Browse Library
Sign In Start Free Trial
Close icon Search icon
Account
Browse Library Sign In Start Free Trial

Add to playlist

Create a Playlist

Modal Close icon
You need to login to use this feature.
  • Book Overview & Buying OpenVPN 2 Cookbook
  • Table Of Contents Toc
OpenVPN 2 Cookbook

OpenVPN 2 Cookbook

4.1 (12)
Buy this Book
close
close
OpenVPN 2 Cookbook

OpenVPN 2 Cookbook

4.1 (12)
Buy this Book

Overview of this book

Table of Contents (19 chapters)
close
close
close
OpenVPN 2 Cookbook
Icon
OpenVPN 2 Cookbook
Credits
Icon
Credits
About the Author
Icon
About the Author
About the Reviewers
Icon
About the Reviewers
www.PacktPub.com
Icon
www.PacktPub.com
Preface
Icon
Preface
Lock Free Chapter
1
Point-to-Point Networks
Icon
Point-to-Point Networks
Icon
Introduction
Icon
Shortest setup possible
Icon
OpenVPN secret keys
Icon
Multiple secret keys
Icon
Plaintext tunnel
Icon
Routing
Icon
Configuration files versus the command-line
Icon
Complete site-to-site setup
Icon
3-way routing
2
Client-server IP-only Networks
Icon
Client-server IP-only Networks
Icon
Introduction
Icon
Setting up the public and private keys
Icon
Simple configuration
Icon
Server-side routing
Icon
Using 'client-config-dir' files
Icon
Routing: subnets on both sides
Icon
Redirecting the default gateway
Icon
Using an 'ifconfig-pool' block
Icon
Using the status file
Icon
Management interface
Icon
Proxy-arp
3
Client-server Ethernet-style Networks
Icon
Client-server Ethernet-style Networks
Icon
Introduction
Icon
Simple configuration—non-bridged
Icon
Enabling client-to-client traffic
Icon
Bridging—Linux
Icon
Bridging—Windows
Icon
Checking broadcast and non-IP traffic
Icon
External DHCP server
Icon
Using the status file
Icon
Management interface
4
PKI, Certificates, and OpenSSL
chevron up
Icon
PKI, Certificates, and OpenSSL
Icon
Introduction
Icon
Certificate generation
Icon
xCA: a GUI for managing a PKI (Part 1)
Icon
xCA : a GUI for managing a PKI (Part 2)
Icon
OpenSSL tricks: x509, pkcs12, verify output
Icon
Revoking certificates
Icon
The use of CRLs
Icon
Checking expired/revoked certificates
Icon
Intermediary CAs
Icon
Multiple CAs: stacking, using --capath
5
Two-factor Authentication with PKCS#11
Icon
Two-factor Authentication with PKCS#11
Icon
Introduction
Icon
Initializing a hardware token
Icon
Getting a hardware token ID
Icon
Using a hardware token
Icon
Using the management interface to list PKCS#11 certificates
Icon
Selecting a PKCS#11 certificate using the management interface
Icon
Generating a key on the hardware token
Icon
Private method for getting a PKCS#11 certificate
Icon
Pin caching example
6
Scripting and Plugins
Icon
Scripting and Plugins
Icon
Introduction
Icon
Using a client-side up/down script
Icon
Windows login greeter
Icon
Using client-connect/client-disconnect scripts
Icon
Using a 'learn-address' script
Icon
Using a 'tls-verify' script
Icon
Using an 'auth-user-pass-verify' script
Icon
Script order
Icon
Script security and logging
Icon
Using the 'down-root' plugin
Icon
Using the PAM authentication plugin
7
Troubleshooting OpenVPN: Configurations
Icon
Troubleshooting OpenVPN: Configurations
Icon
Introduction
Icon
Cipher mismatches
Icon
TUN versus TAP mismatches
Icon
Compression mismatches
Icon
Key mismatches
Icon
Troubleshooting MTU and tun-mtu issues
Icon
Troubleshooting network connectivity
Icon
Troubleshooting 'client-config-dir' issues
Icon
How to read the OpenVPN log files
8
Troubleshooting OpenVPN: Routing
Icon
Troubleshooting OpenVPN: Routing
Icon
Introduction
Icon
The missing return route
Icon
Missing return routes when 'iroute' is used
Icon
All clients function except the OpenVPN endpoints
Icon
Source routing
Icon
Routing and permissions on Windows
Icon
Troubleshooting client-to-client traffic routing
Icon
Understanding the 'MULTI: bad source' warnings
Icon
Failure when redirecting the default gateway
9
Performance Tuning
Icon
Performance Tuning
Icon
Introduction
Icon
Optimizing performance using 'ping'
Icon
Optimizing performance using 'iperf'
Icon
OpenSSL cipher speed
Icon
Compression tests
Icon
Traffic shaping
Icon
Tuning UDP-based connections
Icon
Tuning TCP-based connections
Icon
Analyzing performance using tcpdump
10
OS Integration
Icon
OS Integration
Icon
Introduction
Icon
Linux: using NetworkManager
Icon
Linux: using 'pull-resolv-conf'
Icon
MacOS: using Tunnelblick
Icon
Windows Vista/7: elevated privileges
Icon
Windows: using the CryptoAPI store
Icon
Windows: updating the DNS cache
Icon
Windows: running OpenVPN as a service
Icon
Windows: public versus private network adapters
Icon
Windows: routing methods
11
Advanced Configuration
Icon
Advanced Configuration
Icon
Introduction
Icon
Including configuration files in config files
Icon
Multiple remotes and remote-random
Icon
Details of ifconfig-pool-persist
Icon
Connecting using a SOCKS proxy
Icon
Connecting via an HTTP proxy
Icon
Connecting via an HTTP proxy with authentication
Icon
Using dyndns
Icon
IP-less setups (ifconfig-noexec)
12
New Features of OpenVPN 2.1 and 2.2
Icon
New Features of OpenVPN 2.1 and 2.2
Icon
Introduction
Icon
Inline certificates
Icon
Connection blocks
Icon
Port sharing with an HTTPS server
Icon
Routing features: redirect-private, allow-pull-fqdn
Icon
Handing out the public IPs
Icon
OCSP support
Icon
New for 2.2: the 'x509_user_name' parameter
1
Index
Icon
Index

Multiple CAs: stacking, using --capath

The goal of this recipe is to create an OpenVPN setup where the client certificates are signed by a "client-only" CA and the server certificate is signed by a different "server-only" CA. This provides an extra level of operational security, where one person is allowed to create only client certificates whereas another is allowed to generate only a server certificate. This ensures that the client and server certificates can never be mixed for a Man-in-the-Middle attack.

Getting ready

Set up the server certificate using the first recipe from Chapter 2. Use the client certificate and the intermediary CA certificate from the previous recipe. For this recipe, the server computer was running CentOS 5 Linux and OpenVPN 2.1.1. The client was running Fedora 12 Linux and OpenVPN 2.1.1.

How to do it...

  1. Create the server configuration file:

    tls-server
proto udp
port 1194
dev tun

server 192.168.200.0 255.255.255.0

ca       /etc/openvpn/cookbook/ca+subca.pem
cert  ...
CONTINUE READING
83
Tech Concepts
36
Programming languages
73
Tech Tools
Icon Unlimited access to the largest independent learning library in tech of over 8,000 expert-authored tech books and videos.
Icon Innovative learning tools, including AI book assistants, code context explainers, and text-to-speech.
Icon 50+ new titles added per month and exclusive early access to books as they are being written.
OpenVPN 2 Cookbook
End of Chapter 4
Next Chapter
notes
bookmark Notes and Bookmarks search Search in title playlist Add to playlist download Download options
font-size Font size

Change the font size

margin-width Margin width

Change margin width

day-mode Day/Sepia/Night Modes

Change background colour

Close icon Search
Country selected
Close icon Your notes and bookmarks

Confirmation

Modal Close icon
claim successful
Order Page Read Now

Buy this book with your credits?

Modal Close icon
Are you sure you want to buy this book with one of your credits?
Close
YES, BUY

Submit Your Feedback

Modal Close icon
Modal Close icon
Modal Close icon