1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<title>OpenVPN</title>
<link rel="stylesheet" type="text/css" href="it.css">
<script type="text/javascript" src="jquery.js"></script><script type="text/javascript" src="jquery.syntax.js"></script><script type="text/javascript" src="yelp.js"></script><link rel="stylesheet" type="text/css" href="main.css">
<link rel="stylesheet" type="text/css" href="custom.css">
<script type="text/javascript" src="http://ubuntu-it.org/sites/all/themes/light-drupal-theme/js/cookies.js"></script><script type="text/javascript" src="http://ubuntu-it.org/sites/all/themes/light-drupal-theme/js/accessibility.js"></script>
</head>
<body>
<script type="text/javascript">var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");
document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));
</script><script type="text/javascript">
try {
var pageTracker = _gat._getTracker("UA-8147493-2");
pageTracker._trackPageview();
} catch(err) {}
</script><div id="fixed-header">
<div id="header" class="shadowed curved-bottom"><div class="container">
<ul class="links">
<li><a href="http://help.ubuntu-it.org">Documentazione ufficiale</a></li>
<li><a href="http://wiki.ubuntu-it.org/Documentazione/Indice">Guide della comunità</a></li>
<li class="active"><a href="http://help.ubuntu-it.org/12.04/server/serverguide/it/index.html">12.04 LTS</a></li>
</ul>
<div id="logo">
<div id="ubuntu-it-sites">
<a href="http://www.ubuntu-it.org">web </a><a href="http://wiki.ubuntu-it.org">wiki </a><a href="http://forum.ubuntu-it.org">forum </a><a href="http://planet.ubuntu-it.org">planet </a>
</div>
<a href="http://help.ubuntu-it.org" title="Ubuntu - Documentazione ufficiale"><span>help.</span>ubuntu-it
</a><span>comunità italiana</span>
</div>
<div class="buttons"><div id="accessibility" title="Maggiore focus ai contenuti" onclick="accessibility_toggle();"></div></div>
</div></div>
<div id="subheader"><div class="container"><div class="container-inside"><ul class="links secondary-links">
<li><a href="http://help.ubuntu-it.org/12.04/desktop/index.html" title="Guida utente di Ubuntu 12.04 LTS">Desktop</a></li>
<li class="active"><a href="http://help.ubuntu-it.org/12.04/server/serverguide/it/index.html" title="Guida utente di Ubuntu server 12.04 LTS">Server</a></li>
<li><a href="http://help.ubuntu-it.org/12.04/search.php" title="Ricerna della documentazione di Ubuntu 12.04 LTS">Ricerca</a></li>
</ul></div></div></div>
</div>
<div id="content">
<div id="content-top"></div>
<div class="container">
<div id="tmp-note">Questa guida non è stata ancora completamente tradotta. Se vuoi contribuire alla sua traduzione contatta il <a href="http://wiki.ubuntu-it.org/GruppoTraduzione/" title="Gruppo Traduzione">Gruppo Traduzione</a> di Ubuntu-it.</div>
<div id="search-box"><form action="http://help.ubuntu-it.org/12.04/search.php" id="cse-search-box"><div><input type="text" name="s" value="Cerca ..." onfocus="if(this.value == 'Cerca ...') { this.value = ''; }" onblur="if (this.value == '') {this.value = 'Cerca ...';}"></div></form></div>
<div class="trails"><div class="trail">
<a class="trail" href="index.html" title="Guida a Ubuntu Server">Guida a Ubuntu Server</a> » <a class="trail" href="vpn.html" title="VPN">VPN</a> » </div></div>
<div id="cwt-content"><div id="page">
<div id="content">
<div class="links nextlinks">
<a class="nextlinks-prev" href="vpn.html" title="VPN">Indietro</a> | <a class="nextlinks-next" href="other-useful-applications.html" title="Altre utili applicazioni">Avanti</a>
</div>
<div class="hgroup"><h1 class="title">OpenVPN</h1></div>
<div class="region">
<div class="contents"><p class="para">
If you want more than just pre-shared keys <span class="app application">OpenVPN</span> makes it easy to setup and use a Public Key Infrastructure (PKI)
to use SSL/TLS certificates for authentication and key exchange
between the VPN server and clients.
<span class="app application">OpenVPN</span> can be used in a routed or bridged VPN mode and can be configured to use either UDP or TCP. The port number can be configured as well, but port 1194 is the official one. And it is only using that single port for all communication. VPN client implementations are available for almost anything including all Linux distributions, OS X, Windows and OpenWRT based WLAN routers.
</p></div>
<div class="links sectionlinks"><ul>
<li class="links"><a class="xref" href="openvpn.html#openvpn-server-installation" title="Server Installation">Server Installation</a></li>
<li class="links"><a class="xref" href="openvpn.html#openvpn-pki-setup" title="Public Key Infrastructure Setup">Public Key Infrastructure Setup</a></li>
<li class="links"><a class="xref" href="openvpn.html#openvpn-simple-server-configuration" title="Simple Server Configuration">Simple Server Configuration</a></li>
<li class="links"><a class="xref" href="openvpn.html#openvpn-simple-client-configuration" title="Simple Client Configuration">Simple Client Configuration</a></li>
<li class="links"><a class="xref" href="openvpn.html#openvpn-first-troubleshooting" title="First trouble shooting">First trouble shooting</a></li>
<li class="links"><a class="xref" href="openvpn.html#openvpn-advanced-config" title="Advanved configuration">Advanved configuration</a></li>
<li class="links"><a class="xref" href="openvpn.html#openvpn-client-implementations" title="Client software implementations">Client software implementations</a></li>
<li class="links"><a class="xref" href="openvpn.html#openvpn-references" title="Riferimenti">Riferimenti</a></li>
</ul></div>
<div class="sect2 sect" id="openvpn-server-installation"><div class="inner">
<div class="hgroup"><h2 class="title">Server Installation</h2></div>
<div class="region"><div class="contents">
<p class="para">Per installare <span class="app application">openvpn</span>, in un terminale, digitare:</p>
<div class="screen"><pre class="contents "><span class="cmd command">sudo apt-get install openvpn</span>
</pre></div>
</div></div>
</div></div>
<div class="sect2 sect" id="openvpn-pki-setup"><div class="inner">
<div class="hgroup"><h2 class="title">Public Key Infrastructure Setup</h2></div>
<div class="region">
<div class="contents">
<p class="para">
The first step in building an OpenVPN configuration is to establish a PKI (public key infrastructure). The PKI consists of:
</p>
<div class="list itemizedlist"><ul class="list itemizedlist">
<li class="list itemizedlist"><p class="para">
a separate certificate (also known as a public key) and private key for the server and each client, and
</p></li>
<li class="list itemizedlist"><p class="para">
a master Certificate Authority (CA) certificate and key which is used to sign each of the server and client certificates.
</p></li>
</ul></div>
<p class="para">
OpenVPN supports bidirectional authentication based on certificates, meaning that the client must authenticate the server certificate and the server must authenticate the client certificate before mutual trust is established.
</p>
<p class="para">
Both server and client will authenticate the other by first verifying that the presented certificate was signed by the master certificate authority (CA), and then by testing information in the now-authenticated certificate header, such as the certificate common name or certificate type (client or server).
</p>
</div>
<div class="sect3 sect" id="openvpn-ca-setup"><div class="inner">
<div class="hgroup"><h3 class="title">Certificate Authority Setup</h3></div>
<div class="region"><div class="contents">
<p class="para">
To setup your own Certificate Authority (CA) and generating certificates and keys for an OpenVPN server and multiple clients
first copy the <span class="file filename">easy-rsa</span> directory to <span class="file filename">/etc/openvpn</span>. This will ensure that any
changes to the scripts will not be lost when the package is updated.
From a terminal change to user root and:
</p>
<div class="screen"><pre class="contents "><span class="cmd command">mkdir /etc/openvpn/easy-rsa/</span>
<span class="cmd command">cp -r /usr/share/doc/openvpn/examples/easy-rsa/2.0/* /etc/openvpn/easy-rsa/</span>
</pre></div>
<p class="para">Modificare quindi il file <span class="file filename">/etc/openvpn/easy-rsa/vars</span> sistemando quanto segue al proprio ambiente:</p>
<div class="code"><pre class="contents ">export KEY_COUNTRY="IT"
export KEY_PROVINCE="Roma"
export KEY_CITY="Roma"
export KEY_ORG="Società di esempio"
export KEY_EMAIL="mario@example.com"
</pre></div>
<p class="para">
Enter the following to generate the master Certificate Authority (CA) certificate and key:
</p>
<div class="screen"><pre class="contents "><span class="cmd command">cd /etc/openvpn/easy-rsa/</span>
<span class="cmd command">source vars</span>
<span class="cmd command">./clean-all</span>
<span class="cmd command">./build-ca</span>
</pre></div>
</div></div>
</div></div>
<div class="sect3 sect" id="openvpn-server-cert"><div class="inner">
<div class="hgroup"><h3 class="title">Certificati server</h3></div>
<div class="region"><div class="contents">
<p class="para">
Next, we will generate a certificate and private key for the server:
</p>
<div class="screen"><pre class="contents "><span class="cmd command">./build-key-server myservername</span>
</pre></div>
<p class="para">
As in the previous step, most parameters can be defaulted. Two other queries require positive responses, "Sign the certificate? [y/n]" and "1 out of 1 certificate requests certified, commit? [y/n]".
</p>
<p class="para">
Diffie Hellman parameters must be generated for the OpenVPN server:
</p>
<div class="screen"><pre class="contents "><span class="cmd command">./build-dh</span>
</pre></div>
<p class="para">
All certificates and keys have been generated in the subdirectory keys/. Common practice is to copy them to /etc/openvpn/:
</p>
<div class="screen"><pre class="contents "><span class="cmd command">cd keys/</span>
<span class="cmd command">cp myservername.crt myservername.key ca.crt dh1024.pem /etc/openvpn/</span>
</pre></div>
</div></div>
</div></div>
<div class="sect3 sect" id="openvpn-client-cert"><div class="inner">
<div class="hgroup"><h3 class="title">Certificati client</h3></div>
<div class="region"><div class="contents">
<p class="para">
The VPN client will also need a certificate to authenticate itself to the server. Usually you create a different certificate for each client. To create the
certificate, enter the following in a terminal while being user root:
</p>
<div class="screen"><pre class="contents "><span class="cmd command">cd /etc/openvpn/easy-rsa/</span>
<span class="cmd command">source vars</span>
<span class="cmd command">./build-key client1</span>
</pre></div>
<p class="para">
Copy the following files to the client using a secure method:
</p>
<div class="list itemizedlist"><ul class="list itemizedlist">
<li class="list itemizedlist"><p class="para">/etc/openvpn/ca.crt</p></li>
<li class="list itemizedlist"><p class="para">/etc/openvpn/easy-rsa/keys/client1.crt</p></li>
<li class="list itemizedlist"><p class="para">/etc/openvpn/easy-rsa/keys/client1.key</p></li>
</ul></div>
<p class="para">
As the client certificates and keys are only required on the client machine, you should remove them from the server.
</p>
</div></div>
</div></div>
</div>
</div></div>
<div class="sect2 sect" id="openvpn-simple-server-configuration"><div class="inner">
<div class="hgroup"><h2 class="title">Simple Server Configuration</h2></div>
<div class="region"><div class="contents">
<p class="para">
Along with your <span class="app application">OpenVPN</span> installation
you got these sample config files (and many more if if you check):
</p>
<div class="code"><pre class="contents ">root@server:/# ls -l /usr/share/doc/openvpn/examples/sample-config-files/
total 68
-rw-r--r-- 1 root root 3427 2011-07-04 15:09 client.conf
-rw-r--r-- 1 root root 4141 2011-07-04 15:09 server.conf.gz
</pre></div>
<p class="para">
Start with copying and unpacking server.conf.gz to /etc/openvpn/server.conf.
</p>
<div class="screen"><pre class="contents "><span class="cmd command">sudo cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz /etc/openvpn/</span>
<span class="cmd command">sudo gzip -d /etc/openvpn/server.conf.gz</span>
</pre></div>
<p class="para">
Edit <span class="file filename">/etc/openvpn/server.conf</span> to make sure the following lines are pointing to the certificates and keys you created in the section above.
</p>
<div class="code"><pre class="contents ">ca ca.crt
cert myservername.crt
key myservername.key
dh dh1024.pem
</pre></div>
<p class="para">
That is the minimum you have to configure to get a working OpenVPN server.
You can use all the default settings in the sample server.conf file. Now start the server. You will find logging and error messages in your syslog.
</p>
<div class="code"><pre class="contents ">root@server:/etc/openvpn# /etc/init.d/openvpn start
* Starting virtual private network daemon(s)...
* Autostarting VPN 'server' [ OK ]
</pre></div>
<p class="para">
Now check if OpenVPN created a tun0 interface:
</p>
<div class="code"><pre class="contents ">root@server:/etc/openvpn# ifconfig tun0
tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.8.0.1 P-t-P:10.8.0.2 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
[...]
</pre></div>
</div></div>
</div></div>
<div class="sect2 sect" id="openvpn-simple-client-configuration"><div class="inner">
<div class="hgroup"><h2 class="title">Simple Client Configuration</h2></div>
<div class="region"><div class="contents">
<p class="para">
There are various different <span class="app application">OpenVPN</span> client implementations
with and without GUIs. You can read more about clients in a later section.
For now we use the <span class="app application">OpenVPN</span> client for Ubuntu which is the same executable as the server. So you have to install the openvpn package again on the client machine:
</p>
<div class="screen"><pre class="contents "><span class="cmd command">sudo apt-get install openvpn</span>
</pre></div>
<p class="para">
This time copy the client.conf sample config file to /etc/openvpn/.
</p>
<div class="screen"><pre class="contents "><span class="cmd command">sudo cp /usr/share/doc/openvpn/examples/sample-config-files/client.conf /etc/openvpn/</span>
</pre></div>
<p class="para">
Copy the client keys and the certificate of the CA you created in the section above to e.g. /etc/openvpn/ and edit <span class="file filename">/etc/openvpn/client.conf</span> to make sure the following lines are pointing to those files. If you have the files in /etc/openvpn/ you can omit the path.
</p>
<div class="code"><pre class="contents ">ca ca.crt
cert client1.crt
key client1.key
</pre></div>
<p class="para">
And you have to at least specify the OpenVPN server name or address.
Make sure the keyword client is in the config. That's what enables
client mode.
</p>
<div class="code"><pre class="contents ">client
remote vpnserver.example.com 1194
</pre></div>
<p class="para">
Now start the OpenVPN client:
</p>
<div class="code"><pre class="contents ">root@client:/etc/openvpn# /etc/init.d/openvpn start
* Starting virtual private network daemon(s)...
* Autostarting VPN 'client' [ OK ]
</pre></div>
<p class="para">
Check if it created a tun0 interface:
</p>
<div class="code"><pre class="contents ">root@client:/etc/openvpn# ifconfig tun0
tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.8.0.6 P-t-P:10.8.0.5 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
</pre></div>
<p class="para">
Check if you can ping the OpenVPN server:
</p>
<div class="code"><pre class="contents ">root@client:/etc/openvpn# ping 10.8.0.1
PING 10.8.0.1 (10.8.0.1) 56(84) bytes of data.
64 bytes from 10.8.0.1: icmp_req=1 ttl=64 time=0.920 ms
</pre></div>
<div class="note" title="Annotazione"><div class="inner"><div class="region"><div class="contents">
<p class="para">
The OpenVPN server always uses the first usable IP address in the client network and only that IP is pingable. E.g. if you configured a /24 for the client network mask, the .1 address will be used. The P-t-P address you see in the ifconfig output above is usually not answering ping requests.
</p>
</div></div></div></div>
<p class="para">
Check out your routes:
</p>
<div class="code"><pre class="contents ">root@client:/etc/openvpn# netstat -rn
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
10.8.0.5 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
10.8.0.1 10.8.0.5 255.255.255.255 UGH 0 0 0 tun0
192.168.42.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
0.0.0.0 192.168.42.1 0.0.0.0 UG 0 0 0 eth0
</pre></div>
</div></div>
</div></div>
<div class="sect2 sect" id="openvpn-first-troubleshooting"><div class="inner">
<div class="hgroup"><h2 class="title">First trouble shooting</h2></div>
<div class="region"><div class="contents">
<p class="para">
If the above didn't work for you, check this:
</p>
<div class="list itemizedlist"><ul class="list itemizedlist">
<li class="list itemizedlist"><p class="para">
Check your syslog, e.g. grep -i vpn /var/log/syslog
</p></li>
<li class="list itemizedlist"><p class="para">
Can the client connect to the server machine? Maybe a firewall is blocking access? Check syslog on server.
</p></li>
<li class="list itemizedlist"><p class="para">
Client and server must use same protocol and port, e.g. UDP port 1194, see port and proto config option
</p></li>
<li class="list itemizedlist"><p class="para">
Client and server must use same config regarding compression, see comp-lzo config option
</p></li>
<li class="list itemizedlist"><p class="para">
Client and server must use same config regarding bridged vs routed mode, see server vs server-bridge config option
</p></li>
</ul></div>
</div></div>
</div></div>
<div class="sect2 sect" id="openvpn-advanced-config"><div class="inner">
<div class="hgroup"><h2 class="title">Advanved configuration</h2></div>
<div class="region">
<div class="contents"></div>
<div class="sect3 sect" id="openvpn-routed-server-configuration"><div class="inner">
<div class="hgroup"><h3 class="title">Advanced routed VPN configuration on server</h3></div>
<div class="region"><div class="contents">
<p class="para">
The above is a very simple working VPN. The client can access services on the VPN server machine through an encrypted tunnel. If you want to reach more servers or anything in other networks, push some routes to the clients. E.g. if your company's network can be summarized to the network 192.168.0.0/16, you could push this route to the clients. But you will also have to change the routing for the way back - your servers need to know a route to the VPN client-network.
</p>
<p class="para">
Or you might push a default gateway to all the clients to send all their internet traffic to the VPN gateway first and from there via the company firewall into the internet. This section shows you some possible options.
</p>
<p class="para">
Push routes to the client to allow it
to reach other private subnets behind
the server. Remember that these
private subnets will also need
to know to route the OpenVPN client
address pool (10.8.0.0/24)
back to the OpenVPN server.
</p>
<div class="code"><pre class="contents ">push "route 10.0.0.0 255.0.0.0"
</pre></div>
<p class="para">
If enabled, this directive will configure
all clients to redirect their default
network gateway through the VPN, causing
all IP traffic such as web browsing and
and DNS lookups to go through the VPN
(the OpenVPN server machine or your central firewall may need to NAT
the TUN/TAP interface to the internet in order for this to work properly).
</p>
<div class="code"><pre class="contents ">push "redirect-gateway def1 bypass-dhcp"
</pre></div>
<p class="para">
Configure server mode and supply a VPN subnet
for OpenVPN to draw client addresses from.
The server will take 10.8.0.1 for itself,
the rest will be made available to clients.
Each client will be able to reach the server
on 10.8.0.1. Comment this line out if you are
ethernet bridging.
</p>
<div class="code"><pre class="contents ">server 10.8.0.0 255.255.255.0
</pre></div>
<p class="para">
Maintain a record of client to virtual IP address
associations in this file. If OpenVPN goes down or
is restarted, reconnecting clients can be assigned
the same virtual IP address from the pool that was
previously assigned.
</p>
<div class="code"><pre class="contents ">ifconfig-pool-persist ipp.txt
</pre></div>
<p class="para">
Push DNS servers to the client.
</p>
<div class="code"><pre class="contents ">push "dhcp-option DNS 10.0.0.2"
push "dhcp-option DNS 10.1.0.2"
</pre></div>
<p class="para">
Allow client to client communication.
</p>
<div class="code"><pre class="contents ">client-to-client
</pre></div>
<p class="para">
Enable compression on the VPN link.
</p>
<div class="code"><pre class="contents ">comp-lzo
</pre></div>
<p class="para">
The keepalive directive causes ping-like
messages to be sent back and forth over
the link so that each side knows when
the other side has gone down.
Ping every 1 second, assume that remote
peer is down if no ping received during
a 3 second time period.
</p>
<div class="code"><pre class="contents ">keepalive 1 3
</pre></div>
<p class="para">
It's a good idea to reduce the OpenVPN daemon's privileges after initialization.
</p>
<div class="code"><pre class="contents ">user nobody
group nogroup
</pre></div>
<p class="para">
OpenVPN 2.0 includes a feature that allows the OpenVPN server to securely obtain a username and password from a connecting client, and to use that information as a basis for authenticating the client.
To use this authentication method, first add the auth-user-pass directive to the client configuration. It will direct the OpenVPN client to query the user for a username/password, passing it on to the server over the secure TLS channel.
</p>
<div class="code"><pre class="contents "># client config!
auth-user-pass
</pre></div>
<p class="para">
This will tell the OpenVPN server to validate the
username/password entered by clients using the login PAM module.
Useful if you have centralized authentication with e.g. Kerberos.
</p>
<div class="code"><pre class="contents ">plugin /usr/lib/openvpn/openvpn-auth-pam.so login
</pre></div>
<div class="note" title="Annotazione"><div class="inner"><div class="region"><div class="contents"> <p class="para">
Please read the OpenVPN <a class="ulink" href="http://openvpn.net/index.php/open-source/documentation/howto.html#security" title="http://openvpn.net/index.php/open-source/documentation/howto.html#security">hardening security guide</a> for further security advice.
</p>
</div></div></div></div>
</div></div>
</div></div>
<div class="sect3 sect" id="openvpn-bridged-server-configuration"><div class="inner">
<div class="hgroup"><h3 class="title">Advanced bridged VPN configuration on server</h3></div>
<div class="region">
<div class="contents"><p class="para">
<span class="app application">OpenVPN</span> can be setup for either a routed or a bridged VPN mode. Sometimes this is also referred to as OSI layer-2 versus layer-3 VPN. In a bridged VPN all layer-2 frames - e.g. all ethernet frames - are sent to the VPN partners and in a routed VPN only layer-3 packets are sent to VPN partners.
In bridged mode all traffic including traffic which was traditionally LAN-local like local network broadcasts, DHCP requests, ARP requests etc. are sent to VPN partners whereas in routed mode this would be filtered.
</p></div>
<div class="sect4 sect" id="openvpn-bridged-server-configuration-interface"><div class="inner">
<div class="hgroup"><h4 class="title">Prepare interface config for bridging on server</h4></div>
<div class="region"><div class="contents">
<p class="para">
Make sure you have the bridge-utils package installed:
</p>
<div class="screen"><pre class="contents "><span class="cmd command">sudo apt-get install bridge-utils</span>
</pre></div>
<p class="para">
Before you setup OpenVPN in bridged mode you need to change your interface configuration. Let's assume your server has an interface eth0 connected to the internet and an interface eth1 connected to the LAN you want to bridge. Your /etc/network/interfaces would like this:
</p>
<div class="code"><pre class="contents ">auto eth0
iface eth0 inet static
address 1.2.3.4
netmask 255.255.255.248
default 1.2.3.1
auto eth1
iface eth1 inet static
address 10.0.0.4
netmask 255.255.255.0
</pre></div>
<p class="para">
This straight forward interface config needs to be changed into a bridged mode like where the config of interface eth1 moves to the new br0 interface. Plus we configure that br0 should bridge interface eth1. We also need to make sure that interface eth1 is always in promiscuous mode - this tells the interface to forward all ethernet frames to the IP stack.
</p>
<div class="code"><pre class="contents ">auto eth0
iface eth0 inet static
address 1.2.3.4
netmask 255.255.255.248
default 1.2.3.1
auto eth1
iface eth1 inet manual
up ip link set $IFACE up promisc on
auto br0
iface br0 inet static
address 10.0.0.4
netmask 255.255.255.0
bridge_ports eth1
</pre></div>
<p class="para">
At this point you need to restart networking. Be prepared that this might not work as expected and that you will lose remote connectivity. Make sure you can solve problems having local access.
</p>
<div class="screen"><pre class="contents "><span class="cmd command">sudo /etc/init.d/network restart</span>
</pre></div>
</div></div>
</div></div>
<div class="sect4 sect" id="openvpn-bridged-server-configuration-server"><div class="inner">
<div class="hgroup"><h4 class="title">Prepare server config for bridging</h4></div>
<div class="region"><div class="contents">
<p class="para">Modificare il file <span class="file filename">/etc/openvpn/server.conf</span> cambiando le seguenti opzioni:</p>
<div class="code"><pre class="contents ">;dev tun
dev tap
up "/etc/openvpn/up.sh br0 eth1"
;server 10.8.0.0 255.255.255.0
server-bridge 10.0.0.4 255.255.255.0 10.0.0.128 10.0.0.254
</pre></div>
<p class="para">
Next, create a helper script to add the <span class="em emphasis">tap</span> interface to the bridge and to ensure that eth1 is promiscuous mode. Create <span class="file filename">/etc/openvpn/up.sh</span>:
</p>
<div class="code"><pre class="contents ">#!/bin/sh
BR=$1
ETHDEV=$2
TAPDEV=$3
/sbin/ip link set "$TAPDEV" up
/sbin/ip link set "$ETHDEV" promisc on
/sbin/brctl addif $BR $TAPDEV
</pre></div>
<p class="para">
Then make it executable:
</p>
<div class="screen"><pre class="contents "><span class="cmd command">sudo chmod 755 /etc/openvpn/up.sh</span>
</pre></div>
<p class="para">Una volta configurato il server, riavviare <span class="app application">openvpn</span> digitando:</p>
<div class="screen"><pre class="contents "><span class="cmd command">sudo /etc/init.d/openvpn restart</span>
</pre></div>
</div></div>
</div></div>
<div class="sect4 sect" id="openvpn-client-configuration"><div class="inner">
<div class="hgroup"><h4 class="title">Configurazione del client</h4></div>
<div class="region"><div class="contents">
<p class="para">Installare <span class="app application">openvpn</span> sul client:</p>
<div class="screen"><pre class="contents "><span class="cmd command">sudo apt-get install openvpn</span>
</pre></div>
<p class="para">Configurato il server e copiati i certificati del client nella directory <span class="file filename">/etc/openvpn/</span>, creare un file di configurazione per il client copiando l'esempio. Nel computer client, da un terminale, digitare:</p>
<div class="screen"><pre class="contents "><span class="cmd command">sudo cp /usr/share/doc/openvpn/examples/sample-config-files/client.conf /etc/openvpn</span>
</pre></div>
<p class="para">Ora modificare <span class="file filename">/etc/openvpn/client.conf</span> sistemando le seguenti opzioni:</p>
<div class="code"><pre class="contents ">dev tap
;dev tun
</pre></div>
<p class="para">Infine, riavviare <span class="app application">openvpn</span>:</p>
<div class="screen"><pre class="contents "><span class="cmd command">sudo /etc/init.d/openvpn restart</span>
</pre></div>
<p class="para">Ora dovrebbe essere possibile connettersi alla rete LAN remota attraverso VPN.</p>
</div></div>
</div></div>
</div>
</div></div>
</div>
</div></div>
<div class="sect2 sect" id="openvpn-client-implementations"><div class="inner">
<div class="hgroup"><h2 class="title">Client software implementations</h2></div>
<div class="region">
<div class="contents"></div>
<div class="sect3 sect" id="openvpn-client-networkmanager"><div class="inner">
<div class="hgroup"><h3 class="title">Linux Network-Manager GUI for OpenVPN</h3></div>
<div class="region"><div class="contents">
<p class="para">
Many Linux distributions including Ubuntu desktop variants come with Network Manager,
a nice GUI to configure your network settings. It also can manage your VPN connections. Make sure you have package network-manager-openvpn installed. Here you see that the installation installs all other required packages as well:
</p>
<div class="code"><pre class="contents ">root@client:~# apt-get install network-manager-openvpn
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following extra packages will be installed:
liblzo2-2 libpkcs11-helper1 network-manager-openvpn-gnome openvpn
Suggested packages:
resolvconf
The following NEW packages will be installed:
liblzo2-2 libpkcs11-helper1 network-manager-openvpn
network-manager-openvpn-gnome openvpn
0 upgraded, 5 newly installed, 0 to remove and 631 not upgraded.
Need to get 700 kB of archives.
After this operation, 3,031 kB of additional disk space will be used.
Do you want to continue [Y/n]?
</pre></div>
<p class="para">
To inform network-manager about the new installed packages you will have to restart it:
</p>
<div class="code"><pre class="contents ">root@client:~# restart network-manager
network-manager start/running, process 3078
</pre></div>
<p class="para">
Open the Network Manager GUI, select the VPN tab and then the 'Add' button. Select OpenVPN
as the VPN type in the opening requester and press 'Create'. In the next window
add the OpenVPN's server
name as the 'Gateway', set 'Type' to 'Certificates (TLS)', point 'User Certificate'
to your user certificate, 'CA Certificate' to your CA certificate and 'Private Key'
to your private key file. Use the advanced button to enable compression or other
special settings you set on the server. Now try to establish your VPN.
</p>
</div></div>
</div></div>
<div class="sect3 sect" id="openvpn-client-osx"><div class="inner">
<div class="hgroup"><h3 class="title">OpenVPN with GUI for Mac OS X: Tunnelblick</h3></div>
<div class="region"><div class="contents">
<p class="para">
Tunnelblick is an excellent free, open source implementation of a GUI for OpenVPN for OS X.
The project's homepage is at <a class="ulink" href="http://code.google.com/p/tunnelblick/" title="http://code.google.com/p/tunnelblick/">http://code.google.com/p/tunnelblick/</a>. Download the latest OS X installer from there and install it. Then put your client.ovpn config file together with the certificates and keys in
/Users/username/Library/Application Support/Tunnelblick/Configurations/ and lauch Tunnelblick from your Application folder.
</p>
<div class="code"><pre class="contents "># sample client.ovpn for Tunnelblick
client
remote blue.example.com
port 1194
proto udp
dev tun
dev-type tun
ns-cert-type server
reneg-sec 86400
auth-user-pass
auth-nocache
auth-retry interact
comp-lzo yes
verb 3
ca ca.crt
cert client.crt
key client.key
</pre></div>
</div></div>
</div></div>
<div class="sect3 sect" id="openvpn-client-win"><div class="inner">
<div class="hgroup"><h3 class="title">OpenVPN with GUI for Win 7</h3></div>
<div class="region"><div class="contents">
<p class="para">
First download and install the latest <a class="ulink" href="http://www.openvpn.net/index.php/open-source/downloads.html" title="http://www.openvpn.net/index.php/open-source/downloads.html">OpenVPN Windows Installer</a>. OpenVPN 2.2.1 was the latest when this was written.
Additionally download an alternative Open VPN Windows GUI. The OpenVPN MI GUI from <a class="ulink" href="http://openvpn-mi-gui.inside-security.de" title="http://openvpn-mi-gui.inside-security.de">http://openvpn-mi-gui.inside-security.de</a> seems to be a nice one for Windows 7.
Download the latest version. 20110624 was the latest version when this was written.
</p>
<p class="para">
You need to start the OpenVPN service. Goto Start > Computer > Manage > Services and Applications > Services. Find the OpenVPN service and start it. Set it's startup type to automatic. When you start the OpenVPN MI GUI the first time you need to run it as an administrator. You have to right click on it and you will see that option.
</p>
<p class="para">
You will have to write your OpenVPN config in a textfile and place it in C:\Program Files\OpenVPN\config\client.ovpn along with the CA certificate. You could put the user certificate in the user's home directory like in the follwing example.
</p>
<div class="code"><pre class="contents "># C:\Program Files\OpenVPN\config\client.ovpn
client
remote server.example.com
port 1194
proto udp
dev tun
dev-type tun
ns-cert-type server
reneg-sec 86400
auth-user-pass
auth-retry interact
comp-lzo yes
verb 3
ca ca.crt
cert "C:\\Users\\username\\My Documents\\openvpn\\client.crt"
key "C:\\Users\\username\\My Documents\\openvpn\\client.key"
management 127.0.0.1 1194
management-hold
management-query-passwords
auth-retry interact
</pre></div>
</div></div>
</div></div>
<div class="sect3 sect" id="openvpn-client-openwrt"><div class="inner">
<div class="hgroup"><h3 class="title">OpenVPN for OpenWRT</h3></div>
<div class="region"><div class="contents">
<p class="para">
OpenWRT is described as a Linux distribution for embedded devices like WLAN router.
There are certain types of WLAN routers who can be flashed to run OpenWRT.
Depending on the available memory on your OpenWRT router you can run software like
OpenVPN and you could for example build a small inexpensive branch office router with VPN connectivity
to the central office.
More info on OpenVPN on OpenWRT is <a class="ulink" href="http://wiki.openwrt.org/doc/howto/vpn.overview" title="http://wiki.openwrt.org/doc/howto/vpn.overview">here</a>. And here is the OpenWRT project's homepage: <a class="ulink" href="http://openwrt.org" title="http://openwrt.org">http://openwrt.org</a>
</p>
<p class="para">
Log into your OpenWRT router and install OpenVPN:
</p>
<div class="screen"><pre class="contents "><span class="cmd command">opkg update</span>
<span class="cmd command">opkg install openvpn</span>
</pre></div>
<p class="para">
Check out /etc/config/openvpn and put you client config in there.
Copy certificated and keys to /etc/openvpn/
</p>
<div class="code"><pre class="contents ">config openvpn client1
option enable 1
option client 1
# option dev tap
option dev tun
option proto udp
option ca /etc/openvpn/ca.crt
option cert /etc/openvpn/client.crt
option key /etc/openvpn/client.key
option comp_lzo 1
</pre></div>
<p class="para">
Restart OpenVPN:
</p>
<div class="screen"><pre class="contents "><span class="cmd command">/etc/init.d/openvpn restart</span>
</pre></div>
<p class="para">
You will have to see if you need to adjust your router's routing and firewall rules.
</p>
</div></div>
</div></div>
</div>
</div></div>
<div class="sect2 sect" id="openvpn-references"><div class="inner">
<div class="hgroup"><h2 class="title">Riferimenti</h2></div>
<div class="region"><div class="contents"><div class="list itemizedlist"><ul class="list itemizedlist">
<li class="list itemizedlist">
<p class="para">Per maggiori informazioni, consultare il sito web di <a class="ulink" href="http://openvpn.net/" title="http://openvpn.net/">OpenVPN</a>.</p>
</li>
<li class="list itemizedlist">
<p class="para">
<a class="ulink" href="http://openvpn.net/index.php/open-source/documentation/howto.html#security" title="http://openvpn.net/index.php/open-source/documentation/howto.html#security">OpenVPN hardening security guide</a>
</p>
</li>
<li class="list itemizedlist">
<p class="para">Un'ottima risorsa è anche <a class="ulink" href="http://www.packtpub.com/openvpn/book" title="http://www.packtpub.com/openvpn/book">OpenVPN: Building and Integrating Virtual Private Networks</a> di Pakt (in inglese).</p>
</li>
</ul></div></div></div>
</div></div>
</div>
<div class="links nextlinks">
<a class="nextlinks-prev" href="vpn.html" title="VPN">Indietro</a> | <a class="nextlinks-next" href="other-useful-applications.html" title="Altre utili applicazioni">Avanti</a>
</div>
<div class="clear"></div>
</div>
<div id="pagebottom"></div>
</div></div>
</div>
<div id="content-bottom"></div>
</div>
<div id="footer"><div class="container">
<div id="ubuntulinks">Ubuntu e Canonical sono marchi registrati da Canonical Ltd. <br>
Questa opera è pubblicata sotto una <span style="text-decoration: underline;"><a href="http://help.ubuntu-it.org/legal.html">licenza</a></span> Creative Commons.
</div>
<div id="pagebottom"></div>
</div></div>
</body>
</html>