Virtual Private Networks - Revision history

PhilippeTeuwen: Reverted edits by Etegohy (Talk) to last revision by PhilippeTeuwen

2010-11-24T20:33:24Z

Reverted edits by Etegohy (Talk) to last revision by PhilippeTeuwen

Can't load revision 6807

at 00:27, 24 November 2010

2010-11-24T00:27:32Z

Can't load revision 6649

PhilippeTeuwen: /* OpenVPN on a Linksys WRT54GL */

2010-04-06T09:55:33Z

OpenVPN on a Linksys WRT54GL

← Older revision		Revision as of 09:55, 6 April 2010
Line 223:		Line 223:
	So this requires installing dd-wrt on your WRT54GL.		So this requires installing dd-wrt on your WRT54GL.
	<br>My personal experience:		<br>My personal experience:
	* There was already an openwrt on it of which I couldn't remember the password		* There was already an openwrt White Russian RC6 on it of which I couldn't remember the password
	** Set a fixed IP such as 192.168.1.10		** Set a fixed IP such as 192.168.1.10
	** <pre>tcpdump -nAi eth0 port 4919 and udp</pre>		** <pre>tcpdump -nAi eth0 port 4919 and udp</pre>

PhilippeTeuwen: /* OpenVPN on a Linksys WRT54GL */

2010-04-06T09:55:01Z

OpenVPN on a Linksys WRT54GL

← Older revision		Revision as of 09:55, 6 April 2010
Line 218:		Line 218:
	===OpenVPN on a Linksys WRT54GL===		===OpenVPN on a Linksys WRT54GL===
	See [http://www.dd-wrt.com/wiki/index.php/OpenVPN OpenVPN with dd-wrt] and [http://www.dd-wrt.com/wiki/index.php/VPN_%28the_easy_way%29_v24%2B the easy way]		See [http://www.dd-wrt.com/wiki/index.php/OpenVPN OpenVPN with dd-wrt] and [http://www.dd-wrt.com/wiki/index.php/VPN_%28the_easy_way%29_v24%2B the easy way]

	~~<br>~~[http://www.cs.wustl.edu/~jain/cse567-08/ftp/ovpn/index.html Performances]: ''The largest bandwidth of 8.87 Mbps is measured for the TAP interface with bridging using the UDP transport protocol for the tunnel and no encryption. The bandwidth is cut to less than half to 3.70 Mbps when encryption using AES 256-bit is enabled'' And once using AES256, it doesn’t really matter if you’re doing TAP over UDP or TCP (except latency +10ms if you care).		[http://www.cs.wustl.edu/~jain/cse567-08/ftp/ovpn/index.html Performances]: ''The largest bandwidth of 8.87 Mbps is measured for the TAP interface with bridging using the UDP transport protocol for the tunnel and no encryption. The bandwidth is cut to less than half to 3.70 Mbps when encryption using AES 256-bit is enabled'' And once using AES256, it doesn’t really matter if you’re doing TAP over UDP or TCP (except latency +10ms if you care).
⚫	~~<br>~~So this requires installing dd-wrt on your WRT54GL.

		⚫	So this requires installing dd-wrt on your WRT54GL.
	<br>My personal experience:		<br>My personal experience:
	* There was already an openwrt on it of which I couldn't remember the password		* There was already an openwrt on it of which I couldn't remember the password

PhilippeTeuwen: /* OpenVPN on a Linksys WRT54GL */

2010-04-06T09:54:36Z

OpenVPN on a Linksys WRT54GL

← Older revision		Revision as of 09:54, 6 April 2010
Line 233:		Line 233:
	* I flashed it with dd-wrt.v24_mini_generic.bin (v24 preSP2 [Beta] Build 13064)		* I flashed it with dd-wrt.v24_mini_generic.bin (v24 preSP2 [Beta] Build 13064)
	* It rebooted itself, prompting for a new admin user/pwd		* It rebooted itself, prompting for a new admin user/pwd
	* I flashed it again from the new dd-wrt web interface, with dd-wrt.v24_vpn_generic.bin (v24 preSP2 [Beta] Build 13064)		* I flashed it again from the new dd-wrt web interface, with dd-wrt.v24_vpn_generic.bin (v24 preSP2 [Beta] Build 13064), with reset to defaults
	* It rebooted itself, prompting for a new admin user/pwd		* It rebooted itself, prompting for a new admin user/pwd
	So I didn't use any hard reset 30/30/30 cycle, your mileage may vary.		So I didn't use any hard reset 30/30/30 cycle, your mileage may vary.

PhilippeTeuwen: /* OpenVPN on a Linksys WRT54GL */

2010-04-06T09:53:48Z

OpenVPN on a Linksys WRT54GL

← Older revision		Revision as of 09:53, 6 April 2010
Line 217:		Line 217:
	<br>Note that we cannot use the --ns-cert-type option anymore as it also fails on CACert certificates, cf my other [http://bugs.debian.org/483473 bugreport]		<br>Note that we cannot use the --ns-cert-type option anymore as it also fails on CACert certificates, cf my other [http://bugs.debian.org/483473 bugreport]
	===OpenVPN on a Linksys WRT54GL===		===OpenVPN on a Linksys WRT54GL===
	See http://www.dd-wrt.com/wiki/index.php/OpenVPN		See [http://www.dd-wrt.com/wiki/index.php/OpenVPN OpenVPN with dd-wrt] and [http://www.dd-wrt.com/wiki/index.php/VPN_%28the_easy_way%29_v24%2B the easy way]
	<br>[http://www.cs.wustl.edu/~jain/cse567-08/ftp/ovpn/index.html Performances]: ''The largest bandwidth of 8.87 Mbps is measured for the TAP interface with bridging using the UDP transport protocol for the tunnel and no encryption. The bandwidth is cut to less than half to 3.70 Mbps when encryption using AES 256-bit is enabled'' And once using AES256, it doesn’t really matter if you’re doing TAP over UDP or TCP (except latency +10ms if you care).		<br>[http://www.cs.wustl.edu/~jain/cse567-08/ftp/ovpn/index.html Performances]: ''The largest bandwidth of 8.87 Mbps is measured for the TAP interface with bridging using the UDP transport protocol for the tunnel and no encryption. The bandwidth is cut to less than half to 3.70 Mbps when encryption using AES 256-bit is enabled'' And once using AES256, it doesn’t really matter if you’re doing TAP over UDP or TCP (except latency +10ms if you care).
	<br>So this requires installing dd-wrt on your WRT54GL.		<br>So this requires installing dd-wrt on your WRT54GL.
Line 231:		Line 231:
	** power-cycle the router		** power-cycle the router
	** Now you can access the web interface and go to the firmware upgrade page		** Now you can access the web interface and go to the firmware upgrade page
			* I flashed it with dd-wrt.v24_mini_generic.bin (v24 preSP2 [Beta] Build 13064)
			* It rebooted itself, prompting for a new admin user/pwd
			* I flashed it again from the new dd-wrt web interface, with dd-wrt.v24_vpn_generic.bin (v24 preSP2 [Beta] Build 13064)
			* It rebooted itself, prompting for a new admin user/pwd
			So I didn't use any hard reset 30/30/30 cycle, your mileage may vary.

	==[http://vtun.sourceforge.net/ vtun]==		==[http://vtun.sourceforge.net/ vtun]==

PhilippeTeuwen: /* OpenVPN */

2010-04-06T09:48:10Z

OpenVPN

@@ Line 216: / Line 216: @@
 <br>Note that normally specifying the common_name instead of the subject line should be enough but this does not work on CACert certificates, cf my [http://bugs.debian.org/483472 bugreport]
 <br>Note that we cannot use the --ns-cert-type option anymore as it also fails on CACert certificates, cf my other [http://bugs.debian.org/483473 bugreport]
 ==[http://vtun.sourceforge.net/ vtun]==

PhilippeTeuwen: /* Setup on the Linux server */

2009-08-28T08:45:24Z

Setup on the Linux server

← Older revision		Revision as of 08:45, 28 August 2009
Line 82:		Line 82:
	</pre>		</pre>
	It will start at boot time, for a first try: /etc/init.d/openvpn start		It will start at boot time, for a first try: /etc/init.d/openvpn start

			'''UPDATE:''' after an upgrade on client side, I had troubles overwriting my default gateway with the tunnel one, I had to change this line in the server config:
			push "redirect-gateway"
			=>
			push "redirect-gateway def1"

	With option ifconfig-pool-persist, clients will always get the same IP.		With option ifconfig-pool-persist, clients will always get the same IP.

Twalrant: /* Setup on the Linux server */

2009-01-06T09:51:44Z

Setup on the Linux server

← Older revision		Revision as of 09:51, 6 January 2009
Line 47:		Line 47:
	SOURCE=$1		SOURCE=$1
	DEV=$2		DEV=$2
			# establishing Source NATing (hiding source address)
	/sbin/iptables -t nat -A POSTROUTING -s $SOURCE -d 0.0.0.0/0 -j SNAT --to-source=<ext_ip>		/sbin/iptables -t nat -A POSTROUTING -s $SOURCE -d 0.0.0.0/0 -j SNAT --to-source=<ext_ip>
			# allowing explicitely to forward traffic from NATed interface in Netfilter (not needed if your policy allows all by default)
	/sbin/iptables -I FORWARD -i <ext_if> -o $DEV -m state --state ESTABLISHED,RELATED -j ACCEPT		/sbin/iptables -I FORWARD -i <ext_if> -o $DEV -m state --state ESTABLISHED,RELATED -j ACCEPT
	/sbin/iptables -I FORWARD -i $DEV -o <ext_if> -j ACCEPT		/sbin/iptables -I FORWARD -i $DEV -o <ext_if> -j ACCEPT

PhilippeTeuwen: /* Setup on a Linux client */

2008-09-03T14:37:42Z

Setup on a Linux client

← Older revision		Revision as of 14:37, 3 September 2008
Line 121:		Line 121:
	up /etc/openvpn/domain.up		up /etc/openvpn/domain.up
	plugin /usr/lib/openvpn/openvpn-down-root.so /etc/openvpn/domain.down		plugin /usr/lib/openvpn/openvpn-down-root.so /etc/openvpn/domain.down
			# this is required for new openvpn versions >= 2.1~rc9
			script-security 2
	Create /etc/openvpn/domain.up and make it executable:		Create /etc/openvpn/domain.up and make it executable:
	<pre>		<pre>
Line 141:		Line 143:
	</pre>		</pre>
	If you are not using Debian, see http://forums.gentoo.org/viewtopic-t-233080.html#1655552		If you are not using Debian, see http://forums.gentoo.org/viewtopic-t-233080.html#1655552

	=== Setup of a VPN server in a vserver===		=== Setup of a VPN server in a vserver===
	*cf http://linux-vserver.org/Frequently_Asked_Questions#Can_I_run_an_OpenVPN_Server_in_a_guest.3F		*cf http://linux-vserver.org/Frequently_Asked_Questions#Can_I_run_an_OpenVPN_Server_in_a_guest.3F