GreenLED
I am getting my feet wet trying to exercise my setup abilities with OpenVPN. It's a new frontier for me. I have been a technician for well over 15+ years (basically from when I was born 🙂). Anyhow, Here's the issue I am having. I have an explosion of questions so I guess I will start with one to begin.
I was following the "no frills" OpenVPN setup guide for Windows. My problem is understanding what things can an cannot be done or things that are required every time and things that are not required each time. Let me explain.
1. One of the steps on the guide instructs you to build the Diffie Hellman key agreement (at least that's how I understand it). So, do you need to run this EACH time you adjust any certs, be it the CA or Client certs?
2. I understand the bare bones of SSL and how it works (at least I think I do). Why does OpenVPN separate the ideas of "keys" and "certs". I was under the impression that the "cert" WAS the key essentially or - I dunno I'm a little lost on what is what. I understand this.
Cert (CA)
===> Cert (Intermediate)
=== ===> Cert (Entity)
Each of these certs has a public and private key, yes?
So, that would be three public keys and three private keys, am I correct?
Assuming this is the case, how does the "signing" of a cert change it? Can it only be signed upon minting? I'd like to establish a root certificate that never leaves (or that the private key never leaves the confines of my physical location) as well as an intermediate cert.
3. Why is there commands like "build-server server (I know I'm typing that incorrectly, just going off memory). Why is there this concept of server and client, aren't they ALL just certs? Why can't you just say build-cert? Oh, so for example, why is there a "build-ca" command?
Any help is very very much appreciated. 😃
GreenLED
After a few sleepless nights I got a successful setup working with one server and a client. The client successfully connected to the server (at least that's what the console said) and everything looks kosher. I have run into some issues though.
1. I get an error that says something like "WARNING: No authentication method selected" or something of that flavor for certificates I believe. I'm not sure why I am getting that and how to fix that situation.
2. Since it's a VPN, I should be able to open up my browser and pulup something like "show my ip" and have a different IP, NO? Why do I have the same IP?
Let me explain how my network topology is setup.
I have a main cable box that has four network ports - each of which can be asigned a different IP (and they are). So, for example, when guests come to my house, they have a completely different publicly accessible IP then my internal secured network. So, if I setup a OpenVPN server on one port behind a NAT of course, then I should be able to tunnel my traffic through that port and arrive at that public IP instead of the current port I'm using - hopefully that makes some sense.
Like I said, the connection negotiation seems to be working just fine.
3. If I setup a game server on the VPN server, I should try to access it using the same IP that's within the rang eof the subnet assigned to my VPN adapter, is this correct?
For example. if my normal IP scheme is 10.5.5.x (physical NIC) and the TAP adapter is assigned an IP of 10.8.8.x, I should try to connect to my game server using the 10.8 scheme, so say - 10.8.8.1 for instance.
4. By default, when you connect to a OpenVPN server, do you have full access - i.e. no connection are blocked to and from the machines that are connected? For example, if both machines - server and client have firewalls off (software firewalls, not the router firewall) I should be able to connect to anything I want/need, correct?
Is "Split Tunneling" turned on by default?
