OpenVPN 2 Cookbook

Book Image

OpenVPN 2 Cookbook

Book Image

OpenVPN 2 Cookbook

Overview of this book

OpenVPN 2 Cookbook

OpenVPN 2 Cookbook

Credits

About the Author

About the Author

About the Reviewers

About the Reviewers

www.PacktPub.com

www.PacktPub.com

Preface

Free Chapter

Point-to-Point Networks

Point-to-Point Networks

Shortest setup possible

OpenVPN secret keys

Multiple secret keys

Plaintext tunnel

Configuration files versus the command-line

Complete site-to-site setup

Client-server IP-only Networks

Client-server IP-only Networks

Setting up the public and private keys

Simple configuration

Server-side routing

Using 'client-config-dir' files

Routing: subnets on both sides

Redirecting the default gateway

Using an 'ifconfig-pool' block

Using the status file

Management interface

Client-server Ethernet-style Networks

Client-server Ethernet-style Networks

Simple configuration—non-bridged

Enabling client-to-client traffic

Bridging—Linux

Bridging—Windows

Checking broadcast and non-IP traffic

External DHCP server

Using the status file

Management interface

PKI, Certificates, and OpenSSL

PKI, Certificates, and OpenSSL

Certificate generation

xCA: a GUI for managing a PKI (Part 1)

xCA : a GUI for managing a PKI (Part 2)

OpenSSL tricks: x509, pkcs12, verify output

Revoking certificates

The use of CRLs

Checking expired/revoked certificates

Intermediary CAs

Multiple CAs: stacking, using --capath

Two-factor Authentication with PKCS#11

Two-factor Authentication with PKCS#11

Initializing a hardware token

Getting a hardware token ID

Using a hardware token

Using the management interface to list PKCS#11 certificates

Selecting a PKCS#11 certificate using the management interface

Generating a key on the hardware token

Private method for getting a PKCS#11 certificate

Pin caching example

Scripting and Plugins

Scripting and Plugins

Using a client-side up/down script

Windows login greeter

Using client-connect/client-disconnect scripts

Using a 'learn-address' script

Using a 'tls-verify' script

Using an 'auth-user-pass-verify' script

Script security and logging

Using the 'down-root' plugin

Using the PAM authentication plugin

Troubleshooting OpenVPN: Configurations

Troubleshooting OpenVPN: Configurations

Cipher mismatches

TUN versus TAP mismatches

Compression mismatches

Troubleshooting MTU and tun-mtu issues

Troubleshooting network connectivity

Troubleshooting 'client-config-dir' issues

How to read the OpenVPN log files

Troubleshooting OpenVPN: Routing

Troubleshooting OpenVPN: Routing

The missing return route

Missing return routes when 'iroute' is used

All clients function except the OpenVPN endpoints

Routing and permissions on Windows

Troubleshooting client-to-client traffic routing

Understanding the 'MULTI: bad source' warnings

Failure when redirecting the default gateway

Performance Tuning

Performance Tuning

Optimizing performance using 'ping'

Optimizing performance using 'iperf'

OpenSSL cipher speed

Compression tests

Traffic shaping

Tuning UDP-based connections

Tuning TCP-based connections

Analyzing performance using tcpdump

OS Integration

Linux: using NetworkManager

Linux: using 'pull-resolv-conf'

MacOS: using Tunnelblick

Windows Vista/7: elevated privileges

Windows: using the CryptoAPI store

Windows: updating the DNS cache

Windows: running OpenVPN as a service

Windows: public versus private network adapters

Windows: routing methods

Advanced Configuration

Advanced Configuration

Including configuration files in config files

Multiple remotes and remote-random

Details of ifconfig-pool-persist

Connecting using a SOCKS proxy

Connecting via an HTTP proxy

Connecting via an HTTP proxy with authentication

IP-less setups (ifconfig-noexec)

New Features of OpenVPN 2.1 and 2.2

New Features of OpenVPN 2.1 and 2.2

Inline certificates

Connection blocks

Port sharing with an HTTPS server

Routing features: redirect-private, allow-pull-fqdn

Handing out the public IPs

New for 2.2: the 'x509_user_name' parameter

Index

Customer Reviews

5 star

0

4 star

0

3 star

0

2 star

0

1 star

0

New for 2.2: the 'x509_user_name' parameter

OpenVPN 2.2 is primarily a bug fix release, but there are a few new features added to version 2.2. In this recipe, we will focus on one of these features. The purpose of the x509_user_name parameter is to allow the usage of X509 certificates where the certificate name is not specified by the /CN= element. This can be especially useful when using certificates from a third-party source or when integrating certificates into other authorization systems.

Getting ready

We use the following network layout:

Set up the client and server certificates using the first recipe from Chapter 2, Client-server IP-only Networks. In this recipe, the server computer was running CentOS 5 Linux and OpenVPN 2.2-beta3. The client was running Windows XP SP3 and OpenVPN 2.1.3. Keep the configuration file basic-udp-server.conf from the Chapter 2 recipe Server-side routing at hand, as well as the client configuration file, basic-udp-client.ovpn, from the Chapter 2 recipe Using...