VPN (the easy way) v24+

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 20:01, 20 May 2009 (edit)
Blakerg (Talk | contribs)
(Applying Certificates to the Gateway)
← Previous diff
Revision as of 20:05, 20 May 2009 (edit) (undo)
Blakerg (Talk | contribs)
(Applying Certificates to the Gateway)
Next diff →
Line 77: Line 77:
Server Config File: Server Config File:
-Code:+Code:<br>
-push "route 192.168.54.0 255.255.255.0"+push "route 192.168.54.0 255.255.255.0"<br>
-server 192.168.66.0 255.255.255.0+server 192.168.66.0 255.255.255.0<br><br>
-dev tun0+dev tun0<br>
-proto udp+proto udp<br>
-keepalive 10 120+keepalive 10 120<br>
-dh /tmp/openvpn/dh.pem+dh /tmp/openvpn/dh.pem<br>
-ca /tmp/openvpn/ca.crt+ca /tmp/openvpn/ca.crt<br>
-cert /tmp/openvpn/cert.pem+cert /tmp/openvpn/cert.pem<br>
-key /tmp/openvpn/key.pem+key /tmp/openvpn/key.pem<br><br>
In this example, all the computers behind this appliance will have 192.168.54.* IP addresses. In this example, all the computers behind this appliance will have 192.168.54.* IP addresses.

Revision as of 20:05, 20 May 2009

Contents

Introduction

As of DD-WRT v.24 SP1, it is now possible to set up DD-WRT as an OpenVPN appliance using only the web-based GUI. It is no longer necessary to issue shell commands, or to echo quoted certificates and config files using a shell script.

Getting Started

To flash a brand new WRT54GL:

First, install the the "mini" version of DD-WRT. (Current filename: dd-wrt.v24_mini_generic.bin ) Then, install the the "vpn" version of DD-WRT that has OpenVPN support. (Current filename: dd-wrt.v24_vpn_generic.bin ) For other routers, use the appropriate bin files and installation procedure, as per the DD-WRT website.

OpenVPN Installation and Certificates

Then, install the full OpenVPN software on a desktop computer, so you can use the OpenVPN tools to create the necessary certificates. (Visit http://openvpn.net/index.php/documentation/howto.html, or under Ubuntu Linux just do "sudo apt-get install openvpn openssl".)

Create the Certificates

Go to your desktop computer and create the certificates, as per the OpenVPN Quickstart. Under Ubuntu Linux:


Code:

NOTE: Must be execute the following commands as root' (become root by issuing command: sudo su)

cd /usr/share/doc/openvpn/examples/easy-rsa/2.0/
. ./vars
./clean-all
./build-ca
./build-key-server server
./build-key client1
./build-key client2 # Etc, for other clients
./build-dh

At this point, you have created the certificates which you will need to pass out to the server and client routers. KEEP THEM IN A SAFE PLACE.

Applying Certificates to the Gateway

Now, go ahead and paste in each certificate to the boxes in the GUI which show up when you

The certs (and keys) generated above, on your regular workstation computer, will located be in the new directory "keys". Paste those files into the DD-WRT web interface as follows:

For a DD-WRT OpenVPN Server:

Code: Public Server Cert > ca.crt Certificate Revoke List (CRL) > (blank) Public Client Cert > server.crt Private Client Key > server.key DH PEM > dh1024.pem OpenVPN Config > (see below) OpenVPN TLS Auth > (blank)


NOTE: Only paste in the sections that appear between


BEGIN CERTIFICATE-----
END CERTIFICATE-----

in the text files, including the two ---BEGIN/END CERTIFICATE--- lines above. Do not paste all the descriptive stuff above that section.

Also, set "Start OpenVPN: Enable" and "Start type: WAN Up". (Bug: 2008-07-31 setting "Start type: System" causes OpenVPN to die during the first connection attempt.)

Paste in the Server Config File

The following example config file uses OpenVPN in routed mode. (It is also possible to set up OpenVPN in bridged mode, just change your config files.)

In routed mode, there are three networks to consider:

1. The LAN (192.168.54.0 here)
2. The WAN (Internet)
3. The OpenVPN private routing network (192.168.66.0 here)

The OpenVPN private routing network is used by the OpenVPN software. The OpenVPN server and clients will be on this "private" subnet, and OpenVPN will route packets between your LAN subnet (192.168.54.0) and the OpenVPN subnet (192.168.66.0). Change the LAN subnet addresses to whatever you like. By default the LAN address is 192.168.1.0, but I changed it to 192.168.54.0 here so I could test these devices under my pre-existing LAN.

Note that the port used in this example is 1194, and the OpenVPN subnet is 192.168.66.0. You can change those, but then you must change the firewall commands to match your new settings. I chose 192.168.66.0 simply because it doesn't conflict with anything else on my network.

Server Config File: Code:
push "route 192.168.54.0 255.255.255.0"
server 192.168.66.0 255.255.255.0

dev tun0
proto udp
keepalive 10 120
dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem

In this example, all the computers behind this appliance will have 192.168.54.* IP addresses.

Paste in the Server Firewall Script:

Go to Administration > Commands

Type in these text "commands" for the Firewall:

Code:

  1. Replace 1194 with your OpenVPN port number:

iptables -I INPUT 1 -p tcp --dport 1194 -j ACCEPT
iptables -I INPUT 1 -p udp --dport 1194 -j ACCEPT

  1. Replace 192.168.66.0/24 with your OpenVPN server subnet:

iptables -I FORWARD 1 --source 192.168.66.0/24 -j ACCEPT

  1. These next two lines may or may not be necessary.
  2. I (dereks) did not need them, but bmatthewshea did.
  3. Thus, we include them so that this works for more people:

iptables -I FORWARD -i br0 -o tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o br0 -j ACCEPT


Then Click: Save Firewall

The first two lines allow external clients to connect to the OpenVPN software (on port 1194). The last line allows packets to flow to/from the OpenVPN private network, and thus may not be necessary on bridged configurations.

Client Config: for a Desktop OpenVPN Client: (This was tested from a laptop w/Ubuntu Linux.)

Client Config File: Code: remote XXXXserver.dyndns.org 1194

client remote-cert-tls server dev tun0 proto udp resolv-retry infinite nobind persist-key persist-tun float

ca ca.crt cert client1.crt key client1.key


(Note: for a routed OpenVPN, the "float" option is necessary.)

Client Config: for a DD-WRT OpenVPN Client appliance:

Just set the OpenVPN server name (it's WAN address), and port (1194) using the GUI, and then put in the certs: Code: Public Server Cert > ca.crt Public Client Cert > client1.crt Private Client Key > client1.key


Performance

Using Linksys WRT54GL v1.1 (as both client and server OpenVPN appliances) CPU Model: Broadcom BCM5352 chip rev 0

SCP File transfer w/CPU at 200 MHz: 313 KB/s SCP File transfer w/CPU at 250 MHz: 423 KB/s

Thus, estimated OpenVPN User Capacity (w/CPU at 250 MHz):

For users with 768 Kbit DSL: About 4-5 users (100% usage, like big downloads) About 10-20 users (intermittant usage, like web or shell traffic)

For users with 128 Kbit dial-up modems: About 25 users (100% usage, like big downloads) About 50-100 users (intermittant usage, like web or shell traffic)

I tested an OpenVPN connection for about 24 hours in my lab. I transferred 525MB files. I also did two power cycles on both client and server appliances, and the tunnel re-established itself correctly.

Troubleshooting

Prerequisite: Running commands and watching logs.

Use telnet, SSH, or Administration > Commands to run commands. The default username/password are user: "root", password: "admin".

To troubleshoot, you should turn on logging, and then watch the log file using this command:
Code:
tail -f /var/log/messages

To turn on logging, do this:

1. Turn on syslog with "Services > System Log > Syslogd",
2. Add a line that says "verb 5" to the OpenVPN config file

Here is an example error I got when my config file had a bad setting in it:
Code:
root@WRT54GL:~# cat /var/log/messages | grep openvpn
Jul 31 11:55:13 WRT54GL daemon.err openvpn[1686]: Options error: --server directive network/netmask combination is invalid
Jul 31 11:55:13 WRT54GL daemon.warn openvpn[1686]: Use --help for more information.
root@WRT54GL:~#


First, is OpenVPN running?
Code:
ps | grep openvpn

If you don't see the OpenVPN process listed, then that is the first problem you need to solve.

Make sure you are running it by setting "Start type: WAN Up".

Maybe there is an error in your config file. If so, OpenVPN will log an error message and then die.

See if OpenVPN is logging an error message for you, to tell you what is wrong. (See "Logging" above; you need syslogd on and "verb 5" in your OpenVPN config file.)

Next, is your firewall blocking OpenVPN?

If your firewall settings are wrong, OpenVPN's packets will be blocked by the DD-WRT firewall software.

First, turn off your firewall altogether, as a test to see if that makes things work. "Security > Firewall > SPI Firewall: Disable". If that fixes your problem, you need to tweak your firewall rules.

You can review your Linux IPTABLES firewall rules with this command: Code: iptables -L -v -n --line-numbers

Also, the firewall can log any DROPped or REJECTed packets. Examine these log messages and compare the DROPped packets to your iptables rules, and then tweak as necessary.

"Security > Firewall > Log: Enable" "Security > Firewall > Log > Log Level: Medium" "Security > Firewall > Log > Options: Dropped: Enable, Rejected: Enable"

There are many web sites that explain Linux iptables rules and commands.

If you are still having trouble, make sure the cert and config files are saved correctly on the DD-WRT by looking in the directory /tmp/openvpn/ (for server) and /tmp/openvpncl/ (for client).


Many thanks to all the contributors below, especially bmatthewshea who figured out the correct locations for the certificates.

--Derek

Comments

      • Posted 25 March, 2009 to this wiki after looking everywhere and not finding this =P

The original post which this article was copied & pasted from is: http://www.dd-wrt.com/phpBB2/viewtopic.php?t=35689