Beginning OpenVPN 2.0.9

Beginning

OpenVPN

2.0.9

Build

and

_integrate

Virtual

Private Networks

_using

OpenVPN

Markus Feilner

Norbert Graf

PUBLISHING

Table

of

Contents

Preface ₁

Chapter 1: VPN—Virtual Private Network 7 Broadband Internet access and VPNs 9

How does a VPN work? ₁₀

What are VPNs used for? ₁₂

Networking

concepts—protocols and

_layers

₁₃

Tunneling

and overhead ₁₆

VPN_{concepts—overview 17}

A _proposed standard for_tunneling 17 Protocols _implemented on OSI _layer2 18 Protocols

_implemented

on OSI layer3 19

Protocols

_implemented

on OSI _layer 4 ₂₀

OpenVPN—a

SSL/TLS-based solution ₂₁

Summary

21

Chapter

2: _{VPN Security 23}

VPN

_security

₂₃

Privacy—encrypting

traffic 24

Symmetric encryption

and _pre-shared

_keys

₂₅

Reliability

and authentication ₂₆

The _problem of

_complexity

in classic VPNs 26

Asymmetric

encryption

with SSL/TLS 27

SSL/TLS

_security

₂₈

HTTPS ₂₉

Understanding

SSL/TLS certificates ₃₀

Trusted certificates ₃₀

TableofContents

SSL/TLS certificates and VPNs 33

Generating certificates and

_keys

34

Summary 34 Chapter3: OpenVPN 35

Advantages

ofOpenVPN 35 History of

_OpenVPN

37 OpenVPN Version 1 38 OpenVPNVersion 2 41

The road to version 2.1 42

Networkingwith_OpenVPN 44

OpenVPN

and firewalls 46

Configuring OpenVPN

47

Problems with

_OpenVPN

48

OpenVPN compared

to IPsecVPN 49

User spaceversus kernel space 51

Sources for _helpanddocumentation 51

The

_project

_community 52

Documentation in the software _packages 52

Summary

53

Chapter

4:

_Installing

OpenVPN on Windows and Mac 65

Obtaining

the software 55

Installing

OpenVPN

on Windows 56

Downloading and _startinginstallation 56

Selectingthe _componentsand location 57

Finishing installation 59

Testing

the installation—a first look at the

_{panel applet}

60

Installing OpenVPN

on Mac OS X

(Tunnelblick)

62

Testing

the installation—the Tunnelblick

_{panel applet}

64

Summary 65

Chapter

5:

Installing OpenVPN

on Linux and Unix

Systems

67

Prerequisites 67

Installing

OpenVPNon SuSE Linux 68

Using

YaSTto install software 69

Installing OpenVPN

on Red Hat Fedora _{using yum} 72

Installing

OpenVPN on RedHat

Enterprise

Linux 75

Installing OpenVPN on RPM-based _systems 77

Using wget to download _OpenVPN RPMs 78

Installing OpenVPN

and the LZO

_library

with _wget and RPM 79

of

Installing OpenVPNon Debian and Ubuntu 82

Installing

Debian

_packages

84

Using Aptitude

to search and install _packages 86

OpenVPN—the

files installed on Debian 88

Installing

OpenVPN

on FreeBSD 88

Installing a newer version ofOpenVPN on FreeBSD—the ports system 91

Installingthe portsystemwith_sysinstall 91

Downloading and_installinga BSDport 92

Summary 94

Chapter

6:Advanced

OpenVPN

Installation 95

Troubleshooting—advanced

installation methods 95

Installing

OpenVPN fromsource code 96

Building

and

_distributing

.deb

_packages

102

Building your own RPMfile 104

Enabling Linux kernel TUN/TAP _support 106 Using menuconfig 107

Summary 109

Chapter7: Configuring an OpenVPN Server—The First Tunnel 111

OpenVPN

on MicrosoftWindows 112

Generating

a static

_{OpenVPN key}

113

Creatinga _sampleconnection - 115

Adaptingthe_{sample configuration}file_{provided by OpenVPN} 117

Startingand_testingthe tunnel 119

A brief look at Windows

_OpenVPN

network interfaces 121

Connecting Windows and Linux 122

File

_exchange

betweenWindows and Linux 123

WinSCP 123

Transferringthe_keyfile from Windows to Linux with WinSCP 124 The second_{pitfall—carriage}return/end of line 126

Configuring

the Linux _system 127

Testing the tunnel 129

A look at the Linux network interfaces 130

Running OpenVPN automatically 131

OpenVPNas a server onWindows 131

OpenVPNas aserveronLinux 133

Runlevels andinitscriptsonLinux 133

Using runleveland initto_changeand check runlevels 134 The_systemcontrol for runlevels 135

Managing init_scripts 136

TableofContents

Troubleshooting firewall issues 139

Deactivating

the Windows XP service

_pack

2 firewall 139

Stopping

the SuSE firewall 141

Summary

142

Chapter

8:

_{Setting Up}

OpenVPN with X.509 Certificates 143

Creating

certificates 143

Certificate _generation on Windows Server 2008 with easy-rsa 144

Setting variables—editing vars.bat 145

Creating the Diffie-Hellman_key 146

Building the certificate _authority 147

Generating serverand clientkeys 148

Distributing

the files to the VPN _partners 152

Configuring OpenVPN

to use certificates 154

Using

easy-rsaon Linux 157

Preparing

variables in vars 158

Creating the Diffie-Hellman_key and thecertificate

_authority

158

Creating the firstserver _{certificate/key pair} 159

Creating

furthercertificates and _keys 161

Troubleshooting

162

Summary

163

Chapter

9: The Command openvpn and Its

Configuration

File 165

Syntaxof openvpn 166

OpenVPN command-line _parameters 166

Using OpenVPN atthe command line 167

Parameters used in the standard

_{configuration}

file fora static

key

client 169

Compressing

the data 169

Controlling

and

_restarting

thetunnel 172

Debugging output—troubleshooting 173

Configuring OpenVPNwith _{certificates—simple}TLS mode 175 Overview of _{OpenVPN parameters} 176

General tunnel

_options

176

Routing

179

Controlling

thetunnel 181

Scripting

182

Modules 182

Logging 184

Specifying

a user and _group 185

The_{management interface} 186

Proxies 188

of

Testingthe _{crypto system} with _-test-crypto 190

SSL information—command line ₁₉₁

Server mode ₁₉₅

Server modeparameters 196

--client-configoptions 199

Client mode _parameters 201

Pushoptions 202

Important Windows-specific

options 203

New in Version 2.1 204 Connection _profiles 204 Topology mode 205 Script-security 206

Port-sharing

206 Test 206 Summary 207

Chapter 10: Securing OpenVPN Tunnels and Servers 209

Securingand stabilizing OpenVPN 209

Authentication 212

Using

authentication methods 213

Authentication _pluginsoverview 216

Authentication with tokens 217

Individual authentication with Pam-per-user 218

Linux and Firewalls 220 Debian Linux and Webminwith Shorewall 221

InstallingWebminand Shorewall 221

LookingatWebmin 222

PreparingWebmin and Shorewall for the first start 223

Preparingthe Shoreline firewall 224

TroubleshootingShorewall—editingtheconfigurationfiles 225

OpenVPN

and SuSEfirewall 228

Routing

and firewalls 230

Configuringa router withoutafirewall 230

iptables—the standard Linuxfirewalltool 230

Configuring

the Windows Firewall for

_OpenVPN

234

Summary

238

Chapter

11: Advanced Certificate

_Management

239

Certificate _managementand _security 239

Installing xca 240

Using xca 240

TableofContents

Importinga CA certificate 242

Creating and _signing a newserver/client certificate 244

Revoking certificates with xca 248

Using

TinyCA2

to _{manage certificates} 250

ImportingourCA 250

Using TinyCA2for CA administration 251

Creatingnewcertificates andkeys 252

Exporting keys and certificates with_TinyCA2 254

Revokingcertificates with_TinyCA2 255

Other tools worth _mentioning 255

Summary

256

Chapter

12: OpenVPN GUI Tools 257

OpenVPN

serveradministration: Webmin's

OpenVPN plugin

257

ClientGUIsforLinux 260

KVpnc 260

GAdmin-OpenVPN-Client 262

NetworkManager

263

Summary

264

Chapter

13: Advanced

_{OpenVPN Configuration}

265

Tunneling

a _proxyserverand _protecting the _proxy 266

Scripting

OpenVPN—an overview 268

Using a client_{configuration directory} with _per-client

_{configurations}

270 Individual firewall rules for

_connecting

clients 273

Distributed

_{compilation through}

VPN tunnels with distcc 275

Ethernet

_bridging

with

_OpenVPN

277

Automatic installation for Windows clients 279

Clustering

and

_redundancy

284

Summary 285

Chapter 14: Mobile Securitywith OpenVPN 287

Anonymous

and uncensored InternetAccess 287

OpenVPN

onWindows Mobile 289

Embedded Linux- Maemo

292

Summary

294

Chapter

15: Troubleshooting andMonitoring 295

Testing networkconnectivity 295

Checking interfaces, routing, and _connectivityon the VPN servers 298

Debugging

with _tcpdump and IPTraf 303

Using OpenVPN

protocol and status files for

_debugging

305

Scanning

servers with _Nmap 307

of Monitoring tools 308 ntop 309 Munin ₃₁₀

Nagios

311 OpenVPNgraph 312

Summary

313

Appendix: Internet Resources and More 315