Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
technical:openvpn_setup [2018/12/03 08:36] – [Customizable Web Page Setup Parameters] bobtechnical:openvpn_setup [2018/12/20 13:18] (current) – [Generate the master Certificate Authority (CA) certificate & key] bob
Line 47: Line 47:
 ==== Generate the master Certificate Authority (CA) certificate & key ==== ==== Generate the master Certificate Authority (CA) certificate & key ====
  
-Use easy-rsa 2, a set of scripts which is bundled with OpenVPN. With the Windows OpenVPN client open up a Command Prompt window with administrative privileges and cd to c:\Program Files\OpenVPN\easy-rsa. Run the following batch file to copy configuration files into place (this will overwrite any preexisting vars.bat and openssl.cnf files):+Use easy-rsa 2, a set of scripts which is bundled with OpenVPN. With the Windows OpenVPN client open up a Command Prompt window with administrative privileges and cd to c:\Program Files\OpenVPN\easy-rsa. Run the following batch file to copy configuration files into place (this will overwrite any preexisting vars.bat and openssl.cnf files). Skip this if you already have vars.bat setup the way you like it. :
  
 <code>init-config</code> <code>init-config</code>
Line 71: Line 71:
 build-ca build-ca
 </code> </code>
 +
 +The "build-ca" command issues this OpenSSL command:
 +
 +<code>
 +# Build a cert authority valid for ten years, starting now
 +openssl req -days 3650 -nodes -new -x509 -keyout %KEY_DIR%\ca.key -out %KEY_DIR%\ca.crt -config %KEY_CONFIG%
 +</code>
 +
 +Substitute "-enddate YYMMDDHHMMSSZ" to specify an end date instead.
  
 The final command (build-ca) will build the certificate authority (CA) certificate and key by invoking the interactive openssl command. My certificate looked like: The final command (build-ca) will build the certificate authority (CA) certificate and key by invoking the interactive openssl command. My certificate looked like:
Line 220: Line 229:
  
  
-==== Generate certificate & key for server ====+==== Generate Certificate & Key for Server ====
  
 Generate a certificate and private key for the server. On Windows: Generate a certificate and private key for the server. On Windows:
Line 233: Line 242:
   * “1 out of 1 certificate requests certified, commit? [y/n]”.   * “1 out of 1 certificate requests certified, commit? [y/n]”.
  
-==== Generate certificates & keys for clients ====+The "build-key-server" command generates server files by first building a Certificate Signing Request (CSR) and then signing the CSR. It issues these OpenSSL commands: 
 + 
 +<code> 
 +# Build a request for a cert that will be valid for ten years 
 +openssl req -days 3650 -nodes -new -keyout %KEY_DIR%\%1.key -out %KEY_DIR%\%1.csr -config %KEY_CONFIG% 
 +# Sign the cert request with our ca, creating a cert/key pair 
 +openssl ca -days 3650 -out %KEY_DIR%\%1.crt -in %KEY_DIR%\%1.csr -extensions server -config %KEY_CONFIG% 
 +</code> 
 + 
 +==== Generate Certificates & Keys for Clients ====
  
 Generating client certificates is very similar to the previous step. On Windows: Generating client certificates is very similar to the previous step. On Windows:
Line 244: Line 262:
  
 Remember that for each client, make sure to type the appropriate Common Name when prompted, i.e. “client1”, “client2”, or “client3”. Always use a unique common name for each client. Remember that for each client, make sure to type the appropriate Common Name when prompted, i.e. “client1”, “client2”, or “client3”. Always use a unique common name for each client.
 +
 +The “build-key” command generates client files by first building a Certificate Signing Request (CSR) and then signing the CSR. It issues these OpenSSL commands:
 +
 +<code>
 +# Build a request for a cert that will be valid for ten years
 +openssl req -days 3650 -nodes -new -keyout %KEY_DIR%\%1.key -out %KEY_DIR%\%1.csr -config %KEY_CONFIG%
 +# Sign the cert request with our ca, creating a cert/key pair
 +openssl ca -days 3650 -out %KEY_DIR%\%1.crt -in %KEY_DIR%\%1.csr -config %KEY_CONFIG%
 +</code>
  
 Clients can generate their own private key locally. To do this they submit a Certificate Signing Request (CSR) to the key signer. The key-signer can then processed the CSR and returned a signed certificate to the client. Clients can generate their own private key locally. To do this they submit a Certificate Signing Request (CSR) to the key signer. The key-signer can then processed the CSR and returned a signed certificate to the client.
  
-==== Generate Diffie Hellman parameters ====+ 
 +==== Generate Diffie Hellman Parameters ====
  
 Diffie Hellman parameters must be generated for the OpenVPN server. On Windows: Diffie Hellman parameters must be generated for the OpenVPN server. On Windows:
Line 276: Line 304:
 [[https://wiki.dd-wrt.com/wiki/index.php/OpenVPN_Remote_Access_by_Static_Key_%28The_Simple_Way%29|OpenVPN Remote Access By Static Key (The Simple Way)]] [[https://wiki.dd-wrt.com/wiki/index.php/OpenVPN_Remote_Access_by_Static_Key_%28The_Simple_Way%29|OpenVPN Remote Access By Static Key (The Simple Way)]]
  
-To avoid IP address conflicts in a routed configuration:+Here is another great article on setting up a [[https://advancedhomeserver.com/dd-wrt-and-openvpn-part-3/|home OpenVPN server]]. 
 + 
 +When using tunneling mode, to avoid IP address conflicts in a routed configuration:
  
   * the private LAN IP subnet   * the private LAN IP subnet
Line 282: Line 312:
   * the remote LAN subnet   * the remote LAN subnet
  
-must all be different from each other.+must all be different from each other. I used bridge mode and avoided all the routing stuff.
  
 Choose subnets for the private LAN and the VPN that are unlikely to conflict. I chose 192.168.100.x for my home LAN. Choose subnets for the private LAN and the VPN that are unlikely to conflict. I chose 192.168.100.x for my home LAN.
Line 288: Line 318:
 ==== Customizable Web Page Setup Parameters ==== ==== Customizable Web Page Setup Parameters ====
  
-  * DD-WRT default settings in {}  +<WRAP center round tip 80%> 
-  * OpenVPN config example in []+Settings are stored in NVRAM which is limited in size. Only store the PEM version of keys and certs to save space. If there isn't enough space in NVRAM some of these settings will mysteriously disappear after saving. 
 +</WRAP>
  
 ^  Setting  ^ Description ^ Default ^ ^  Setting  ^ Description ^ Default ^