OpenVPN 2 Cookbook

Book Image

OpenVPN 2 Cookbook

Book Image

OpenVPN 2 Cookbook

Overview of this book

OpenVPN 2 Cookbook

OpenVPN 2 Cookbook

Credits

About the Author

About the Author

About the Reviewers

About the Reviewers

www.PacktPub.com

www.PacktPub.com

Preface

Free Chapter

Point-to-Point Networks

Point-to-Point Networks

Shortest setup possible

OpenVPN secret keys

Multiple secret keys

Plaintext tunnel

Configuration files versus the command-line

Complete site-to-site setup

Client-server IP-only Networks

Client-server IP-only Networks

Setting up the public and private keys

Simple configuration

Server-side routing

Using 'client-config-dir' files

Routing: subnets on both sides

Redirecting the default gateway

Using an 'ifconfig-pool' block

Using the status file

Management interface

Client-server Ethernet-style Networks

Client-server Ethernet-style Networks

Simple configuration—non-bridged

Enabling client-to-client traffic

Bridging—Linux

Bridging—Windows

Checking broadcast and non-IP traffic

External DHCP server

Using the status file

Management interface

PKI, Certificates, and OpenSSL

PKI, Certificates, and OpenSSL

Certificate generation

xCA: a GUI for managing a PKI (Part 1)

xCA : a GUI for managing a PKI (Part 2)

OpenSSL tricks: x509, pkcs12, verify output

Revoking certificates

The use of CRLs

Checking expired/revoked certificates

Intermediary CAs

Multiple CAs: stacking, using --capath

Two-factor Authentication with PKCS#11

Two-factor Authentication with PKCS#11

Initializing a hardware token

Getting a hardware token ID

Using a hardware token

Using the management interface to list PKCS#11 certificates

Selecting a PKCS#11 certificate using the management interface

Generating a key on the hardware token

Private method for getting a PKCS#11 certificate

Pin caching example

Scripting and Plugins

Scripting and Plugins

Using a client-side up/down script

Windows login greeter

Using client-connect/client-disconnect scripts

Using a 'learn-address' script

Using a 'tls-verify' script

Using an 'auth-user-pass-verify' script

Script security and logging

Using the 'down-root' plugin

Using the PAM authentication plugin

Troubleshooting OpenVPN: Configurations

Troubleshooting OpenVPN: Configurations

Cipher mismatches

TUN versus TAP mismatches

Compression mismatches

Troubleshooting MTU and tun-mtu issues

Troubleshooting network connectivity

Troubleshooting 'client-config-dir' issues

How to read the OpenVPN log files

Troubleshooting OpenVPN: Routing

Troubleshooting OpenVPN: Routing

The missing return route

Missing return routes when 'iroute' is used

All clients function except the OpenVPN endpoints

Routing and permissions on Windows

Troubleshooting client-to-client traffic routing

Understanding the 'MULTI: bad source' warnings

Failure when redirecting the default gateway

Performance Tuning

Performance Tuning

Optimizing performance using 'ping'

Optimizing performance using 'iperf'

OpenSSL cipher speed

Compression tests

Traffic shaping

Tuning UDP-based connections

Tuning TCP-based connections

Analyzing performance using tcpdump

OS Integration

Linux: using NetworkManager

Linux: using 'pull-resolv-conf'

MacOS: using Tunnelblick

Windows Vista/7: elevated privileges

Windows: using the CryptoAPI store

Windows: updating the DNS cache

Windows: running OpenVPN as a service

Windows: public versus private network adapters

Windows: routing methods

Advanced Configuration

Advanced Configuration

Including configuration files in config files

Multiple remotes and remote-random

Details of ifconfig-pool-persist

Connecting using a SOCKS proxy

Connecting via an HTTP proxy

Connecting via an HTTP proxy with authentication

IP-less setups (ifconfig-noexec)

New Features of OpenVPN 2.1 and 2.2

New Features of OpenVPN 2.1 and 2.2

Inline certificates

Connection blocks

Port sharing with an HTTPS server

Routing features: redirect-private, allow-pull-fqdn

Handing out the public IPs

New for 2.2: the 'x509_user_name' parameter

Index

Customer Reviews

5 star

0

4 star

0

3 star

0

2 star

0

1 star

0

Linux: using NetworkManager

When Linux is used as a desktop operating system, the network configuration is configured using the Linux NetworkManager in most of the cases. This package allows a non-root user to start and stop the network connections, connect and disconnect from wireless networks, and also to set up several types of VPN connections, including OpenVPN. In this recipe, we will show how to configure an OpenVPN connection using the GNOME variant of the NetworkManager.

Getting ready

Set up the client and server certificates using the first recipe from Chapter 2, Client-server IP-only Networks. For this recipe, the server computer was running CentOS 5 Linux and OpenVPN 2.1.1. The client was running Fedora 13 Linux and OpenVPN 2.1.1. This version of Linux comes with NetworkManager 0.8, including the NetworkManager-openvpn plugin. The NetworkManager-openvpn plugin is not installed by default and needs to be explicitly added to the system. This version is highly recommended when setting...