489
edits
Changes
OpenVPN configuration examples RUT R 00.07 (view source)
Revision as of 15:28, 11 May 2022
, 15:28, 11 May 2022no edit summary
[[File:Networking rut configuration openvpn instances.jpg|border|class=tlt-border|1547x1547px]]
[[File:Networking rut configuration openvpn instances.jpg|border|class=tlt-border|1547x1547px]]
To sum up, just make sure the Server and the Clients use the same parameters (same authentication, same port, same protocol, etc.). Another important aspect is the '''Virtual network IP address''' (10.0.0.0 in this case). The Server and the connected Clients will be given IP addresses that belongs to this network. If you're creating an exceptionally large network, you might want to change the '''Virtual network netmask'''.
To sum up, just make sure the Server and the Clients use the same parameters (same authentication, same port, same protocol, etc.). Another important aspect is the '''Virtual network IP address''' (10.0.0.0 in this case). The Server and the connected Clients will be given IP addresses that belong to this network. If you're creating an exceptionally large network, you might want to change the '''Virtual network netmask'''.
From the Client side, make sure to enter the correct '''Remote host/IP address''' (213.226.191.61 in this case). This is the Server's Public IP address, not the virtual IP address.
From the Client side, make sure to enter the correct '''Remote host/IP address''' (213.226.191.61 in this case). This is the Server's Public IP address, not the virtual IP address.
==Static key Authentication==
This section provides a guide on how to configure a successful OpenVPN connection between an OpenVPN Client and Server, using the '''Static key''' Authentication method on RUT routers.
===Creating a Static key===
----
A Static key connection uses a pre-shared for authentication between a Server and one Client. You can generate a Static key within the router itself or with a PC that uses a Linux-based OS.
====Within the router====
----
In order to generate a Static key within the router connect to the device via the '''[[CLI|Command Line Interface]]''' ('''[[CLI]]''') or '''SSH''' (the default username is '''root''', the password is your router's admin password, '''admin01''' by default). CLI can be found in the router's WebUI, under Services. To connect to the router via SSH, use the Terminal app (type ssh '''[email protected]'''; replace 192.168.1.1 with your router's LAN IP address) if you're using a Linux-based OS. Or download '''PuTTY''', a free SSH and telnet client, if you're using Windows.
When you have connected to the router, relocate to the directory (for example, '''cd /etc/easy-rsa/keys/''') where you want to store your Static key and use this command:
# openvpn --genkey --secret static.key
The newly generated Static key will appear in the same directory where you issued the command above.
=====Extracting the key=====
----
If you are using a Linux-based OS, extracting files from the router is simple. Just go to the directory on your PC where you want to relocate the files, right click anywhere and choose the '''Open in Terminal''' option. In the Terminal command line use the '''Secure Copy''' ('''scp''') command to copy the files from the router. The full command should look something like this:
$ scp [email protected]:/etc/easy-rsa/keys/static.key ./
The '''[email protected]:/etc/easy-rsa/keys/static.key''' specifies the path to where the Static key is located (replace the IP address with your router's LAN IP); the '''./''' denotes that you want to copy the contents to the directory you are in at the moment.
If you are using Windows, you can copy files from the router using '''WinSCP''', an Open source freeware SFTP, SCP, and FTP client for Windows OS. Use the same login information with WinSCP as with CLI or SSH. Once you've connected to the router with WinSCP, copying the files should be simple enough: just relocate to the directory where you generated the key, select the Static key file and drag it to a directory on your PC where you would like to store it.
'''Please note''': You must select '''SCP''' as File Protocol in WinSCP Session settings.
====On a Linux PC====
----
To generate a Static key on a Linux PC, go to the directory where you want the key to appear, right-click anywhere in that directory, and chose the option '''Open in Terminal'''. In the Terminal window execute this command:
$ openvpn --genkey --secret static.key
The newly generated key should then appear in the directory you were in.
===Configuration===
----
When you have a Static key, you can start configuring OpenVPN Server and Client instances. For this example we will be creating a TUN (Tunnel) type connection that uses the UDP protocol for data transfer and Static key for Authentication. We will be using two RUT routers: '''RUT1''' ('''Server'''; LAN IP: '''192.168.1.1'''; WAN (Public static) IP: '''213.226.191.61''') and '''RUT2''' ('''Client'''; LAN IP: '''192.168.2.1'''); the two routers will be connected via OpenVPN; the Server's Virtual IP address will be '''10.0.0.1'''; the Client's - '''10.0.0.2''':