OpenVPN - Revision history

Dave: Reverted edits by 204.39.95.9 (Talk); changed back to last version by Jimbo

2007-09-02T01:59:24Z

Reverted edits by 204.39.95.9 (Talk); changed back to last version by Jimbo

216.110.12.175 at 03:27, 17 June 2007

2007-06-17T03:27:41Z

Dave at 18:28, 8 June 2007

2007-06-08T18:28:08Z

Jimbo at 17:54, 5 May 2007

2007-05-05T17:54:00Z

24.23.181.229 at 09:04, 30 April 2007

2007-04-30T09:04:13Z

200.238.102.170 at 21:24, 12 April 2007

2007-04-12T21:24:41Z

Ice: reverted to older version

2007-04-12T18:19:58Z

reverted to older version

Jimbo at 12:54, 10 July 2006

2006-07-10T12:54:58Z

Jimbo: /* Installing */

2006-07-10T12:53:29Z

Installing

203.214.90.222: /* Installing */

2006-07-10T12:13:57Z

Installing

@@ Line 1: / Line 1: @@
-[http://openvpn.sourceforge.net OpenVPN] is a very useful open source, cross platform Virtual Private Networking tool.  It uses SSL encryption (dynamic or 2048-bit static shared key), can use LZO stream compression, and is blindingly fast as well as much more secure compared to typical industry standard IPSEC   DES or IPSEC   3DES solutions.  Better yet, it's so simple it can be run entirely from the command line.
+[http://openvpn.sourceforge.net OpenVPN] is a very useful open source, cross platform Virtual Private Networking tool.  It uses SSL encryption (dynamic or 2048-bit static shared key), can use LZO stream compression, and is blindingly fast as well as much more secure compared to typical industry standard IPSEC + DES or IPSEC + 3DES solutions.  Better yet, it's so simple it can be run entirely from the command line.
 ==Installing==
@@ Line 36: / Line 36: @@
          # Finally, open up for business.
          # A tunnel numbered [x] is configured as follows:
-         # device tun[x], port (4900   [x]), network 10.10.(10   [x])
+         # device tun[x], port (4900 + [x]), network 10.10.(10 + [x])
          # Client machine is always .2, server is always .1
@@ Line 47: / Line 47: @@
          --dev tap0 --port 4900 --ifconfig 10.10.10.1 255.255.255.252 \
          --tun-mtu 1500 --tun-mtu-extra 32 --mssfix 1450 --key-method 2 \
-         --secret /usr/local/etc/openvpn.key --ping 1
+         --secret /usr/local/etc/openvpn.key --ping 1 &

@@ Line 1: / Line 1: @@
-[http://openvpn.sourceforge.net OpenVPN] is a very useful open source, cross platform Virtual Private Networking tool.  It uses SSL encryption (dynamic or 2048-bit static shared key), can use LZO stream compression, and is blindingly fast as well as much more secure compared to typical industry standard IPSEC + DES or IPSEC + 3DES solutions.  Better yet, it's so simple it can be run entirely from the command line.
+[http://openvpn.sourceforge.net OpenVPN] is a very useful open source, cross platform Virtual Private Networking tool.  It uses SSL encryption (dynamic or 2048-bit static shared key), can use LZO stream compression, and is blindingly fast as well as much more secure compared to typical industry standard IPSEC   DES or IPSEC   3DES solutions.  Better yet, it's so simple it can be run entirely from the command line.
 ==Installing==
@@ Line 36: / Line 36: @@
          # Finally, open up for business.
          # A tunnel numbered [x] is configured as follows:
-         # device tun[x], port (4900 + [x]), network 10.10.(10 + [x])
+         # device tun[x], port (4900   [x]), network 10.10.(10   [x])
          # Client machine is always .2, server is always .1
@@ Line 47: / Line 47: @@
          --dev tap0 --port 4900 --ifconfig 10.10.10.1 255.255.255.252 \
          --tun-mtu 1500 --tun-mtu-extra 32 --mssfix 1450 --key-method 2 \
-         --secret /usr/local/etc/openvpn.key --ping 1 &
+         --secret /usr/local/etc/openvpn.key --ping 1
-−
- #        # 1a. Client side - persistent VPN
- #        /usr/local/sbin/openvpn \
- #                --dev tap1 \
- #                --remote ''ip_or_hostname.to.connect.to'' \
- #                --secret /usr/local/etc/openvpn.key \
- #                --key-method 2 \
- #                --port 4901 \
- #                --ifconfig 10.10.11.2 255.255.255.252 \
- #                --route 192.168.1.0 255.255.255.0 10.10.11.1 \
- #                --tun-mtu 1500 --tun-mtu-extra 32 \
- #                --fragment 1300 --mssfix \
- #                --persist-tun --persist-key --resolv-retry 86400 \
- #                --ping 10 --ping-restart 15 \
- #                --verb 4 --mute 10 &
-−
-        # 1b. Server side - persistent VPN
-        /usr/local/sbin/openvpn \
-                --dev tap1 \
-                --secret /usr/local/etc/openvpn.key \
-                --key-method 2 \
-                --port 4901 \
-                --ifconfig 10.10.11.1 255.255.255.252 \
-                --route 192.168.1.0 255.255.255.0 10.10.11.2 \
-                --tun-mtu 1500 --tun-mtu-extra 32 \
-                --fragment 1300 --mssfix \
-                --persist-tun --persist-key --resolv-retry 86400 \
-                --ping 10 --ping-restart 15 \
-                --verb 4 --mute 10 &
-−
-−
-        # end section
-        ;;
-−
- stop)
-        killall openvpn
-        ;;
- *)
-        echo "Usage: `basename $0` {start|stop}" >&2
-        ;;
- esac
-−
- exit 0
-−
-Don't forget to '''chmod 755 /usr/local/etc/rc.d/openvpn.sh''' to make sure you can execute it.
-−
-What you've got there is a setup (which can be started up or stopped like any other rc.d script - '''/usr/local/etc/rc.d/openvpn.sh start''' or '''stop''') which provides for two tunnels - one coming from a Windows machine, probably a laptop or something (labeled "dynamic VPN"; more on that in a minute) and one (labeled "persistent VPN") from another BSD or other *nix machine.
-−
-All we'll do on the other *nix box is copy over the '''openvpn.key''' we created on this machine, copy over this same script, comment out the:
-−
-* '''# 1b. Server side - persistent VPN''' section
-* ''un''comment the '''# 1a. Client side - persistent VPN''' side
-* and fire it up.
-−
-Once the scripts have been started on both machines (obviously you'll need a routeable IP address for at least the machine on the "server" side), presto, you've got a tunnel!
-−
-Obviously this article is unfinished, but work beckons.  More later.
-−
-http://freshmeat.net/projects/webmin-openvpnadmin/ is a webmin module for controlling the openvpn (and CA-related tunnels), if you're not all CLI-hardcore like Jimbo.
-−
-[[Category:Ports and Packages]][[Category:Common Tasks]]

← Older revision		Revision as of 18:28, 8 June 2007
Line 105:		Line 105:

	Obviously this article is unfinished, but work beckons. More later.		Obviously this article is unfinished, but work beckons. More later.
		+
		+	http://freshmeat.net/projects/webmin-openvpnadmin/ is a webmin module for controlling the openvpn (and CA-related tunnels), if you're not all CLI-hardcore like Jimbo.

	[[Category:Ports and Packages]][[Category:Common Tasks]]		[[Category:Ports and Packages]][[Category:Common Tasks]]

@@ Line 1: / Line 1: @@
-[http://openvpn.sourceforge.net OpenVPN] is a very useful open source, cross platform Virtual Private Networking tool.  It uses SSL encryption (dynamic or 2048-bit static shared key), can use LZO stream compression, and is blindingly fast as well as much more secure compared to typical industry standard IPSEC   DES or IPSEC   3DES solutions.  Better yet, it's so simple it can be run entirely from the command line.
+[http://openvpn.sourceforge.net OpenVPN] is a very useful open source, cross platform Virtual Private Networking tool.  It uses SSL encryption (dynamic or 2048-bit static shared key), can use LZO stream compression, and is blindingly fast as well as much more secure compared to typical industry standard IPSEC + DES or IPSEC + 3DES solutions.  Better yet, it's so simple it can be run entirely from the command line.
 ==Installing==
@@ Line 36: / Line 36: @@
          # Finally, open up for business.
          # A tunnel numbered [x] is configured as follows:
-         # device tun[x], port (4900   [x]), network 10.10.(10   [x])
+         # device tun[x], port (4900 + [x]), network 10.10.(10 + [x])
          # Client machine is always .2, server is always .1
@@ Line 47: / Line 47: @@
          --dev tap0 --port 4900 --ifconfig 10.10.10.1 255.255.255.252 \
          --tun-mtu 1500 --tun-mtu-extra 32 --mssfix 1450 --key-method 2 \
-         --secret /usr/local/etc/openvpn.key --ping 1
+         --secret /usr/local/etc/openvpn.key --ping 1 &

@@ Line 1: / Line 1: @@
-[http://openvpn.sourceforge.net OpenVPN] is a very useful open source, cross platform Virtual Private Networking tool.  It uses SSL encryption (dynamic or 2048-bit static shared key), can use LZO stream compression, and is blindingly fast as well as much more secure compared to typical industry standard IPSEC + DES or IPSEC + 3DES solutions.  Better yet, it's so simple it can be run entirely from the command line.
+[http://openvpn.sourceforge.net OpenVPN] is a very useful open source, cross platform Virtual Private Networking tool.  It uses SSL encryption (dynamic or 2048-bit static shared key), can use LZO stream compression, and is blindingly fast as well as much more secure compared to typical industry standard IPSEC   DES or IPSEC   3DES solutions.  Better yet, it's so simple it can be run entirely from the command line.
 ==Installing==
@@ Line 36: / Line 36: @@
          # Finally, open up for business.
          # A tunnel numbered [x] is configured as follows:
-         # device tun[x], port (4900 + [x]), network 10.10.(10 + [x])
+         # device tun[x], port (4900   [x]), network 10.10.(10   [x])
          # Client machine is always .2, server is always .1
@@ Line 47: / Line 47: @@
          --dev tap0 --port 4900 --ifconfig 10.10.10.1 255.255.255.252 \
          --tun-mtu 1500 --tun-mtu-extra 32 --mssfix 1450 --key-method 2 \
-         --secret /usr/local/etc/openvpn.key --ping 1 &
+         --secret /usr/local/etc/openvpn.key --ping 1
-−
- #        # 1a. Client side - persistent VPN
- #        /usr/local/sbin/openvpn \
- #                --dev tap1 \
- #                --remote ''ip_or_hostname.to.connect.to'' \
- #                --secret /usr/local/etc/openvpn.key \
- #                --key-method 2 \
- #                --port 4901 \
- #                --ifconfig 10.10.11.2 255.255.255.252 \
- #                --route 192.168.1.0 255.255.255.0 10.10.11.1 \
- #                --tun-mtu 1500 --tun-mtu-extra 32 \
- #                --fragment 1300 --mssfix \
- #                --persist-tun --persist-key --resolv-retry 86400 \
- #                --ping 10 --ping-restart 15 \
- #                --verb 4 --mute 10 &
-−
-        # 1b. Server side - persistent VPN
-        /usr/local/sbin/openvpn \
-                --dev tap1 \
-                --secret /usr/local/etc/openvpn.key \
-                --key-method 2 \
-                --port 4901 \
-                --ifconfig 10.10.11.1 255.255.255.252 \
-                --route 192.168.1.0 255.255.255.0 10.10.11.2 \
-                --tun-mtu 1500 --tun-mtu-extra 32 \
-                --fragment 1300 --mssfix \
-                --persist-tun --persist-key --resolv-retry 86400 \
-                --ping 10 --ping-restart 15 \
-                --verb 4 --mute 10 &
-−
-−
-        # end section
-        ;;
-−
- stop)
-        killall openvpn
-        ;;
- *)
-        echo "Usage: `basename $0` {start|stop}" >&2
-        ;;
- esac
-−
- exit 0
-−
-Don't forget to '''chmod 755 /usr/local/etc/rc.d/openvpn.sh''' to make sure you can execute it.
-−
-What you've got there is a setup (which can be started up or stopped like any other rc.d script - '''/usr/local/etc/rc.d/openvpn.sh start''' or '''stop''') which provides for two tunnels - one coming from a Windows machine, probably a laptop or something (labeled "dynamic VPN"; more on that in a minute) and one (labeled "persistent VPN") from another BSD or other *nix machine.
-−
-All we'll do on the other *nix box is copy over the '''openvpn.key''' we created on this machine, copy over this same script, comment out the:
-−
-* '''# 1b. Server side - persistent VPN''' section
-* ''un''comment the '''# 1a. Client side - persistent VPN''' side
-* and fire it up.
-−
-Once the scripts have been started on both machines (obviously you'll need a routeable IP address for at least the machine on the "server" side), presto, you've got a tunnel!
-−
-Obviously this article is unfinished, but work beckons.  More later.
-−
-[[Category:Ports and Packages]][[Category:Common Tasks]]

@@ Line 1: / Line 1: @@
-[http://openvpn.sourceforge.net OpenVPN] is an absolutely invaluable open source, cross platform Virtual Private Networking tool.  It uses SSL encryption (dynamic or 2048-bit static shared key), can use LZO stream compression, and is blindingly fast as well as vastly more secure compared to typical industry standard IPSEC + DES or IPSEC + 3DES solutions.  Better yet, it's so simple it can be run entirely from the command line.
+[http://openvpn.sourceforge.net OpenVPN] is a very useful open source, cross platform Virtual Private Networking tool.  It uses SSL encryption (dynamic or 2048-bit static shared key), can use LZO stream compression, and is blindingly fast as well as much more secure compared to typical industry standard IPSEC + DES or IPSEC + 3DES solutions.  Better yet, it's so simple it can be run entirely from the command line.
 ==Installing==
-To build it on a BSD machine, just:
+To build it on a FreeBSD machine, just:
   cd /usr/ports/security/openvpn

@@ Line 11: / Line 11: @@
 First, generate yourself a private key file and '''chmod''' it so that only its owner can read it:
   ph34r# '''openvpn --genkey --secret /usr/local/etc/openvpn.key'''
   ph34r# '''chmod 400 /usr/local/etc/openvpn.key'''

@@ Line 17: / Line 17: @@
 Note under FreeBSD5.4 with openvpn version 2.0.6
   ph34r# '''openvpn --genkey --secret /usr/local/etc/openvpn.key'''
 ==Starting OpenVPN==