Description: Candidates should be able to configure a VPN (Virtual Private Network) and create secure point-to-point or site-to-site connections.
Key Knowledge Areas:
OpenVPN
Terms and Utilities:
/etc/openvpn/
openvpn
In this light weight lesson we talk about OpenVPN but before that lets talk about VPN itself.
What is VPN all about?
Imagine that your are working for a company. And you have been asked to provide secure access to the company lan for another user or remote company branch. The problem is that our traffic shoud be transfer over the internet, which is routed and untrusted. The solution is VPN.
A Virtual Private Network (VPN) is a technology solution used to provide privacy and security for network connections.
It's Virtual...because it's as if we have a private connection directly to another computer we connect to.
It's Private...because all our traffic is encrypted and no one can recognize what is really transfered.
It's a Network...because we're using a special network of VPN servers that covers the entire globe.
Typically an encryption is added and that is SSL/TLS, which uses certificates to make sure that the connection is encrypted and established between trusted parties as well.
As its shown above there are two types of vpn connections:
Point to Point : the most commonly used VPN. PPTP VPNs are used by remote users to connect them to the VPN network using their existing internet connection. This is a useful VPN for both business users and home users.
Site to Site : is mostly used in corporate based operations. The fact that many companies have offices located both nationally and internationally, a Site-to-Site VPN is used to connect the network of the main office location to multiple offices. This is also known as an Intranet based VPN.
OpenVPN
OpenVPN is an open-source software application that implements virtual private network (VPN) techniques to create secure point-to-point or site-to-site connections.
OpenVPN can use a variety of methods such as pre-shared secret keys, certificates, or usernames/passwords, to let clients authenticate to the server. OpenVPN uses the OpenSSL protocol and implements many security and control features such as challenge response authentication, single sign-on capability, load balancing and failover features and multi daemon support.
By default OpenVPN works on port 1194 UDP but Open VPN is highly capable of transparently traversing through firewalls especially when the default port is chnaged to 443.
Lets get started by installing OpenVPN and establish a VPN connection between two computers.
We use CentOS(192.168.10.147) computer az a server and ubuntu(192.168.10.129) machine as a client, also for keeping simple we will use pre-shared keys instead of generating certificates:
[root@centos7-1 ~]# yum search openvpn
Loaded plugins: fastestmirror, langpacks
Loading mirror speeds from cached hostfile
* base: mirrors.maine.edu
* extras: mirror.clarkson.edu
* updates: mirror.math.princeton.edu
Warning: No matches found for: openvpn
No matches found
For installing Open VPN we have to add epel-release repository :
[root@centos7-1 ~]# yum install epel-release.noarch -y
[root@centos7-1 ~]# yum repolist
Loaded plugins: fastestmirror, langpacks
Loading mirror speeds from cached hostfile
* base: mirror.linux.duke.edu
* epel: fedora-epel.mirrors.tds.net
* extras: repos.forethought.net
* updates: centos.mirror.ndchost.com
repo id repo name status
base/7/x86_64 CentOS-7 - Base 9,911
docker-ce-stable/x86_64 Docker CE Stable - x86_64 16
epel/x86_64 Extra Packages for Enterprise Linux 7 - x86_64 12,640
extras/7/x86_64 CentOS-7 - Extras 363
updates/7/x86_64 CentOS-7 - Updates 1,004
repolist: 23,934
and lets install open vpn:
[root@centos7-1 ~]# yum search openvpn
Loaded plugins: fastestmirror, langpacks
epel/x86_64/metalink | 19 kB 00:00:00
epel | 3.2 kB 00:00:00
(1/3): epel/x86_64/group_gz | 88 kB 00:00:02
(2/3): epel/x86_64/updateinfo | 933 kB 00:00:08
(3/3): epel/x86_64/primary | 3.6 MB 00:00:23
Loading mirror speeds from cached hostfile
* base: mirrors.maine.edu
* epel: mirror.clarkson.edu
* extras: mirror.clarkson.edu
* updates: mirror.math.princeton.edu
epel 12642/12642
=========================================================== N/S matched: openvpn ===========================================================
NetworkManager-openvpn.x86_64 : NetworkManager VPN plugin for OpenVPN
NetworkManager-openvpn-gnome.x86_64 : NetworkManager VPN plugin for OpenVPN - GNOME files
kde-plasma-networkmanagement-openvpn.x86_64 : OpenVPN support for kde-plasma-networkmanagement-extras
openvpn-auth-ldap.x86_64 : OpenVPN plugin for LDAP authentication
openvpn-devel.x86_64 : Development headers and examples for OpenVPN plug-ins
openvpn.x86_64 : A full-featured SSL VPN solution
stonevpn.noarch : Easy OpenVPN certificate and configuration management
Name and summary matches only, use "search all" for everything.
[root@centos7-1 ~]# yum install openvpn.x86_64 -y
Transfer shared-key to the client machine with any method that you like:
[root@centos7-1 ~]# scp openvpn.key 192.168.10.129:/root/
The authenticity of host '192.168.10.129 (192.168.10.129)' can't be established.
ECDSA key fingerprint is SHA256:GV/PpX9YGvMZTAbuz6w3zBDreokesZHhVSM1zrXmHLw.
ECDSA key fingerprint is MD5:80:73:95:56:eb:94:6e:f6:45:df:1e:c4:bb:62:f7:9c.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.10.129' (ECDSA) to the list of known hosts.
root@192.168.10.129's password:
openvpn.key
on the ubuntu client:
root@ubuntu16-1:~# cd
root@ubuntu16-1:~# ls
openvpn.key
Okey lets go back to our CentOS server and configre OpenVPN Server configuration file:
[root@centos7-1 ~]# vi server.conf
[root@centos7-1 ~]# cat server.conf
dev tun
ifconfig 10.10.10.1 10.10.10.2
secret openvpn.key
and lets start the openvpn sever to recieve connections:
[root@centos7-1 ~]# openvpn --config server.conf
Sat Aug 11 04:28:59 2018 disabling NCP mode (--ncp-disable) because not in P2MP client or server mode
Sat Aug 11 04:28:59 2018 OpenVPN 2.4.6 x86_64-redhat-linux-gnu [Fedora EPEL patched] [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Apr 26 2018
Sat Aug 11 04:28:59 2018 library versions: OpenSSL 1.0.2k-fips 26 Jan 2017, LZO 2.06
Sat Aug 11 04:28:59 2018 WARNING: INSECURE cipher with block size less than 128 bit (64 bit). This allows attacks like SWEET32. Mitigate by using a --cipher with a larger block size (e.g. AES-256-CBC).
Sat Aug 11 04:28:59 2018 WARNING: INSECURE cipher with block size less than 128 bit (64 bit). This allows attacks like SWEET32. Mitigate by using a --cipher with a larger block size (e.g. AES-256-CBC).
Sat Aug 11 04:28:59 2018 TUN/TAP device tun0 opened
Sat Aug 11 04:28:59 2018 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Sat Aug 11 04:28:59 2018 /sbin/ip link set dev tun0 up mtu 1500
Sat Aug 11 04:28:59 2018 /sbin/ip addr add dev tun0 local 10.10.10.1 peer 10.10.10.2
Sat Aug 11 04:28:59 2018 Could not determine IPv4/IPv6 protocol. Using AF_INET
Sat Aug 11 04:28:59 2018 UDPv4 link local (bound): [AF_INET][undef]:1194
Sat Aug 11 04:28:59 2018 UDPv4 link remote: [AF_UNSPEC]
and it is client configuration time:
root@ubuntu16-1:~# apt install openvpn
root@ubuntu16-1:~# vim client.conf
root@ubuntu16-1:~# cat client.conf
remote 192.168.10.147
dev tun
ifconfig 10.10.10.2 10.10.10.1
secret openvpn.key
and lets get connected:
root@ubuntu16-1:~# openvpn --config client.conf
Sat Aug 11 02:39:53 2018 OpenVPN 2.3.10 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Jun 22 2017
Sat Aug 11 02:39:53 2018 library versions: OpenSSL 1.0.2g 1 Mar 2016, LZO 2.08
Sat Aug 11 02:39:53 2018 WARNING: this cipher's block size is less than 128 bit (64 bit). Consider using a --cipher with a larger block size.
Sat Aug 11 02:39:53 2018 WARNING: this cipher's block size is less than 128 bit (64 bit). Consider using a --cipher with a larger block size.
Sat Aug 11 02:39:53 2018 TUN/TAP device tun0 opened
Sat Aug 11 02:39:53 2018 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sat Aug 11 02:39:53 2018 /sbin/ip link set dev tun0 up mtu 1500
Sat Aug 11 02:39:53 2018 /sbin/ip addr add dev tun0 local 10.10.10.2 peer 10.10.10.1
Sat Aug 11 02:39:53 2018 UDPv4 link local (bound): [undef]
Sat Aug 11 02:39:53 2018 UDPv4 link remote: [AF_INET]192.168.10.147:1194
^CSat Aug 11 02:43:07 2018 event_wait : Interrupted system call (code=4)
Sat Aug 11 02:43:07 2018 /sbin/ip addr del dev tun0 local 10.10.10.2 peer 10.10.10.1
Sat Aug 11 02:43:07 2018 SIGINT[hard,] received, process exiting
root@ubuntu16-1:~# openvpn --config client.conf
Sat Aug 11 02:43:09 2018 OpenVPN 2.3.10 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Jun 22 2017
Sat Aug 11 02:43:09 2018 library versions: OpenSSL 1.0.2g 1 Mar 2016, LZO 2.08
Sat Aug 11 02:43:09 2018 WARNING: this cipher's block size is less than 128 bit (64 bit). Consider using a --cipher with a larger block size.
Sat Aug 11 02:43:09 2018 WARNING: this cipher's block size is less than 128 bit (64 bit). Consider using a --cipher with a larger block size.
Sat Aug 11 02:43:09 2018 TUN/TAP device tun0 opened
Sat Aug 11 02:43:09 2018 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sat Aug 11 02:43:09 2018 /sbin/ip link set dev tun0 up mtu 1500
Sat Aug 11 02:43:09 2018 /sbin/ip addr add dev tun0 local 10.10.10.2 peer 10.10.10.1
Sat Aug 11 02:43:09 2018 UDPv4 link local (bound): [undef]
Sat Aug 11 02:43:09 2018 UDPv4 link remote: [AF_INET]192.168.10.147:1194
Sat Aug 11 02:43:19 2018 Peer Connection Initiated with [AF_INET]192.168.10.147:1194
Sat Aug 11 02:43:20 2018 Initialization Sequence Completed
And as you can see our virtual private network connection has been established and we can ping each other on an imaginary ip addresses that we have set. Before checking, Please make sure that UDP port 1194 is open on the server and the virtual TUN interface used by OpenVPN is not blocked on either the client or server :
### Client
root@ubuntu16-1:~# ping 10.10.10.2
PING 10.10.10.2 (10.10.10.2) 56(84) bytes of data.
64 bytes from 10.10.10.2: icmp_seq=1 ttl=64 time=0.090 ms
^C
--- 10.10.10.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.090/0.090/0.090/0.000 ms
root@ubuntu16-1:~# ifconfig
ens33 Link encap:Ethernet HWaddr 00:0c:29:03:64:0d
inet addr:192.168.10.128 Bcast:192.168.10.255 Mask:255.255.255.0
inet6 addr: fe80::6b27:5482:7f91:fe70/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:441392 errors:0 dropped:0 overruns:0 frame:0
TX packets:168340 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:434873292 (434.8 MB) TX bytes:11126119 (11.1 MB)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:25627 errors:0 dropped:0 overruns:0 frame:0
TX packets:25627 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:1725455 (1.7 MB) TX bytes:1725455 (1.7 MB)
tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.10.10.2 P-t-P:10.10.10.1 Mask:255.255.255.255
inet6 addr: fe80::dbb5:654:4d57:f049/64 Scope:Link
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:11 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:0 (0.0 B) TX bytes:636 (636.0 B)
root@ubuntu16-1:~# ping 10.10.10.1
PING 10.10.10.1 (10.10.10.1) 56(84) bytes of data.
64 bytes from 10.10.10.1: icmp_seq=1 ttl=64 time=1.55 ms
64 bytes from 10.10.10.1: icmp_seq=2 ttl=64 time=2.17 ms
64 bytes from 10.10.10.1: icmp_seq=3 ttl=64 time=2.05 ms
^C
--- 10.10.10.1 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2004ms
rtt min/avg/max/mdev = 1.557/1.928/2.177/0.269 ms
It was the simplest example we could demonstrate for establishing point-to-point VPN connection between to computers using a shared key, but as we said, we can use Certificates inorder to provide SSL/TLS connections to make secure, encrypted VPN connections.This way we can prevent snooping our traffic in a higher level. For that we have to install easy-rsa package and do some extra steps(LPIC3 303 course)
/etc/openvpn/
All OpenVPN configuration files should be configured under /etc/openvpn directory but by default no configuration files are found here. So we should either create new ones (which seems complicated) or we can easily copy sample configuration files from /usr/share/doc/openvpn-x to /etc/openvpn directory and modify them (the simplest way)
