a) Configure OpenVPN Client
3) That's it! Enjoy.
Network Info
Site A
OpenVPN Server
Internal network/subnetmask - 192.168.
1.0/255.255.255.0
External Public IP Address
Site B
OpenVPN Client
Internal network/subnetmask - 192.168.2.0/255.255.255.0
External Public IP Address
-------------------------------------------------------------------------------
LETS GET STARTED!
Setup OpenVPN Server on Site A Router
Plug in USB flash drive. Make sure the router has internet access.
Connect via SSH into router. For Windows, I recommend
Putty.
Log in with username of
root and password of
admin.
Execute the following commands:
#Partition your usb flash drive
umount /dev/sda1
fdisk /dev/sda
Type in the following commands to create a primary partition on your USB Flash drive
# p # list current partitions
# o # to delete all partitions
# n # new partition
# p # primary partition
# 1 (one) # first partition
# <enter> # default start block
# <enter> # default end block #use the whole flash drive
# w # write new partition to disk
#format newly created partition
#label disk as 'optware' case sensitive
umount /dev/sda1
mke2fs -j -L optware /dev/sda1
Install Entware (a package manager that allows you to install additional software on your router)
#mount the new disk partition
mount /dev/sda1 /opt
cd /opt
wget http://wl500g-repo.googlecode.com/svn/ipkg/entware_install.sh
sh ./entware_install.sh
#Make sure /opt is properly mounted on a reboot.
echo "LABEL=optware /opt ext2 defaults 1 1" >> /etc/fstab
nvram setfile2nvram /etc/fstab
nvram commit
Install openvpn-easy-rsa
opkg install openvpn-easy-rsa nano
Setup working folder for openvpn-easy-rsa (It's recommended that you cut/paste everything up to Setup CA, into your console window to prevent any error/typos)
#Create a working folder for easy-rsa
rm -rf /opt/openvpn-easy-rsa
mkdir /opt/openvpn-easy-rsa
#copy files to working directory
cd /opt/openvpn-easy-rsa
cp /opt/sbin/sign-req .
cp /opt/sbin/build-req .
cp /opt/sbin/inherit-inter .
cp /opt/sbin/revoke-full .
cp /opt/sbin/clean-all .
cp /opt/sbin/build-ca .
cp /opt/sbin/pkitool .
cp /opt/sbin/build-dh .
cp /opt/sbin/build-key-pass .
cp /opt/sbin/build-key-pkcs12 .
cp /opt/sbin/list-crl .
cp /opt/sbin/whichopensslcnf .
cp /opt/sbin/build-key-server .
cp /opt/sbin/build-key .
cp /opt/etc/easy-rsa/openssl-1.0.0.cnf .
cp /opt/sbin/build-inter .
cp /opt/sbin/build-req-pass .
#copy vars files to working folder
cp /opt/etc/easy-rsa/vars /opt/openvpn-easy-rsa
#Set working directory and reduce key_size to 1024 in vars file
cd /opt/openvpn-easy-rsa
sed -i 's:`pwd`:/opt/openvpn-easy-rsa:' ./vars
sed -i 's:KEY_SIZE=2048:KEY_SIZE=1024:' ./vars
#update PATH to pick up correct openssl (save a reboot)
#correct = /opt/bin/openssl
PATH=/opt/bin:$PATH
Setup Certificate Authority (CA)
#Setup and initialize environment
cd /opt/openvpn-easy-rsa
source ./vars
./clean-all
#Select Default for All, Keep Hitting <Enter> (8 times)
./build-ca
Generate Diffie Hellman parameters (DH file)
./build-dh
Generate Certificate and Key for the OpenVPN Server router at Site A with Common Name [CN] of "OpenVPNServer".
#Generate Cert/Key for Site2SiteClient
#<Enter> 10 times to take default value
#Followed by two 'y' <Enter> when asked to sign and commit
./build-key-server OpenVPNServer
Generate Certificate and Key for the OpenVPN Client router Site B with Common Name [CN] of "Site2SiteClient". The "Common Name" isn't really "common". Make sure its unique for all your clients.
#Generate Cert/Key for Site2SiteClient
#<Enter> 10 times to take default value
#Followed by two 'y' <Enter> when asked to sign and commit
./build-key Site2SiteClient
Output Certificate and Key to console - cut/paste into text file for later use.
cd /opt/openvpn-easy-rsa/keys
cat ./ca.crt
cat ./Site2SiteClient.crt
cat ./Site2SiteClient.key
Create a new text file on your computer and name it "ClientRouterKeys.txt" and cut and paste in the output of the three cat commands above. You'll need this file to setup the OpenVPN Client Router later in the tutorial.
That's it for the SSH Console. The rest of the configuration will be done via a web browser. If you run into any issues with the above commands, take a look at my
console output. Hopefully it will help.
Configure OpenVPN Server
Open your favorite browser and connect to your router and go to VPN Tunneling -> OpenVPN Server (
http://192.168.1.1/vpn-server.asp).
On "Server 1 -> Basic" Tab, check "Start with WAN". Leave everything else as default.
OpenVPN Server Configuration Server 1->Basic Screen should look like the following:
Change to the Advanced Tab
Check "Respond to DNS"
Check "Manage Client-Specific Options"
Check "Allow Client<->Client"
Check "Enable"
Type in "Site2SiteClient" under "Common Name"
Type in "192.168.2.0" under Subnet
Type in "255.255.255.0" under Netmask
Check Push
Click 'Add' button. (pushes routes to the client router and add route to server router. No need for router/iptable commands)
In the "Custom Configuration" box, paste in the following (saves us from pasting in the certs/key in the Keys Tab):
ca /opt/openvpn-easy-rsa/keys/ca.crt
cert /opt/openvpn-easy-rsa/keys/OpenVPNServer.crt
key /opt/openvpn-easy-rsa/keys/OpenVPNServer.key
dh /opt/openvpn-easy-rsa/keys/dh1024.pem
[Save]
OpenVPN Server Configuration Server 1->Advanced Screen should look like the following:
Setup Port Fowarding for OpenVPN Server
Forward UDP Port 1194 to your router internal IP @192.168.1.1
Select UDP in the Proto dropdown box.
Type "1194" in the "Ext Ports" and "Int Port".
Type "192.168.1.1" for the "Int Address".
Type "OpenVPN Server" as the Description.
Click the "Add" button
[Save]
Setup Free Dynamic DNS Service (http://freedns.afraid.org/)
If you don't have a public static IP (most don't), you'll need to setup DDNS so your OpenVPN client(s) can find your OpenVPN server.
Go to
http://freedns.afraid.org and setup an account and then setup a subdomain.
I'm using "OpenVPNServer.mooo.com" (use something else). We'll need this subdomain during the OpenVPN Client setup.
Find the subdomain you just created and right click on the "Direct URL" link and select "Copy link address"
On your router, go to Basic -> DDNS (
http://192.168.1.1/basic-ddns.asp)
For Dynamic DNS 1, select "FreeDNS(afraid.org)" in the "Service" dropdown.
Paste in the URL you copied in the previous step (note that the URL will change to a token)
Check "Force next update"
Change the "Auto refresh every" to 7 or something lower than 30.
[Save]
Last Result should say Update Successfully.
Start OpenVPN Server
Go to VPN Tunneling -> OpenVPN Server (
http://192.168.1.1/vpn-server.asp).
On "Server 1 -> Status" Tab, click the "Start Now" button. Give it a few seconds and click on the "Refresh Status" link.
If you see the following, then the OpenVPN Server has started successfully. Congratulations we're almost there. Note that the button will change to "Stop Now". If the button remains as "Start Now", we have a problem. Go back and review the instructions.
Configuration of Site A Router is complete. Go ahead and reboot the router and verify that OpenVPN Server started properly.
Let's move on to setting up your Site B Router.
Setup OpenVPN Client on Site B Router
Configure OpenVPN Client
At Site B, open up your browser and go to VPN Tunneling -> OpenVPN Client (
http://192.168.2.1/vpn-client.asp). Go to Client 1 -> Basic.
Type in the Dynamic DNS address (subdomain) you setup for your Site A router in the "Server Address"
field. In my example, "OpenVPNServer.mooo.com"
Uncheck the "Connect NAT on tunnel"
Check "Start with WAN"
[Save]
Nothing has to be changed on the Client 1 -> Advanced Tab
Open up the Client 1 -> Keys Tab.
Open up "ClientRouterKeys.txt" file you created earlier in the tutorial and cut/paste the certificates and key into the appropriate field.
ca.crt in the Certificate Authority box
Site2SiteClient.crt in the Client Certificate box
Site2SiteClient.key in the Client Key box
Don't forget to [Save].
Your done with the configuration. The moment of truth, on the Client 1 -> Status Tab, Click "Start Now"
Wait a few seconds and click on the "Refresh Status" link. Hopefully you'll see some bytes in the Value column.
From Site B, you should now be able to access Site A network resources and vice-versa.
Lets give the VPN a quick test. Still connected to Site B, open up the OpenVPN Server Configuration page on your Site A router @
http://192.168.1.1/vpn-server.asp. Hopefully you can see a successfully status page like the one below:
That's it!! Enjoy.
Client to Site VPN
You should easily be able to add additional OpenVPN Clients (for Client to Site VPN) by generating additional RSA Certs/Key on your OpenVPN Server Router.
#Setup and initialize environment
cd /opt/openvpn-easy-rsa
source ./vars
./build-key Zoe-Laptop
./build-key Landon-Laptop
#Install SFTP so you can securely access your keys
#Location of keys = /opt/openvpn-easy-rsa/keys
#Connect as root
opkg install openssh-sftp-server
[Tutorial] CentOS 6 OpenVPN Client - Connecting to Existing Site to Site VPN
Troubleshooting and FAQ:
- Review my
console output
-
Watch my walk-through video
- Make sure the time is correct on both routers (NTP is setup, watch video)
- Check the logs
- Restore Default Configuration and start fresh (backup your current config, just in case).
Erase all data in NVRAM memory (thorough) @ http://192.168.1.1/admin-config.asp
Special Thanks to Shibby for the excellent firmware, the Entware Team, and Wasaga Computer's for their excellent blog, which is the original tutorial I used to successfully setup my first Site to Site VPN using TomatoUSB.
If you have any issues, have any questions or notice any mistakes, please don't hesitate
to leave a comment (anonymously if you want). Your feedback will help me improve the tutorial and keep it up to date. Thank you.
