User Tools
vpn-server
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| vpn-server [2024/11/05 22:05] – [OpenVPN Server Won't Start When EasyRSA3 used] -Condense hogwild | vpn-server [2024/11/24 10:52] (current) – CB -> CBC petervdm | ||
|---|---|---|---|
| Line 13: | Line 13: | ||
| \\ | \\ | ||
| - | However, there are still differences between versions. For example, clients and servers may be configured on different versions. Encryption algorithms may be negotiated differently among versions. FreshTomato 2024.3 includes OpenVPN 2.6.12. For details, see the OpenVPN documentation/ | + | However, there are still differences between versions. For example, clients and servers may be configured on different versions. Encryption algorithms may be negotiated differently among versions. FreshTomato 2024.3 includes OpenVPN 2.6.12. For details, see the OpenVPN documentation/ |
| \\ | \\ | ||
| Line 236: | Line 236: | ||
| * Encrypt Channel - (tls-crypt) [Direction] is set to 3. \\ Will use // | * Encrypt Channel - (tls-crypt) [Direction] is set to 3. \\ Will use // | ||
| - | * Encrypt Channel v2 - (tls-crypt-v2[Direction] is set to 4. \\ Will use // | + | * Encrypt Channel v2 - (tls-crypt-v2[Direction] is set to 4. \\ Uses // |
| \\ | \\ | ||
| Line 351: | Line 351: | ||
| * AES-128-GCM | * AES-128-GCM | ||
| * AES-256-GCM | * AES-256-GCM | ||
| - | * AES-128-CB | + | * AES-128-CBC |
| * AES-256-CBC | * AES-256-CBC | ||
| Line 448: | Line 448: | ||
| Here, you can specify a custom configuration for the OpenVPN server to use. | Here, you can specify a custom configuration for the OpenVPN server to use. | ||
| - | For details about valid custom parameters, please see: \\ [[https:// | + | For details about valid custom parameters, please see: \\ [[https:// |
| Line 470: | Line 470: | ||
| * A separate certificate (public key) and private key for the server \\ and for each client | * A separate certificate (public key) and private key for the server \\ and for each client | ||
| - | * A master | + | * A master CA certificate and key used to sign each of the server |
| \\ | \\ | ||
| Line 489: | Line 489: | ||
| \\ | \\ | ||
| - | * The server only needs its own certificate/ | + | * The server only needs its own certificate/ |
| * The server will only accept clients whose certificates were signed \\ by the master CA certificate (which we'll generate below). \\ \\ Because the server can verify this signature without needing access \\ to the CA private key itself, you can store the CA key on another machine. \\ It can even be stored on a device not connected to the network. \\ This is crucial, since it's the most sensitive key in the entire PKI. \\ \\ | * The server will only accept clients whose certificates were signed \\ by the master CA certificate (which we'll generate below). \\ \\ Because the server can verify this signature without needing access \\ to the CA private key itself, you can store the CA key on another machine. \\ It can even be stored on a device not connected to the network. \\ This is crucial, since it's the most sensitive key in the entire PKI. \\ \\ | ||
| * If a private key is compromised, | * If a private key is compromised, | ||
| Line 601: | Line 601: | ||
| ==== Routing Notes ==== | ==== Routing Notes ==== | ||
| - | To access | + | You must add network routes to access |
| \\ | \\ | ||
| - | To configure this, you need to add a line in the server configuration | + | For example, let's say: |
| + | |||
| + | * A server exists on 192.168.1.10 behind your VPN server. | ||
| + | * You want to access this server through the VPN. | ||
| + | |||
| + | \\ | ||
| + | |||
| + | You need to configure | ||
| + | |||
| + | To do this, you must add a line similar to this in the server configuration: | ||
| \\ | \\ | ||
| Line 612: | Line 621: | ||
| push "route 192.168.1.0 255.255.255.0" | push "route 192.168.1.0 255.255.255.0" | ||
| </ | </ | ||
| + | | ||
| + | You must then restart both the OpenVPN server and the client.\\ | ||
| - | \\ | + | This will cause the server to tell any client that connects to route all traffic for IP addresses in scope 192.168.1.XXX through the VPN. |
| - | Now, when the client connects, the server tells it that it should route all traffic for IP addresses in the 192.168.1.XXX scope through | + | This example describes a basic setup. The setup is almost complete. The only thing left is to add the appropriate routes, as with normal routing. |
| - | This is an example of a basic setup. When we now start on the routing part, the setup is mostly complete. At this point, all you need to add are the appropriate routes, just as you would for normal TCP/IP routing. | + | You also must ensure return routes. Just because a VPN client can access a host behind |
| - | Remember, you also need to consider return routes. Just because | + | For a more detailed example, see the%% %%Using routing%% %%section in the Bridging and routing wiki page. |
| - | For a more detailed example of using routing, see the%% %%Using routing%% %%section in the ' | ||
| - | + | ==== Routing all Traffic | |
| - | ==== Routing all Traffic | + | |
| You can route all network traffic over the VPN. The configuration for this is fairly simple. However, you'll need to learn how to configure NAT on your VPN server for the virtual TUN adapter. | You can route all network traffic over the VPN. The configuration for this is fairly simple. However, you'll need to learn how to configure NAT on your VPN server for the virtual TUN adapter. | ||
| Line 657: | Line 666: | ||
| ==== About IPv6 ==== | ==== About IPv6 ==== | ||
| - | OpenVPN v2.3 and later support IPv6. Setting up IPv6 in a VPN is similar to the IPv4 examples | + | OpenVPN v2.3 and later support IPv6. Configuring |
| \\ | \\ | ||
| Line 673: | Line 682: | ||
| \\ | \\ | ||
| - | You can use the // | + | You can use the // |
| + | |||
| + | \\ | ||
| + | |||
| + | The syntax is similar: | ||
| \\ | \\ | ||
vpn-server.1730844303.txt.gz · Last modified: 2024/11/05 22:05 by hogwild
Page Tools
