Setting up a OpenVPN server: Difference between revisions
Clandmeter (talk | contribs) |
Clandmeter (talk | contribs) No edit summary |
||
| Line 191: | Line 191: | ||
This should work both as server and as client. | This should work both as server and as client. | ||
== persistent devices == | |||
lxc guest have their dev recreated on each restart in a tmpfs. This means all devices are reset and are not read from rootfs dev directory. | |||
To make it persistent you can use an autodev script by adding the following to your lxc guest config | |||
<pre> | |||
# tun (openvpn) | |||
lxc.cgroup.devices.allow = c 10:200 rwm | |||
# audodev script to add devices | |||
lxc.hook.autodev=/var/lib/lxc/CONTAINER/autodev | |||
</pre> | |||
The autodev script would be as following: | |||
<pre> | <pre> | ||
#!/bin/sh | #!/bin/sh | ||
# dev is populated on earch container start. | |||
# to make devices persistence we need to recreate them on each start. | |||
cd ${LXC_ROOTFS_MOUNT}/dev | |||
mkdir net | |||
mknod net/tun c 10 200 | |||
chmod 0666 net/tun | |||
</pre> | </pre> | ||
Revision as of 10:14, 16 March 2016
This article describes how to set up an OpenVPN server with the Alpine Linux. This is an ideal solution for allowing single users or devices to remotely connect to your network. To establish connectivity with a Remote Office or site, Racoon/Opennhrp would provide better functionality.
It is recommended that you have a publicly routable static IP address in order for this to work. This means that your IP address cannot be in the private IP address ranges described here: WikiPedia
If your Internet-connected machine doesn't have a static IP address, DynDNS can be used for resolving DNS names to IP addresses.
Setup Alpine
Initial Setup
Follow Installing_Alpine to setup Alpine Linux.
Install programs
Install openvpn
apk add openvpn
Prepare autostart of OpenVPN
rc-update add openvpn default
modprobe tun echo "tun" >>/etc/modules
Certificates
One of the first things that needs to be done is to make sure that you have secure keys to work with. Alpine makes this easy by having a web interface to manage the certificates. Documentation for it can be found here: Generating_SSL_certs_with_ACF. It is a best practice not to have your certificate server be on the same machine as the router being used for remote connectivity.
You will need to create a server (ssl_server_cert) certificate for the server and one client (ssl_client_cert) for each client. To use the certificates, you should download the .pfx file and extract it.
To extract the three parts of each .pfx file, use the following commands:
To get the ca cert out...
openssl pkcs12 -in PFXFILE -cacerts -nokeys -out ca.pem
To get the cert file out...
openssl pkcs12 -in PFXFILE -nokeys -clcerts -out cert.pem
To get the private key file out. Make sure this stays private.
openssl pkcs12 -in PFXFILE -nocerts -nodes -out key.pem
On the VPN server, you can also install the acf-openvpn package, which contains a web page to automatically upload and extract the server certificate. There is also a button to automatically generate the Diffie Hellman parameters.
If you would prefer to generate your certificates using OpenVPN utilities, see #Alternative Certificate Method
Configure OpenVPN server
Example configuration file for server. Place the following content in /etc/openvpn/openvpn.conf:
local "Public Ip address" port 1194 proto udp dev tun ca openvpn_certs/server-ca.pem cert openvpn_certs/server-cert.pem dh openvpn_certs/dh1024.pem #to generate by hand #openssl dhparam -out dh1024.pem 1024 server 10.0.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt push "route 10.0.0.0 255.0.0.0" push "dhcp-option DNS 10.0.0.1" keepalive 10 120 comp-lzo user nobody group nobody persist-key persist-tun status /var/log/openvpn-status.log log-append /var/log/openvpn.log verb 3
(Instructions are based on openvpn.net/howto.html#server)
Test your configuration
Test configuration and certificates
openvpn --config /etc/openvpn/openvpn.conf
Configure OpenVPN client
Example client.conf:
client dev tun proto udp remote "public IP" 1194 resolv-retry infinite nobind ns-cert-type server # This means that the certificate on the openvpn server needs to have this field. Prevents MitM attacks persist-key persist-tun ca client-ca.pem cert client-cert.pem key client-key.pem comp-lzo verb 3
(Instructions are based on openvpn.net/howto.html#client)
Save settings
Don't forget to save all your settings if you are running a RAM-based system.
lbu commit
More than one server or client
If you want more than one server or client running on the same alpine box, use the standard Multiple Instances of Services process.
For example, to create a config named "AlphaBravo":
- Create an approriate /etc/openvpn/openvpn.conf file, but name it "/etc/openvpn/AlphaBravo.conf"
- create a new symlink of the init.d script:
ln -s /etc/init.d/openvpn /etc/init.d/openvpn.AlphaBravo
- Have the new service start automatically
rc-update add openvpn.AlphaBravo
Alternative Certificate Method
Manual Certificate Commands
(Instructions are based on openvpn.net/howto.html#pki)
Initial setup for administrating certificates
The following instructions assume that you want to save your configs, certs and keys in /etc/openvpn/keys.
Start by moving to the /usr/share/openvpn/easy-rsa folder to execute commands
apk add easy-rsa # from the community repo cd /usr/share/easy-rsa
If not already done then create a folder where you will save your certificates and save a copy of your /usr/share/easy-rsa/vars for later use.
mkdir /etc/openvpn/keys cp ./vars.example ./vars #easy-rsa v3 cp ./vars /etc/openvpn/keys #easy-rsa v2
For EasyRSA v3 see: https://community.openvpn.net/openvpn/wiki/EasyRSA
The instructions below are for EasyRSA v2:
If not already done then edit /etc/openvpn/keys/vars
(This file is used for defining paths and other standard settings)
vim /etc/openvpn/keys/vars
- Change KEY_DIR= from "$EASY_RSA/keys" to "/etc/openvpn/keys"
- Change KEY_SIZE, CA_EXPIRE, KEY_EXPIRE, KEY_COUNTRY, KEY_PROVINCE, KEY_CITY, KEY_ORG, KEY_EMAIL to match your system.
source the vars to set properties
source /etc/openvpn/keys/vars
touch /etc/openvpn/keys/index.txt echo 00 > /etc/openvpn/keys/serial
Set up a 'Certificate Authority' (CA)
Clean up the keys folder.
./clean-all
Generate Diffie Hellman parameters
./build-dh
Now lets make the CA certificates and keys
./build-ca
Set up a 'OpenVPN Server'
Create server certificates
./build-key-server <commonname>
Set up a 'OpenVPN Client'
Create client certificates
./build-key <commonname>
Revoke a certificate
To revoke a certificate
./revoke-full <commonname>
The revoke-full script will generate a CRL (certificate revocation list) file called crl.pem in the keys subdirectory.
The file should be copied to a directory where the OpenVPN server can access it, then CRL verification should be enabled in the server configuration:
crl-verify crl.pem
openVPN and LXC
Let's call this LXC "mylxc"...
On the host
modprobe tun mkdir /var/lib/lxc/mylxc/rootfs/dev/net mknod /var/lib/lxc/mylxc/rootfs/dev/net/tun c 10 200 chmod 666 /var/lib/lxc/mylxc/rootfs/dev/net/tun
In /var/lib/lxc/mylxc/config
lxc.cgroup.devices.allow = c 10:200 rwm
In the guest
apk add openvpn
Then config as usual...
This should work both as server and as client.
persistent devices
lxc guest have their dev recreated on each restart in a tmpfs. This means all devices are reset and are not read from rootfs dev directory. To make it persistent you can use an autodev script by adding the following to your lxc guest config
# tun (openvpn) lxc.cgroup.devices.allow = c 10:200 rwm # audodev script to add devices lxc.hook.autodev=/var/lib/lxc/CONTAINER/autodev
The autodev script would be as following:
#!/bin/sh
# dev is populated on earch container start.
# to make devices persistence we need to recreate them on each start.
cd ${LXC_ROOTFS_MOUNT}/dev
mkdir net
mknod net/tun c 10 200
chmod 0666 net/tun