ASL-Corp members, Bureaucrats, Check users, Structured Discussions bots, oversight, Suppressors, Administrators, Upload Wizard campaign editors
1,714
edits
Changes
Jump to navigation
Jump to search
Line 1:
Line 1: − [[Category:How to]]+ + − + + + + + + − = VPN = + − Line 202:
Line 207: + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + − + Line 216:
Line 562: − + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Line 262:
Line 816: − │ ├── server1 + − │ ├── server2 + − │ └── server3 + Line 270:
Line 824: + + + Line 366:
Line 923: + + + + + + + + + + + + + + + + Line 391:
Line 964: + + + + + + + + + + + + Line 455:
Line 1,040: + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Line 699:
Line 1,340: + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Added SOCAT
[[Category:VPN]]
[[Category:VPN]]
[[Category:Node Configuration]]
[[Category:Administration]]
[[Category:Administration]]
[[Category:Networking]]
[[Category:Networking]]
[[category:Software]]
[[Category:Software]]
{{Infobox PTTLink
| image = Cyber-security-4072712 1920.jpg
| caption = VPN Security
| category = How to
}}
{{ Note|'''This document is a work in progress and is still being updated by the author.''' }}
{{ Note|'''This document is a work in progress and is still being updated by the author.''' }}
The following contains information on how to setup a Virtual Private Network (VPN) connection using various popular software packages and hardware devices.
The following contains information on how to setup a Virtual Private Network (VPN) connection using various popular packages.
== IPSEC ==
== IPSEC ==
172.16.10.2 : PSK "cisco"
172.16.10.2 : PSK "cisco"
172.16.10.1 : PSK "cisco"
172.16.10.1 : PSK "cisco"
== PPTP ==
{{go to top}}
== GRE Tunnel ==
{{go to top}}
GRE Tunnels
===Public/Private VM tunnel===
GRE tunnels are useful for connecting a VM in a private/home network to the internet via a public server/VM. The following information will connect Server A (public server) to Server B (private server), and allow requests to Server B to be passed to Server A's resources for use on the Internet.
====Configuration====
'''IP addresses'''
* Server A will have a public IP of 30.30.30.30/24 and the GRE interface will be assigned 192.168.168.1/30
* Server B will have a private IP of 10.0.0.50/24, a public IP of 40.40.40.40/24 and the GRE interface will be assigned 192.168.168.2/30
'''Ports'''
* Ports 22, 80 and 443 will be forwarded over the GRE tunnel
=====Server A (Public)=====
Copy the following to /etc/gre.sh
<syntaxhighlight lang="bash">
#!/bin/sh
ip tunnel add gre1 mode gre local 10.0.0.50 remote 40.40.40.40 ttl 255
ip add add 192.168.168.1/30 dev gre1
ip link set gre1 up
iptables -t nat -A POSTROUTING -s 192.168.168.0/30 ! -o gre+ -j SNAT --to-source 30.30.30.30
iptables -A FORWARD -d 192.168.168.2 -m state --state NEW.ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -d 192.168.168.2 -m state --state NEW.ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A PREROUTING -d 30.30.30.30 -p tcp -m tcp --dport 22 -j DNAT --to-destination 192.168.168.2
iptables -t nat -A PREROUTING -d 30.30.30.30 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.168.2
iptables -t nat -A PREROUTING -d 30.30.30.30 -p tcp -m tcp --dport 443 -j DNAT --to-destination 192.168.168.2
</syntaxhighlight>
=====Server B (Private)=====
* Add the following to /etc/iproute2/rt_tables<syntaxhighlight lang="text">
100 GRE</syntaxhighlight>
* Copy the following to /etc/gre.sh
<syntaxhighlight lang="bash">
#!/bin/sh
iptunnel add gre1 mode gre local 10.0.0.50 remote 30.30.30.30 ttl 255
ip addr add 192.168.168.2/30 dev gre1
ip link set gre1 up
ip rule add from 192.168.168.0/30 table GRE
ip route add default via 192.168.168.1 table GRE
</syntaxhighlight>
==L2TP Ethernet Pseudowires==
{{go to top}}
===Cisco===
The following configuration will setup L2TPv3 between two Cisco Routers - R1 and R2.
====R1 - Router Config====
pseudowire-class test
encapsulation l2tpv3
ip local interface Loopback0
ip pmtu
ip tos value 10
!
!
interface Loopback0
ip address 1.1.1.1 255.255.255.255
!
interface FastEthernet0/0.1
encapsulation dot1Q 5
xconnect 2.2.2.2 1 encapsulation l2tpv3 pw-class test
!
interface FastEthernet0/0.2
encapsulation dot1Q 2
xconnect 2.2.2.2 2 encapsulation l2tpv3 pw-class test
====R2 - Router Config====
pseudowire-class test
encapsulation l2tpv3
ip local interface Loopback0
ip pmtu
ip tos value 10
!
!
interface Loopback0
ip address 2.2.2.2 255.255.255.255
!
!
interface FastEthernet0/1.1
encapsulation dot1Q 5
xconnect 1.1.1.1 1 encapsulation l2tpv3 pw-class test
!
interface FastEthernet0/1.2
encapsulation dot1Q 2
xconnect 1.1.1.1 2 encapsulation l2tpv3 pw-class test
===Linux===
Create an L2TP ethernet pseudowires connection using the Linux kernel's L2TP drivers along with the ip utility.
Note: This setup does not have any security. You will need to route it over IPSEC to create a secure connection.
In this example we use separate systems to establish the tunnels across the Gateway (which represents the Internet).
====Topology====
{| class="wikitable" style="text-align: center; width: 35%"
|+ L2TP Tunnel Topology
! System
! Network
|-
| Gateway
| eth1: 1.1.1.1/30; eth2: 2.2.2.1.30
|-
| Tunnel1
| eth1/l2tpeth0 (bridged); eth1: No IP configured; eth2: 1.1.1.2/30
|-
| Tunnel2
| eth1/l2tpeth0 (bridged); eth1: No IP configured; eth2: 2.2.2.2/30
|}
====Configuration====
*Enable IP forwarding on Gateway, '''Tunnel1''' and '''Tunnel2''' systems by running this command on each:
# echo 1 > /proc/sys/net/ipv4/ip_forward
*Establish L3 connectivity between '''Tunnel1''' and '''Tunnel2''' systems:
On '''Tunnel1''' run:
# ip route add 2.2.2.0/30 via 1.1.1.1
On '''Tunnel2''' run:
# ip route add 1.1.1.0/30 via 2.2.2.1
Check to make sure both sides can ping each other:
#tunnel1:~# ping -c1 2.2.2.2
PING 2.2.2.2 (2.2.2.2) 56(84) bytes of data.
64 bytes from 2.2.2.2: icmp_req=1 ttl=63 time=1.03 ms
#tunnel2:~# ping -c1 1.1.1.2
PING 1.1.1.2 (1.1.1.2) 56(84) bytes of data.
64 bytes from 1.1.1.2: icmp_req=1 ttl=63 time=1.20 ms
*Load L2TPv3 ethernet pseudowire module on '''Tunnel1''' and '''Tunnel2''' systems:
# modprobe l2tp_eth
*Configure l2tp interface on '''Tunnel1''':
# ip l2tp add tunnel tunnel_id 1000 peer_tunnel_id 2000 encap udp local 1.1.1.2 remote 2.2.2.2 udp_sport 6000 udp_dport 5000
# ip l2tp add session tunnel_id 1000 session_id 3000 peer_session_id 4000
*Check configuration of tunnel on '''Tunnel1''' system:
# ip l2tp show tunnel
Tunnel 1000, encap UDP
From 1.1.1.2 to 2.2.2.2
Peer tunnel 2000
UDP source / dest ports: 6000/5000
UDP checksum: disabled
# ip l2tp show session
Session 3000 in tunnel 1000
Peer session 4000, tunnel 2000
interface name: l2tpeth0
offset 0, peer offset 0
*Configure l2tp interface on '''Tunnel2''':
# ip l2tp add tunnel tunnel_id 2000 peer_tunnel_id 1000 encap udp local 2.2.2.2 remote 1.1.1.2 udp_sport 5000 udp_dport 6000
# ip l2tp add session tunnel_id 2000 session_id 4000 peer_session_id 3000
*Check configuration of tunnel on '''Tunnel2''' system:
# ip l2tp show tunnel
Tunnel 2000, encap UDP
From 2.2.2.2 to 1.1.1.2
Peer tunnel 1000
UDP source / dest ports: 5000/6000
UDP checksum: disabled
# ip l2tp show session
Session 4000 in tunnel 2000
Peer session 3000, tunnel 1000
interface name: l2tpeth0
offset 0, peer offset 0
*Check MTU of newly created interfaces
# ip a s dev l2tpeth0
l2tpeth0: <BROADCAST,MULTICAST> mtu 1488 qdisc noop state DOWN qlen 1000
link/ether 1a:8f:6e:04:3f:a3 brd ff:ff:ff:ff:ff:ff
*Adjust MTU and enforce MSS on eth1 on both '''Tunnel1''' and '''Tunnel2''' systems to prevent fragmentation that can cause issues:
# ip link set eth1 mtu 1446
# iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1406:1536 -j TCPMSS --set-mss 1406
*Install bridge-utils on '''Tunnel1''' and '''Tunnel2''' systems:
# apt-get install bridge-utils
*Bridge the L2TP interface to eth1 on both the '''Tunnel1''' and '''Tunnel2''' systems so that is can communicate over the network:
# brctl addbr l2tp
# brctl addif l2tp eth1 l2tpeth0
*Check bridge configuration on '''Tunnel1''' and '''Tunnel2''' systems:
# brctl show
bridge name bridge id STP enabled interfaces
l2tp 8000.1a8f6e043fa3 no eth1 l2tpeth0
*Turn up the new l2tpeth0 interface on '''Tunnel1''' and '''Tunnel2''' systems so that it can be used:
# ip l set dev l2tpeth0 up
# ip l set dev l2tp up
Assuming you've done everything correctly here, you should now be able to use the '''Tunnel1''' and '''Tunnel2''' systems to send traffic over the same subnet on each side.
Example:
*Using the setup above, assume you have two additional systems setup.
**Computer1 is connected to Tunnel1. No gateway set (not needed for an L2 link).
**Computer1 has eth1 configured with 192.168.0.3/24
**Computer2 is connected to Tunnel2. No gateway set (not needed for an L2 link).
**Computer 2 has eth1 configured wtih 192.168.0.4/24
*Do a ping test to make sure Computer1 can talk to Computer2 through the l2tp link:
# ping -c5 192.168.0.4
64 bytes from 192.168.0.4: icmp_req=1 ttl=64 time=3.85 ms
64 bytes from 192.168.0.4: icmp_req=2 ttl=64 time=1.93 ms
64 bytes from 192.168.0.4: icmp_req=3 ttl=64 time=1.91 ms
64 bytes from 192.168.0.4: icmp_req=4 ttl=64 time=1.87 ms
64 bytes from 192.168.0.4: icmp_req=5 ttl=64 time=1.89 ms
*Successful output means that Computer1 can talk to Computer2 over the l2tp link since you're created a L2 link between each system. Both computers act as if they are on the same local network segment, unaware of the L2TP connection over the Gateway via the Tunnels.
The path that data will travel is:
Computer1 -> Tunnel1 -> Gateway -> Tunnel2 -> Computer2
Computer1 <- Tunnel1 <- Gateway -< Tunnel2 -< Computer2
'''''NOTE: THERE IS NO ENCRYPTION WITH AN L2TP TUNNEL. ALL LAYER 2 DATA THAT IS VISIBLE TO EACH SIDE OF THE TUNNEL WILL NORMALLY BE SENT OVER THE LINK AND BE SEEN BY THE OTHER SIDE.'''''
===Between Cisco and Linux===
{{go to top}}
You can use L2TPv3 between Cisco and Linux utilizing the following script from Leif Sawyer.
*Script repository: https://github.com/akhepcat/Miscellaneous
*Direct download link: https://raw.githubusercontent.com/akhepcat/Miscellaneous/master/l2tpv3-cisco.sh
This script will bring up the Linux side of the connection and generate the Cisco side config.
====Configuration====
*Edit the variables '''TUNNEL_ID''', '''SESSION_ID''', '''LOCAL''', and '''REMOTE''' to values that are suitable for your environment.
====Commands====
*Start the tunnel with '''l2tpv3-cisco.sh start'''
*Stop the tunnel with '''l2tpv3-cisco.sh stop'''
*Restart the tunnel with '''l2tpv3-cisco.sh restart'''
*Generate Cisco config with '''l2tpv3-cisco.sh config'''
====l2tpv3-cisco.sh====
#!/bin/bash
# (c) 2020 Leif Sawyer
# License: GPL 3.0 (see https://github.com/akhepcat/)
# Permanent home: https://github.com/akhepcat/Miscellaneous/
# Direct download: https://raw.githubusercontent.com/akhepcat/Miscellaneous/master/l2tpv3-cisco.sh
#
# using l2tpV3 between linux and cisco is sometimes weird.
# this script is how I get the linux side up.
# This will also auto-generate the cisco-side config.
################################
TUNNEL_ID=101
REMOTE_TUNNEL_ID=${TUNNEL_ID}
SESSION_ID=101
REMOTE_SESSION_ID=${SESSION_ID}
LOCAL=10.1.1.1
REMOTE=10.100.100.1
################################
PATH=/sbin:$PATH
IPV=$(ip -V | sed 's/.*-ss//')
if [ ${IPV:-0} -lt 130716 ]
then
echo "Please install a newer version of iproute2 ( 3.10 or (>= 2013-07-16))"
echo " from https://www.kernel.org/pub/linux/utils/net/iproute2/"
exit
fi
modules() {
for module in l2tp_core l2tp_netlink l2tp_eth l2tp_ip
do
modprobe $i
done
}
tunnel_up() {
ip l2tp add tunnel remote ${REMOTE} local ${LOCAL} tunnel_id $TUNNEL_ID peer_tunnel_id $REMOTE_TUNNEL_ID encap ip
ip l2tp add session tunnel_id $TUNNEL_ID session_id $SESSION_ID peer_session_id $REMOTE_SESSION_ID l2spec_type none
ip link set l2tpeth0 up mtu 1488
iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1448:1536 -j TCPMSS --set-mss 1448
}
tunnel_down() {
iptables -D FORWARD -p tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1448:1536 -j TCPMSS --set-mss 1448
ip link set l2tpeth0 down
ip l2tp del session tunnel_id $TUNNEL_ID session_id $SESSION_ID
ip l2tp del tunnel tunnel_id $TUNNEL_ID
}
cisco_config() {
cat <<EOF
! Global config
!
pseudowire-class Linux-L2TP
encapsulation l2tpv3
interworking ethernet
protocol none
ip local interface $REMOTE
ip pmtu
ip tos value 41
ip ttl 100
!
! Interface config
!
interface \$L2interface
xconnect $LOCAL $REMOTE_TUNNEL_ID encapsulation l2tpv3 manual pw-class Linux-L2TP
l2tp id $SESSION_ID $REMOTE_SESSION_ID
EOF
}
case $1 in
start|up) tunnel_up
;;
stop|down) tunnel_down
;;
restart|reload) stop; start
;;
config|cisco|cisco-config) cisco_config
;;
*) echo "$0 (start|up || stop|down || restart|reload || config|cisco|cisco-config)"
;;
esac
== OpenVPN ==
== OpenVPN ==
{{go to top}}
{{go to top}}
Information on OpenVPN is available from https://openvpn.net/<ref>OpenVPN Official Site [https://openvpn.net/]</ref>
Information on OpenVPN is available from https://openvpn.org/<ref>OpenVPN Official Site [https://openvpn.org/]</ref>
=== Road Warrior Install ===
=== Road Warrior Install ===
wget https://git.io/vpn -O openvpn-install.sh && bash openvpn-install.sh
wget https://git.io/vpn -O openvpn-install.sh && bash openvpn-install.sh
*You can run it again to add/remove users or completely uninstall OpenVPN
*Example install using the defaults (installed on Ubuntu 20.04.2 LTS VM):
Welcome to this OpenVPN road warrior installer!
Which protocol should OpenVPN use?
1) UDP (recommended)
2) TCP
Protocol [1]:
What port should OpenVPN listen to?
Port [1194]:
Select a DNS server for the clients:
1) Current system resolvers
2) Google
3) 1.1.1.1
4) OpenDNS
5) Quad9
6) AdGuard
DNS server [1]:
Enter a name for the first client:
Name [client]:
OpenVPN installation is ready to begin.
Press any key to continue...
Get:1 http://security.ubuntu.com/ubuntu focal-security InRelease [114 kB]
Hit:2 http://us.archive.ubuntu.com/ubuntu focal InRelease
Get:3 http://us.archive.ubuntu.com/ubuntu focal-updates InRelease [114 kB]
Get:4 http://us.archive.ubuntu.com/ubuntu focal-backports InRelease [101 kB]
Fetched 328 kB in 1s (488 kB/s)
Reading package lists... Done
Reading package lists... Done
Building dependency tree
Reading state information... Done
ca-certificates is already the newest version (20210119~20.04.1).
openssl is already the newest version (1.1.1f-1ubuntu2.4).
Suggested packages:
resolvconf openvpn-systemd-resolved easy-rsa
The following NEW packages will be installed:
openvpn
0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.
Need to get 0 B/477 kB of archives.
After this operation, 1,188 kB of additional disk space will be used.
Preconfiguring packages ...
Selecting previously unselected package openvpn.
(Reading database ... 109259 files and directories currently installed.)
Preparing to unpack .../openvpn_2.4.7-1ubuntu2.20.04.2_amd64.deb ...
Unpacking openvpn (2.4.7-1ubuntu2.20.04.2) ...
Setting up openvpn (2.4.7-1ubuntu2.20.04.2) ...
* Restarting virtual private network daemon. [ OK ]
Created symlink /etc/systemd/system/multi-user.target.wants/openvpn.service → /lib/systemd/system/openvpn.service.
Processing triggers for man-db (2.9.1-1) ...
Processing triggers for systemd (245.4-4ubuntu3.7) ...
init-pki complete; you may now create a CA or requests.
Your newly created PKI dir is: /etc/openvpn/server/easy-rsa/pki
Using SSL: openssl OpenSSL 1.1.1f 31 Mar 2020
Generating RSA private key, 2048 bit long modulus (2 primes)
......+++++
...................+++++
e is 65537 (0x010001)
Using SSL: openssl OpenSSL 1.1.1f 31 Mar 2020
Generating a RSA private key
..........................................................................................................................................+++++
....+++++
writing new private key to '/etc/openvpn/server/easy-rsa/pki/easy-rsa-2749.6tj7Mb/tmp.fSqcnR'
-----
Using configuration from /etc/openvpn/server/easy-rsa/pki/easy-rsa-2749.6tj7Mb/tmp.TS5dnM
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName :ASN.1 12:'server'
Certificate is to be certified until Jul 10 05:27:40 2031 GMT (3650 days)
Write out database with 1 new entries
Data Base Updated
Using SSL: openssl OpenSSL 1.1.1f 31 Mar 2020
Generating a RSA private key
............................+++++
..............+++++
writing new private key to '/etc/openvpn/server/easy-rsa/pki/easy-rsa-2824.Fx4J3A/tmp.tlGKns'
-----
Using configuration from /etc/openvpn/server/easy-rsa/pki/easy-rsa-2824.Fx4J3A/tmp.dVVyTl
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName :ASN.1 12:'client'
Certificate is to be certified until Jul 10 05:27:40 2031 GMT (3650 days)
Write out database with 1 new entries
Data Base Updated
Using SSL: openssl OpenSSL 1.1.1f 31 Mar 2020
Using configuration from /etc/openvpn/server/easy-rsa/pki/easy-rsa-2880.kL0wa3/tmp.uyyWGn
An updated CRL has been created.
CRL file: /etc/openvpn/server/easy-rsa/pki/crl.pem
Created symlink /etc/systemd/system/multi-user.target.wants/openvpn-iptables.service → /etc/systemd/system/openvpn-iptables.service.
Created symlink /etc/systemd/system/multi-user.target.wants/openvpn-server@server.service → /lib/systemd/system/openvpn-server@.service.
Finished!
The client configuration is available in: /root/client.ovpn
New clients can be added by running this script again.
==== Add a user ====
To add a new user, run the openvpn-install.sh script again and select option '''1 - Add a new client'''
# bash openvpn-install.sh
OpenVPN is already installed.
Select an option:
1) Add a new client
2) Revoke an existing client
3) Remove OpenVPN
4) Exit
Option: 1
*You will be prompted for a name, in this example we use client2
Provide a name for the client:
Name: client2
Using SSL: openssl OpenSSL 1.1.1f 31 Mar 2020
Generating a RSA private key
....................................................+++++
....+++++
writing new private key to '/etc/openvpn/server/easy-rsa/pki/easy-rsa-4310.cmbMtC/tmp.MMKA2C'
-----
Using configuration from /etc/openvpn/server/easy-rsa/pki/easy-rsa-4310.cmbMtC/tmp.l84eev
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName :ASN.1 12:'client2'
Certificate is to be certified until Jul 10 05:41:10 2031 GMT (3650 days)
Write out database with 1 new entries
Data Base Updated
client2 added. Configuration available in: /root/client2.ovpn
*Copy the configuration file above to your client to use it with OpenVPN
==== Remove a user ====
To add a remove a user, run the openvpn-install.sh script again and select option '''2 - Revoke an existing client'''
# bash openvpn-install.sh
OpenVPN is already installed.
Select an option:
1) Add a new client
2) Revoke an existing client
3) Remove OpenVPN
4) Exit
Option: 2
*You will be presented with a list of configured users to remove. We will choose client2 for this example.
Select the client to revoke:
1) client
2) client2
Client: 2
Confirm client2 revocation? [y/N]: Y
Using SSL: openssl OpenSSL 1.1.1f 31 Mar 2020
Using configuration from /etc/openvpn/server/easy-rsa/pki/easy-rsa-4407.i66z91/tmp.iS3gWM
Revoking Certificate 05D02E0DF2A242398233588721BB75E0.
Data Base Updated
Using SSL: openssl OpenSSL 1.1.1f 31 Mar 2020
Using configuration from /etc/openvpn/server/easy-rsa/pki/easy-rsa-4444.LpkzMp/tmp.03Azaw
An updated CRL has been created.
CRL file: /etc/openvpn/server/easy-rsa/pki/crl.pem
client2 revoked!
==== Uninstall ====
*To uninstall, run the openvpn-install.sh script again and select option '''3 - Remove OpenVPN'''
Confirm OpenVPN removal? [y/N]:
*When prompted answer Y to start the removal
Removed /etc/systemd/system/multi-user.target.wants/openvpn-iptables.service.
Removed /etc/systemd/system/multi-user.target.wants/openvpn-server@server.service.
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following package was automatically installed and is no longer required:
libpkcs11-helper1
Use 'apt autoremove' to remove it.
The following packages will be REMOVED:
openvpn*
0 upgraded, 0 newly installed, 1 to remove and 0 not upgraded.
After this operation, 1,188 kB disk space will be freed.
(Reading database ... 109344 files and directories currently installed.)
Removing openvpn (2.4.7-1ubuntu2.20.04.2) ...
Processing triggers for man-db (2.9.1-1) ...
(Reading database ... 109265 files and directories currently installed.)
Purging configuration files for openvpn (2.4.7-1ubuntu2.20.04.2) ...
Processing triggers for systemd (245.4-4ubuntu3.7) ...
OpenVPN removed!
== TINC ==
== TINC ==
└── NoMoreSecrets
└── NoMoreSecrets
├── hosts
├── hosts
│ ├── server1
│ ├── server2
│ └── server3
├── rsa_key.priv
├── rsa_key.priv
├── tinc.conf
├── tinc.conf
└── tinc-up
└── tinc-up
</pre>
</pre>
==== FreeBSD Note ====
FreeBSD will use the '''/usr/local/etc/tinc''' directory structure instead of the Linux '''/etc/tinc''' as shown above. Adjust the paths below accordingly. Additionally, the '''tinc-up''' and '''tinc-down''' files will differ. See the section below the '''Server 3''' example for notes on these differences.
====Individual node setup and configuration====
====Individual node setup and configuration====
ip addr del 10.0.0.3/32 dev $INTERFACE
ip addr del 10.0.0.3/32 dev $INTERFACE
ip link set $INTERFACE down
ip link set $INTERFACE down
====== FreeBSD Note ======
The '''tinc-up''' and '''tinc-down''' files will differ from those listed above as follows:
* /usr/local/etc/tinc/NoMoreSecrets/tinc-up:
#!/bin/sh
ifconfig "$INTERFACE" up
ifconfig "$INTERFACE" inet 10.0.0.3 netmask 255.255.255.255
route add -net 10.0.0.0 10.0.0.3
Note: Substitute '''route add -host <remote tinc ip> <local tinc ip>''' in place of the last line above for a two node setup
* /usr/local/etc/tinc/NoMoreSecrets/tinc-down:
#!/bin/sh
ifconfig "$INTERFACE" destroy
exit
=====Create keypair=====
=====Create keypair=====
=====Start tinc=====
=====Start tinc=====
'''Linux:'''
* On all servers enable and start tinc
* On all servers enable and start tinc
systemctl enable tinc@NoMoreSecrets
systemctl enable tinc@NoMoreSecrets
systemctl start tinc@NoMoreSecrets
systemctl start tinc@NoMoreSecrets
'''FreeBSD:'''
You will need to ensure that tincd is properly configured on '''/etc/rc.conf''' before you attempt to start it:
*Add the following to your /etc/rc.conf:
#tinc
tincd_enable="YES"
tincd_cfg="NoMoreSecrets"
tincd_flags="-d 2 -L"
*Start tinc with:
service tincd start
Once tinc is up and running on all three servers you should be able to communicate over the 10.0.0.0/24 network.
Once tinc is up and running on all three servers you should be able to communicate over the 10.0.0.0/24 network.
Calling tinc with -k or --kill option will cause it to automatically unregister itself.
Calling tinc with -k or --kill option will cause it to automatically unregister itself.
== SOCAT ==
SOCAT can be used to create a simple virtual network between two hosts using UDP and TUN devices.
'''Note: It is possible to use TCP for this as well, but without the nodelay option it might cause problems. You can also replace UDP with DTLS to add security to the connection.'''
*IP addresses used in this example:
{| class="wikitable" style="text-align: center; width: 35%"
! Host
! Address
! Mask
|-
| Physical server address
| 1.2.3.4
| N/A
|-
| Physical client address
| N/A
| N/A
|-
| TUN device on server
| 192.168.255.1
| 255.255.255.0
|-
| TUN device on client
| 192.168.255.2
| 255.255.255.0
|}
Note: UDP connections will use PORT 11443.
=== Create TUN devices ===
*TUN Server<syntaxhighlight lang="text">
socat -d -d UDP-LISTEN:11443,reuseaddr TUN:192.168.255.1/24,up</syntaxhighlight>
*TUN Client<syntaxhighlight lang="text">
socat UDP:1.2.3.4:11443 TUN:192.168.255.2/24,up</syntaxhighlight>
Executing these two commands will result in a connection being established from the client to the server via TUN devices.
=== Troubleshooting ===
The following are common errors that you may encounter when using SOCAT to create a VPN.
*Missing TUN/TAP Support<syntaxhighlight lang="text">
... E unknown device/address "tun"</syntaxhighlight>
The SOCAT binary probably does not provide TUN/TAP support. Reasons include not using Linux and using an older version of SOCAT.
*Missing Kernel Support<syntaxhighlight lang="text">
,,, E open("/dev/net/tun", 02, 0666): No such file or directory</syntaxhighlight>
This incidates that your kernel does not have TUN/TAP support compiled in.
*TUN Cloning Device Permissions<syntaxhighlight lang="text">
... E open("/dev/net/tun", 02, 0666): Permission denied</syntaxhighlight>
This indicates that you do not have sufficient permission to read or write to the TUN cloning device. Check the device's permssions and ownership.
== SoftEther ==
== SoftEther ==
*You can run it again to add/remove users or completely uninstall WireGuard
*You can run it again to add/remove users or completely uninstall WireGuard
=== Mikrotik Wireguard Road Warrior Config ===
From: https://forum.mikrotik.com/viewtopic.php?t=174417#<ref>Mikrotik Forums - MikroTik Wireguard server with Road Warrior clients [https://forum.mikrotik.com/viewtopic.php?t=174417#]</ref>
The following information will show you how to setup a Mikrotik Wireguard server with Road Warrior clients.
==== Network topology ====
The network used in this examples is 192.168.66.0/24. A Mikrotik device will be the server and client can be any device running the Wireguard software.
{| class="wikitable" style="text-align: center; width: 35%"
! System
! IP Address
|-
| Wireguard server
| 192.168.66.1
|-
| Wireguard client(s)
| 192.168.66.[2-254]
|}
==== Mikrotik Configuration ====
<syntaxhighlight lang="text">
# a private and public key will be automatically generated when adding the wireguard interface
/interface wireguard
add listen-port=13231 mtu=1420 name=wireguard1
/interface wireguard peers
# the first client added here is ipv4 only
add allowed-address=192.168.66.2/32 interface=wireguard1 public-key="*** replace-with-public-key-of-first-client ***"
# this client is dual stack - public IPv6 should be used - replace 2001:db8:cafe:beef: with one of your /64 prefixes.
add allowed-address=192.168.66.3/32,2001:db8:cafe:beef::3/128 interface=wireguard1 public-key="*** replace-with-public-key-of-second-client-dual-stack ***"
/ip address
add address=192.168.66.1/24 interface=wireguard1 network=192.168.66.0
/ipv6 address
add address=2001:db8:cafe:beef::1/64 interface=wireguard1
</syntaxhighlight>
==== Client configuration ====
<syntaxhighlight lang="text">
Interface: (whatever name you want to specify)
Public key: the client should automatically generate this - add this to the server above replacing "replace-with-public-key-of-second-client-dual-stack"
Addresses: 192.168.66.3/24,2001:db8:cafe:beef::3/64 (note these are different subnet masks than in the server config)
DNS servers: as desired - if you want to use the wireguard server for dns, specify 192.168.66.1
Peer:
Public key - get the public key from the wireguard interface on the Mikrotik device and place here
Endpoint - mydyndns.whatever:13231
Allowed IPs: 0.0.0.0/0, ::/0
</syntaxhighlight>
This client configuration will result in all traffic being forwarded via the Mikrotik Wireguard server. You will need to ensure:
*Create an input chain firewall rule to allow UDP traffic in on port 13231
<syntaxhighlight lang="text">
/ip firewall filter add action=accept chain=input comment="Allow Wireguard" dst-port=13231 protocol=udp
</syntaxhighlight>
*Ensure the Mikrotik firewall is allowing traffic from 192.168.66.0/24 and that you are NATing this traffic. If your device is based off the default Mikrotik config and using the LAN interface list, you can add the Wireguard interface to this list to allow traffic through and NATing it as it leaves your network. Otherwise, you will need to modify your configuration accordingly.
==== Get/Set Wireguard Peers ====
*Get Mikrotik Wireguard peers list
<syntaxhighlight lang="text">
/interface wireguard peers print
</syntaxhighlight>
*Set Mikrotik Wireguard peers list
<syntaxhighlight lang="text">
/interface wireguard peers set <ID> allowed-addresses=whatever,whateverelse
</syntaxhighlight>
== VPNC ==
== VPNC ==