needhelp123
Hello everyone,
I've been working on trying to implement an "Always On VPN" solution with OpenVPN on and off for a few weeks now and I've ran into a few hiccups. I basically want a "Device Tunnel" that is available pre-logon for our road warriors, and to allow for new domain users to connect when they are not in the office. We need our users to be able to use group policy, redirected folders, and file shares. After they login to Windows, it should fire up the "User Tunnel", and this connection should ultimately take precedence over the device tunnel when the user is logged in. My users are incredibly technical illiterate, and I need a pre-login alwaysonvpn that requires no user interaction. We're also hoping to utilize the device tunnel for remote admin such as wipes, support, etc. but thats later.
I'm using a Windows CA server to generate certificates, GPO to autoenroll certs, and I've wrote a custom perl script to identify these devices and users as well as authenticate them against our DC with the client-connect parameters. All is good in that regard.
I'm having several issues with autoconnect, autostart, and routing. I want all traffic for the connected clients to go over the VPN. I'd also like if they are not connected to the VPN for them not to be able to access the internet. VPN should continuously attempt to reconnect when it's not connected. It needs to be "Always On" for both tunnels.
1) I set the device tunnel to a 192.168.3.20/32 (dc1), 192.168.3.21/32 (dc2), 192.168.3.40/32 (public file share). This should allow for group policy to fire up and allow domain users to login whether they are cached or not. I've found it's not reliable 100% of the time. It seems like once the users VPN kicks in, the device tunnel's routes are taking precedence over the users (randomly). Reboots take forever. This makes for the user unable to contact the pushed DNS servers and ultimately unable to connect to anything. Not 100% sure on this, but a theory.
2) I have openvpn installing through GPO, but it only installs 1 TAP device by default. I'm not sure the best route to go in order to install an additional TAP driver through GPO. I was going to run the TAP script elevated, but I've also ran into issues where even 2 was not enough. There were times I've tried to fire up the "user tunnel" and it says no TAP drivers available for use. This is a huge issue as my users will never be able to figure out how to fix a TAP issue. The only way for me to fix these was to reboot, uninstall all TAP drivers, and then install 2 fresh ones.
3) What is the best way to autostart/autoconnect the device tunnel prior to user logon under Local System Context (This is required to pull the computers certificate from the Computer Certificate Store)? What parameters/reg keys to achieve "always on"?
4) What is the best way to autostart/autoconnect the user tunnel when they login under the active user (This is required to pull the users certificate from the User Certificate Store)? What exe parameters / reg keys to achieve "always on"?
5) Best way to ensure the VPN is _always_ connected at all times?
My server.conf:
port 1874
proto udp
dev tun
mode server
management 10.151.156.12 7500
topology subnet
server 10.152.0.0 255.255.255.0
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key
dh /etc/openvpn/dh2048.pem
persist-key
persist-tun
keepalive 10 60
comp-lzo
status /etc/openvpn/1874.log
user nobody
group nogroup
verb 4
cipher AES-256-CBC
auth SHA512
tls-crypt /etc/openvpn/pfs.key
tls-server
script-security 3
client-connect /etc/openvpn/bin/connect-auth.pl
client-config-dir /etc/openvpn/etc
status /var/log/openvpn-status.log
CLIENT1 config-dir config:
push "redirect-gateway def1"
push "route 192.168.2.0 255.255.254.0"
push "route 10.151.156.0 255.255.255.0"
push "route 10.152.0.0 255.255.255.0"
push "dhcp-option DNS 192.168.3.20"
push "dhcp-option DNS 192.168.3.21"
#push "block-outside-dns"
DEVICE1 config:
push "route 192.168.3.20 255.255.255.255"
push "route 192.168.3.21 255.255.255.255"
push "route 192.168.3.32 255.255.255.255"
push "dhcp-option DNS 192.168.3.20"
push "dhcp-option DNS 192.168.3.21"
#push "block-outside-dns"
CLIENT1 openvpn config:
# OpenVPN client configuration
# (lines begining with `#' or `;' are comments)
# IP address, port, and protocol to bind
client
remote vpn.myco.com 1874
proto udp
dev tun
resolv-retry infinite
nobind
persist-key
persist-tun
cipher AES-256-CBC
auth SHA512
# the next one only for OpenVPN >= 2.1 and server certificates having
# the keyUsage and extendedKeyUsage attributes set accordingly:
remote-cert-tls server
crypoapicert "SUBJ:myco.com"
# miscellanous options
comp-lzo
key-direction 1
verb 6
<ca>
...
</ca>
