212.5. OpenVPN

Weight: 2

Description: Candidates should be able to configure a VPN (Virtual Private Network) and create secure point-to-point or site-to-site connections.

Key Knowledge Areas:

  • OpenVPN

Terms and Utilities:

  • /etc/openvpn/

  • openvpn

In this light weight lesson we talk about OpenVPN but before that lets talk about VPN itself.

What is VPN all about?

Imagine that your are working for a company. And you have been asked to provide secure access to the company lan for another user or remote company branch. The problem is that our traffic shoud be transfer over the internet, which is routed and untrusted. The solution is VPN.

A Virtual Private Network (VPN) is a technology solution used to provide privacy and security for network connections.

  • It's Virtual...because it's as if we have a private connection directly to another computer we connect to.

  • It's Private...because all our traffic is encrypted and no one can recognize what is really transfered.

  • It's a Network...because we're using a special network of VPN servers that covers the entire globe.

Typically an encryption is added and that is SSL/TLS, which uses certificates to make sure that the connection is encrypted and established between trusted parties as well.

As its shown above there are two types of vpn connections:

  • Point to Point : the most commonly used VPN. PPTP VPNs are used by remote users to connect them to the VPN network using their existing internet connection. This is a useful VPN for both business users and home users.

  • Site to Site : is mostly used in corporate based operations. The fact that many companies have offices located both nationally and internationally, a Site-to-Site VPN is used to connect the network of the main office location to multiple offices. This is also known as an Intranet based VPN.

OpenVPN

OpenVPN is an open-source software application that implements virtual private network (VPN) techniques to create secure point-to-point or site-to-site connections.

OpenVPN can use a variety of methods such as pre-shared secret keys, certificates, or usernames/passwords, to let clients authenticate to the server. OpenVPN uses the OpenSSL protocol and implements many security and control features such as challenge response authentication, single sign-on capability, load balancing and failover features and multi daemon support.

By default OpenVPN works on port 1194 UDP but Open VPN is highly capable of transparently traversing through firewalls especially when the default port is chnaged to 443.

Lets get started by installing OpenVPN and establish a VPN connection between two computers.

We use CentOS(192.168.10.147) computer az a server and ubuntu(192.168.10.129) machine as a client, also for keeping simple we will use pre-shared keys instead of generating certificates:

For installing Open VPN we have to add epel-release repository :

and lets install open vpn:

okey lets start generating shared keys:

Transfer shared-key to the client machine with any method that you like:

on the ubuntu client:

Okey lets go back to our CentOS server and configre OpenVPN Server configuration file:

and lets start the openvpn sever to recieve connections:

and it is client configuration time:

and lets get connected:

And as you can see our virtual private network connection has been established and we can ping each other on an imaginary ip addresses that we have set. Before checking, Please make sure that UDP port 1194 is open on the server and the virtual TUN interface used by OpenVPN is not blocked on either the client or server :

It was the simplest example we could demonstrate for establishing point-to-point VPN connection between to computers using a shared key, but as we said, we can use Certificates inorder to provide SSL/TLS connections to make secure, encrypted VPN connections.This way we can prevent snooping our traffic in a higher level. For that we have to install easy-rsa package and do some extra steps(LPIC3 303 course)

/etc/openvpn/

All OpenVPN configuration files should be configured under /etc/openvpn directory but by default no configuration files are found here. So we should either create new ones (which seems complicated) or we can easily copy sample configuration files from /usr/share/doc/openvpn-x to /etc/openvpn directory and modify them (the simplest way)

Keep this information in your mind for lpic 3 course.

that's all folks!

Congratulation we have done lpic2-202 !!! do not forget to give a star and donate :-)

You can start studying my LPIC-3 book: https://borosan.gitbook.io/lpic3-exam-guide/

Previous212.4. Security tasks

Last updated