Template:Networking rutos configuration example connecting to openvpn access server: Difference between revisions

From Teltonika Networks Wiki
Tag: Removed redirect
m (Protected "Template:Networking rutos configuration example connecting to openvpn access server" ([Edit=Allow only administrators] (indefinite) [Move=Allow only administrators] (indefinite)))
 
(3 intermediate revisions by the same user not shown)
Line 59: Line 59:
<br>
<br>


*Login to your OpenVPN Access Server as administrator by entering this link into your web browser https://localhost:943<br>
*Login to your OpenVPN Access Server as administrator by entering this link into your web browser: https://localhost:943<br>
*By default username is: <b>openvpn</b>
*By default username is: <b>openvpn</b>
*The Password is the same as you have configured previously:
*The Password is the same as you have configured previously.
[[File:Networking RUTX configuration example connecting to openvpn access server openVPN login2 v1.jpg|border|class=tlt-border|1100px]]<br>
[[File:Networking RUTX configuration example connecting to openvpn access server openVPN login2 v1.jpg|border|class=tlt-border|1100px]]<br>


Line 68: Line 68:
You will need to set up some details into the OpenVPN Access Server:
You will need to set up some details into the OpenVPN Access Server:


*Create new OpenVPN Access Server user. (Username and password)
*Create new OpenVPN Access Server user (Username and password).
*Set up the Public IP address.
*Set up the Public IP address.
*Once the new user is created, you will need to login with these credentials and download the .openvpn client file (it will be used in the {{{device}}} router)
*Once the new user is created, you will need to login with these credentials and download the .openvpn client file (it will be used in the {{{device}}} router).
===Adding new user to OpenVPN Access Server===
===Adding new user to OpenVPN Access Server===
----
----
In order to manage your users on OpenVPN Access Server navigate to <b>User Management -> User Permissions</b>
In order to manage your users on OpenVPN Access Server navigate to <b>User Management -> User Permissions</b>
[[File:Networking RUTX configuration example connecting to openvpn access server openVPN user permissions2 v1.jpg|border|class=tlt-border|1100px]]<br>
[[File:Networking RUTX configuration example connecting to openvpn access server openVPN user permissions2 v1.jpg|border|class=tlt-border|1100px]]<br>
#Type the username.<br>
#Type the <b>Username</b>.<br>
#Select <b>Allow Auto-login</b>.<br>
#Select <b>Allow Auto-login</b>.<br>
#Click on <b>More Settings</b>.<br>
#Click on <b>More Settings</b>.<br>
#Add a password.<br>
#Add a <b>Password</b>.<br>
#Click on <b>Save Settings</b><br>
#Click on <b>Save Settings</b>.<br>
[[File:Networking RUTX configuration example connecting to openvpn access server openVPN user permissions3 v2.jpg|border|class=tlt-border|1100px]]
[[File:Networking RUTX configuration example connecting to openvpn access server openVPN user permissions3 v2.jpg|border|class=tlt-border|1100px]]
Click on <b>Update Running Server</b> (it should pop-up at the top of configuration window):
Click on <b>Update Running Server</b> (it should pop-up at the top of configuration window):
Line 87: Line 87:
===Network settings===
===Network settings===
----
----
Presuming that <b>OpenVPN Access Server</b> will be running on Windows PC (virtual machine with Linux installed) and assuming that Teltonika {{{device}}} device will be providing a public IP address for Windows PC we need to configure OpenVPN Access Server, virtual machine and {{{device}}} device to allow connection to OpenVPN Access Server.
Presuming that <b>OpenVPN Access Server</b> will be running on Windows PC (virtual machine with Linux installed) and assuming that Teltonika {{{device}}} device will be providing a public IP address for Windows PC you will need to configure OpenVPN Access Server, virtual machine and {{{device}}} device to allow connection to OpenVPN Access Server.


'''Setting IP address'''
'''Setting IP address'''
----
----
Now, our Windows PC and Linux systems will be getting public IP from Teltonika {{{device}}} device, so we need to make one more configuration to OpenVPN
Now Windows PC and Linux systems will be getting public IP from Teltonika {{{device}}} device, so it is required to make one more configuration to OpenVPN
Access Server.
Access Server.


Line 101: Line 101:
#Navigate to <b>Configuration -> Network Settings -> Hostname or IP address</b>.  
#Navigate to <b>Configuration -> Network Settings -> Hostname or IP address</b>.  
#Enter the public IP address of the Teltonika {{{device}}} device:
#Enter the public IP address of the Teltonika {{{device}}} device:
#Save the settings and update the running server.
[[File:Networking RUTX configuration example connecting to openvpn access server openVPN publicip v1.jpg|border|class=tlt-border|1100px]]
[[File:Networking RUTX configuration example connecting to openvpn access server openVPN publicip v1.jpg|border|class=tlt-border|1100px]]
#Save the settings and update running server.


In this way, the clients .ovpn configuration files will be successfuly downloaded from server.
This way, the clients .ovpn configuration files will be successfully downloaded from the server.


==Virtual machine configuration==
==Virtual machine configuration==

Latest revision as of 13:40, 10 November 2020

Introduction

OpenVPN Access Server is a set of installation and configuration tools that comes in one package, it simplifies the rapid deployment of a VPN remote access solution. At its core it is based on the popular OpenVPN open source software and maintains compatibility with it, making the deployed VPN immediately compatible with OpenVPN client software across multiple platforms and devices.

This article provides an extensive configuration example with details on how to install an OpenVPN Access Server in a virtual machine connected to a {{{device}}} device, also provides the {{{device}}} OpenVPN client configuration.

Prerequisites

  • Two {{{device}}} routers.
  • At least one router must have a Public Static or Public Dynamic IP address.
  • One PC to configure the OpenVPN access server and routers.

Configuration scheme

Installing OpenVPN Access Server

First of all we will need to have working OpenVPN Access Server on PC, which would act as server.

Note: Please keep in mind that for PC to act as any kind of server it MUST have either Public Static or Public Dynamic IP address.

If you're using Windows, we recommend installing OpenVPN Access Server in a virtual machine with Linux Ubuntu 18.04.1.

For this manual we will assume you are working with Linux Ubuntu 18.04.1 on your virtual machine.

  • Login to your Linux machine.
  • Open the terminal (Ctrl + Alt + t).
  • Type the following commands into your virtual Linux machine to install OpenVPN Access Server (one at a time):
sudo apt update && apt -y install ca-certificates wget net-tools gnupg

It will ask for a password, it's the same one you use to login into your Linux Ubuntu.

sudo –i
wget -qO - https://as-repository.openvpn.net/as-repo-public.gpg | apt-key add -
echo "deb http://as-repository.openvpn.net/as/debian bionic main">/etc/apt/sources.list.d/openvpn-as-repo.list
exit
apt update && apt -y install openvpn-as

Setting administrator password


After installation restart the Linux machine, once the reboot is done, open terminal and set the password for OpenVPN Access Server administrator account, in order to do that use the following commands:

sudo passwd openvpn

Enter Linux machine password and then the password for OpenVPN Access Server administrator account, (see picture below):

If everything was done correctly, you should be able to access OpenVPN Access Server via virtual Linux machine from the web browser by entering: https://localhost:943

Probably you will get a warning: "Potential Security Risk Ahead", simply accept the risks and Continue.

If for some reason the OpenVPN Access Server installation failed on your virtual machine, we recommend you to visit these pages, it could help you to solve the issue: Installing openvpn access server on a linux system and VPN Software Packages

Note: Installed OpenVPN Access Server only provides 2 VPN connections.

OpenVPN Access Server configuration

After installing OpenVPN Access Server on your virtual machine you will need to change some settings to get .ovpn configuration file and allow Teltonika Networking devices to connect as clients to this server.

  • Login to your OpenVPN Access Server as administrator by entering this link into your web browser: https://localhost:943
  • By default username is: openvpn
  • The Password is the same as you have configured previously.


Once you are connected, scroll down and click on Admin button to get access to VPN configuration (it could ask to login again).

You will need to set up some details into the OpenVPN Access Server:

  • Create new OpenVPN Access Server user (Username and password).
  • Set up the Public IP address.
  • Once the new user is created, you will need to login with these credentials and download the .openvpn client file (it will be used in the {{{device}}} router).

Adding new user to OpenVPN Access Server


In order to manage your users on OpenVPN Access Server navigate to User Management -> User Permissions

  1. Type the Username.
  2. Select Allow Auto-login.
  3. Click on More Settings.
  4. Add a Password.
  5. Click on Save Settings.

Click on Update Running Server (it should pop-up at the top of configuration window):

Network settings


Presuming that OpenVPN Access Server will be running on Windows PC (virtual machine with Linux installed) and assuming that Teltonika {{{device}}} device will be providing a public IP address for Windows PC you will need to configure OpenVPN Access Server, virtual machine and {{{device}}} device to allow connection to OpenVPN Access Server.

Setting IP address


Now Windows PC and Linux systems will be getting public IP from Teltonika {{{device}}} device, so it is required to make one more configuration to OpenVPN Access Server.

  1. To get the IP address, login into your {{{device}}} device and check your WAN IP Address.

  1. Connect to the OpenVPN Access Server as Administrator https://localhost:943
    1. Username: openvpn
    2. Password: The password you configured above in the Setting administrator password step.
  2. Navigate to Configuration -> Network Settings -> Hostname or IP address.
  3. Enter the public IP address of the Teltonika {{{device}}} device:
  4. Save the settings and update the running server.

This way, the clients .ovpn configuration files will be successfully downloaded from the server.

Virtual machine configuration

Now you will need to configure virtual machine network settings.

  • Open the virtual machine and go to Devices → Network → Network Settings

  1. Click on Advanced.
  2. Click on Port Forwarding and add the following rules.

  1. Click on Add new rule.
  2. Type the Port Forwarding rule name.
  3. Select the protocol to use.
  4. Type the ports in Host port and Guest port fields.
  5. Click on OK.

{{{device}}} configuration

Also, you need to configure port forwarding on the {{{device}}} device. So the client could connect to OpenVPN Access Server. For this configuration example we will be using a {{{device}}} device, to configure port forwarding:

  • Navigate to Network -> Firewall -> Port Forwarding
  • Add three port forwarding rules (See the picture below)

Note: The destination IP "Forward to IP" should be your Windows PC IP address on which virtual machine is running.

Keep in mind that port 443 is also used for HTTPS, if you want to use a different port for OpenVPN Access Server when using TCP connection, try configuring the Access Server. With this configuration you will be able to connect to OpenVPN Access Server from internet side.

Getting OpenVPN client configuration file

Now, assuming that both Linux virtual machine and Teltonika Networking device are configured correctly, we need to get OpenVPN client configuration file (.ovpn).

  • Scroll down and click on the link Yourself(autologin profile) located in the tab "Available Connection Profiles"

  • Download and save the .ovpn file.

Now with the downloaded .ovpn configuration file you will be able to connect as client to OpenVPN Access Server. The configuration file can be used on any device which supports OpenVPN configuration from file.

Uploading .opvn file to {{{device}}} device

At this point you should have configured OpenVPN Access Server and you should have the .ovpn configuration file. Now you will need to upload it to the {{{device}}} device OpenVPN configuration.

Connect to {{{device}}} WebUI, navigate to Services → VPN → OpenVPN and do the following:

  1. Type the New Configuration Name.
  2. Select Role: Client.
  3. Click ADD.
  4. New configuration should appear after a few seconds. Then press Edit.

Now apply the following configuration:

  1. Click on Enable.
  2. Click on Enable OpenVPN config from file.
  3. Upload the .opvn client configuration file.
  4. Press Save & Apply.


Wait for a about a minute and the {{{device}}} should connect to the OpenVPN Server Access, to confirm it go to OpenVPN instance Status and it should be as "Connected".

Note: The same .opvn configuration file should work on other devices.

Testing the configuration

In order to check whether your configuration is correct access your OpenVPN Access Server and go to Status --> Current Users:

  • The OpenVPN instance should appear and display its IP addresses.

  • Enter VPN IP Address to your internet browser and you should be able to reach the {{{device}}} WebUI.