Using OpenVPN to avoid being sniifed on local network

bburzmali

Hi,

I am currently sharing my WIFI connection with somebody who live in the same house.

I would like to secure my access to the internet for professional reasons, actually I don't want him to access my data in clear using wireshark or anything like that.

As I have two computers always running in the same time (professional reasons), I want to use one of my computer as a VPN server (this one is connected in ethernet, so it is not subject to sniffing), and I want to use the other one (using WIFI) as a VPN client ... to securely access the internet throught wifi and using a ssh tunnel.

I first started by installing openvpn on my two computers (both ubuntu systems) and configured one as a server (after having carefully generated the keys and accound and so on). I configured the other one as a client.

But when I launch openvpn on the client side, I get this output:

Tue Jan 27 19:54:51 2015 OpenVPN 2.2.1 x86_64-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Dec  1 2014
Tue Jan 27 19:54:51 2015 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Tue Jan 27 19:54:51 2015 WARNING: file 'asus.key' is group or others accessible
Tue Jan 27 19:54:51 2015 LZO compression initialized
Tue Jan 27 19:54:51 2015 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Tue Jan 27 19:54:51 2015 Socket Buffers: R=[212992->131072] S=[212992->131072]
Tue Jan 27 19:54:51 2015 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Jan 27 19:54:51 2015 Local Options hash (VER=V4): '41690919'
Tue Jan 27 19:54:51 2015 Expected Remote Options hash (VER=V4): '530fdded'
Tue Jan 27 19:54:51 2015 NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
Tue Jan 27 19:54:51 2015 UDPv4 link local: [undef]
Tue Jan 27 19:54:51 2015 UDPv4 link remote: [AF_INET]192.168.1.35:1194
Tue Jan 27 19:54:51 2015 TLS: Initial packet from [AF_INET]192.168.1.35:1194, sid=9c9a3f9b dd375cf0
Tue Jan 27 19:54:51 2015 VERIFY OK: depth=1, /C=FR/ST=ARD/L=Lablachere/O=BoulotMis/OU=MOI/CN=azmodai/name=azmodai/emailAddress=alef@tuxfamily.org
Tue Jan 27 19:54:51 2015 VERIFY OK: nsCertType=SERVER
Tue Jan 27 19:54:51 2015 VERIFY OK: depth=0, /C=FR/ST=ARD/L=Lablachere/O=BoulotMis/OU=changeme/CN=server/name=BOULOTMIS/emailAddress=azmodai.paul@gmail.com
Tue Jan 27 19:54:51 2015 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Jan 27 19:54:51 2015 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jan 27 19:54:51 2015 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Jan 27 19:54:51 2015 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jan 27 19:54:51 2015 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Tue Jan 27 19:54:51 2015 [server] Peer Connection Initiated with [AF_INET]192.168.1.35:1194
Tue Jan 27 19:54:54 2015 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Tue Jan 27 19:54:54 2015 PUSH: Received control message: 'PUSH_REPLY,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Tue Jan 27 19:54:54 2015 OPTIONS IMPORT: timers and/or timeouts modified
Tue Jan 27 19:54:54 2015 OPTIONS IMPORT: --ifconfig/up options modified
Tue Jan 27 19:54:54 2015 OPTIONS IMPORT: route options modified
Tue Jan 27 19:54:54 2015 ROUTE default_gateway=192.168.1.1
Tue Jan 27 19:54:54 2015 TUN/TAP device tun2 opened
Tue Jan 27 19:54:54 2015 TUN/TAP TX queue length set to 100
Tue Jan 27 19:54:54 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue Jan 27 19:54:54 2015 /sbin/ifconfig tun2 10.8.0.6 pointopoint 10.8.0.5 mtu 1500
Tue Jan 27 19:54:54 2015 /sbin/route add -net 10.8.0.1 netmask 255.255.255.255 gw 10.8.0.5
SIOCADDRT: File exists
Tue Jan 27 19:54:54 2015 ERROR: Linux route add command failed: external program exited with error status: 7
Tue Jan 27 19:54:54 2015 GID set to nogroup
Tue Jan 27 19:54:54 2015 UID set to nobody
Tue Jan 27 19:54:54 2015 Initialization Sequence Completed

and ping 10.8.0.1 is not working as well.

Do you know what could be the problem ?

Thanks !

maikcat

tun2? how many times did you started openvpn?

also post your configs used.

Michael.

bburzmali

Yes, indeed, I had ran it several times :-(

Here is my client side config:
(basically the default configuration with minor modifications)

client
dev tun
proto udp
remote 192.168.1.35 1194
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
ca ca.crt
cert asus.crt
key asus.key
ns-cert-type server
comp-lzo
verb 3

here is the server side config:

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key  # This file should be kept secret
dh dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 10 120
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
;log         openvpn.log
verb 3

Thanks!

maikcat

ok stop ALL running instances first,

then fire your client up (as root) and post logs here,

also post the output of:

iptables -L -v

on your openvpn server.

Michael.

bburzmali

Ok,

Here is the log:

Wed Jan 28 20:26:51 2015 OpenVPN 2.2.1 x86_64-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Dec  1 2014
Wed Jan 28 20:26:51 2015 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed Jan 28 20:26:51 2015 WARNING: file 'asus.key' is group or others accessible
Wed Jan 28 20:26:51 2015 LZO compression initialized
Wed Jan 28 20:26:51 2015 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Wed Jan 28 20:26:51 2015 Socket Buffers: R=[212992->131072] S=[212992->131072]
Wed Jan 28 20:26:51 2015 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Wed Jan 28 20:26:51 2015 Local Options hash (VER=V4): '41690919'
Wed Jan 28 20:26:51 2015 Expected Remote Options hash (VER=V4): '530fdded'
Wed Jan 28 20:26:51 2015 NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
Wed Jan 28 20:26:51 2015 UDPv4 link local: [undef]
Wed Jan 28 20:26:51 2015 UDPv4 link remote: [AF_INET]192.168.1.35:1194
Wed Jan 28 20:26:51 2015 TLS: Initial packet from [AF_INET]192.168.1.35:1194, sid=365a7a26 6ebe257b
Wed Jan 28 20:26:51 2015 VERIFY OK: depth=1, /C=FR/ST=AD/L=LBL/O=BoulotMis/OU=MOI/CN=azmodai/name=azmodai/emailAddress=alef@tuxfamily.org
Wed Jan 28 20:26:51 2015 VERIFY OK: nsCertType=SERVER
Wed Jan 28 20:26:51 2015 VERIFY OK: depth=0, /C=FR/ST=ARD/L=Lablachere/O=BoulotMis/OU=changeme/CN=server/name=BOULOTMIS/emailAddress=azmodai.paul@gmail.com
Wed Jan 28 20:26:51 2015 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Jan 28 20:26:51 2015 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Jan 28 20:26:51 2015 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Jan 28 20:26:51 2015 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Jan 28 20:26:51 2015 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Wed Jan 28 20:26:51 2015 [server] Peer Connection Initiated with [AF_INET]192.168.1.35:1194
Wed Jan 28 20:26:53 2015 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Wed Jan 28 20:26:53 2015 PUSH: Received control message: 'PUSH_REPLY,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Wed Jan 28 20:26:53 2015 OPTIONS IMPORT: timers and/or timeouts modified
Wed Jan 28 20:26:53 2015 OPTIONS IMPORT: --ifconfig/up options modified
Wed Jan 28 20:26:53 2015 OPTIONS IMPORT: route options modified
Wed Jan 28 20:26:53 2015 ROUTE default_gateway=192.168.1.1
Wed Jan 28 20:26:53 2015 TUN/TAP device tun0 opened
Wed Jan 28 20:26:53 2015 TUN/TAP TX queue length set to 100
Wed Jan 28 20:26:53 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Jan 28 20:26:53 2015 /sbin/ifconfig tun0 10.8.0.6 pointopoint 10.8.0.5 mtu 1500
Wed Jan 28 20:26:53 2015 /sbin/route add -net 10.8.0.1 netmask 255.255.255.255 gw 10.8.0.5
Wed Jan 28 20:26:53 2015 GID set to nogroup
Wed Jan 28 20:26:53 2015 UID set to nobody

And here is what I got when I tip iptables -L -v: (on server side)

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination        

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination        

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

My client and my server are in the same local network, all the traffic go throught the router (192.168.1.1).
I've read somewhere something about DNS pushing and pulling, could it be something like that ?

Thanks !

maikcat

just a note

I would like to secure my access to the internet for professional reasons

i suggest that the most easy setup would be to establish an openvpn connection to your
ethernet based pc , setup a proxy to it then use the proxy to access internet OVER the vpn tunnel.

alternatively you can use push "redirect-gateway def1" statement on your server config.

since you are in the same lan you dont need to bother by changing dns settings..

after your last post you still dont access 10.8.0.1?

are you starting your client as root?

Michael.

Traffic

You should also consider this, if you ever use your VPN from another location:

NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.

bburzmali

malkcat:

Unfortunately, even using push "redirect-gateway def1", I still cannot ping 10.8.0.1 ...

Here are my logs:

Server side:

Sat Jan 31 17:30:45 2015 MULTI: multi_create_instance called
Sat Jan 31 17:30:45 2015 192.168.1.14:34170 Re-using SSL/TLS context
Sat Jan 31 17:30:45 2015 192.168.1.14:34170 LZO compression initialized
Sat Jan 31 17:30:45 2015 192.168.1.14:34170 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sat Jan 31 17:30:45 2015 192.168.1.14:34170 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Sat Jan 31 17:30:45 2015 192.168.1.14:34170 Local Options hash (VER=V4): '530fdded'
Sat Jan 31 17:30:45 2015 192.168.1.14:34170 Expected Remote Options hash (VER=V4): '41690919'
Sat Jan 31 17:30:45 2015 192.168.1.14:34170 TLS: Initial packet from [AF_INET]192.168.1.14:34170, sid=3e437408 377a04e0
Sat Jan 31 17:30:45 2015 192.168.1.14:34170 VERIFY OK: depth=1, /C=FR/ST=ARD/L=L/O=BMis/OU=MOI/CN=ai/name=ai/emailAddress=mymail1@stuff.org
Sat Jan 31 17:30:45 2015 192.168.1.14:34170 VERIFY OK: depth=0, /C=FR/ST=ARD/L=L/O=BMis/OU=MOI/CN=asus/name=theasus/emailAddress=mymail@stuff.org
Sat Jan 31 17:30:45 2015 192.168.1.14:34170 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sat Jan 31 17:30:45 2015 192.168.1.14:34170 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Jan 31 17:30:45 2015 192.168.1.14:34170 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sat Jan 31 17:30:45 2015 192.168.1.14:34170 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Jan 31 17:30:45 2015 192.168.1.14:34170 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Sat Jan 31 17:30:45 2015 192.168.1.14:34170 [asus] Peer Connection Initiated with [AF_INET]192.168.1.14:34170
Sat Jan 31 17:30:45 2015 asus/192.168.1.14:34170 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=1::1700:0:8c7f:0
Sat Jan 31 17:30:45 2015 asus/192.168.1.14:34170 MULTI: Learn: 10.8.0.6 -> asus/192.168.1.14:34170
Sat Jan 31 17:30:45 2015 asus/192.168.1.14:34170 MULTI: primary virtual IP for asus/192.168.1.14:34170: 10.8.0.6
Sat Jan 31 17:30:47 2015 asus/192.168.1.14:34170 PUSH: Received control message: 'PUSH_REQUEST'
Sat Jan 31 17:30:47 2015 asus/192.168.1.14:34170 send_push_reply(): safe_cap=960
Sat Jan 31 17:30:47 2015 asus/192.168.1.14:34170 SENT CONTROL [asus]: 'PUSH_REPLY,redirect-gateway def1,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)

client side:

Sat Jan 31 17:30:45 2015 OpenVPN 2.2.1 x86_64-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Dec  1 2014
Sat Jan 31 17:30:45 2015 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Sat Jan 31 17:30:45 2015 WARNING: file 'asus.key' is group or others accessible
Sat Jan 31 17:30:45 2015 LZO compression initialized
Sat Jan 31 17:30:45 2015 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sat Jan 31 17:30:45 2015 Socket Buffers: R=[212992->131072] S=[212992->131072]
Sat Jan 31 17:30:45 2015 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Sat Jan 31 17:30:45 2015 Local Options hash (VER=V4): '41690919'
Sat Jan 31 17:30:45 2015 Expected Remote Options hash (VER=V4): '530fdded'
Sat Jan 31 17:30:45 2015 NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
Sat Jan 31 17:30:45 2015 UDPv4 link local: [undef]
Sat Jan 31 17:30:45 2015 UDPv4 link remote: [AF_INET]192.168.1.35:1194
Sat Jan 31 17:30:45 2015 TLS: Initial packet from [AF_INET]192.168.1.35:1194, sid=1efaa87f 8b86e8ac
Sat Jan 31 17:30:45 2015 VERIFY OK: depth=1, /C=FR/ST=ARD/L=L/O=BMis/OU=MOI/CN=ai/name=ai/emailAddress=mail@stuff.org
Sat Jan 31 17:30:45 2015 VERIFY OK: nsCertType=SERVER
Sat Jan 31 17:30:45 2015 VERIFY OK: depth=0, /C=FR/ST=ARD/L=Le/O=BMis/OU=changeme/CN=server/name=BMIS/emailAddress=mail1@stuffl.com
Sat Jan 31 17:30:45 2015 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sat Jan 31 17:30:45 2015 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Jan 31 17:30:45 2015 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sat Jan 31 17:30:45 2015 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Jan 31 17:30:45 2015 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Sat Jan 31 17:30:45 2015 [server] Peer Connection Initiated with [AF_INET]192.168.1.35:1194
Sat Jan 31 17:30:47 2015 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Jan 31 17:30:47 2015 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Sat Jan 31 17:30:47 2015 OPTIONS IMPORT: timers and/or timeouts modified
Sat Jan 31 17:30:47 2015 OPTIONS IMPORT: --ifconfig/up options modified
Sat Jan 31 17:30:47 2015 OPTIONS IMPORT: route options modified
Sat Jan 31 17:30:47 2015 ROUTE default_gateway=192.168.1.1
Sat Jan 31 17:30:47 2015 TUN/TAP device tun0 opened
Sat Jan 31 17:30:47 2015 TUN/TAP TX queue length set to 100
Sat Jan 31 17:30:47 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sat Jan 31 17:30:47 2015 /sbin/ifconfig tun0 10.8.0.6 pointopoint 10.8.0.5 mtu 1500
Sat Jan 31 17:30:47 2015 /sbin/route add -net 192.168.1.35 netmask 255.255.255.255 gw 192.168.1.1
Sat Jan 31 17:30:47 2015 /sbin/route add -net 0.0.0.0 netmask 128.0.0.0 gw 10.8.0.5
Sat Jan 31 17:30:47 2015 /sbin/route add -net 128.0.0.0 netmask 128.0.0.0 gw 10.8.0.5
Sat Jan 31 17:30:47 2015 /sbin/route add -net 10.8.0.1 netmask 255.255.255.255 gw 10.8.0.5
Sat Jan 31 17:30:47 2015 GID set to nogroup
Sat Jan 31 17:30:47 2015 UID set to nobody
Sat Jan 31 17:30:47 2015 Initialization Sequence Completed

Traffic: Thanks for the advice! but I think I will not use my VPN from outside, it's just for my local network.

Traffic

bburzmali wroteTraffic: Thanks for the advice

no problem .. just letting you know.

Your logs show a normal successful connection:

bburzmali wroteI still cannot ping 10.8.0.1 ...

I presume your client iptables or other firewall is not blocking 10.8/24 ?