User Tools
vpn-server
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| vpn-server [2024/11/05 21:51] – [A Warning about Certificates] -Condense hogwild | vpn-server [2024/11/24 10:52] (current) – CB -> CBC petervdm | ||
|---|---|---|---|
| Line 13: | Line 13: | ||
| \\ | \\ | ||
| - | However, there are still differences between versions. For example, clients and servers may be configured on different versions. Encryption algorithms may be negotiated differently among versions. FreshTomato 2024.3 includes OpenVPN 2.6.12. For details, see the OpenVPN documentation/ | + | However, there are still differences between versions. For example, clients and servers may be configured on different versions. Encryption algorithms may be negotiated differently among versions. FreshTomato 2024.3 includes OpenVPN 2.6.12. For details, see the OpenVPN documentation/ |
| \\ | \\ | ||
| Line 236: | Line 236: | ||
| * Encrypt Channel - (tls-crypt) [Direction] is set to 3. \\ Will use // | * Encrypt Channel - (tls-crypt) [Direction] is set to 3. \\ Will use // | ||
| - | * Encrypt Channel v2 - (tls-crypt-v2[Direction] is set to 4. \\ Will use // | + | * Encrypt Channel v2 - (tls-crypt-v2[Direction] is set to 4. \\ Uses // |
| \\ | \\ | ||
| Line 351: | Line 351: | ||
| * AES-128-GCM | * AES-128-GCM | ||
| * AES-256-GCM | * AES-256-GCM | ||
| - | * AES-128-CB | + | * AES-128-CBC |
| * AES-256-CBC | * AES-256-CBC | ||
| Line 448: | Line 448: | ||
| Here, you can specify a custom configuration for the OpenVPN server to use. | Here, you can specify a custom configuration for the OpenVPN server to use. | ||
| - | For details about valid custom parameters, please see: \\ [[https:// | + | For details about valid custom parameters, please see: \\ [[https:// |
| Line 459: | Line 459: | ||
| For a TLS handshake, both " | For a TLS handshake, both " | ||
| - | Every certificate is issued by a Certificate Authority, (" | + | Every certificate is issued by a Certificate Authority, (" |
| \\ | \\ | ||
| - | The first step to building an OpenVPN 2.x setup is to create a Public Key Infrastructure | + | The first step to building an OpenVPN 2.x setup is to create a Public Key Infrastructure. |
| A PKI consists of: | A PKI consists of: | ||
| Line 470: | Line 470: | ||
| * A separate certificate (public key) and private key for the server \\ and for each client | * A separate certificate (public key) and private key for the server \\ and for each client | ||
| - | * A master | + | * A master CA certificate and key used to sign each of the server |
| \\ | \\ | ||
| - | OpenVPN | + | OpenVPN |
| Both server and client authenticate each other: | Both server and client authenticate each other: | ||
| Line 489: | Line 489: | ||
| \\ | \\ | ||
| - | * The server only needs its own certificate/ | + | * The server only needs its own certificate/ |
| * The server will only accept clients whose certificates were signed \\ by the master CA certificate (which we'll generate below). \\ \\ Because the server can verify this signature without needing access \\ to the CA private key itself, you can store the CA key on another machine. \\ It can even be stored on a device not connected to the network. \\ This is crucial, since it's the most sensitive key in the entire PKI. \\ \\ | * The server will only accept clients whose certificates were signed \\ by the master CA certificate (which we'll generate below). \\ \\ Because the server can verify this signature without needing access \\ to the CA private key itself, you can store the CA key on another machine. \\ It can even be stored on a device not connected to the network. \\ This is crucial, since it's the most sensitive key in the entire PKI. \\ \\ | ||
| * If a private key is compromised, | * If a private key is compromised, | ||
| Line 550: | Line 550: | ||
| ==== A Warning about Certificates ==== | ==== A Warning about Certificates ==== | ||
| - | A common mistake when setting up a new Certificate Authority is to place all CA files on the OpenVPN server.%% **Avoid | + | A common mistake when setting up a new Certificate Authority is to place all CA files on the OpenVPN server.%% **Avoid this**. %%A CA needs a private key to sign the certificates clients and servers use. If you lose control of the CA private key, you can no longer trust certificates from that CA. At that point, anyone with access to the key can sign new certificates without your knowledge. Clients using those certificates can then connect to your OpenVPN server without |
| - | There are just 3 files you need to copy from a CA to achieve this: | + | There are 3 files you need to copy from a CA to achieve this: |
| \\ | \\ | ||
| Line 573: | Line 573: | ||
| - | ==== Adding Certificate Revocation Lists ==== | + | ==== Adding Certificate Revocation Lists (CRLs) |
| - | Within the CA, you can revoke certificates when needed. Using your preferred CA management tool, you can generate a Certificate Revocation List (CRL file). Adding this to the OpenVPN server should cause all client certificates to be checked against this revocation | + | Within the CA, you can revoke certificates when needed. Using your preferred CA management tool, you can generate a Certificate Revocation List (CRL file). Adding this to the OpenVPN server should cause all client certificates to be checked against this list. Clients |
| \\ | \\ | ||
| Line 592: | Line 592: | ||
| - | ==== OpenVPN Server Won't Start When EasyRSA3 used ==== | + | ==== OpenVPN Server Won't Start When EasyRSA3 |
| - | In some cases when you've generated server certificate/ | + | In some cases, when you've generated server certificate/ |
| \\ | \\ | ||
| Line 601: | Line 601: | ||
| ==== Routing Notes ==== | ==== Routing Notes ==== | ||
| - | To access | + | You must add network routes to access |
| \\ | \\ | ||
| - | To configure this, you need to add a line in the server configuration | + | For example, let's say: |
| + | |||
| + | * A server exists on 192.168.1.10 behind your VPN server. | ||
| + | * You want to access this server through the VPN. | ||
| + | |||
| + | \\ | ||
| + | |||
| + | You need to configure | ||
| + | |||
| + | To do this, you must add a line similar to this in the server configuration: | ||
| \\ | \\ | ||
| Line 612: | Line 621: | ||
| push "route 192.168.1.0 255.255.255.0" | push "route 192.168.1.0 255.255.255.0" | ||
| </ | </ | ||
| + | | ||
| + | You must then restart both the OpenVPN server and the client.\\ | ||
| - | \\ | + | This will cause the server to tell any client that connects to route all traffic for IP addresses in scope 192.168.1.XXX through the VPN. |
| - | Now, when the client connects, the server tells it that it should route all traffic for IP addresses in the 192.168.1.XXX scope through | + | This example describes a basic setup. The setup is almost complete. The only thing left is to add the appropriate routes, as with normal routing. |
| - | This is an example of a basic setup. When we now start on the routing part, the setup is mostly complete. At this point, all you need to add are the appropriate routes, just as you would for normal TCP/IP routing. | + | You also must ensure return routes. Just because a VPN client can access a host behind |
| - | Remember, you also need to consider return routes. Just because | + | For a more detailed example, see the%% %%Using routing%% %%section in the Bridging and routing wiki page. |
| - | For a more detailed example of using routing, see the%% %%Using routing%% %%section in the ' | ||
| - | + | ==== Routing all Traffic | |
| - | ==== Routing all Traffic | + | |
| You can route all network traffic over the VPN. The configuration for this is fairly simple. However, you'll need to learn how to configure NAT on your VPN server for the virtual TUN adapter. | You can route all network traffic over the VPN. The configuration for this is fairly simple. However, you'll need to learn how to configure NAT on your VPN server for the virtual TUN adapter. | ||
| Line 657: | Line 666: | ||
| ==== About IPv6 ==== | ==== About IPv6 ==== | ||
| - | OpenVPN v2.3 and later support IPv6. Setting up IPv6 in a VPN is similar to the IPv4 examples | + | OpenVPN v2.3 and later support IPv6. Configuring |
| \\ | \\ | ||
| Line 673: | Line 682: | ||
| \\ | \\ | ||
| - | You can use the // | + | You can use the // |
| + | |||
| + | \\ | ||
| + | |||
| + | The syntax is similar: | ||
| \\ | \\ | ||
vpn-server.1730843486.txt.gz · Last modified: 2024/11/05 21:51 by hogwild
Page Tools
