OpenVPN server setup
This is a brief howto about the steps required to get OpenVPN up and running on an Unslung NSLU2 in Tun Mode.
The OpenVPN 2.0 HOWTO is an excellent reference for this process: http://openvpn.net/howto.html.
1. Install OpenVPN software on the NSLU2
**note**: The dependencies warning can be disregarded.
2. Configure the NSLU2 box for OpenVPN support
Create the TUN device node:
Load the TUN/TAP kernel module:
3. Follow the directions in the OpenVPN 2.0 HOWTO to for instructions on generating certificates and keys for the OpenVPN server and client(s) at http://openvpn.net/howto.html#pki
**note**: Since the OpenVPN ipk for the NSLU2 is a bare-bones distribution, I did this work on an existing Red Hat Linux server.
**note**: If you wish to do this on your nslu2, download the latest source package from http://openvpn.net/download.html (get the *.tar.gz package) and extract it into a temporary folder using tar -zxvf <downloaded file name> and copy the easy-rsa/2.0/ folder to your openvpn folder and rename it easy-rsa. You can then run all the key preparation commands on your slug.
4. Create directory /opt/etc/openvpn/easy-rsa/keysCopy on the NSLU2 and copy the server key files there.
**note**: In my case, I copied
5. Follow the directions in the OpenVPN 2.0 HOWTO to create configuration files for server and client(s)on http://openvpn.net/howto.html#config
NOTE ----ETHERNET BRIDGING------------------------------------------
under the mssii platform i built the bridge module in a host platform, but it didn't work. It install correctly in my mssii, but won't load. My solution to was to build a whole kernel image(under a different name) with the CONFIG_BRIDGE=y and CONFIG_LLC2=y (built-in). and i upgraded my kernel-image through ipkg.
6. Start the OpenVPN server process from the command line to test connectivity in accordance with the OpenVPN 2.0 HOWTO reference at http://openvpn.net/howto.html#start
**note**: If using iptables firewall add:
"$IPT -A udp_inbound -p UDP -s 0/0 --destination-port 1194 -j ACCEPT"
under "# udp_inbound chain" to enable the initialization Add the following to allow ping etc.:
$IPT -A INPUT -i tun+ -j ACCEPT $IPT -A OUTPUT -o tun+ -j ACCEPT
$IPT -A INPUT -i tap+ -j ACCEPT
7. Once everything is working properly, configure
Don't forget to
And don't forget to set the right shell in openvpn.up, which defaults to /bin/bash. Better is #!/bin/sh, or if installed #!/opt/bin/bash -- Caplink811
I had to do a "chmod 666 /dev/net/tun" to get it to work in my system (Unslung-6.8-beta-firmware) (tnx blaster8) -- FB[i]
Trurl, 2007.09.04: I also did:
- "chmod +x /opt/etc/openvpn/server.up" - add "ifconfig 10.1.0.2 10.1.0.1" line in client.ovpn on the client side (WinXP?, OpenVPN? 2.0.9); notice that addresses are in different order than in a server config, - add "tls-client" line in client.ovpn - uncomment "comp-lzo" line in both server and client configs
For users wishing to use the Xinetd program to start the Openvpn on demand, a working script for the
The default openvpn config file included in the ipk will allow you connect to the openvpn server in tun mode using a static key. If you need to connect to other computers/boxes on your internal LAN network then you will need to set up a return route so that data packets sent from these computers and destined for the external openvpn client can be redirected through the openvpn gateway.
The easiest way is to add the return route into your LAN router/gateway box. Most routers allow for the addition of a number of LAN side static routes.
Assuming your internal LAN subnet is 192.168.1.0, your NSLU2 IP (or other NAS device) which is running the openvpn server program is 192.168.1.77 and your openvpn gateway IP subnet is 10.1.0.0 then add the following return route to your router :-
Alternatively if your router does not support the addition of static routes then you can add the return route individualy to each LAN computer using the following route command.
Include the above script in a small batch file that loads at boot time. Note that you do not need to add the return route to the openvpn server, it is created when the program loads.
RobHam Dec 2010
The OpenVPN server can also be easily configured to run in Tap mode. (Note - a description of the differences/advantages/disadvantages between Tun and Tap modes can be found at the OpenVPN web site).
Firstly it is recommended that the OpenVPN server and matching client should be configured and tested in Tun mode using the instruction above.
In Tun mode, the server and client configuration files will have the following two entries
To establish a tunnel using Tap mode just change the two configuration files too
The main benefit of the Tap driver is the ability to create a bridge to the ether port. To install the bridge-utils package, bridge kernel module and load the module use :-
Instructions for setting up the Bridge can be found by using Internet search engines such as Google.
RobHam Nov 2007 - Modified Jan 2008