OpenVPN - Site-to-Site Bridged VPN Between Two Routers

From DD-WRT Wiki

Revision as of 07:15, 27 March 2007 by Placebo (Talk | contribs)
Jump to: navigation, search

The following details the procedure for establishing a site-to-site bridged VPN between two Linksys WRT54GL routers. Other routers should work just as easily, but other routers have not been tested by the author. To understand more about bridged VPNs, you can read Ethernet Bridging on www.openvpn.net.

Also, this document utilizes public key authentication rather than static key authentication. Static key authentication should work just as easily (possibly easier), but the author has not tried to establish a site-to-site VPN using static key authentication.

Contents

Procedure Summary

  1. Obtain a Linksys WRT54GL router
  2. Install the OpenVPN version of DD-WRT on both routers
  3. Generate the necessary keys for public key authentication
  4. Configure a router as the server
  5. Configure the other router as the client
  6. Test the VPN

Obtain a Linksys WRT54GL Router

The author has experienced flawless performance from the two Linksys WRT54GL routers he has used to establish a site-to-site VPN. Although other routers will likely work equally well, if you obtain Linksys WRT54GL routers to set up a site-to-site VPN, you can have a high level of confidence that you will be successful.

Install DD-WRT onto Your Routers

  1. Download the latest stable release of the OpenVPN version of DD-WRT from DD-WRT. At the time this was written, the file you need to download is dd-wrt.v23_vpn_generic.bin.
  2. For each router, follow the instructions for flashing the routers with the .bin file you downloaded. Both routers need to be flashed with the same file.

Generate Keys for Authentication

  1. Download OpenVPN from HERE onto the computer that you are going to use to communicate with the routers.
  2. Follow these instructions to install OpenVPN onto your computer.
  3. Follow these instructions to generate keys for authentication. (Note: when generating the client key, create only one key and name it client, rather than client1.)

Configure the Server Router

Basic Setup

  1. Log onto the first router, which will be our server router, using the GUI.
  2. Go to Setup > Basic Setup.
  3. Set the Local IP Address of the first router to 192.168.1.1 with a Subnet Mask of 255.255.255.0. (Of course, you are not required to use the network address 192.168.1.0. You can use any network address you like, but this tutorial will assume you are using this network.)
  4. Make sure DHCP server is enabled.
  5. Set the Start IP Address to 100.
  6. Set Maximum DHCP Users to 50.
  7. Set the Time Zone. (The time zone you select is not important to the success of this tutorial, but setting the same time zone on both routers is important.)
  8. Click Save Settings.

Startup Script

  1. Go to Administration > Commands
  2. Paste the following into the Command Shell box:
cd /tmp
openvpn --mktun --dev tap0
brctl addif br0 tap0
ifconfig tap0 0.0.0.0 promisc up

echo "
# Tunnel options
mode server       # Set OpenVPN major mode
proto udp         # Setup the protocol (server)
port 1194         # TCP/UDP port number
dev tap0          # TUN/TAP virtual network device
keepalive 15 60   # Simplify the expression of --ping 
daemon            # Become a daemon after all initialization
verb 3            # Set output verbosity to n 
comp-lzo          # Use fast LZO compression 

# OpenVPN server mode options
client-to-client  # tells OpenVPN to internally route client-to-client traffic 
duplicate-cn      # Allow multiple clients with the same common name

# TLS Mode Options
tls-server        # Enable TLS and assume server role during TLS handshake 
ca ca.crt         # Certificate authority (CA) file
dh dh1024.pem     # File containing Diffie Hellman parameters 
cert server.crt   # Local peer's signed certificate
key server.key    # Local peer's private key 
" > openvpn.conf

echo "
-----BEGIN CERTIFICATE-----
INSERT YOUR ca.crt HERE
-----END CERTIFICATE-----
" > ca.crt
echo "
-----BEGIN RSA PRIVATE KEY-----
INSERT YOUR server.key HERE
-----END RSA PRIVATE KEY-----
" > server.key
chmod 600 server.key
echo "
-----BEGIN CERTIFICATE-----
INSERT YOUR server.crt HERE
-----END CERTIFICATE-----
" > server.crt
echo "
-----BEGIN DH PARAMETERS-----
INSERT YOUR dh1024.pem HERE
-----END DH PARAMETERS-----
" > dh1024.pem

sleep 5
ln -s /usr/sbin/openvpn /tmp/myvpn
/tmp/myvpn --config openvpn.conf
  1. Replace the "INSERT YOUR [FILE] HERE" text with the appropriate text from the .crt or .key files you generated during the Generate Keys for Authentication step.
  2. Click Save Startup
  3. Paste the following into the Command Shell box:
/usr/sbin/iptables -I INPUT -p udp --dport 1194 -j ACCEPT
  1. Click Save Firewall
  2. Reboot the router

Configure the Client Router

Basic Setup

  1. Log onto the second router, which will be our client router, using the GUI.
  2. Go to Setup > Basic Setup.
  3. Set the Local IP Address of the second router to 192.168.1.254 with a Subnet Mask of 255.255.255.0. (Of course, if you used a different network address and subnet mask when setting up the server router, use that same address and mask for this router.)
  4. Make sure DHCP server is enabled.
  5. Set the Start IP Address to 100.
  6. Set Maximum DHCP Users to 50.
  7. Set the Time Zone to the same time zone you set on the first (server) router.
  8. Click Save Settings.

Startup Script

  1. Go to Administration > Commands
  2. Paste the following into the Command Shell box:
cd /tmp
ln -s /usr/sbin/openvpn /tmp/myvpn
./myvpn --mktun --dev tap0
brctl addif br0 tap0
ifconfig tap0 0.0.0.0 promisc up
sleep 5

echo "
client
dev tap0
proto udp
remote xxx.xxx.xxx.xxx 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
ns-cert-type server
comp-lzo
verb 3
" > /tmp/client.conf

echo "
-----BEGIN CERTIFICATE-----
INSERT YOUR ca.crt HERE
-----END CERTIFICATE-----
" > /tmp/ca.crt

echo "
-----BEGIN RSA PRIVATE KEY-----
INSERT YOUR client.key HERE
-----END RSA PRIVATE KEY-----
" > /tmp/client.key
chmod 600 /tmp/client.key

echo "
-----BEGIN CERTIFICATE-----
INSERT YOUR client.crt HERE
-----END CERTIFICATE-----
" > /tmp/client.crt

./myvpn --config client.conf
  1. Replace the "INSERT YOUR [FILE] HERE" text with the appropriate text from the .crt or .key files you generated during the Generate Keys for Authentication step.
  2. Replace the xxx.xxx.xxx.xxx text with the public IP address (or DNS name) of your first (server) router. (Note: if your Internet Service Provider gives your routers dynamic IP addresses (and they probably do), you might want to look into Dynamic DNS services such as DynDNS or No-IP.com. You can start to learn more about dynamic DNS by looking at the help from Setup > DDNS in the DD-WRT GUI.)
  3. Click Save Startup
  4. Reboot the router (i.e., In the GUI, click Administration > Management and click Reboot Router at the bottom)

Test the VPN

If all is well, and a VPN has been established between your two routers, you should be able to ping hosts behind either router.