Please help a VPN newb?

jsmizza

Good morning all.

I'm new to VPN but have tried getting all this VPN stuff working on-and-off for about the last 18 months. Every time, I get completely lost trying to interpret conflicting tutorial information.

I'm hoping that a patient someone (or several someones) would be willing to assist me in configuring VPN step-by-step from start to finish.

My goal is to have both my iPhone and my laptop able to connect to my home network via OpenVPN. I'd like to use certificate-login only if possible (no passwords). My router is running DD-WRT and supports an OpenVPN config.

My PC and laptop both run Debian Stretch.

Unfortunately, every tutorial I've read assumes that I already know what they're talking about, which clearly, I don't. So, I have many questions. For instance, it seems I need to enter Country, Organisation, Email, etc... why is this required if I'm just a home user? 😃

The current "official" guides I'm looking at are:

https://openvpn.net/index.php/open-source/documentation/howto.html
https://www.dd-wrt.com/wiki/index.php/OpenVPN

Thank you.

TinCanTech

jsmizza wrote it seems I need to enter Country, Organisation, Email, etc... why is this required if I'm just a home user?

That is one of the ways a certificate is constructed but you don't have to use your real name or anything real.

EG:

#set_var EASYRSA_REQ_COUNTRY	"00"
#set_var EASYRSA_REQ_PROVINCE	"home"
#set_var EASYRSA_REQ_CITY	"office"
#set_var EASYRSA_REQ_ORG	"vpn1"
#set_var EASYRSA_REQ_EMAIL	"me@example.net"
#set_var EASYRSA_REQ_OU		"My Organizational Unit"

jsmizza wrote have tried getting all this VPN stuff working on-and-off for about the last 18 months. Every time, I get completely lost

It is not that difficult and your router does much of the work automatically.

jsmizza

TinCanTech wrote That is one of the ways a certificate is constructed but you don't have to use your real name or anything real.

OK, thank you.

TinCanTech wroteIt is not that difficult and your router does much of the work automatically.

Nothing is difficult - when you know how. 😉

So, some good progress this morning. After some initial difficulty with a missing 'openssl.cnf', I've created server certificates and loaded them into DD-WRT:

"CA Cert" = I used file 'ca.crt'
"Public Server Cert" = I used file 'server.crt'
"Private Server Key" = I used file 'server.key'
"DH PEM" = I used file 'dh2048.pem'

I've also created client certificates for my iPhone, so I now have these files:

iphone.crt
iphone.csr
iphone.key

Now I'm stuck again. It's seems I need to create a configuration file for the DD-WRT server to tell it about the iPhone, and an OpenVPN configuration file to load into the iPhone OpenVPN app. How do I do these two things?

Thank you.

TinCanTech

Hello,

We don't support DD-WRT directly so you will have to check their website also.

jsmizza wrote Now I'm stuck again

jsmizza wrote Good morning all.

I'm new to VPN

=[ snip ]=

The current "official" guides I'm looking at are:

https://openvpn.net/index.php/open-source/documentation/howto.html
https://www.dd-wrt.com/wiki/index.php/OpenVPN

Thank you.

They are the best place to start and you will refer back to them often .. :ugeek: :shock:

This section should help: HOWTO: Routing all client traffic (including web-traffic) through the VPN

jsmizza wrote Nothing is difficult - when you know how

...... but it is very difficult if you can't be bothered.

jsmizza wrote It's seems I need to create a configuration file

Yes you do .. for both client and server and they have to be compatible with each other.

If you are stuck then you should try to document your setup like this:
HOWTO: Request Help ! {2}

Remember .. if you don't read .. then I can't help ..

jsmizza

TinCanTech wrote We don't support DD-WRT directly so you will have to check their website also.

Ah, OK. I'm looking for someone who has set this up on DD-WRT and is able to effectively communicate their knowledge to a newb. If you are unwilling or unable to do this, then please refrain from commenting.

TinCanTech wrote...... but it is very difficult if you can't be bothered.

Even more difficult when the "advice" from assumed experts is to RTM. That's not help. I'm asking for the next step - not "go and read all that stuff you've already read" as if the answer will magically appear.

Most of the info shown on those "official" pages should be separated into an "advanced configuration" page (or pages) as it is irrelevant and confusing to a newb. Clearly, they have been written by experts who didn't want to be accused of leaving something out. :roll:

I've now found this which looks like the right way to go. You'll note that the author has not tried to cover every OpenVPN configuration option, and explains the process simply and without ambiguity.

Thank you.

jsmizza

All done.

I'll document my settings here as a "note-to-self" until I get some more experience with VPN. I can't promise it will help anyone else, though. 😉

iptables -t nat -A POSTROUTING -s 10.0.1.0/24 -j MASQUERADE
iptables -I INPUT 1 -p udp --dport 1194 -j ACCEPT
iptables -I FORWARD 1 --source 10.0.1.0/24 -j ACCEPT
iptables -I FORWARD -i br0 -o tun2 -j ACCEPT
iptables -I FORWARD -i tun2 -o br0 -j ACCEPT
WAN_IF="$(route -n | awk '/^0.0.0.0/{wif=$NF} END {print wif}')"
iptables -t nat -I POSTROUTING -s 10.0.1.0/24 -o $WAN_IF -j MASQUERADE

/tmp/openvpn/openvpn.conf

dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem
keepalive 10 120
verb 3
mute 3
syslog
writepid /var/run/openvpnd.pid
management 127.0.0.1 14
management-log-cache 100
topology subnet
script-security 2
port 1194
proto udp4
cipher aes-256-cbc
auth sha256
client-connect /tmp/openvpn/clcon.sh
client-disconnect /tmp/openvpn/cldiscon.sh
client-config-dir /tmp/openvpn/ccd
comp-lzo adaptive
tls-server
ifconfig-pool-persist /tmp/openvpn/ip-pool 86400
client-to-client
push "redirect-gateway def1"
fast-io
tun-mtu 1500
mtu-disc yes
server 10.0.1.0 255.255.255.0
dev tun2
push "dhcp-option DNS 10.0.0.1"

iphone.opvn

tls-client
ca ca.crt
cert iphone.crt
key iphone.key
remote vpn.<redacted>.com
port 1194
comp-lzo
proto udp
cipher AES-256-CBC
auth SHA256
keysize 256
link-mtu 1570

Thank you @TinCanTech for your answers. Now that it all works, I can break it to learn how to fix it. :geek:

TinCanTech

Just one thing .. if you check your log file you will probably find this:

NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.

:arrow: Never use 192.168.0.0/24 or 192.168.1.0/24 (or other common subnets) for your OpenVPN Server LAN :!:

You are advised to change your server LAN to a more unique RFC1918 compliant subnet.
For example: 192.168.143.0/24

jsmizza

You're exactly right - the logs do show that, however I don't use that number system for my VPN LAN.

The connection between my modem-router and my main router DOES use that system (192.168.x.x) but downstream from the second router, it's all 10.x.x.x.

My LAN is 10.0.0.x and the VPN is 10.0.1.x.

I was disregarding that warning as a bug. What should I do?

TinCanTech

jsmizza wrote I was disregarding that warning as a bug. What should I do?

It is not a bug .. openvpn has correctly detected that your router is connected to a common subnet and provided you with a warning.

In your case it is not something to worry about because your main router is your LAN perimeter device.

jsmizza

Okiedoke. Thanks! 🙂