|
|
| (73 intermediate revisions by 4 users not shown) |
| Line 1: |
Line 1: |
| ==Summary==
| |
|
| |
|
| VPN (Virtual Private Network) is a method for secure data transfer through unsafe public networks. This page is an overview of different types of VPN that can be used with RUT routers. | | ==VPN== |
|
| |
|
| ==OpenVPN==
| | * [[DMVPN_with_IPsec_Phase_3 | DMVPN]] |
| | | * [[OpenVPN configuration examples RUT R 00.07|OpenVPN configuration example]] |
| The default OpenVPN Configuration list is empty, so you have to define your own configuration to establish any sort of OpenVPN connection. OpenVPN configurations can have one of two roles: '''client''' or '''server'''. Let’s start with an OpenVPN client. To create it, enter the desired instance name in the '''New configuration name''' field, select the instance’s role from the '''Role''' list and press the '''Add New''' button.
| | * [[IPsec RUTOS configuration example|IPsec cofiguration example]] |
| | | * [[ZeroTier One VPN configuration RutOS|ZeroTier One VPN configuration example]] |
| [[Image:Services vpn openvpn creation.PNG]] | | * [[ZeroTier Configuration|ZeroTier]] |
| | | * [[L2TP configuration examples RutOS| L2TP configuration examples]] |
| Once you’ve added a new OpenVPN instance there is no need to press the '''Save''' button, since the '''Add New''' button both creates and saves the new instance. By default the instance will be disabled and unconfigured. In order to establish an OpenVPN connection you must Enable your instance, enter an OpenVPN server address, choose an authentication method and a few other things, all of which can be configured in the '''Settings''' window, which can reached by pressing the '''Edit''' button next to your OpenVPN instance (as shown in the figure above).
| | * [[Overlapping subnets with IPsec solution]] |
| | | * [[Setting up a GRE over IPsec tunnel between RUTOS devices|GRE over IPsec Tunnel]] |
| ===OpenVPN Client===
| | * [[L2TP over IPsec RutOS| L2TP over IPsec RutOS]] |
| | | * [[Setting up an IPsec tunnel between Teltonika Networks and Cisco devices|Cisco IPsec]] |
| This section is overview of OpenVPN Client configuration.
| | * [[Setting up a GRE tunnel between Teltonika Networks and Cisco devices| Cisco GRE]] |
| | | * [[Setting up a GRE over IPsec tunnel between Teltonika Networks and Cisco devices]] |
| [[Image:Services vpn openvpn client.PNG]] | | * [[Setting up a GRE over IPsec tunnel between Teltonika Networks and Mikrotik devices|Mikrotik GRE over IPsec Tunnel]] |
| | | * [[Setting up a SSTP tunnel between Teltonika Networks and Mikrotik devices|Mikrotik SSTP]] |
| The figure above is an example of a configured OpenVPN Client instance that uses the UDP protocol and TLS/Password authentication. Comprehensible explanations on how to configure each field are presented in the table below.
| | * [[Setting up an OpenVPN tunnel between Teltonika Neworks and Mikrotik devices|Mikrotik OpenVPN]] |
| | | * [[Setting up a L2TP over IPsec tunnel between Teltonika Networks and Mikrotik devices|Mikrotik L2TP over IPsec]] |
| {| class="wikitable"
| | * [[Creating OpenVPN access server and connecting it to a Teltonika Networks router|OpenVPN Access Server]] |
| |+ | | * [[Setting up an IPsec tunnel between RUT and Android phone]] |
| ! style="width: 250px; background: black; color: white;" | Field name
| | * [[Tinc VPN configuration examples]] |
| ! style="width: 250px; background: black; color: white;" | Value
| | * [[L2TP over IPsec PC|L2TP over IPsec VPN to a PC configuration example]] |
| ! style="width: 1200px; background: black; color: white;" | Description
| | * [[OpenVPN traffic split]] |
| |-
| | * [[Default_IPsec_route_configuration_between_Teltonika_Networks_devices | Default IPsec route configuration between Teltonika Networks devices]] |
| ! style="text-align: left; vertical-align: top;" | Enable
| | * [[OpenVPN over Stunnel RutOS|OpenVPN over Stunnel]] |
| | style="text-align: left; vertical-align: top;" | yes {{!}} no; Default: '''no'''
| | * [[DMVPN with IPsec Phase 3]] |
| | style="text-align: left; vertical-align: top;" | Enables the OpenVPN instance
| | * [[L2 LAN bridging over internet using L2TPv2+EoIP]] |
| |-
| | * [[1NCE Configuration]] |
| ! style="text-align: left; vertical-align: top;" | TUN/TAP
| | * [[RutOS ExpressVPN configuration example|ExpressVPN]] |
| | style="text-align: left; vertical-align: top;" | TUN (tunnel) {{!}} TAP (bridged); Default: '''TUN (tunnel)'''
| | * [[RutOS NordVPN configuration example|NordVPN]] |
| | style="text-align: left; vertical-align: top;" | OpenVPN interface type. '''TUN''' is most often in typical VPN connections, however, '''TAP''' is required in some Ethernet bridging configurations | | [[Category:Configuration Examples]] |
| |-
| |
| ! style="text-align: left; vertical-align: top;" | Protocol
| |
| | style="text-align: left; vertical-align: top;" | UDP {{!}} TCP; Default: '''UDP'''
| |
| | style="text-align: left; vertical-align: top;" | The transfer protocol used by the OpenVPN connection. '''TCP''' is connection oriented – once a connection is established, data can be sent bidirectionally. '''UDP''' is a simpler, connectionless Internet protocol. '''UDP''' is usually faster but '''TCP''' has more security features. Choose the connection protocol according to your needs.
| |
| |- | |
| ! style="text-align: left; vertical-align: top;" | Port
| |
| | style="text-align: left; vertical-align: top;" | integer [0..65535]; Default: '''1194'''
| |
| | style="text-align: left; vertical-align: top;" | TCP/UDP Port number for both local and remote endpoints (make sure that the chosen port is allowed by firewall)
| |
| |- | |
| ! style="text-align: left; vertical-align: top;" | LZO
| |
| | style="text-align: left; vertical-align: top;" | yes {{!}} no; Default: '''no'''
| |
| | style="text-align: left; vertical-align: top;" | With LZO compression, your VPN connection will generate less network traffic. However, enabling this causes a higher CPU load. Use it carefully with a high traffic rate or low CPU resources
| |
| |- | |
| ! style="text-align: left; vertical-align: top;" | Encryption
| |
| | style="text-align: left; vertical-align: top;" | DES-CBC 64 {{!}} RC2-CBC 128 {{!}} DES-EDE-CBC 128 {{!}} DES-EDE3-CBC 192 {{!}} DESX-CBC 192 {{!}} BF-CBC 128 {{!}} RC2-40-CBC 40 {{!}} CAST5-CBC 128 {{!}} RC2-40CBC 40 {{!}} CAST5-CBC 128 {{!}} RC2-64-CBC 64{{!}} AES-128-CBC 128 {{!}} AES-192-CBC 192 {{!}} AES-256-CBC 256 {{!}} none; Default: '''BF-CBC 128'''
| |
| | style="text-align: left; vertical-align: top;" | Packet encryption algorithm
| |
| |-
| |
| ! style="text-align: left; vertical-align: top;" | Authentication
| |
| | style="text-align: left; vertical-align: top;" | TLS {{!}} Static Key {{!}} Password {{!}} TLS/Password; Default: '''TLS''' | |
| | style="text-align: left; vertical-align: top;" | Authentication mode, used to secure data sessions.
| |
| '''Static key''' is a secret key used for server–client authentication.
| |
| | |
| '''TLS''' authentication mode uses X.509 type certificates:
| |
| | |
| '''Certificate Authority (CA)''', '''Client certificate''', '''Client key'''.
| |
| | |
| All mentioned certificates can be generated using OpenVPN or Open SSL utilities on any type of host machine.
| |
| | |
| '''Password''' is a simple username/password based authentication where the owner of the OpenVPN server provides the login data.
| |
| | |
| '''TLS/Password''' uses both TLS and Password authentication
| |
| |- | |
| ! style="text-align: left; vertical-align: top;" | TLS cipher
| |
| | style="text-align: left; vertical-align: top;" | all {{!}} DHE+RSA {{!}} custom; Default: '''all'''
| |
| | style="text-align: left; vertical-align: top;" | Packet encryption algorithm cipher
| |
| |-
| |
| ! style="text-align: left; vertical-align: top;" | Remote host / IP address
| |
| | style="text-align: left; vertical-align: top;" | ip; Default: " "
| |
| | style="text-align: left; vertical-align: top;" | IP address or hostname of an OpenVPN server
| |
| |-
| |
| ! style="text-align: left; vertical-align: top;" | Resolve retry
| |
| | style="text-align: left; vertical-align: top;" | integer {{!}} infinite; Default: '''infinite'''
| |
| | style="text-align: left; vertical-align: top;" | Time in seconds to resolve server hostname periodically in case of first resolve failure before generating service exception
| |
| |- | |
| ! style="text-align: left; vertical-align: top;" | Keep alive
| |
| | style="text-align: left; vertical-align: top;" | integer *space* integer; Default: " "
| |
| | style="text-align: left; vertical-align: top;" | Defines two time intervals: one is used to periodically send ICMP request to the OpenVPN server, the other defines a time window, which is used to restart the OpenVPN service, if no ICMP response is received during the window time slice. | |
| '''Example:''' 10 60
| |
| |-
| |
| ! style="text-align: left; vertical-align: top;" | Remote network IP address
| |
| | style="text-align: left; vertical-align: top;" | ip; Default: " " | |
| | style="text-align: left; vertical-align: top;" | LAN IP address of the remote network (server) | |
| |-
| |
| ! style="text-align: left; vertical-align: top;" | Remote network IP netmask
| |
| | style="text-align: left; vertical-align: top;" | ip; Default: " "
| |
| | style="text-align: left; vertical-align: top;" | LAN IP subnet mask of the remote network (server)
| |
| |-
| |
| ! style="text-align: left; vertical-align: top;" | Username
| |
| | style="text-align: left; vertical-align: top;" | string; Default: " " | |
| | style="text-align: left; vertical-align: top;" | User name used for authentication
| |
| |-
| |
| ! style="text-align: left; vertical-align: top;" | Password
| |
| | style="text-align: left; vertical-align: top;" | string; Default: " "
| |
| | style="text-align: left; vertical-align: top;" | Password name used for authentication
| |
| |-
| |
| ! style="text-align: left; vertical-align: top;" | Extra options
| |
| | style="text-align: left; vertical-align: top;" | string; Default: " "
| |
| | style="text-align: left; vertical-align: top;" | Extra options to be used by the OpenVPN instance
| |
| |-
| |
| ! style="text-align: left; vertical-align: top;" | HMAC authentication algorithm
| |
| | style="text-align: left; vertical-align: top;" | none {{!}} SHA1 {{!}} SHA256 {{!}} SHA384 {{!}} SHA512; Default: '''SHA1'''
| |
| | style="text-align: left; vertical-align: top;" | HMAC authentication algorithm type
| |
| |-
| |
| ! style="text-align: left; vertical-align: top;" | Additional HMAC authentication
| |
| | style="text-align: left; vertical-align: top;" | yes {{!}} no; Default: '''no'''
| |
| | style="text-align: left; vertical-align: top;" | An additional layer of HMAC authentication on top of the TLS control channel to protect against DoS attacks
| |
| |-
| |
| ! style="text-align: left; vertical-align: top;" | Certificate authority
| |
| | style="text-align: left; vertical-align: top;" | .ca file; Default: " "
| |
| | style="text-align: left; vertical-align: top;" | Certificate authority is an entity that issues digital certificates. A digital certificate certifies the ownership of a public key by the named subject of the certificate
| |
| |-
| |
| ! style="text-align: left; vertical-align: top;" | Client certificate
| |
| | style="text-align: left; vertical-align: top;" | .crt file; Default: " "
| |
| | style="text-align: left; vertical-align: top;" | Client certificate is a type of digital certificate that is used by client systems to make authenticated requests to a remote server. Client certificates play a key role in many mutual authentication designs, providing strong assurances of a requester's identity
| |
| |-
| |
| ! style="text-align: left; vertical-align: top;" | Client key
| |
| | style="text-align: left; vertical-align: top;" | .key file; Default: " "
| |
| | style="text-align: left; vertical-align: top;" | Authenticates the client to the server and establishes precisely who they are
| |
| |-
| |
| |}
| |
