- •Credits
- •About the Author
- •About the Reviewers
- •www.PacktPub.com
- •Table of Contents
- •Preface
- •Introduction
- •Shortest setup possible
- •OpenVPN secret keys
- •Multiple secret keys
- •Plaintext tunnel
- •Routing
- •Configuration files versus the command-line
- •Complete site-to-site setup
- •3-way routing
- •Introduction
- •Setting up the public and private keys
- •Simple configuration
- •Server-side routing
- •Routing: subnets on both sides
- •Redirecting the default gateway
- •Using an 'ifconfig-pool' block
- •Using the status file
- •Management interface
- •Proxy-arp
- •Introduction
- •Simple configuration—non-bridged
- •Enabling client-to-client traffic
- •Bridging—Linux
- •Bridging—Windows
- •Checking broadcast and non-IP traffic
- •External DHCP server
- •Using the status file
- •Management interface
- •Introduction
- •Certificate generation
- •xCA: a GUI for managing a PKI (Part 1)
- •xCA: a GUI for managing a PKI (Part 2)
- •OpenSSL tricks: x509, pkcs12, verify output
- •Revoking certificates
- •The use of CRLs
- •Checking expired/revoked certificates
- •Intermediary CAs
- •Multiple CAs: stacking, using --capath
- •Introduction
- •Initializing a hardware token
- •Getting a hardware token ID
- •Using a hardware token
- •Selecting a PKCS#11 certificate using the management interface
- •Generating a key on the hardware token
- •Private method for getting a PKCS#11 certificate
- •Pin caching example
- •Introduction
- •Using a client-side up/down script
- •Windows login greeter
- •Using client-connect/client-disconnect scripts
- •Using a 'learn-address' script
- •Using a 'tls-verify' script
- •Using an 'auth-user-pass-verify' script
- •Script order
- •Script security and logging
- •Using the 'down-root' plugin
- •Using the PAM authentication plugin
- •Introduction
- •Cipher mismatches
- •TUN versus TAP mismatches
- •Compression mismatches
- •Key mismatches
- •Troubleshooting MTU and tun-mtu issues
- •Troubleshooting network connectivity
- •How to read the OpenVPN log files
- •Introduction
- •The missing return route
- •Missing return routes when 'iroute' is used
- •Source routing
- •Routing and permissions on Windows
- •Troubleshooting client-to-client traffic routing
- •Understanding the 'MULTI: bad source' warnings
- •Failure when redirecting the default gateway
- •Introduction
- •Optimizing performance using 'ping'
- •OpenSSL cipher speed
- •Compression tests
- •Traffic shaping
- •Tuning UDP-based connections
- •Tuning TCP-based connections
- •Analyzing performance using tcpdump
- •Introduction
- •Linux: using NetworkManager
- •MacOS: using Tunnelblick
- •Windows Vista/7: elevated privileges
- •Windows: using the CryptoAPI store
- •Windows: updating the DNS cache
- •Windows: running OpenVPN as a service
- •Windows: public versus private network adapters
- •Windows: routing methods
- •Introduction
- •Including configuration files in config files
- •Details of ifconfig-pool-persist
- •Connecting using a SOCKS proxy
- •Connecting via an HTTP proxy
- •Connecting via an HTTP proxy with authentication
- •Using dyndns
- •IP-less setups (ifconfig-noexec)
- •Introduction
- •Inline certificates
- •Connection blocks
- •Port sharing with an HTTPS server
- •Routing features: redirect-private, allow-pull-fqdn
- •OCSP support
- •New for 2.2: the 'x509_user_name' parameter
- •Index
OS Integration
4.Copy over the client.up and client.down files from the OpenVPN contrib directory and make them executable. On Fedora 13, these files are located in the directory /usr/share/doc/openvpn-2.1.1/contrib/pull-resolv-conf:
[root@client]# cd /etc/openvpn/cookbook
[root@client]# cp /usr/share/doc/openvpn-2.1.1/contrib/pull- resolv-conf/client.* .
[root@client]# chmod 755 client.*
5.And finally, start the client:
[root@client]# openvpn --config example10-2-client.conf
After the VPN connection comes up, check the contents of the /etc/resolv.conf file. The first line should contain the DNS server as specified by the OpenVPN server:
nameserver 10.198.0.1
When the VPN connection is terminated, the entry is removed again.
How it works...
The scripts supplied with OpenVPN parse the environment variables foreign_option_* and look for DOMAIN and DNS settings. These settings are then written out to the beginning of the /etc/resolv.conf file. This causes the DNS server and the DOMAIN pushed by the
OpenVPN server to take precedence over the system's DNS and DOMAIN settings.
When the VPN connection is dropped, the same settings are removed from the
/etc/resolv.conf file.
There's more...
Note that when the NetworkManager-openvpn plugin is used, these scripts are not necessary, as the NetworkManager itself updates the /etc/resolv.conf file.
MacOS: using Tunnelblick
This recipe will demonstrate how to set up OpenVPN on a machine running Mac OS X. For Mac OS X, several OpenVPN GUI applications are available. In this recipe, we will show how to use one of them, Tunnelblick (http://code.google.com/p/tunnelblick/).
262
Chapter 10
Getting ready
We use the following network layout:
I |
Set up the client and server certificates using the first recipe from Chapter 2, Client-server IP-only Networks. For this recipe, the server computer was running CentOS 5 Linux and OpenVPN 2.1.1. The client was running Mac OS X "Leopard", Tunnelblick 3.0, and OpenVPN 2.1.1. Keep the configuration file, example10-2-server.conf, from the previous recipe at hand.
How to do it...
1.Launch Tunnelblick if it is not running already.
2.Click on the tunnel icon in the task bar, after which the main Tunnelblick window will come up:
263
OS Integration
3.Click on Edit configuration to launch the Text Editor with the default configuration file. Set up the client configuration file as follows:
Note that this is exactly the same configuration as used in the Chapter 2 recipe Server-side routing. Save the configuration and close the Text Editor.
4.When Tunnelblick warns that the configuration file is protected, click on
Unprotect and modify to modify it.
5.Next, start the server:
[root@server]# openvpn --config example10-2-server.conf
6.Then, on the client, click on the Connect button in the main Tunnelblick screen.
Before the OpenVPN connection can be established Tunnelblick pops up a new window. Because the configuration file was modified, Tunnelblick explicitly asks for the Mac Admin password in order to repair the permissions:
264
Chapter 10
After the Mac Admin password has been entered the OpenVPN connection is established:
If anything goes wrong during the connection phase, the output messages of Tunnelblick and the OpenVPN process can be found in the All Messages screen of the Console utility. The Console utility is normally found in the Utilities folder of the system volume:
265