Difference between revisions of "OpenVPN"

Revision as of 22:40, 12 February 2012

OpenVPN is a secure tunnel. I use it to connect to my home network.

OpenVPN uses certificates to both authenticate the client with the server, and the server with the client. The only hard part about OpenVPN is setting up the certificate infrastructure. You need a root certificate (the certificate authority, CA), and certificates for each server and each client, signed by this root certificate.

Setting up a public key infrastructure

Main article: Create a OpenVPN Certificate Authority

The use of client certificates enhances the security, but makes it harder to deploy, as you need to distribute client certificates to each host. You can not use an existing public key infrastructure (PKI); you would allow anyone with a certificate of that PKI to connect to your server (the tls-remote and tls-verify options can limits the allowed clients). You either need to to set up your own certificate infrastructure, or limit OpenVPN to use password-based authentication (see the options auth-user-pass-verify, client-cert-not-required and username-as-common-name).

The easiest method it to use easy-rsa, as described in the OpenVPN How-to.

The article Create a OpenVPN Certificate Authority describes the steps in more detail, but basically gives the same result.

Certificates, when deployed correctly, are much more secure than passwords, since the secret (key) does not need to be exchanged or shared between the different hosts. However, doing so requires a security hygiene which may not be required for a small-scale deployment.

Running IPv6 through the Tunnel

OpenVPN can both use a tap or a tun interface. A tap interface tunnels Ethernet traffic, so that includes both IPv4, IPv6 and NetBIOS. A tun interface tunnels IP traffic. Version 2.3 of OpenVPN supports tunnelling bot IPv4 and IPv6 traffic through the tunnel. OpenVPN 2.2 can also tunnel IPv6 traffic, but requires a custom scripts to configure the IPv6 addresses and routing tables. At the time of writing, OpenVPN 2.3 is not yet released, so the following three options are available:

• Use a tap interface to bridge all Ethernet traffic, including IPv4 and IPv6 traffic. The disadvantage is that is less efficient since the tunnel contains broadcast traffic not targeted to the client;
• Wait for OpenVPN 2.3 or compile a development version;
• Use OpenVPN 2.2 with a custom connect- and disconnect script to set the IPv6 address of the tunnel.

I choose to compile a development version.

Install Development Version

On FreeBSD:

cd /usr/ports/security/openvpn-devel
sudo make install

On Mac OS X:

sudo port install lzo2
git clone git://openvpn.git.sourceforge.net/gitroot/openvpn/openvpn.git
cd openvpn
git checkout 32ab329bc69c6292c205d4f33a4b8069341798d3
autoreconf -i -v
./configure --with-lzo-headers=/opt/local/include --with-lzo-lib=/opt/local/lib
make
make check
sudo make install

Configure IPv6 Tunnel

Imagine the following setup:

A sample server and client configuration follow. These examples could probably be reduced in size; some parameters are default or some can be combined (e.g. "server" can replace "mode server", "tls-server" "ifconfig" and "ifconfig-pool").

See the OpenVPN man page and Gert Döring's IPv6 Payload Patch for information on the different configuration options.

OpenVPN server configuration

# The IP to listen on for incoming VPN connections
local 192.0.2.206
proto udp   # or tcp-server is UDP is blocked
dev tun1

# PKI Stuff
ca          ca.crt
cert        server.crt
key         server.key
dh          dh2048.pem
crl-verify  crl.pem
# Option TLS shared secret for HMAC signing for additional security
tls-auth    tls-auth.key

mode server
tls-server

topology net30
ifconfig 10.240.177.1 10.240.177.2
ifconfig-pool 10.240.177.4 10.240.177.251
route 10.240.177.0/24

tun-ipv6
ifconfig-ipv6 2001:db8:f0:b1::1 2001:db8:f0:b1::2
ifconfig-ipv6-pool 2001:db8:f0:b1::4/64
route-ipv6 2001:db8:f0:b1::/64

# the actual routes are 10.240.129.0/24 and 2001:db8:f0:81::/64 but this avoids 
# a bug when connecting from the private network
push route 10.240.128.0 255.255.254.0
push route-ipv6 2001:db8:f0:80::0/63

ifconfig-pool-persist ipp.txt

# server and client ping every 10 seconds, client reconnects after 60 seconds.
keepalive 10 60

user nobody
group nobody
persist-key
persist-tun
ns-cert-type client
remote-cert-tls client
# Allow a client to log in multiple times
duplicate-cn
#opt-verify

# Logging 
#
log         /var/log/openvpn-server.log
log-append  /var/log/openvpn.log
status      /var/log/openvpn-status.log
verb 3

OpenVPN client configuration

# First try UDP
remote 145.99.1.67 1194 udp

# If UDP fails, try TCP
remote 145.99.1.67 1194 tcp-client

dev tun
nobind
tls-client
pull

ca       ca.crt
cert     cert.crt
key      key.key
tls-auth tls-auth.key

tun-ipv6
persist-key
persist-tun
ns-cert-type server