem

#These IP addresses need to be changed to be *your* ddwrt LAN addresses ...
push "route-gateway 192.168.3.1"
push "dhcp-option DNS 192.168.3.1"

client-to-client

keepalive 15 60

comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

client.conf:

tls-client
dev tap
proto tcp-client
resolv-retry infinite
nobind
persist-key
persist-tun

ca ca.crt
cert client.crt
key client.key
ns-cert-type server

comp-lzo
verb 3

#Pull info from server, viz. server-side LAN IP's for gateway and DNS
pull
# Uncomment the following to send all traffic through VPN
redirect-gateway

19:10, 30 Jun 2006 (CEST)

76472429234521330421186

Installing into jffs partition

old method only recommended for non-vpn firmware

This no longer works with the latest firmware version, please download the new VPN inclusive version. !!However, with at least some new firmware versions (I'm using V23SP1 6/5/06 VOIP), the hurdle can be overcome with some extra effort ... details are provided below in the Troubleshooting section... 19:22, 30 Jun 2006 (CEST)!!

Prerequisites

You should already have:
-a Linksys WRT54G/GS product
-DD-WRT installed as the firmware
-SCP or some other way to copy files to and from your desktop setup
-some knowledge of using ipkg to install packages
-jffs already configured if you don't want to install to ram
If you are running Windows on your desktop: -TextPad or Win32Pad
(or other *nix friendly text editor. DO NOT USE NOTEPAD)

Install the OpenVPN ipkg package

-Find the openvpn package in the THIS LINK DOES NOT WORK ANY MORE OpenWRT Package Tracker.
You will need the URI of package to install it.
-telnet or ssh shell into the router -run the command ipkg -d <dest_name> install <URI of package>
<dest_name> should be root to install to /jffs <dest_name> should be ram to install to /tmp *Remember, /tmp is deleted on router reboot* Ex: ipkg -d root install http://nthill.free.fr/openwrt/ipkg/experimental/20050420/openvpn-static_2.0-1_mipsel.ipk

EDIT: Can't find the right package? Yeah, neither can anyone else. Don't bother. The best strategy is to download and flash the distro with the built-in VPN and copy the binary off of that then re-flash with another distro and copy the binary to the jffs partition. The packages on the openWRT tracker don't seem to work for v23 on WRT54Gv3 ("Bus Error"). The version originally linked above and the version in the VPN firmware are statically compiled. I had to do it this way because the nvram startup script only ran the first command in the variable and I needed the VPN to survive a WRT reboot. Not enough room for jffs on all but the mini distro... so no shell scripts for me! YMMV. Note to the powers that be: How about posting this stuff with the mini firmware so we don't have to do it this way?????

Create the openvpn config file

-Using your method of choice, copy the file /<dest_name>/etc/openvpn/office.conf
to your desktop machine -Using a *nix friendly text editor, edit office.conf (the config file in my setup).
See http://openvpn.net for more informations and examples.

19:16, 30 Jun 2006 (CEST) pagedude

- NOTE : openvpn is highly configurable. Distinct from the original writer of this portion of the wiki, I setup my configuration files much more along the lines of the earlier section in this Wiki on configuring the OpenVPN server with certificates in bridging mode. Certificates provide a more robust dynamic configuration scheme, but take a little bit more time up-front to generate (but the http://www.openvpn.net site has an excellent, easy-to-follow guide on how to generate them). Bridging mode is very convenient in that the remote VPN client effectively appears to be part of the remote(server) LAN, plus much less routing configuration (i.e. use of ifconfig, route etc.) is required on either the OpenVPN server or the OpenVPN client.

19:16, 30 Jun 2006 (CEST) pagedude

##############################################################################
# this is a sample configuration file for openvpn
# it should be changed to contain your values and
# placed in /jffs/etc/openvpn
#
remote servername.domain.com
rport 5000
dev tap
ifconfig 10.0.1.2 255.255.255.252
secret /jffs/etc/openvpn/key.txt
ping 10
ping-restart 60
ping-timer-rem
persist-tun
persist-key
resolv-retry 86400
verb 1
mute 10
route-up "route add -net 192.168.1.0 netmask 255.255.255.0 gw 10.0.1.1"
#
##############################################################################

This is the OpenVPN config file of the other side (a Linux server or another WRT54G/GS)

##############################################################################
#
dev tap
secret /etc/openvpn/key.txt
persist-key
persist-tun
ifconfig 10.0.1.1 255.255.255.252
ping-restart 60
ping 10
verb 5
mute 10
lport 5000
route-up "route add -net 192.168.2.0/24 gw 10.0.1.2"
#
###############################################################################

Usage & Troubleshooting

Launching the Client

-cd to the install folder (/<dest_name>/usr/sbin)
-run ./openvpn --config ./../../etc/openvpn/office.conf --log openvpn.log

See openvpn.log for debugging

Load on Router Startup

-Using a *nix friendly text editor, create openvpn.startup as:

#!/bin/sh
killall -q openvpn
/jffs/usr/sbin/openvpn --config /jffs/etc/openvpn/office.conf

-Follow the instructions in Startup Scripts#Shell Script Method to make your script load on startup.

Troubleshooting

Correct time

OpenVPN requires client and server to have more or less synchronized time. Therefore make sure that router has correct time. To check it use command date and if you get info about year 1970, you should enable NTP client. Also, ntp server has to be outside of your VPN as time should be corrected before VPN is established. If you have syslog enabled (to local server, or the server outside your VPN), errors like TLS Error: Unroutable control packet received from server_ip:1194 may indicate this problem. (This error message may appear if your certificates are not valid or have expired, too.)

openvpn does not start, gives error message " ... can't resolve symbol 'fopen64' "

19:13, 30 Jun 2006 (CEST) pagedude

I have V23SP1 5/6/06 VOIP, extracted the openvpn executable from V23SP1 5/6/06 VPN and copied it to my jffs partition as outlined above, and set everything up as outlined above, except that I setup my own configuration files, of course. Then I got the above error message. The reason for this error message is that the openvpn executable requires an updated version of the libuClibc library. For my build, this should be libuClibc-0.9.28.so. Fortunately the package for this library can be located on the dd-wrt downloads page. Look for the "packages" folder at http://www.dd-wrt.com/dd-wrtv2/downloads.php, and retrieve the package named uclibc_0.9.28-6_mipsel.ipk. Install this package on the jffs partition - refer to the ipkg documentation for details. After installation, note down the exact path for libuClibc-0.9.28.so .. e.g. I installed mine at /jffs/sbin/liuClibc-0.9.8.so. Now you need to ensure that when openvpn is launched as a daemon, the executing environment has the variable LD_PRELOAD set to point to the path to this library. In simpler language, what you need to do is insert the following line:

export LD_PRELOAD=<replace_this_whole_angle_bracketed_region_with_your_full_path_to_library>

at the start of the script that launches the openvpn server. openvpn will then use this library, instead of the older one that exists in the non-vpn OpenVPN distributions.

19:13, 30 Jun 2006 (CEST) pagedude