Hey All:
I'm trying to configure my OVPN Server to make life as easy as possible for me. My server used to run OpenVPN, but when I undertook this task I purged OpenVPN and created all new certificates. Now, I can connect but have no local network access and my IP remains the client's IP.
My goal is twofold: 1) Get the OpenVPN connection working again so that I have both internal (10.10.X.X) access and external internet access through the tunnel; and 2) Also (but not exclusively) allow password access so that I don't have to keep warring with the stupid ONC files in ChromeOS.
Server Conf:
# Port Number.
port 1194
# TCP or UDP server.
proto udp
# Interface type, TUN or TAP.
dev tun
# Certificates.
ca ca.crt
crl-verify crl.pem
cert server.crt
key key.pem # This file should be kept secret
# Diffie hellman parameters.
dh dh1024.pem
# HMAC Firewall (disabled until we get ChromeOS working)
#tls-auth ta.key 0
#key-direction 0
# Auth and TLS Settings.
auth SHA256
cipher AES-128-CBC
#tls-version-min 1.2
# Subnet to use for OpenVPN Connections.
server 10.8.0.0 255.255.255.0
# Maintain Virtual IP Address registration for reconnections
ifconfig-pool-persist ipp.txt
# Keepalive: send ping every 10 seconds, tunnel down after 120 seconds no response.
keepalive 10 120
# LZO Compression for the tunnel.
#comp-lzo
# Push Pi-Hole as DNS
#push "dhcp-option DNS 10.10.1.20"
# Client to Client Communication
#client-to-client
# Drop privileges to user/group nobody.
user nobody
group nogroup
# Makes the link more resistant to connection failures.
persist-key
persist-tun
# Username and Password authentication.
#client-cert-not-required #depreciated
#verify-client-cert optional
#plugin /usr/lib/x86_64-linux-gnu/openvpn/plugins/openvpn-plugin-auth-pam.so login
#plugin /etc/openvpn/openvpn-plugin-auth-pam.so login
# OpenVPN Status Log files.
status openvpn-status.log
# LOG FILE VERBOSITY:
# 0 is silent, except for fatal errors
# 4 is reasonable for general usage
# 5 and 6 can help to debug connection problems
# 9 is extremely verbose
verb 3
Client config (minor changes to protect the innocent):
# OpenVPN Client Profile.
client
# OpeenVPN Address.
remote [external domain] [nonstandard port #]
# TCP or UDP server.
proto udp
# Interface Type, TUN or TAP.
dev tun
# Keep trying to reconnect (for devices not permanently connected to the internet).
resolv-retry infinite
# Most clients don't need to bind to a specific local port number.
nobind
# Downgrade privileges after initialization (non-Windows only).
user nobody
group nogroup
# Try to preserve some state across restarts.
persist-key
persist-tun
# Certificates.
ca ca.crt
# HMAC Firewall (disabled until we get ChromeOS working)
#tls-auth ta.key 1
#key-direction 1
# Verify server certificate by checking that the certicate has the correct key usage set.
remote-cert-tls server
# Cryptographic Cypher and TLS Version.
auth SHA256
cipher AES-128-CBC
tls-version-min 1.2
# Compression
#comp-lzo
Can you guys see anything obviously not working, or anything that I should change to achieve both of my goals? If not, what other logs would be worth looking at? Server is Ubuntu Server 18.04, running UFW as a firewall.
Thanks all.
