User Tools

Site Tools


doc:howto:vpn.client.openvpn.tun

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision
Previous revision
doc:howto:vpn.client.openvpn.tun [2013/10/28 08:27]
lorema
doc:howto:vpn.client.openvpn.tun [2015/01/27 23:33] (current)
lukeshu change title
Line 1: Line 1:
-====== ​Openwrt configuration example ​with 2 OpenVpn Tunnel ​====== +====== ​OpenVPN client ​with TUN (Layer 3) device  ​====== 
-For an overview over all existing Virtual private network (VPN)-related articles in the OpenWrt ​wikiplease visit [[doc/​howto/​vpn.overview]] |+:!: There are many redundant wiki pages relating to configuring OpenVPN on OpenWrt. ​ Some are better than others, and others are an out-of-date muddled mess.  For a reasonably complete / up-to-date guide to installing, configuring and troubleshooting OpenVPN clients & servers on OpenWrt ​(including creating a simple PKI)could I suggest you consider starting with [[doc/​howto/​vpn.openvpn]] instead of this page. It is not that the other pages aren't worth reading; it is just that (IMHO) [[doc/​howto/​vpn.openvpn]] is a better place to start (it has been rewritten from scratch just a few weeks ago).  Maybe you could improve it further rather than edit this page? :!: |
  
-Router Openwrt +In this instance, this page covers issues not raised in [[doc/​howto/​vpn.openvpn]] ​However,​ if you're new to OpenVPN, then it might still be a useful place to visit.
-ip 192.168.1.1+
  
-OpenVpn Client 1 tun0 Tunnel IP 10.2.1.6 +| For an overview over all existing Virtual private network (VPN)-related articles in the OpenWrt wiki, please visit [[doc/​howto/​vpn.overview]] |
-Clients behind ​the tunnel 128.39.x.x+
  
-OpenVpn Client 2 tun1 Tunnel IP 10.66.88.102+This document walks through setting up the following example configuration:​
  
-OpenVpn Server ​1 IP 66.77.88.9 ​TunnelIP ​10.2.1.1+             ​+-[OpenWrt router]-------+ 
 +             ​| ​                       | 
 +             ​| ​ +[LAN]-------------+ ​ | 
 +    you   ​---+--| IP: 192.168.1.1 ​ |  | 
 +             ​| ​ +------------------+ ​ | 
 +             ​| ​                       | 
 +             ​| ​ +[OpenVPN client 1]+  |   ​+-[OpenVPN server ​1]----+ 
 +             ​| ​ |                  |  |   | Public ​IP66.77.88.9 ​|   / 
 +             ​| ​ | Iface: tun0      |--+---| Tunnel IP: 10.2.1.1 ​  |---- { 128.39.x.x 
 +             ​| ​ | IP: 10.2.1.6 ​    ​| ​ |   ​+-----------------------+ ​  \  
 +             ​| ​ +------------------+ ​ | 
 +             ​| ​                       |   ​+-[OpenVPN server 1]----+ 
 +             ​| ​ +[OpenVPN client 2]+  |   | Public IP: 22.33.44.9 |   / 
 +             ​| ​ | Iface: tun1      |--+---| Tunnel IP: 10.66.88.1 |---- { some other network 
 +             ​| ​ | IP: 10.66.88.102 |  |   ​+-----------------------+ ​  \  
 +             ​| ​ +------------------+ ​ | 
 +             ​| ​                       | 
 +             ​+------------------------+
  
-OpenVpn Server 2 IP 22.33.44.9 TunnelIP 10.66.88.1+===== Create OpenVPN configuration ===== 
 +| :!: This section describes configuring OpenVPN through LuCI The LuCI module for OpenVPN no longer exists; this needs to be re-written for plain uci Or, perhaps you'd like to update the LuCI module? :!: |
  
- 
-===== Installation ===== 
-   - Install the openvpn package: 
-<​code>​ 
-opkg update 
-opkg install openvpn 
-</​code>​ 
-Or if you prefer configure openvpn via GUI: 
-<​code>​ 
-opkg update 
-opkg install openvpn luci-app-openvpn 
-</​code>​ 
- 
-===== Create OpenVPN configuration ===== 
 Go into Luci 192.168.1.1 Go into Luci 192.168.1.1
 Services → OpenVpn Services → OpenVpn
Line 58: Line 60:
 If the configuration ok, Luci shows Startet yes (prozessid 32165) If the configuration ok, Luci shows Startet yes (prozessid 32165)
 If you it again want to check on the console ​ type ifconfig If you it again want to check on the console ​ type ifconfig
-    snip +<​code>​ 
-    tun0      Link encap:​UNSPEC ​ HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 +... 
-              inet addr:​10.2.1.6 ​ P-t-P:​10.2.1.5 ​ Mask:​255.255.255.255 +tun0      Link encap:​UNSPEC ​ HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 
-    snip +          inet addr:​10.2.1.6 ​ P-t-P:​10.2.1.5 ​ Mask:​255.255.255.255 
-    tun1      Link encap:​UNSPEC ​ HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 +... 
-             ​inet addr:​10.66.88.102 ​ P-t-P:​10.66.88.101 ​ Mask:​255.255.255.255 +tun1      Link encap:​UNSPEC ​ HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 
-    snip+          inet addr:​10.66.88.102 ​ P-t-P:​10.66.88.101 ​ Mask:​255.255.255.255 
 +... 
 +</​code>​
  
 test your the tunnel test your the tunnel
Line 80: Line 84:
 **/​etc/​config/​network** **/​etc/​config/​network**
  
-''​config interface '​loopback'​+<​code>​ 
 +config interface '​loopback'​
  option ifname '​lo'​  option ifname '​lo'​
  option proto '​static'​  option proto '​static'​
Line 91: Line 96:
  option ipaddr '​192.168.1.1'​  option ipaddr '​192.168.1.1'​
  option netmask '​255.255.255.0'​  option netmask '​255.255.255.0'​
- option _orig_ifname 'eth0 wlan0 wlan0-1 tun0 tun1' 
- option _orig_bridge '​true'​ 
  option ifname '​eth0'​  option ifname '​eth0'​
  option stp '​1'​  option stp '​1'​
Line 107: Line 110:
  option auto '​1'​  option auto '​1'​
  option proto '​none'​  option proto '​none'​
- +</​code>​
-''​+
  
 **/​etc/​config/​openvpn** **/​etc/​config/​openvpn**
  
-''​config openvpn '​client_tun_0'​+<​code>​ 
 +config openvpn '​client_tun_0'​
  option enabled '​1'​  option enabled '​1'​
  option client '​1'​  option client '​1'​
Line 124: Line 127:
  option key '/​lib/​uci/​upload/​cbid.openvpn.client_tun_0.key'​  option key '/​lib/​uci/​upload/​cbid.openvpn.client_tun_0.key'​
  option cert '/​lib/​uci/​upload/​cbid.openvpn.client_tun_0.cert'​  option cert '/​lib/​uci/​upload/​cbid.openvpn.client_tun_0.cert'​
- option comp_lzo '1'+ option comp_lzo 'yes'
  option verb '​3'​  option verb '​3'​
  option float '​1'​  option float '​1'​
Line 151: Line 154:
  option key '/​lib/​uci/​upload/​cbid.openvpn.client_tun_1.key'​  option key '/​lib/​uci/​upload/​cbid.openvpn.client_tun_1.key'​
  option enable '​1'​  option enable '​1'​
-''​+</​code>​
  
 ===== Modify your firewall ===== ===== Modify your firewall =====
  
-in Luci go Network → Interfaces+In LuCI go Network → Interfaces
  
 Create new Interfaces Create new Interfaces
Line 196: Line 199:
 **/​etc/​config/​firewall** **/​etc/​config/​firewall**
  
-''​+<​code>​
 config defaults config defaults
  option syn_flood '​1'​  option syn_flood '​1'​
Line 245: Line 248:
  option icmp_type '​echo-request'​  option icmp_type '​echo-request'​
  option family '​ipv4'​  option family '​ipv4'​
- option target '​ACCEPT'​ 
- 
-config rule 
- option name '​Allow-DHCPv6'​ 
- option src '​wan'​ 
- option proto '​udp'​ 
- option src_ip '​fe80::/​10'​ 
- option src_port '​547'​ 
- option dest_ip '​fe80::/​10'​ 
- option dest_port '​546'​ 
- option family '​ipv6'​ 
- option target '​ACCEPT'​ 
- 
-config rule 
- option name '​Allow-ICMPv6-Input'​ 
- option src '​wan'​ 
- option proto '​icmp'​ 
- list icmp_type '​echo-request'​ 
- list icmp_type '​echo-reply'​ 
- list icmp_type '​destination-unreachable'​ 
- list icmp_type '​packet-too-big'​ 
- list icmp_type '​time-exceeded'​ 
- list icmp_type '​bad-header'​ 
- list icmp_type '​unknown-header-type'​ 
- list icmp_type '​router-solicitation'​ 
- list icmp_type '​neighbour-solicitation'​ 
- option limit '​1000/​sec'​ 
- option family '​ipv6'​ 
- option target '​ACCEPT'​ 
- 
-config rule 
- option name '​Allow-ICMPv6-Forward'​ 
- option src '​wan'​ 
- option dest '​*'​ 
- option proto '​icmp'​ 
- list icmp_type '​echo-request'​ 
- list icmp_type '​echo-reply'​ 
- list icmp_type '​destination-unreachable'​ 
- list icmp_type '​packet-too-big'​ 
- list icmp_type '​time-exceeded'​ 
- list icmp_type '​bad-header'​ 
- list icmp_type '​unknown-header-type'​ 
- option limit '​1000/​sec'​ 
- option family '​ipv6'​ 
  option target '​ACCEPT'​  option target '​ACCEPT'​
  
Line 301: Line 260:
  option dest '​vpn'​  option dest '​vpn'​
  option src '​lan'​  option src '​lan'​
- +</​code>​
-''​+
  
  
  
  
doc/howto/vpn.client.openvpn.tun.1382945275.txt.bz2 · Last modified: 2013/10/28 08:27 by lorema