User Tools
toolsandtechnologies:raspberrypiopenvpn
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| toolsandtechnologies:raspberrypiopenvpn [2018/12/10 18:54] – [Initial Setup] slawrence | toolsandtechnologies:raspberrypiopenvpn [2021/06/25 10:09] (current) – external edit 127.0.0.1 | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| + | --- // | ||
| + | ====== Install Open VPN on Raspberry Pi (Raspbian)/ | ||
| + | source : https:// | ||
| + | The source is Ubuntu but there are some steps that need to be added to make it work on the Pi but not many | ||
| + | |||
| + | ===== Initial Setup ===== | ||
| + | * sudo apt-get update | ||
| + | * sudo apt-get install openvpn easy-rsa | ||
| + | * sudo apt-get install ufw | ||
| + | * make-cadir ~/ | ||
| + | * cd ~/ | ||
| + | * nano vars | ||
| + | * # The following variables should be something like : < | ||
| + | .............. | ||
| + | export KEY_COUNTRY=" | ||
| + | export KEY_PROVINCE=" | ||
| + | export KEY_CITY=" | ||
| + | export KEY_ORG=" | ||
| + | export KEY_EMAIL=" | ||
| + | export KEY_OU=" | ||
| + | |||
| + | # X509 Subject Field | ||
| + | export KEY_NAME=" | ||
| + | ................. | ||
| + | </ | ||
| + | * NOTE: On newer versions of Ubuntu, you make have to make an update in vars for the KEY_CONFIG openssl.cnf pointer < | ||
| + | # This variable should point to | ||
| + | # the openssl.cnf file included | ||
| + | # with easy-rsa. | ||
| + | export KEY_CONFIG=$EASY_RSA/ | ||
| + | </ | ||
| + | * sudo chown -R scotty / | ||
| + | * cd ~/ | ||
| + | * source vars< | ||
| + | OUTPUT should look like: | ||
| + | |||
| + | scotty@erato: | ||
| + | NOTE: If you run ./ | ||
| + | </ | ||
| + | * ./clean-all | ||
| + | * ./build-ca | ||
| + | * ./ | ||
| + | * # The next part will take a good few minutes | ||
| + | * ./build-dh | ||
| + | * openvpn --genkey --secret keys/ta.key **(TWO DASHSES BEFORE genkey and secret)** | ||
| + | * cd ~/ | ||
| + | * source vars | ||
| + | * ./ | ||
| + | * cd ~/ | ||
| + | * sudo cp ca.crt ca.key server.crt server.key ta.key dh2048.pem / | ||
| + | * gunzip -c / | ||
| + | * sudo nano / | ||
| + | * # First, find the HMAC section by looking for the tls-auth directive. Remove the ";" | ||
| + | key-direction 0 </ | ||
| + | *# Next, find the section on cryptographic ciphers by looking for the commented out cipher lines. The AES-128-CBC cipher offers a good level of encryption and is well supported. Remove the ";" | ||
| + | * # Below this, add an auth line to select the HMAC message digest algorithm. For this, SHA256 is a good choice: < | ||
| + | * # Finally, find the user and group settings and remove the ";" | ||
| + | group nogroup </ | ||
| + | * # Ensure dh dh2048.pem is dh dh2048.pem and not dh dh1024.pem : < | ||
| + | * # Ensure to push dhcp options and redirect the gateway : < | ||
| + | push " | ||
| + | push " | ||
| + | * save and exit | ||
| + | * sudo nano / | ||
| + | * # Inside, look for the line that sets net.ipv4.ip_forward. Remove the "#" | ||
| + | * save and exit | ||
| + | * sudo sysctl -p | ||
| + | * ip route | grep default | ||
| + | * # Your public interface should follow the word " | ||
| + | * # For the RPI if using ethernet it will probably be eth0 | ||
| + | * # Make sure you actually replace wlp11s0 with whatever the interface is, incase of the pi it probably will be eth0 for ethernet but if you are using WiFi it would be wlan0 etc, make sure to check using : ip route | grep default | ||
| + | * sudo nano / | ||
| + | * # Make it look like < | ||
| + | # rules.before | ||
| + | # | ||
| + | # Rules that should be run before the ufw command line added rules. Custom | ||
| + | # rules should be added to one of these chains: | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # START OPENVPN RULES | ||
| + | # NAT table rules | ||
| + | *nat | ||
| + | : | ||
| + | # Allow traffic from OpenVPN client to wlp11s0 (change to the interface you discovered!) | ||
| + | -A POSTROUTING -s 10.8.0.0/8 -o wlp11s0 -j MASQUERADE | ||
| + | COMMIT | ||
| + | # END OPENVPN RULES | ||
| + | |||
| + | # Don't delete these required lines, otherwise there will be errors | ||
| + | *filter | ||
| + | . . . </ | ||
| + | * sudo nano / | ||
| + | * # Inside, find the DEFAULT_FORWARD_POLICY directive. We will change the value from DROP to ACCEPT: < | ||
| + | * save and exit | ||
| + | * sudo ufw allow 1194/udp | ||
| + | * sudo ufw allow OpenSSH | ||
| + | * sudo ufw disable | ||
| + | * sudo ufw enable | ||
| + | * # Now time to start open vpn | ||
| + | * sudo systemctl start openvpn@server | ||
| + | * # If this says anything after running, there probably an error | ||
| + | * sudo systemctl status openvpn@server | ||
| + | * # See the status it should show something like : < | ||
| + | | ||
| + | | ||
| + | Docs: man: | ||
| + | | ||
| + | | ||
| + | Process: 5852 ExecStart=/ | ||
| + | Main PID: 5856 (openvpn) | ||
| + | Tasks: 1 (limit: 512) | ||
| + | | ||
| + | | ||
| + | |||
| + | May 03 15:30:05 openvpn2 ovpn-server[5856]: | ||
| + | May 03 15:30:05 openvpn2 ovpn-server[5856]: | ||
| + | May 03 15:30:05 openvpn2 ovpn-server[5856]: | ||
| + | May 03 15:30:05 openvpn2 ovpn-server[5856]: | ||
| + | May 03 15:30:05 openvpn2 ovpn-server[5856]: | ||
| + | May 03 15:30:05 openvpn2 ovpn-server[5856]: | ||
| + | May 03 15:30:05 openvpn2 ovpn-server[5856]: | ||
| + | May 03 15:30:05 openvpn2 ovpn-server[5856]: | ||
| + | May 03 15:30:05 openvpn2 ovpn-server[5856]: | ||
| + | May 03 15:30:05 openvpn2 ovpn-server[5856]: | ||
| + | * # If it shows an error its fairly good at telling you what is missing and the error is probably in the / | ||
| + | * # Check the tun0 interface | ||
| + | * ip addr show tun0 | ||
| + | * # If everything went well enable Open Vpn | ||
| + | * sudo systemctl enable openvpn@server | ||
| + | |||
| + | ===== Client Configuration Infrastructure ===== | ||
| + | * mkdir -p ~/ | ||
| + | * chmod 700 ~/ | ||
| + | * cp / | ||
| + | * nano ~/ | ||
| + | * # First, locate the remote directive. This points the client to our OpenVPN server address. This should be the public IP address of your OpenVPN server. If you changed the port that the OpenVPN server is listening on, change 1194 to the port you selected: < | ||
| + | # The hostname/IP and port of the server. | ||
| + | # You can have multiple remote entries | ||
| + | # to load balance between the servers. | ||
| + | remote 212.17.60.121 1194 | ||
| + | . . . </ | ||
| + | * Next, uncomment the user and group directives by removing the ";": | ||
| + | user nobody | ||
| + | group nogroup</ | ||
| + | * Find the directives that set the ca, cert, and key. Comment out these directives since we will be adding the certs and keys within the file itself: < | ||
| + | # See the server config file for more | ||
| + | # description. | ||
| + | # a separate .crt/.key file pair | ||
| + | # for each client. | ||
| + | # file can be used for all clients. | ||
| + | #ca ca.crt | ||
| + | #cert client.crt | ||
| + | #key client.key</ | ||
| + | * # Mirror the cipher and auth settings that we set in the / | ||
| + | auth SHA256</ | ||
| + | * # Next, add the key-direction directive somewhere in the file. This must be set to " | ||
| + | * # Finally, add a few commented out lines. We want to include these with every config, but should only enable them for Linux clients that ship with a / | ||
| + | # up / | ||
| + | # down / | ||
| + | * save and exit | ||
| + | * nano ~/ | ||
| + | * # Ensure its blank and paste the following : < | ||
| + | |||
| + | # First argument: Client identifier | ||
| + | |||
| + | KEY_DIR=~/ | ||
| + | OUTPUT_DIR=~/ | ||
| + | BASE_CONFIG=~/ | ||
| + | |||
| + | cat ${BASE_CONFIG} \ | ||
| + | <(echo -e '< | ||
| + | ${KEY_DIR}/ | ||
| + | <(echo -e '</ | ||
| + | ${KEY_DIR}/ | ||
| + | <(echo -e '</ | ||
| + | ${KEY_DIR}/ | ||
| + | <(echo -e '</ | ||
| + | ${KEY_DIR}/ | ||
| + | <(echo -e '</ | ||
| + | > ${OUTPUT_DIR}/ | ||
| + | * save and exit | ||
| + | * chmod 700 ~/ | ||
| + | * # How to make client configs is below - the .ovpn file is the important file | ||
| + | |||
| + | |||
| + | |||
| + | ===== Initial Set up Revoking Certs - Only needs to be done once for initial setup ===== | ||
| + | * cd ~/ | ||
| + | * source vars | ||
| + | * ./ | ||
| + | * # Should say error 23 | ||
| + | * sudo nano / | ||
| + | * # At the bottom of the file, add the crl-verify option, so that the OpenVPN server checks the certificate revocation list that we've created each time a connection attempt is made: < | ||
| + | * save and exit | ||
| + | * sudo cp ~/ | ||
| + | * sudo systemctl restart openvpn@server | ||
| + | |||
| + | ===== VPN Program for Mac ===== | ||
| + | https:// | ||
| + | |||
| + | ===== Generating New VPN Certs ===== | ||
| + | * ssh to the VPN server | ||
| + | * cd ~/ | ||
| + | * source vars | ||
| + | * ./ | ||
| + | * # Give them a good password (pem passphrase), | ||
| + | * # When asked to sign, y and enter, when asked to commit y and enter | ||
| + | * # if an error appears such as db then the user already exists so give them a different name like firstname_lastname_1 etc. | ||
| + | * # if successful it should say : Write out database with 1 new entries\n Data Base Updated | ||
| + | * cd ~/ | ||
| + | * ./ | ||
| + | * # The opvn file should be located : ~/ | ||
| + | |||
| + | ===== Revoking VPN Certs ===== | ||
| + | * cd ~/ | ||
| + | * source vars | ||
| + | * ./ | ||
| + | * sudo cp ~/ | ||
| + | * sudo systemctl restart openvpn@server | ||
| + | |||
| + | ===== Rebooting Pi ===== | ||
| + | Run the following commands: | ||
| + | * ssh pi@10.5.5.11 | ||
| + | * sudo reboot | ||
Page Tools
