Softether on R7000

From DD-WRT Wiki

Revision as of 12:17, 26 February 2014 by Magick777 (Talk | contribs)
(diff) ←Older revision | Current revision (diff) | Newer revision→ (diff)
Jump to: navigation, search

BIG WARNING: THIS IS UTTERLY ALPHA, TESTING OUTPUT, NOT A SET OF INSTALL INSTRUCTIONS.

Contents

[edit] Install notes

Available in magick's devel repo. The four available packages (server, client, bridge, cmd) all contain the same file hamcore.se2 which causes opkg conflicts if you wish to install two of them, e.g. server and cmd. Overrule this with the --force-overwrite switch to opkg. For most situations, you probably only require the server or the bridge on the router.

[edit] Runtime notes

Prefix your commandline with LD_LIBRARY_PATH=/opt/usr/lib in order to find the libraries it was compiled with; so for instance

LD_LIBRARY_PATH=/opt/usr/lib vpnserver start

should start the SoftEther VPN server. That will open up a whole ton of ports before you've made any configuration settings whatsoever. Was this developed by a Windows user?

[edit] Warnings

[edit] CPU scheduling priority

By default, SoftEther VPN server sets itself a CPU scheduling priority of -20 (above normal), meaning it takes precedence over almost everything else for CPU time. Running with "nice -n10 vpnserver start" doesn't fix it either so the setting must be buried somewhere in the SoftEther startup. My solution was to "renice 10 `pgrep vpnserver`" after the startup; to do that, you'll need the "procps-pgrep" package, and if you want to see you process priorities and nice levels in numerical form, install "procps-top" as well. The former will just work; the latter must be run with full path, else you'll get busybox top instead.

The priority that you choose is arbitrary, between 0 and 20, but it should be greater (i.e. a lower priority) than zero, the priority at which most things on DD-WRT will be running, yet lesser than the priority of anything less important than the VPN (e.g. tor, transmission). The idea is that e.g. Privoxy should take precedence over VPN use, but that should take priority over Tor, which should itself take priority over e.g. bittorrent.

[edit] Open ports

By default, SoftEther VPN server automatically opens up (prior to any configuration) the following ports/protocols:

tcp        0      0 0.0.0.0:992             0.0.0.0:*               LISTEN      23632/vpnserver     
tcp        0      0 0.0.0.0:1194            0.0.0.0:*               LISTEN      23632/vpnserver     
tcp        0      0 0.0.0.0:5555            0.0.0.0:*               LISTEN      23632/vpnserver     
tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      23632/vpnserver     
tcp        0      0 :::992                  :::*                    LISTEN      23632/vpnserver     
tcp        0      0 :::1194                 :::*                    LISTEN      23632/vpnserver     
tcp        0      0 :::5555                 :::*                    LISTEN      23632/vpnserver     
tcp        0      0 :::443                  :::*                    LISTEN      23632/vpnserver     
udp        0      0 127.0.0.1:4500          0.0.0.0:*                           23632/vpnserver     
udp        0      0 192.168.182.1:4500      0.0.0.0:*                           23632/vpnserver     
udp        0      0 192.168.1.1:4500        0.0.0.0:*                           23632/vpnserver     
udp        0      0 169.254.255.1:4500      0.0.0.0:*                           23632/vpnserver     
udp        0      0 82.35.162.79:4500       0.0.0.0:*                           23632/vpnserver     
udp        0      0 10.0.0.1:4500           0.0.0.0:*                           23632/vpnserver     
udp        0      0 127.0.0.1:1194          0.0.0.0:*                           23632/vpnserver     
udp        0      0 192.168.182.1:1194      0.0.0.0:*                           23632/vpnserver     
udp        0      0 192.168.1.1:1194        0.0.0.0:*                           23632/vpnserver     
udp        0      0 169.254.255.1:1194      0.0.0.0:*                           23632/vpnserver     
udp        0      0 82.35.162.79:1194       0.0.0.0:*                           23632/vpnserver     
udp        0      0 10.0.0.1:1194           0.0.0.0:*                           23632/vpnserver     
udp        0      0 0.0.0.0:50377           0.0.0.0:*                           23632/vpnserver     
udp        0      0 0.0.0.0:51174           0.0.0.0:*                           23632/vpnserver     
udp        0      0 127.0.0.1:500           0.0.0.0:*                           23632/vpnserver     
udp        0      0 192.168.182.1:500       0.0.0.0:*                           23632/vpnserver     
udp        0      0 192.168.1.1:500         0.0.0.0:*                           23632/vpnserver     
udp        0      0 169.254.255.1:500       0.0.0.0:*                           23632/vpnserver     
udp        0      0 82.35.162.79:500        0.0.0.0:*                           23632/vpnserver     
udp        0      0 10.0.0.1:500            0.0.0.0:*                           23632/vpnserver     
udp        0      0 0.0.0.0:46838           0.0.0.0:*                           23632/vpnserver     
udp        0      0 :::4500                 :::*                                23632/vpnserver     
udp        0      0 ::1:4500                :::*                                23632/vpnserver     
udp        0      0 fe80::dc2c:4fff:fe:4500 :::*                                23632/vpnserver     
udp        0      0 fe80::c604:15ff:fe:4500 :::*                                23632/vpnserver     
udp        0      0 fe80::c604:15ff:fe:4500 :::*                                23632/vpnserver     
udp        0      0 fe80::c604:15ff:fe:4500 :::*                                23632/vpnserver     
udp        0      0 fe80::c604:15ff:fe:4500 :::*                                23632/vpnserver     
udp        0      0 fe80::c404:15ff:fe:4500 :::*                                23632/vpnserver     
udp        0      0 :::1194                 :::*                                23632/vpnserver     
udp        0      0 ::1:1194                :::*                                23632/vpnserver     
udp        0      0 fe80::dc2c:4fff:fe:1194 :::*                                23632/vpnserver     
udp        0      0 fe80::c604:15ff:fe:1194 :::*                                23632/vpnserver     
udp        0      0 fe80::c604:15ff:fe:1194 :::*                                23632/vpnserver     
udp        0      0 fe80::c604:15ff:fe:1194 :::*                                23632/vpnserver     
udp        0      0 fe80::c604:15ff:fe:1194 :::*                                23632/vpnserver     
udp        0      0 fe80::c404:15ff:fe:1194 :::*                                23632/vpnserver     
udp        0      0 :::500                  :::*                                23632/vpnserver     
udp        0      0 ::1:500                 :::*                                23632/vpnserver     
udp        0      0 fe80::dc2c:4fff:fe8:500 :::*                                23632/vpnserver     
udp        0      0 fe80::c604:15ff:fe0:500 :::*                                23632/vpnserver     
udp        0      0 fe80::c604:15ff:fe0:500 :::*                                23632/vpnserver     
udp        0      0 fe80::c604:15ff:fe0:500 :::*                                23632/vpnserver     
udp        0      0 fe80::c604:15ff:fe0:500 :::*                                23632/vpnserver     
udp        0      0 fe80::c404:15ff:fe0:500 :::*                                23632/vpnserver     
raw        0      0 127.0.0.1:50            0.0.0.0:*               7           23632/vpnserver     
raw        0      0 192.168.182.1:50        0.0.0.0:*               7           23632/vpnserver     
raw        0      0 192.168.1.1:50          0.0.0.0:*               7           23632/vpnserver     
raw        0      0 169.254.255.1:50        0.0.0.0:*               7           23632/vpnserver     
raw        0      0 82.35.162.79:50         0.0.0.0:*               7           23632/vpnserver     
raw        0      0 10.0.0.1:50             0.0.0.0:*               7           23632/vpnserver     
raw        0      0 127.0.0.1:52            0.0.0.0:*               7           23632/vpnserver     
raw        0      0 192.168.182.1:52        0.0.0.0:*               7           23632/vpnserver     
raw        0      0 192.168.1.1:52          0.0.0.0:*               7           23632/vpnserver     
raw        0      0 169.254.255.1:52        0.0.0.0:*               7           23632/vpnserver     
raw        0      0 82.35.162.79:52         0.0.0.0:*               7           23632/vpnserver     
raw        0      0 10.0.0.1:52             0.0.0.0:*               7           23632/vpnserver     
raw        0      0 fe80::2ac:11ff:fecb::50 :::*                    7           23632/vpnserver     
raw        0      0 ::1:50                  :::*                    7           23632/vpnserver     
raw        0      0 fe80::dc2c:4fff:fe83:50 :::*                    7           23632/vpnserver     
raw        0      0 fe80::c604:15ff:fe03:50 :::*                    7           23632/vpnserver     
raw        0      0 fe80::c604:15ff:fe03:50 :::*                    7           23632/vpnserver     
raw        0      0 fe80::c604:15ff:fe03:50 :::*                    7           23632/vpnserver     
raw        0      0 fe80::c604:15ff:fe03:50 :::*                    7           23632/vpnserver     
raw        0      0 fe80::c404:15ff:fe03:50 :::*                    7           23632/vpnserver     
raw        0      0 fe80::2ac:11ff:fecb::52 :::*                    7           23632/vpnserver     
raw        0      0 ::1:52                  :::*                    7           23632/vpnserver     
raw        0      0 fe80::dc2c:4fff:fe83:52 :::*                    7           23632/vpnserver     
raw        0      0 fe80::c604:15ff:fe03:52 :::*                    7           23632/vpnserver     
raw        0      0 fe80::c604:15ff:fe03:52 :::*                    7           23632/vpnserver     
raw        0      0 fe80::c604:15ff:fe03:52 :::*                    7           23632/vpnserver     
raw        0      0 fe80::c604:15ff:fe03:52 :::*                    7           23632/vpnserver     
raw        0      0 fe80::c404:15ff:fe03:52 :::*                    7           23632/vpnserver

[edit] Port conflicts

On my system, it didn't get port 443 under IPv4 because it was claimed by lighttpd. If you intend to run SoftEther on port 443 and you run lighttpd, you'll have to change the HTTPS port used by lighttpd first. Obviously, running an OpenVPN server would also conflict with having SoftEther provide OpenVPN on the same port.

[edit] Cloud services

SoftEther offers a couple of optional services that rely on connecting to servers which are run by the developers of the software at the University of Tsukuba, Japan. One is a dynamic DNS service, the other is a cloud VPN service intended to allow a VPN server to run behind a firewall (using an outgoing HTTPS connection to their cloud). These services are legitimate, and benign in their intentions, but they carry performance and security implications.

[edit] Dynamic DNS

Allowing SoftEther to provide dynamic DNS means that there is a centralised list of IP addresses running SoftEther on a server in Japan. This probably won't assist in compromising anything, but, it is information that could in theory be seized / compromised / corrupted / intercepted; it creates a central point of potential vulnerability that is not otherwise there. In countries with heavily filtered Internet, network authorities could happily intercept the DNS replies and block any dynamic IPs returned by SoftEther.

Accordingly, it is suggested to disable this and make your own dynamic DNS arrangements; note that for SSL VPNs, your SSL certificate should match the hostname to which you intend to connect.

[edit] Cloud VPN

Using VPN Azure implies making a bridged connection from your VPN server to a cloud server at the University of Tsukuba and routing incoming connections through their cloud. This effectively means giving them (and anyone who can exert power over them) access to your entire network; the software authors might be perfectly trustworthy, but centralising your VPN access onto somebody else's cloud server doesn't sound wise; it opens up risks that would not otherwise be there.

For most DD-WRT users, it should be superfluous as we're typically running on the firewall rather than running behind one. It's only useful for putting VPN servers (not clients) behind firewalls that utterly forbid it, i.e. running a VPN server on your office PC. Besides the security risks, European users are a LONG way from their cloud server (in my case, 19 hops and 300ms via Paris, Kentucky, New York, Los Angeles and Tokyo) and can expect lousy performance by routing connections through Japan.

Accordingly, unless you have a use for it, consider disabling VPN Azure.

[edit] Configuration

[edit] Command line

I guess SoftEther expects to be configured after it's running, since it didn't require any configuration to startup. You can run

LD_LIBRARY_PATH=/opt/usr/lib vpncmd

and point it to localhost:443 to access the command-line configuration interface, but you'll be presented with 204 commands to choose from. This might be fine if you're an expert in SoftEther, but clearly it's more intended to be managed using their VPN server manager, a GUI interface that is (surprise, surprise) for Windows only.

Before you exit vpncmd, you might at least investigate ServerPasswordSet.

[edit] Remote GUI

Fine. Break out the ten-year-old WinXP laptop that you keep just for stupid software that isn't Linux-compatible, download the VPN Server Manager (or rather the whole Windows package... why have a separate option if it leads you to the same installer?). Thankfully, the installer will let you install just the admin tools, so do that.

Run the GUI, get an impressive array of options. Go through the setup wizard, hopefully creating a VPN server, a virtual hub and a user account. Do as thou wilt with dynamic dns, azure, etc. Sooner or later you'll end up at the main server manager screen, with most of the above configured.

OK... let's see if we can set up a simple bridged VPN, so our connections are bridged straight to the LAN, and VPN clients receive DHCP and DNS from DD-WRT in the usual way. We want the minimum of interference with DD-WRT's network interfaces, so go into Local Bridge Setting, delete any bridge you created during the setup wizard, and have it bridge to a new brctl addif br0 tap_1 virtual tap. This will create a new virtual network interface in DD-WRT for our bridged VPN clients. Let's assume we've called it '1' in the GUI, leading to device 'tap_1' on DD-WRT.

[edit] Configuration on DD-WRT

This interface won't natively be supported by the DD-WRT GUI for bridging purposes, but you can manually add the interface to the LAN bridge with

brctl addif br0 tap_1

and verify it with

brctl show br0

Now, in theory at least, you should be ready for testing. Clients that successfully connect to the given virtual hub should be bridged to tap_1 by SoftEther and then to the LAN by DD-WRT.

[edit] Basic testing

The first thing to test is that this actually works at all, i.e. that a client, no matter what type or protocol, can connect and use the VPN.

[edit] Windows XP

[edit] SoftEther VPN Client

My first testing was done using SoftEther's VPN client under Windows XP, connecting over BTWiFi. Mostly it worked; I was able to get a connection from outside the network, get an IP address, ping hosts within the LAN, make an SSH connection, etc. So, fundamentally, the VPN server works and the bridge works.

What doesn't seem to work - and I haven't worked out why - was transmitting/uploading any substantial volume of data over a TCP connection. For both speedtest.net, and softether's own speed test utility, I was able to perform download speed tests, but the upload tests hang without completing. For an HP Laserjet printer, I was able to telnet to the RAW port, type some data in and have it printed, but trying to print a test page from Windows didn't work when connecting from outside the network via BTWiFi. Why not? A TCP connection is made successfully, data is sent and received over it, but it's not reliably doing what I expect for printing, speedtests, etc. Not sure yet if this is about the connection, the SSL VPN, my integration with DD-WRT, connection tracking or what.

[edit] Maemo 5 (Nokia N900, Linux 2.6, ARM EABI binaries)

[edit] SoftEther VPN Client

Installing the ARM EABI binaries on an N900 went largely without a hitch - download, unzip, make, manually copy executables to /opt/usr/bin, vpnclient start, vpncmd works. Use "RemoteEnable" and "PasswordSet" if you want to prepare it for remote configuration from a VPN Client Manager on a Windows box. Connecting to it from Windows and configuring it seemed to go OK, but I didn't manage to make a successful connection to the router on 443, either via 3G or via BTWiFi. Keeps trying to reconnect (tcpdump shows communication between client and server) but I haven't yet worked out why it's not succeeding. May be simple user error, but I'm not having very much luck with SoftEther so far. Fairly sure the problem is client side, since I was able to connect to it using Windows XP.

[edit] OpenVPN

[edit] Which VPN protocol(s)?

[edit] Linux clients

[edit] Windows clients

[edit] Other clients