[TheHijacker]

Here are the repeated manual for the OpenVPN usage:

After days of testing and trying to make everything work and after receiving missing piece of the puzzle from R&D and azslow3 I can finaly present the OpenVPN package.

When running on the eTrayz it can turn him into a VPN server to which you can connect to and access your home network just as if you were phisicaly present in that network.

Using it is actualy quite simple. You have a server using a server certificates and you have client(s) using own certificates but based on server certificates, to connect to it. Just don't get scared on seeing this instructions. I explain in longer way to make more sense. I did all the hard work for you already .

Actualy there are two ways to connect. One is by already mentioned certificates and second one is by using a static key. Default usage after installing the package is by using static keys. It is made just after the installation automaticly and its quite a fast process. But you can only use one client, while with certificates you can have more then one.

All the configuration files is stored in folder:

/home/epkg/etc/openvpn

Main configuration files are with sufix .conf:

openvpn.conf - file that is used when you start the OpenVPN process
openvpn.conf.certificates - configuration file that uses certificates
openvpn.conf.static - configuration file that uses static key

By default openvpn.conf file is just a copy of openvpn.conf.static file, that is for using static key. If you want to use certificates you need to create server and client keys, but more about this later.

After installing, everything should be prepared on the eTrayz to start OpenVPN with static keys. So just start the process.

Next step is to configure OpenVPN client. I will write it for Windows client, since I have no OSX computers. But there are also clients for OSX such as tunnelblick. For windows client download OpenVPN 2.1.1 windows installer from here (openvpn-2.1.1-install.exe):

<!-- m -->http://openvpn.net/i.../downloads.html<!-- m -->

Install it with all default settings. It also installs a nice GUI interface for easy connecting to our server.

What we need now is to copy all the premade configurations that I already setup for etrayz connection and proper routing. All the certificates and static keys are automaticly copied to a non public location:

/home/sysadmin/openvpn/client

Copy all the files from that folder to OpenVPN client folder at location:

c:\Program Files\OpenVPN\config

For static key connection you only need files Static keys.ovpn and static.key. If/after you create server and client certificates you can copy them too to the client. GUI will then show you both options to connect with.

!!! MANUAL EDIT !!!

Edit the .ovpn files and look for line:

remote YOURETRAYZDDNS 1194

Replace YOURETRAYZDDNS with your remote DDNS or external WAN IP to your eTrayz. As you can see it runs on port 1194 so make sure its opened on your router and forwarded to your eTrayz (TCP+UDP).

Once this is done just start OpenVPN GUI. You will see new icon in tray. Right click on it, select Static Keys connection and click connect. It usualy takes 10-20 seconds and if ports are forwarded you will successfuly connect and get IP asigned in the 10.8.0.0 network (usualy 10.8.0.2 for static and 10.8.0.6 for first client for certificate connection).

You can ping your VPN/eTrayz by pinging 10.8.0.1 or your LAN eTrayz IP. BUT!!! YOU WILL NOT BE ABLE TO PING ANY OTHER COMPUTERS IN YOUR HOME NETWORK. I'll deal with this later in this manual.

!!! USING CERTIFICATES !!!

If you want to have more then one client and of course make things even more secure you can use certificates. It takes quite a lot of command line commands to do this. But again I made things easier. You still need SSH connection but I minimized the commands to only two. One for making server keys and another to make client keys.

So login to your eTrayz via SSH and type this command to first make server keys:

/home/epkg/etc/openvpn/easy-rsa/thj_server.sh

Making basic keys is fast but it can take a lot of time to make DH file. Just let it run. It can take 5-30 minutes to finish. Once done we will make client keys. I by default name them client1, client2,... You can use diffrent naming but you need to edit the configure files. Lets make client1 keys:

/home/epkg/etc/openvpn/easy-rsa/thj_client.sh client1

And we are done. All the keys needed now for setting up the client are again stored into folder:

/home/sysadmin/openvpn/client

Files needed are ca.crt, client1.crt and client1.key. Copy them to client /config folder. If you named client diffrently then you need to change file Certificates.ovpn:

# using certificates
ca ca.crt
cert client??.crt
key client??.key

You also need to switch openvpn.conf file (from static to certificates) in /home/epkg/etc/openvpn folder. Just copy file openvpn.conf.certificates over openvpn.conf with SSH command:

cp /home/epkg/etc/openvpn/openvpn.conf.certificates /home/epkg/etc/openvpn/openvpn.conf

No need to change anything inside it. It uses the server keys, that we made before, automaticly. Start server, and client from GUI but this time choose Certificates from the OpenVPN GUI.

!!! FIXING ROUTING !!!

If you have firmware 1.0.5 then all you need to do is type this:

modprobe ip_tables
modprobe ipt_MASQUERADE
iptables -t nat -A POSTROUTING -s 10.8.0.0/16 -o eth0 -j MASQUERADE

For older firmwares (I urge you to upgrade to 1.0.5!!!):

This is something that I banged my head with and it prevented me to release this package before. The whole point in VPN is to have ability to see ALL the computers inside the network eTrayz is running in. With default setting I could only access eTrayz and nothing else. Here is my theory and sample network settings:

eTrayz local network: 192.168.0.0
eTrayz local IP: 192.168.0.25
eTrayz VPN IP: 10.8.0.1
My router IP: 192.168.0.10

Client network: 192.168.21.0
Client local IP: 192.168.21.100
VPN appointed IP: 10.8.0.6

So. When connected I am able to ping VPN server (eTrayz) with IP 10.8.0.1 or with IP 192.168.0.25. But I was unable to ping my router with IP 192.168.0.10. After a lot of google searches and testing with vpeter we figured out that the ping package is received by router and returned but he returns it to IP 10.8.0.6 which of course he doesn't know where it is since his network is 192.168.0.0.

So only solution that I figured out was to tell my router, which all devices in my network use as gateway, to send all the packages for network 10.8.0.0 to eTrayz and let OpenVPN with tun adapter handle it. And it worked!

My router is Linksys WRT54GL with Tomato firmware. Here is the change that I needed:



So for network 10.8.0.0 use gateway 192.168.0.25 (my eTrayz IP).

So... This is it. Any questions, ask. Any better solutions, please share. Any brave that tested this, post feedback.

This post has been edited by TheHijacker: 08 October 2010 - 19:53
Reason for edit: Changes because of new epkg structure

[Cobane]

Thanks for your efford!

I am just curious... have you ever checked how much resources this VPN server takes to eTRAYz?

[TheHijacker]

Minimal CPU usage and this is the memory usage of my OpenVPN process running for two days:

   Private       Shared   RAM used       Program
904.0 KiB + 808.0 KiB =   1.7 MiB       openvpn

[prospero0]

Today I try to connect with the UMTS modem (I'm away from home) and the VPN works perfectly!
As soon as I put the network configuration time that I have when I connect with UMTS and the network configuration when connected via LAN to work

I hope someone can help me work because the VPN does not work properly

Hello

[prospero0]

openvpn working with this configuration (connected by line UMTS) to ADSL etrayz

eTrayz local network: 192.168.0.0
eTrayz local IP: 192.168.0.5
eTrayz VPN IP: 10.8.0.1
My router IP: 192.168.0.1

Client network: 151.81.0.0
Client local IP: 151.81.0.63
VPN appointed IP: 10.8.0.2

route print
===========================================================================
Elenco interfacce
0x1 ........................... MS TCP Loopback interface
0x2 ...xxxxxxxxxxxxxxxx...... Intel® PRO/Wireless 3945ABG Network Connection
- Teefer2 Miniport
0x3 ...xxxxxxxxxxxxxxxx...... TAP-Win32 Adapter V9 - Teefer2 Miniport
0x10005 ...xxxxxxxxxxxxxxxx...... Juniper Network Connect Virtual Adapter - Te
efer2 Miniport
0x30006 ...xxxxxxxxxxxxxxxx...... WAN (PPP/SLIP) Interface
===========================================================================
===========================================================================
Route attive:
Indirizzo rete Mask Gateway Interfac. Metric
0.0.0.0 0.0.0.0 151.81.0.xx 151.81.0.xx 1
10.8.0.0 255.255.255.252 10.8.0.2 10.8.0.2 30
10.8.0.2 255.255.255.255 127.0.0.1 127.0.0.1 30
10.255.255.255 255.255.255.255 10.8.0.2 10.8.0.2 30
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
151.81.0.xx 255.255.255.255 127.0.0.1 127.0.0.1 50
151.81.255.255 255.255.255.255 151.81.0.xx 151.81.0.xx 50
192.168.0.0 255.255.255.0 10.8.0.1 10.8.0.2 1
224.0.0.0 240.0.0.0 10.8.0.2 10.8.0.2 30
224.0.0.0 240.0.0.0 151.81.0.xx 151.81.0.xx 1
255.255.255.255 255.255.255.255 10.8.0.2 10005 1
255.255.255.255 255.255.255.255 10.8.0.2 2 1
255.255.255.255 255.255.255.255 10.8.0.2 10.8.0.2 1
255.255.255.255 255.255.255.255 151.81.0.xx 151.81.0.xx 1
Gateway predefinito: 151.81.0.xx
===========================================================================
Static key log VPN

Sat Mar 20 12:16:16 2010 OpenVPN 2.1.1 i686-pc-mingw32 [SSL] [LZO2] [PKCS11] built on Dec 11 2009
Sat Mar 20 12:16:16 2010 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Sat Mar 20 12:16:16 2010 LZO compression initialized
Sat Mar 20 12:16:17 2010 TAP-WIN32 device [Connessione alla rete locale (LAN) 6] opened: .Global{16D79EFB-B60F-4528-904C-FB3EAC4EA846}.tap
Sat Mar 20 12:16:17 2010 Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.8.0.2/255.255.255.252 on interface {16D79EFB-B60F-4528-904C-FB3EAC4EA846} [DHCP-serv: 10.8.0.1, lease-time: 31536000]
Sat Mar 20 12:16:17 2010 Successful ARP Flush on interface [3] {16D79EFB-B60F-4528-904C-FB3EAC4EA846}
Sat Mar 20 12:16:17 2010 UDPv4 link local: [undef]
Sat Mar 20 12:16:17 2010 UDPv4 link remote: 151.21.xx.xxx:1194
Sat Mar 20 12:16:37 2010 Peer Connection Initiated with 151.21.xx.xxx:1194
Sat Mar 20 12:16:43 2010 Initialization Sequence Completed

[albertmm]

Hello,

my router doesn't let me create some rules on LAN network. I am a IT Manager, and I usually work with OpenVPN Servers, and I think that the problem of routing to the network (instead of accessing only to the eTrayz) is that there is no NAT on the eTrayz... The server has to translate addresses form the outside network (VPN, 10.8.0.0) to the incoming network.

I tried with this sentence, with iptables, th routing&filtering Linux software:

iptables -t nat -A POSTROUTING -s 10.8.0.0/16 -o eth0 -j MASQUERADE

but the iptables system doesn't work:

iptables v1.4.3.2: can't initialize iptables table `nat': Table does not exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.

Thus, I think that the problem is because iptables is not compiled in the kernel.

Anybody know how can this be done it?

Thanks,

[TheHijacker]

Yes you are correct. There is no iptables on eTrayz. And sorry, but I am unable to fix this. No idea how it could be done.

[sebek72]

Which router do you use...it must have some routing options.
Routing must be done so that the traffic from LAN to 10.8.0.0 is routed via Etrayz.
Without routing the traffic actualy gets to the server side LAN, but doesn't return, because the router doesn't know where to route it.

[albertmm]

sebek72 said:

Which router do you use...it must have some routing options.
Routing must be done so that the traffic from LAN to 10.8.0.0 is routed via Etrayz.
Without routing the traffic actualy gets to the server side LAN, but doesn't return, because the router doesn't know where to route it.

Hello,

my router is an D-LINK DIR 635. It doesn't let me create routes for the LAN side. I am only able to create to the WAN side (it has sense).

I have no routing form LAN to the VPN. I just have VPN connection to the eTrayz.

I will wait until we have a NAT engine on eTrayz kernel...

Thanks a lot.

[albertmm]

thehijacker said:

Yes you are correct. There is no iptables on eTrayz. And sorry, but I am unable to fix this. No idea how it could be done.

Thank you, I will investigate-it...

[prospero0]

The problem is both the quad server network vpn the vpn client's network are in a NAT

In fact one of the two connections do not NAT the VPN is created

I read that with this type of networks (both under NTA) had to create a network bridge side is that side servervpn clientvpn

[PJGM]

Mine works, but can't enter in my router

PJGM

[PJGM]

sebek72 said:

Which router do you use...it must have some routing options.
Routing must be done so that the traffic from LAN to 10.8.0.0 is routed via Etrayz.
Without routing the traffic actualy gets to the server side LAN, but doesn't return, because the router doesn't know where to route it.

It is possible to set it by telnet?

Thanks
PJGM

[sebek72]

Hi
Anyone treid samba shares via VPN?

They are working, but the speed aer not good.

When uploading form client to server i get max speed 4.5Mbit/s (both server and client are on 20Mbit links).
Tried with some mtu settings in openvpn.conf but nothing helps.

Anyone?

[vpeter]

sebek72, can you check CPU usage with top when transfering files? Probably is high

[sebek72]

PID    USER   PR   NI   VIRT RES  SHR S %CPU %MEM    TIME+  COMMAND
16741  root    20    0  4048 1916 1384 R  54.1 1.5  0:47.79 openvpn
31619  sysadmin 20   0  7036 3136 2440 S   8.3  2.5  0:04.47 smbd

about 15-10% CPU idle including other processes.

[PJGM]

eTrayz local network: 192.168.1.0
eTrayz local IP: 192.168.1.77
eTrayz VPN IP: 10.8.0.1
My router IP: 192.168.1.254

VPN appointed IP: 10.8.0.2

Now I opened telnet and Add a route to the routing table:



Tomorrow I will test if it worked

PJGM

-------------------------------------------------------------------

IT WORKED !!!

-------------------------------------------------------------------

[TheHijacker]

Good job PJGM. Congratulations. Another happy OpenVPN user.

[sebek72]

Samba performance over Mac client is a bit better around 6Mbit.

FTP is around 9-12Mbit on Mac and Windows client

[PJGM]

As I have posted here, (But gone somehow... )

In my case some applications have problems with openvpn and Hamachi.

Folder Gallery, File Manager (Both) and jsvnstat.

And I think that is a graphic issue.

I need more testimonials to assure that is a router problem.

Thanks
PJGM