OpenVPN configuration - Revision history

Adj at 20:46, 16 January 2018

2018-01-16T20:46:01Z

← Older revision		Revision as of 20:46, 16 January 2018
Line 22:		Line 22:

	Please note that this does still need some work.		Please note that this does still need some work.

			== A Windows client system ==
			lorem ipsum

			== a Linux client system ==
			lorem ipsum

			== An Android client system ==
			lorem ipsum

			== an OpenWRT client system ==
			lorem ipsum

Adj at 01:37, 13 January 2018

2018-01-13T01:37:14Z

← Older revision		Revision as of 01:37, 13 January 2018
Line 7:		Line 7:
	* <code>client-to-client</code> in use to allow two VPN client systems to talk with each other instead of bouncing through a third system		* <code>client-to-client</code> in use to allow two VPN client systems to talk with each other instead of bouncing through a third system
	* ciphers are currently manually chosen -- after testing all clients, consider switching to "negotiable crypto parameters", an OpenVPN 2.4 feature		* ciphers are currently manually chosen -- after testing all clients, consider switching to "negotiable crypto parameters", an OpenVPN 2.4 feature

			== not quite complete doc of server install ==
			sudo apt-get install openvpn
			sudo mkdir -m 755 /etc/openvpn/certificate-authorities
			sudo install -o root -g root -m 644 fnord*.cr[lt] /etc/openvpn/certificate-authorities
			cd /etc/openvpn/certificate-authorities
			for f in *.crt; do sudo ln -s "${f}" $(openssl x509 -hash -noout -in ${f}).0; done
			for f in *.crl; do sudo ln -s "${f}" $(openssl x509 -hash -noout -in "${f%.crl}.crt").r0; done
			cd -
			sudo openssl dhparam -out /etc/openvpn/''vpn-0.fnord.greeley.co.us''_server_dh4096.pem 4096 # expect this to take quite a while
			# copy certificate and key file to /etc/openvpn (certificate (and probably the server's private key as well) was generated elsewhere)
			# copy server config to /etc/openvpn
			sudo systemctl start openvpn@vpn-0.fnord.greeley.co.us_server

			Please note that this does still need some work.

Adj: Created page with "Wouldn't it be nice to talk to the private network resources through some sort of secure channel? We make use of [https://openvpn.net/ OpenVPN] for that. This will allow pri..."

2018-01-07T19:39:41Z

Created page with "Wouldn't it be nice to talk to the private network resources through some sort of secure channel? We make use of [https://openvpn.net/ OpenVPN] for that. This will allow pri..."

New page

Wouldn't it be nice to talk to the private network resources through some sort of secure channel? We make use of [https://openvpn.net/ OpenVPN] for that. This will allow private, authenticated traffic flow over potentially hostile networks.

Some quick bits about the config:
* Private PKI in use to do certificate based authentication
* TLS HMAC auth (<code>tls-auth</code> config option) in use. Migrate to using <code>tls-crypt</code> when all clients are compatible (OpenWRT wifi APs for instance probably need updating)
* template based client and server config file creation
* <code>client-to-client</code> in use to allow two VPN client systems to talk with each other instead of bouncing through a third system
* ciphers are currently manually chosen -- after testing all clients, consider switching to "negotiable crypto parameters", an OpenVPN 2.4 feature