Skip to content

Commit f77e2e1

Browse files
author
Timo Stankowitz
committed
add OpenVPN client configuration
1 parent fbd072d commit f77e2e1

File tree

5 files changed

+116
-9
lines changed

5 files changed

+116
-9
lines changed

‎OpenVPN-client.md‎

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
# OpenVPN config (Client)
2+
This tutorial describes how to configure the EdgeRouter as a OpenVPN Client.
3+
4+
Usefull links:
5+
- [Youtube: EdgeRouter OpenVPN to Private Internet Access!](https://www.youtube.com/watch?v=B9dXiKhDVl0)
6+
- [Youtube: Dedicated Private Internet VLAN and Wireless Network](https://www.youtube.com/watch?v=_TBj5MYmgQc)
7+
8+
## Basic setup
9+
First you need to ssh into your EdgeRouter. Then create a directory where you store your OpenVPN files.
10+
11+
```
12+
sudo su
13+
mkdir -p /config/auth/example
14+
```
15+
16+
In this example I have the following files:
17+
- ca.crt (Root CA)
18+
- client.key (User private key)
19+
- client.crt (User certificate)
20+
- openvpn-static-key-v1.key (for tls-auth)
21+
- example.ovpn (OpenVPN client configuration (see below))
22+
23+
Make sure that `key.pem` has `chmod 600`
24+
25+
## Example of the OpenVPN config-file
26+
This file could differ depending on your openvpn server setup.
27+
```
28+
client
29+
dev tun
30+
proto udp
31+
remote vpn.example.com
32+
resolv-retry infinite
33+
nobind
34+
persist-key
35+
persist-tun
36+
key-direction 1
37+
remote-cert-tls server
38+
auth-nocache
39+
auth SHA512
40+
cipher AES-256-GCM
41+
42+
# files
43+
ca /config/auth/example/ca.crt
44+
cert /config/auth/example/client.crt
45+
key /config/auth/example/key.pem
46+
tls-auth /config/auth/example/openvpn-static-key-v1.key 1
47+
48+
```
49+
50+
## Setup the interface
51+
If you already configured you EdgeRouter as a OpenVPN server then you need to change the network inteface from `vtun0` to something else (e.g. `vtun1`)
52+
53+
```
54+
configure
55+
set interfaces openvpn vtun0 description 'example vpn'
56+
set interfaces openvpn vtun0 config-file /config/auth/example/example.ovpn
57+
commit
58+
save
59+
```
60+
61+
62+
63+
## Setup an extra VLAN for clients
64+
```
65+
# create a new vlan (VLAN 10)
66+
set interfaces switch switch0 vif 10 address 192.168.40.1/24
67+
set interfaces switch switch0 vif 10 description 'example VLAN'
68+
set interfaces switch switch0 vif 10 mtu 1500
69+
```
70+
71+
## Setup a DHCP server
72+
```
73+
set service dhcp-server shared-network-name EXAMPLE-LAN authoritative disable
74+
set service dhcp-server shared-network-name EXAMPLE-LAN subnet 192.168.40.0/24 default-router 192.168.40.1
75+
set service dhcp-server shared-network-name EXAMPLE-LAN subnet 192.168.40.0/24 dns-server 1.1.1.1
76+
set service dhcp-server shared-network-name EXAMPLE-LAN subnet 192.168.40.0/24 domain-name example.com
77+
set service dhcp-server shared-network-name EXAMPLE-LAN subnet 192.168.40.0/24 lease 86400
78+
set service dhcp-server shared-network-name EXAMPLE-LAN subnet 192.168.40.0/24 start 192.168.40.10 stop 192.168.40.100
79+
```
80+
81+
## Setup NAT & routing
82+
```
83+
# setup NAT
84+
set service nat rule 5020 description NAT-EXAMPLE-VPN
85+
set service nat rule 5020 log disable
86+
set service nat rule 5020 outbound-interface vtun0
87+
set service nat rule 5020 source address 192.168.40.0/24
88+
set service nat rule 5020 type masquerade
89+
90+
# setup routing
91+
set protocols static table 1 interface-route 0.0.0.0/0 next-hop-interface vtun0
92+
93+
set firewall modify VPN_EXAMPLE_ROUTE rule 10 description 'Subnet to VPN'
94+
set firewall modify VPN_EXAMPLE_ROUTE rule 10 source address 192.168.40.0/24
95+
set firewall modify VPN_EXAMPLE_ROUTE rule 10 modify table 1
96+
97+
# apply the firewall route to VLAN 10
98+
set interfaces switch switch0 vif 10 firewall in modify VPN_EXAMPLE_ROUTE
99+
```

OpenVPN.md renamed to OpenVPN-server.md

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,8 @@
1-
# OpenVPN config
1+
# OpenVPN config (Server)
2+
This tutorial describes how to setup a OpenVPN server on a EdgeRouter.
23

3-
## create Certificates
4-
You need to create the following files. You can use the Software XCA for that
4+
## Create certificates
5+
Here is a list with files that you need. You can use the Software XCA for that
56
- ca.crt (Root CA)
67
- server.crt (Server Certificate)
78
- To prevent MITM Attacks make sure you set
@@ -15,7 +16,7 @@ After you create the files copy all of them into `/config/auth/`
1516

1617
For you client config: Make sure `remote-cert-tls server` is set.
1718

18-
## configure Basic
19+
## Basic OpenVPN configuration
1920
```
2021
configure
2122
set interfaces openvpn vtun0
@@ -28,8 +29,8 @@ set interfaces openvpn vtun0 server push-route 192.168.178.0/24
2829
set interfaces openvpn vtun0 server subnet 192.168.177.0/24
2930
```
3031

31-
## configure Files
32-
As described above. Make sure you private key has `chmod 400`.
32+
## Certificate setup
33+
As described above. Make sure you private key has `chmod 600`.
3334

3435
```
3536
set interfaces openvpn vtun0 tls ca-cert-file /config/auth/ca.crt
@@ -40,15 +41,14 @@ set interfaces openvpn vtun0 tls key-file /config/auth/server.key
4041
set interfaces openvpn vtun0 tls crl-file /config/auth/revocation-list.crl
4142
```
4243

43-
## config Log
44-
44+
## Configure logging
4545
```
4646
set interfaces openvpn vtun0 openvpn-option "--log /var/log/openvpn.log"
4747
set interfaces openvpn vtun0 openvpn-option "--status /var/log/openvpn-status.log"
4848
set interfaces openvpn vtun0 openvpn-option "--verb 7"
4949
```
5050

51-
## configure Firewall
51+
## Firewall configuration
5252
Don't forget to set NAT for the openvpn clients
5353

5454
```

‎README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,4 @@
11
# EdgeRouter-Stuff
22
Some Information about the Ubiquiti's EdgeOS
3+
4+
If you have comments / find errors /suggestions feel free to contact me / create a merge request. Thanks.

dual-wan.txt renamed to dual-wan.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
# set nat for both interfaces
22

3+
```
34
set load-balance group LB-GROUP interface eth3 failover-only
45
set load-balance group LB-GROUP interface eth3 route-test initial-delay 60
56
set load-balance group LB-GROUP interface eth3 route-test interval 10
@@ -11,3 +12,4 @@ set load-balance group LB-GROUP interface pppoe0 route-test type ping target 8.8
1112
1213
set load-balance group LB-GROUP lb-local enable
1314
set load-balance group LB-GROUP lb-local-metric-change disable
15+
```

example-dhcp.txt renamed to example-dhcp.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,10 @@
1+
# Example DHCP configuration
2+
3+
```
14
set service dhcp-server shared-network-name CLIENT-LAN authoritative disable
25
set service dhcp-server shared-network-name CLIENT-LAN subnet 172.22.1.0/24 default-router 172.22.1.1
36
set service dhcp-server shared-network-name CLIENT-LAN subnet 172.22.1.0/24 dns-server 172.21.7.147
47
set service dhcp-server shared-network-name CLIENT-LAN subnet 172.22.1.0/24 lease 86400
58
set service dhcp-server shared-network-name CLIENT-LAN subnet 172.22.1.0/24 domain-name example.com
69
set service dhcp-server shared-network-name CLIENT-LAN subnet 172.22.1.0/24 start 172.22.1.10 stop 172.22.1.100
10+
```

0 commit comments

Comments
 (0)