OpenVPN
From DD-WRT Wiki
Contents |
Introduction
OpenVPN is a full-featured SSL VPN solution which can accomodate a wide range of configurations, including road warrior access, home/office/campus telecommuting, WiFi security, secure branch office linking, and enterprise-scale remote access solutions with load balancing, failover, and fine-grained access-controls.
There are two methods how to get OpenVPN on your router:
- install openvpn package to jffs partition;
- use firmware with OpenVPN client included (starting from 23b2 from 2005-11-21 there is separate firmware).
Installing into jffs partition
Prerequisites
You should already have: -a Linksys WRT54G/GS product -DD-WRT installed as the firmware -SCP or some other way to copy files to and from your desktop setup -some knowledge of using ipkg to install packages -jffs already configured if you don't want to install to ram
If you are running Windows on your desktop: -TextPad or Win32Pad
(or other *nix friendly text editor. DO NOT USE NOTEPAD)
Install the OpenVPN ipkg package
-Find the openvpn package in the THIS LINK DOES NOT WORK ANY MORE OpenWRT Package Tracker.
You will need the URI of package to install it.
-telnet or ssh shell into the router -run the command ipkg -d <dest_name> install <URI of package>
<dest_name> should be root to install to /jffs <dest_name> should be ram to install to /tmp *Remember, /tmp is deleted on router reboot* Ex: ipkg -d root install http://nthill.free.fr/openwrt/ipkg/experimental/20050420/openvpn-static_2.0-1_mipsel.ipk
Create the openvpn config file
-Using your method of choice, copy the file /<dest_name>/etc/openvpn/office.conf
to your desktop machine -Using a *nix friendly text editor, edit office.conf (the config file in my setup).
See http://openvpn.net for more informations and examples.
############################################################################## # this is a sample configuration file for openvpn # it should be changed to contain your values and # placed in /jffs/etc/openvpn # remote servername.domain.com rport 5000 dev tap ifconfig 10.0.1.2 255.255.255.252 secret /jffs/etc/openvpn/key.txt ping 10 ping-restart 60 ping-timer-rem persist-tun persist-key resolv-retry 86400 verb 1 mute 10 route-up "route add -net 192.168.1.0 netmask 255.255.255.0 gw 10.0.1.1" # ##############################################################################
This is the OpenVPN config file of the other side (a Linux server or another WRT54G/GS)
############################################################################## # dev tap secret /etc/openvpn/key.txt persist-key persist-tun ifconfig 10.0.1.1 255.255.255.252 ping-restart 60 ping 10 verb 5 mute 10 lport 5000 route-up "route add -net 192.168.2.0/24 gw 10.0.1.2" # ###############################################################################
Usage & Troubleshooting
Launching the Client
-cd to the install folder (/<dest_name>/usr/sbin) -run ./openvpn --config ./../../etc/openvpn/office.conf --log openvpn.log
See openvpn.log for debugging
Load on router startup
-Using a *nix friendly text editor, create openvpn.startup as:
#!/bin/sh killall -q openvpn /jffs/usr/sbin/openvpn --config /jffs/etc/openvpn/office.conf
-Follow the instructions in Startup Scripts#Shell Script Method to make your script load on startup.
Using VPN firmware
Web interface of this firmware supports operation as a client to single server only. But using custom initialization commands it may be possible to add connections to more servers or even run a server on this router.
Enabling
OpenVPN client can be enabled via web menu at Administration/Services/OpenVPN Client. Choose "enable" and "Save Settings", then fill in parameters and press "Save Setting" again. Parameters:
- Server IP address
- IP address of the OpenVPN server you want to work with
- Port
- port which OpenVPN server listens on
- Use LZO Compression
- where to use or not compression on vpn traffic; must be the same value as on server
- Tunnel protocol
- what transport to use to transfer VPN traffic; default is udp, but if routers/nat devices causes problems, choose tcp; must be the same as on server
- Public Server Cert
- Certificate of OpenVPN CA in pem form; only part between (and including) -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- is necessary; as it is stored in nvram, everything else from that file should be removed to conserve space
- Public Client Cert
- Client certificate issued by CA for this particular router; also only part between 'BEGIN' and 'END' is required
- Private Client Key
- Key associated with certificate above; should be kept secret because anybody who knows this key can successfully authenticate as this client
=====
Troubleshooting
Correct time
OpenVPN requires client and server to have more or less synchronized time. Therefor make sure that router has correct time. To check it use command date and if you get info about year 1970, you should enable NTP client. Also, ntp server has to be outside of your VPN as time should be corrected before VPN is established. If you have syslog enabled (to local server, or the server outside your VPN), errors like TLS Error: Unroutable control packet received from server_ip:1194 may indicate this problem.
You are here: Main Page/DD-WRT Docu (EN)/OpenVPN