Both sides previous revision
Previous revision
Next revision
|
Previous revision
Next revision
Both sides next revision
|
userdoc:tt_openvpn_server [2013/02/25 13:00] abelbeck |
userdoc:tt_openvpn_server [2018/10/14 06:37] mkeuter [Apple OS X Client Configuration] |
====== OpenVPN Configuration ====== | ====== OpenVPN Configuration ====== |
| |
[[http://openvpn.net/|OpenVPN]] is arguably the easiest to use, highly secure, open source VPN available. The addition of OpenVPN Client support for iOS and Andriod mobile devices has led to new supported features in AstLinux. Features include a dual IPv4/IPv6 tunnel, TLS-Auth for added security, and ''client.ovpn'' file export to easily configure mobile devices and desktops. | [[http://openvpn.net/|OpenVPN]] is an easy to use, secure, open source VPN. The addition of OpenVPN Client support for iOS and Andriod mobile devices has led to new supported features in AstLinux. Features include a dual IPv4/IPv6 tunnel, TLS-Auth for added security, and ''client.ovpn'' file export to easily configure mobile devices and desktops. |
| |
| |
* ''multihome'' | * ''multihome'' |
* ''mute 20'' | * ''mute 20'' |
| |
| !!Tip ->!! If you also want to route packets to client networks: [[userdoc:tt_openvpn_client_networks|OpenVPN Client Networks]] |
| |
{{:userdoc:ovpn-server-auth.jpg?nolink|}} | {{:userdoc:ovpn-server-auth.jpg?nolink|}} |
{{:userdoc:ovpn-server-firewall.jpg?nolink|}} | {{:userdoc:ovpn-server-firewall.jpg?nolink|}} |
| |
* External Hosts: Define a space separated list of allowed IPv4/IPv6 addresses via the external interface. The external firewall rules are automatically created by the [[http://doc.astlinux.org/userdoc:tt_firewall_plugins#openvpn-server|openvpn-server plugin]] . The firewall must be enabled, see the "Enable Firewall" section below for more info. | * External Hosts: Define a space separated list of allowed IPv4/IPv6 addresses via the external interface. The external firewall rules are automatically created by the [[userdoc:tt_firewall_plugins#openvpn-server|openvpn-server plugin]] . The firewall must be enabled, see the "Enable Firewall" section below for more info. |
| |
!!Tip ->!! Allow any external IPv4/IPv6 address by defining "External Hosts:" to "0/0". | !!Tip ->!! Allow any external IPv4/IPv6 address by defining "External Hosts:" to "0/0". |
{{:userdoc:ovpn-server-server.jpg?nolink|}} | {{:userdoc:ovpn-server-server.jpg?nolink|}} |
| |
* Server Hostname: Does not effect the OpenVPN server configuration, rather it is only used when downloading client credentials containing ''client.ovpn'' files. It is used to define the hostname of the server from the client's point of view. This entry can be a DNS hostname, IPv4 or IPv6 manual address. //[client.ovpn]// | * Server Hostname(s): Does not effect the OpenVPN server configuration, rather it is only used when downloading client credentials containing ''client.ovpn'' files. It is used to define the hostname of the server from the client's point of view. This entry can be a DNS hostname, IPv4 or IPv6 manual address. !!AstLinux 1.2.1 and later!! this may contain a space separated list of hosts for failover. //[client.ovpn]// |
| |
* Network IPv4 NM: Define an IPv4 address and NetMask, space separated, which configures the server tunnel device ''tun0'' network. | * Network IPv4 NM: Define an IPv4 address and NetMask, space separated, which configures the server tunnel device ''tun0'' network. |
{{:userdoc:ovpn-server-client-cert.jpg?nolink|}} | {{:userdoc:ovpn-server-client-cert.jpg?nolink|}} |
| |
Create new clients, then download their credentials. Keep it secure! | Create new clients, then download their credentials. Keep it secure! |
| |
{{:userdoc:ovpn-credentials-files.jpg?nolink|}} | !!Note ->!! Create unique credentials for each client! If 2 different clients connect with the same credentials at the same time, the second client will log out the first one, then the first one will be re-connecting automatically and again logging out the second, and so on :-). |
| |
| {{:userdoc:ovpn-credentials-files2.jpg?nolink|}} |
| |
== openvpn-cert-key, openvpn-nocert-nokey or openvpn-pkcs12 == | == openvpn-cert-key, openvpn-nocert-nokey or openvpn-pkcs12 == |
| |
Additionally, the OpenVPN server tunnel is NAT'ed via the external interface, such that if an exiting IPv4 tunnel packet is routed out through the external interface it will have a NAT'ed path back into the tunnel. | Additionally, the OpenVPN server tunnel is NAT'ed via the external interface, such that if an exiting IPv4 tunnel packet is routed out through the external interface it will have a NAT'ed path back into the tunnel. |
| |
| |
| |
===== Apple iOS Client Configuration ===== | ===== Apple iOS Client Configuration ===== |
!!Tip ->!! You can delete a file from the OpenVPN Documents by selecting the file and hitting the ''Delete'' key. | !!Tip ->!! You can delete a file from the OpenVPN Documents by selecting the file and hitting the ''Delete'' key. |
| |
{{:userdoc:ovpn-credentials-files.jpg?nolink|}} {{:userdoc:ovpn-client-file.jpg?nolink|}} | {{:userdoc:ovpn-credentials-files2.jpg?nolink|}} {{:userdoc:ovpn-client-file.jpg?nolink|}} |
| |
The ''ipad0.ovpn'' file is now on the iOS device. | The ''ipad0.ovpn'' file is now on the iOS device. |
\\ | \\ |
\\ | \\ |
**OpenVPN Client for Mac OS X:** [[http://code.google.com/p/tunnelblick/wiki/DownloadsEntry|Tunnelblick]] //(Free)//\\ | **OpenVPN Client for Mac OS X:** [[https://tunnelblick.net|Tunnelblick]] //(Free)//\\ |
{{:userdoc:ovpn-tunnelblick-icon.png?nolink|}} | {{:userdoc:ovpn-tunnelblick-icon.png?nolink|}} |
\\ | \\ |
| |
\\ | \\ |
| |
===== Windows Client Configuration ===== | ===== Windows Client Configuration ===== |
| |
\\ | \\ |
\\ | \\ |
**OpenVPN Client for Windows:** [[http://openvpn.net/index.php/open-source/downloads.html|Windows Installer/GUI]] //(Free)//\\ | **OpenVPN Client for Windows:** [[https://openvpn.net/community-downloads/|Windows Installer/GUI]] //(Free)//\\ |
{{:userdoc:ovpn-openvpn-icon.png?nolink|}} | {{:userdoc:ovpn-openvpn-icon.png?nolink|}} |
\\ | \\ |
The OpenVPN folks offer a free Windows Installer and GUI for the OpenVPN package. | The OpenVPN folks offer a free Windows Installer and GUI for the OpenVPN package. |
| |
Using the above link download the "Windows Installer" (32-bit) or (64-bit) for your Windows system. This example uses Windows7. Download the latest version, and install using the default selections. | Using the above link download the "Windows Installer". This example uses Windows7. Download the latest version, and install using the default selections. |
| |
Next, download your credentials from the AstLinux OpenVPN server page, unzip the package, and using the **openvpn-cert-key** format ''client.ovpn'' file, place the (''win7.ovpn'' in this example) file into the following folder: | Next, download your credentials from the AstLinux OpenVPN server page, unzip the package, and using the **openvpn-cert-key** format ''client.ovpn'' file, place the (''win7.ovpn'' in this example) file into the following folder: |
| |
C:\Program Files\OpenVPN\config | C:\Program Files\OpenVPN\config |
| |
| On newer OpenVPN versions the "config" folder must be created manually. |
| |
{{:userdoc:ovpn-win-gui-config.jpg?nolink|}} | {{:userdoc:ovpn-win-gui-config.jpg?nolink|}} |
| |
Alternatively, you could use the **openvpn-pkcs12** format ''client.ovpn'' and ''client.p12'' files, place the (''win7.ovpn'' and ''win7.p12'' in this example) files into the folder. | Alternatively, you could use the **openvpn-pkcs12** format ''client.ovpn'' and ''client.p12'' files, place both the (''win7.ovpn'' and ''win7.p12'' in this example) files into the folder. |
| |
That's it, next start the OpenVPN-GUI service. This procedure can vary depending on your version of Windows. The OpenVPN-GUI service needs to have administrator permissions to add and delete routes and such. For the Windows7 case, right-click the OpenVPN-GUI icon and "Run as administrator". | That's it, next start the OpenVPN-GUI service. This procedure can vary depending on your version of Windows. The OpenVPN-GUI service __needs to have administrator permissions__ to add and delete routes and such. For the Windows7 case, right-click the OpenVPN-GUI icon and "Run as administrator". |
| |
!!Note ->!! Make sure you understand the security implications of running any application with administrator privileges. | !!Note ->!! Make sure you understand the security implications of running any application with administrator privileges. |
| |
Finally, select "Connect" and a connection window will appear, then disappear when the connection is established. | Finally, select "Connect" and a connection window will appear, then disappear when the connection is established. |
| |