Question about generating .ovpn file

jwright8

I have an OpenVPN server configured on Ubuntu Server 10.04. I have generated the hostname.crt and hostname.key file for the client machine. I have those, as well as the ca.crt and ta.key that the tutorials I've read (and followed), such as https://help.ubuntu.com/10.04/serverguide/openvpn.html , said I would need to have for client configuration.

I'd initially tried the OpenVPN client from the main downloads page, and it asked me for a username and password, which I didn't configure. Then, searching the forums, I'd read somewhere that I needed to download the one under the "Community" section instead. I've downloaded and installed that, but the read me says that it also requires an .ovpn file in the /config/ directory. From what I've read, it is the equivalent of the client.conf; the only problem there, again, is following the instructions didn't yield a client.conf file on the server, just the aforementioned files.

Can anyone point me in the right direction?

Mimiko

Please read this howto: http://openvpn.net/index.php/open-source/documentation/howto.html
You have to have a config file on server in order for it to work.

jwright8

I'm sorry I didn't include much information, I had assumed I could go back and edit it and the topic approval thing kinda surprised me.

The server has the files:

ca ca.crt
cert JustinDesktop.crt
key JustinDesktop.key

In relation to the client, as well as the other files like ta.key, etc. that are generated in the tutorial.

My client config JustinDesktop.ovpn is:

client
dev tap0
proto udp
remote 24.23.50.193 56
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert JustinDesktop.crt
key JustinDesktop.key
ns-cert-type server
tls-auth ta.key 1
comp-lzo
verb 3

My server.conf is:

local 10.1.10.70
port 56
proto udp
dev tap0
up "/etc/openvpn/up.sh br0"
down "/etc/openvpn/down.sh br0"
ca ca.crt
cert server.crt
key server.key  # This file should be kept secret
dh dh1024.pem
ifconfig-pool-persist ipp.txt
server-bridge 10.1.10.70 255.255.255.0 10.1.10.150 10.1.10.165
push "route 10.1.10.1 255.255.255.0"
push "dhcp-option DNS 10.1.10.1"
client-to-client
keepalive 10 120
tls-auth ta.key 0 # This file is secret
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3

When I try to use the OpenVPN client I get the following errors:

Wed May 30 14:58:11 2012 OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
Wed May 30 14:58:11 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed May 30 14:58:11 2012 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Wed May 30 14:58:11 2012 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed May 30 14:58:11 2012 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed May 30 14:58:11 2012 LZO compression initialized
Wed May 30 14:58:11 2012 Control Channel MTU parms [ L:1574 D:166 EF:66 EB:0 ET:0 EL:0 ]
Wed May 30 14:58:11 2012 Socket Buffers: R=[8192->8192] S=[8192->8192]
Wed May 30 14:58:11 2012 Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
Wed May 30 14:58:11 2012 Local Options hash (VER=V4): '13a273ba'
Wed May 30 14:58:11 2012 Expected Remote Options hash (VER=V4): '360696c5'
Wed May 30 14:58:11 2012 UDPv4 link local: [undef]
Wed May 30 14:58:11 2012 UDPv4 link remote: 24.23.50.193:56
Wed May 30 14:59:11 2012 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Wed May 30 14:59:11 2012 TLS Error: TLS handshake failed
Wed May 30 14:59:11 2012 TCP/UDP: Closing socket
Wed May 30 14:59:11 2012 SIGUSR1[soft,tls-error] received, process restarting
Wed May 30 14:59:11 2012 Restart pause, 2 second(s)
Wed May 30 14:59:13 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed May 30 14:59:13 2012 Re-using SSL/TLS context
Wed May 30 14:59:13 2012 LZO compression initialized
Wed May 30 14:59:13 2012 Control Channel MTU parms [ L:1574 D:166 EF:66 EB:0 ET:0 EL:0 ]
Wed May 30 14:59:13 2012 Socket Buffers: R=[8192->8192] S=[8192->8192]
Wed May 30 14:59:13 2012 Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
Wed May 30 14:59:13 2012 Local Options hash (VER=V4): '13a273ba'
Wed May 30 14:59:13 2012 Expected Remote Options hash (VER=V4): '360696c5'
Wed May 30 14:59:13 2012 UDPv4 link local: [undef]
Wed May 30 14:59:13 2012 UDPv4 link remote: 24.23.50.193:56
Wed May 30 14:59:23 2012 TCP/UDP: Closing socket
Wed May 30 14:59:23 2012 SIGTERM[hard,] received, process exiting

My server's ifconfig is:

br0       Link encap:Ethernet  HWaddr 00:1e:90:38:25:11
          inet addr:10.1.10.70  Bcast:10.1.10.255  Mask:255.255.255.0
          inet6 addr: fe80::21e:90ff:fe38:2511/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:19753 errors:0 dropped:0 overruns:0 frame:0
          TX packets:8580 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:15090609 (15.0 MB)  TX bytes:1033886 (1.0 MB)

eth0      Link encap:Ethernet  HWaddr e0:46:9a:2b:bc:ca
          inet6 addr: fe80::e246:9aff:fe2b:bcca/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:25878 errors:0 dropped:0 overruns:0 frame:0
          TX packets:40832 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:2895601 (2.8 MB)  TX bytes:59358345 (59.3 MB)
          Interrupt:19 Base address:0x6000

eth1      Link encap:Ethernet  HWaddr 00:1e:90:38:25:11
          inet6 addr: fe80::21e:90ff:fe38:2511/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:66907 errors:0 dropped:0 overruns:0 frame:0
          TX packets:41282 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:82792474 (82.7 MB)  TX bytes:4728107 (4.7 MB)
          Interrupt:16

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:1 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:88 (88.0 B)  TX bytes:88 (88.0 B)

tap0      Link encap:Ethernet  HWaddr e2:c1:2a:bd:23:b8
          inet6 addr: fe80::e0c1:2aff:febd:23b8/64 Scope:Link
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:6 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:0 (0.0 B)  TX bytes:468 (468.0 B)

It might also be worth mentioning that I have the following files on the client in D:\Program Files (x86):\OpenVPn\config\ :

ca.crt
JustinDesktop.crt
JustinDesktop.key
ta.key
JustinDesktop.ovpn

Thank you for the reply.

krzee

why are you bridging?
from the Forum Header: " **You ONLY want to use dev tap if you are tunneling layer2 traffic, if you are using IP traffic you want tun."

jwright8

Perhaps I'm clueless on this, but I read that if you wanted to connect a setup like

Remote Client -> Internet -> Modem -> Router w/ DHCP/DNS -> Linux Box w/ VPN/IPTables/2 NICs -> Windows machine

You'd need to configure the eth1->eth0 in bridge mode to share the connection to the router. I then read somewhere that if the adapter was in bridge mode, then I needed to configure the VPN in bridge mode as well. Correct me if I'm mistaken though, as I'm far from knowledgeable about it; it's just what I've pieced together.

krzee

a bridge is one way to do that.
but that means nothing about the vpn, your vpn could be bridged or routed
what is your actual goal for the vpn?

jwright8

I would like for the remote client (Windows machine) to connect to the VPN on the Linux the box (the port on the router will be forwarded to the static IP for the box).

I would then like for some additional control to be possible, say to use IPTables to drop EVERY IP except ones I explicitly allow (still working on how to do that, actually, but I'll work on it after I get this VPN up).

The client would then be routed through the box to the Windows machine connected to the eth0 out. They would then map the drive of the Windows machine as a network drive.

EDIT:

It also seems like, from the FAQ, that I would need it set up as bridged. Maybe I'm reading it wrong, though, I'm not sure.

I would recommend using routing unless you need a specific feature which requires bridging, such as:

the VPN needs to be able to handle non-IP protocols such as IPX,
you are running applications over the VPN which rely on network broadcasts (such as LAN games), or
you would like to allow browsing of Windows file shares across the VPN without setting up a Samba or WINS server.

jwright8

Sorry for the double post, but it appears the config was valid. I'm not sure how I missed it, but going over the server config for the hundredth time I noticed that the IP address of the remote server was one off. I corrected it, and it connected and mapped the drive fine.

On the bright side, perhaps the configuration above will help someone that's having problems with it.

As a parting query, though, do you have any idea where I could look for the IPTables thing?

My idea is that when they connect to the OpenVPN, I would want IPTables to drop the connection (or refuse) if it wasn't an IP I explicitly allowed, no matter if the cert/auth was valid or not.

Thank you for all the responses so far!

Mimiko

I would want IPTables to drop the connection (or refuse) if it wasn't an IP I explicitly allowed

You can use allow only for certain IPs to the service with like this:

iptables -A INPUT -s <ip_allowed> -p udp --dport 1196 -j accept