Tags:
OpenVPN is an open-source SSL VPN software. It allows you to connect different (private) networks securely over the internet. It's the perfect alternative to all the crappy SSL VPN appliances that the salesmen desperately try to sell. See my OpenVPN FAQ for additional questions and answers.
(This is not the official OpenVPN FAQ. It's just my personal answers to my personal questions.)
IPs and routing
How do I assign my users fixed IP addresses?
Use ''client-config-dir'' and push the IP addresses to a certain client using this line in the client-specific configuration file:
ifconfig-push 10.100.8.1 10.100.8.2
This will assign John_Doe the IP address 10.100.8.1. The other IP address is assigned to the OpenVPN server - you won't see it there through ifconfig though.
The server also needs to route this IP (or a range) through the tunnel. So your server.conf needs to contain a route entry for all the static IPs that you will assign:
route 10.100.8.0 255.255.255.0
Which iptables rules are needed to allow OpenVPN connections?
First you need to allow UDP 1194 incoming and outgoing connections on your main interface:
iptables -A INPUT -i eth0 -p udp --dport 1194 -j ACCEPT iptables -A OUTPUT -o eth0 -p udp --dport 1194 -j ACCEPT
Next you need to allow certain traffic going through the tunnel. If you don't want any restrictions then use:
iptables -A INPUT -i tun0 -j ACCEPT iptables -A OUTPUT -o tun0 -j ACCEPT iptables -A FORWARD -o tun0 -j ACCEPT
How do I make a network on the remote side of the tunnel accessible?
You need both a route and an iroute configuration directive on your server.
iroute 192.168.152.128 255.255.255.128 route 192.168.152.128 255.255.255.128
Note: the iroute statement best belongs in the ''client-config-dir'' directory. The route statement needs to be in your global server configuration file.
Also don't forget to route that network to your OpenVPN server. The route and iroute statements will just tell OpenVPN that this network is supposed to be reached through a VPN tunnel.
How do I let remote Windows clients browse my network?
Network browsing requires WINS to function across a router even in a full AD network. You will need to configure a WINS server and point your remote users to it.
You will also need to prevent them from assuming responsibility for maintaining the browse list. This is done with a couple of registry changes:
HKLM\System\CurrentControlSet\Services\Browser\Parameters
Make sure that IsDomainMaster and MaintainServerList are both set to FALSE.
Of course, any firewalling you are doing in the tunnel will need to allow the underlying NetBIOS traffic.
John A. Sullivan III
Certificates
How do I revoke a certificate?
If you want to permanently revoke access for a certain user you need to revoke the certificate that you issued. Revoking means that you list that certificate in a certificate revocation list (CRL). Once your OpenVPN server has a crl-verify option set that points to your CRL the certificates of new incoming connections will be checked against that CRL. If a certificate is listed there the access is denied. See the make-crl and revoke-full commands as part of Easy-RSA. And don't forget to copy the new CRL to the OpenVPN server. You do not need to restart the server since the CRL is considered automatically everytime a user connects.
Why is it bad to use static keys?
- anyone can create an OpenVPN server and fool users (man-in-the-middle-attack)
- you cannot revoke access for one user but need to distribute a new static key to everyone else
Which files do I need to keep secret?
The private keys (suffix '.key') need to be kept secret. The certitifcates (suffix '.crt') can be exchanged freely and even sent through unsecured channels like email.
Operation
Who is currently connected to my OpenVPN server?
TELNET interface
Use the TELNET interface and issue a status command.
Status file
Add these lines to your server configuration file:
status status.log 5 status-version 2
This will write the current status of the OpenVPN server to the given logfile every 5 seconds in the configuration directory. Lines starting with CLIENT_LIST show you the connected users.
If you like to collect statistics on how many users are online at a given time (MRTG creates nice graphs) you can use this one-liner:
grep ^CLIENT_LIST /etc/openvpn/status.log | wc -l
How can I disconnect a client from the OpenVPN server?
Use the TELNET interface and issue a kill command on the common name of the client. The client will be able to reconnect though unless you revoke its certificate. Killing a client may be useful if you have changed a configuration file in the client-config-dir.
Do I have to restart OpenVPN after every configuration change?
Changes to the global configuration file (e.g. /etc/openvpn/server.conf) require a restart of the OpenVPN service. Consider using the ''client-config-dir'' option to set client-specific parameters. Such configuration files will be read when a client connects and do not require a restart.
From time to time you will need to restart the server e.g. if you need to add a route entry. Consider adding this lien to your server configuration though:
keepalive 1 5 persist-tun persist-key persist-local-ip persist-remote-ip push "persist-key" push "persist-tun"
It will make the client send a "ping" to the server every second. If there is no reply to that "ping" after 5 seconds then the connection will be re-initiated. The default connection timeout is very large and will surely annoy your users. If they get disconnected for less than 10 seconds they will complain less likely. The persist-* settings will make the client keep the tunnel device open so existing connections won't be interrupted during the renegotiation. Otherwise permanent connections like shell sessions would be disconnected.
How do I use the 'client-config-dir' parameter?
The client config directory is a location where you put custom client-specific configuration files. Example in your global configuration (e.g. /etc/openvpn/server.conf):
client-config-dir /etc/openvpn/clients
Then put files with the common names of your users there. The common name must match the filename exactly. Let's pretend you have a user with the common name "John_Doe" on his certificate. Create a file /etc/openvpn/clients/John_Doe and make it contain configuration directives that should only apply to John Doe. The following directives are allowed there:
- push
- push-reset
- iroute
- ifconfig-push
- config
Example /etc/openvpn/clients/John_Doe:
iroute 112.12.58.128 255.255.255.240 ifconfig-push 10.100.8.1 10.100.8.2
This will assign John Doe the IP 10.100.8.1 on his side of the VPN tunnel. Also the server will learn that the network 112.12.58.128/28 is on John's side of the VPN tunnel and route packets there. (Note that you also need to create a "route 112.12.58.128 255.255.255.240" in your global configuration to make the OpenVPN server learn this route. The "route" command does not work within a client-config-dir configuration file.)
The charming advantage of client-config-dir configurations is that you don't need to restart your OpenVPN server to make changes to these files work. Every time a client connects the client-config-dir will be searched for an appropriate file and if one is found the configuration will be applied.
There is also a special DEFAULT file that contains settings in case there is no configuration file for a certain client.
How can I access the TELNET management console?
You need to start OpenVPN with the --management option. For example --management 127.0.0.1 12345 as a startup parameter will get you access to the TELNET console on port 12345 on localhost. Accessing the console then is as easy as telnet localhost 12345. This is what you get:
Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. >INFO:OpenVPN Management Interface Version 1 -- type 'help' for more info
This is a security risk though because everybody can access the console without any further authentication.
Interoperability
Does OpenVPN work with Juniper/Nortel/Checkpoint VPNs?
No. OpenVPN just works with other OpenVPN clients/servers. OpenVPN is not an IPSEC software. It uses SSL to create VPN tunnels instead.
12 Comments
ask permission to copy the article
Submitted by nuttinu (not verified) on
I have copied and pasted your article to my blog for another reference of openVPN
please review it http://nuttinu.wordpress.com/2010/07/18/openvpn-mini-faq/
if you don't wish your article to be added, please do let me know.
thanks before
regards, nuttinu
Letting you know
Submitted by Christoph Haas on
I'd like you to remove the copy from your page. Usually it's nice to ask first and copy laster. Besides you are making money (Google Ads) with my work.
Apparently you have improved the page (which I like of course) and I'd be happy to include your changes if you like.
nice to know that you replied
Submitted by nuttinu (not verified) on
nice to know that you replied it..sorry for not asking for your permission first
i don't use it for google ads FYI. at first i wanted to try your post for myself.but it seems that you do mind about it
by the way..i have deleted my post that i copied from you.you can check it by urself
Thanks for your fairness.
Submitted by Christoph Haas on
Thanks for your fairness. Could we perhaps add your improvements to this page (of course having your name mentioned)?
Btw, I've checked your page (when it was still online) and found an "Ads by Google" section at the bottom. That made me wonder.
auth-user-pass in ccd
Submitted by Patxi (not verified) on
Hi Christopher,
Thank you very much for the mini-faq.
I have a little question:
is it possible to add auth-user-pass in a client's configuration file in the client-config-dir at the server?
Some how
for example?
Thank you very much one more time.
Glad you like the mini-FAQ.
Submitted by Christoph Haas on
Glad you like the mini-FAQ. Puttiing the authentication for a client into its config file in the client-config-dir is not supported as far as I know. But I have an idea that you could try:
You could put the username and passsword into comments of each CCD file. Like:
And then you could write a shell script to use as an auth-user-pass-verify script that parses these comments and verifies the username and password. The "$common_name" environment variable is set to the certificate's common name which will help the shell script find the proper file, do a grep and awk and then you can check it.
Not sure that's really a good idea security-wise though. I personally use a script to check the username and password against LDAP.
openvpn client windows static ip assining not work
Submitted by Anonymous (not verified) on
Hi !
glad to see this page, well i have question, as we using openvpn in windows 2003server, and when ever we connect with client its give different ip then last time thats means DHCP ip working but i want to use static ip insted of DHCP, in your FAQ you only mention about how to fix static ip in linux. Kindly guide us that how we fix this problem thanks
Sheher yar Khan
SITO oy
Client-specific redirect-gateway?
Submitted by Etnoy (not verified) on
Hello and thanks for your great article, I didn't know about client-config-dir before and it seems very useful to my needs. I'm setting up a smallish OpenVPN server for my family, and it's working great. I was just wondering if you know of any way to let the clients themselves decide to use redirect-gateway or not.
For instance, if I'm is sitting at a trusted high-speed network I don't need to surf through the secure channel. However, when sitting on a public hotspot, the VPN channel can be very useful and improves security. Do I need to comment/uncomment push-reset every time to change this? Do you know of any way to change this in a more GUI fashion? (Me and my family uses the Windows GUI).
Thanks a bunch,
Jonathan
Is it possible to have access restriction on openVPN clients?
Submitted by openVPN newbie (not verified) on
hi,
I have an openVPN environment set up I have one openVPN server and appromixately 100 openVPN clients. I would like to know if it is possible to have an access control list of such to control which client can connect to the openVPN server. I am looking at a scenario where I would like to deny access to some of the clients when needed? Is it possible to do so with openVPN?
thank you.
Several ways
Submitted by Christoph Haas on
There are several ways to do that. The simplest solution is using the client-config-dir. For example if you set
in your OpenVPN's server configuration file then only users would be able to login who's certificate's common names match a file in that directory. Or in other words: a user having a client certificate with the common name (CN) "lars.mueller" could only log in if there exists a file called /etc/openvpn/user-configs/lars.mueller. That file can even be empty - but it has to exist. It also gives you additional features like assigning every user a fixed IP address so you can assign firewall rules e.g. using iptables.
A more hardcore solution is a two factor authentication where you do the above and also use a script to run some kind of user authentication. For example we use LDAP lookups. Interesting configuration directives in this context are username-as-common-name, auth-user-pass-verify, client-connect and client-disconnect.
Perhaps I should write a more detailed article about that. :)
Pages