VPN

Serious VPN && !(Serious Cost)Serious VPN && !(Serious Cost)a.k.a. don't pay to “go-to-your-pc”a.k.a. don't pay to “go-to-your-pc”

Jeremy WilldenJeremy WilldenOpen Source EnthusiastOpen Source Enthusiast

Ad Hoc ElectronicsAd Hoc Electronicshttp://www.adhocelectronics.com/http://www.adhocelectronics.com/

Internet Security Issue: BGP spoof

● Border Gateway Protocol handles major routing● Unencrypted traffic can be monitored or

modified from anywhere in the world

http://blog.wired.com/27bstroke6/2008/08/revealed-the-in.html

Networking Overview

● Firewalls and NAT

Networking Overview

Networking Overview

Networking Overview

Networking Overview

Remote Access

● Problem: how to remote control your PC● Partial Solution: VNC Server & Client

Remote Access

Remote Access

Remote Access

● Problem: how to remote control your PC● Partial Solution: VNC Server & Client● Google VNC or check sourceforge.net● Use password authentication● Port forwarding (5900) remote - insecure!● Solution isn't complete

– It's not secure, only allows one service (port)

– Separate port for each client

Securely Connecting Networks

● Virtual Private Network (VPN)● Data encrypted between networks● Many closed and open-source alternatives

– Many get broken by NAT, or are limited by it

– Proprietary ones may only be obscure, not secure

● Ideal: open/free, well tested, reviewed– Use the same code base as eCommerce, TLS/SSL

– Take it further: not just one service/port

Why OpenVPN?

● Uses OpenSSL (TLS)– Heavily tested, SSL is used for HTTPS

– Many ciphers (Blowfish, AES 128/256, many more)

– Free as in Freedom

– Available ready to deploy on many platforms● Linux/Mac/Windows● Router (embedded) firmware

– Public Key Infrastructure● Certificate revocation without re-keying

TLS (SSL) Handshake

● Random keys exchanged using public key cryptography, prevents man-in-middle attacks

Image Copyleft Christian Friedrich, licensed under GFDL, with spelling corrections. Source: Wikimedia

TLS (SSL) Handshake

Image Copyleft Christian Friedrich, licensed under GFDL, with spelling corrections. Source: Wikimedia

General Setup-Linux

● http://openvpn.net/index.php/documentation/howto.html

● Pull down the source from openvpn.net– http://www.oberhumer.com/opensource/lzo/download/lzo-2.03.tar.gz

– http://openvpn.net/release/openvpn-2.0.9.tar.gz

– Unzip/untar: tar -xzf ./lzo-2.03.tar.gz, tar -xzf ./openvpn-2.0.9.tar.gz

– “cd” into each folder, do ./configure, make, make install

● Use yum or apt-get (yum -y install openvpn)● Download RPMs (including dependencies)

– rpm -ivh (path to each RPM, one at a time)

● chkconfig openvpn on (to auto-start)

General Setup-Windows

● Install Windows package from openvpn.net

<<== All config files reside here

<<== You need at least one virtual adapter

<<== Logs are useful for troubleshooting

Windows-OpenVPN GUI

● Roving computer (laptop)

OpenVPN as a service

● Desktop at home, always connected

OpenVPN as a service

● Desktop at home, always connected

Bridged VPN

● Broadcast traffic is forwarded through the VPN● Allows service easy service discovery (virtual

Ethernet connection) netBIOS, Bonjour, etc.● DHCP server shouldn't send a default gateway

to VPN clients● VPN client IP addresses are in the same subnet

as the private network

Routed VPN

● Connect to other devices by IP address (because broadcast traffic is blocked)

● Or set up DNS on both ends to include all names

● VPN IP addresses are separate from both client and server IPs

● Either way, you use the private, internal addresses to connect to your private network– All data encrypted through the tunnel

Implementation 1

● Routed VPN with public key infrastructure● Generate your own keys/certificates● Private IP range for VPN addresses● Use a server with Apache, install a status page

– http://pablohoffman.com/software/vpnstatus/vpnstatus.txt

– PHP script that connects to the management port

server.conf (Implementation 1)Port 1194proto udpdev tunca /etc/openvpn/keys/ca.crtcert /etc/openvpn/keys/server.crtkey /etc/openvpn/keys/server.key # This file should be kept secretdh /etc/openvpn/keys/dh1024.pemserver 10.200.200.0 255.255.255.0ifconfig-pool-persist ipp.txtpush "route 192.168.15.0 255.255.255.0"push "route 192.168.0.0 255.255.255.0"client-to-clientkeepalive 30 120# Generate with: openvpn --genkey --secret ta.key# The second parameter should be '0' on the server and '1' on the clients.tls-auth ta.key 0;cipher AES-128-CBC # AEScomp-lzomax-clients 30user nobodygroup nobodypersist-keypersist-tunstatus /etc/openvpn/openvpn-status.loglog-append /etc/openvpn/openvpn.logverb 4;crl-verify keys/crl.pemmanagement localhost 7505

Also ensure that IP forwarding is enabled on the server, so either run this in a startup script somewhere:

cat > 1 /proc/sys/net/ipv4/ip_forward

or edit your /etc/sysctl.conf file and make sure this line is there (and not commented out)

net/ipv4/ip_forward=1

client1.conf (Implementation 1)clientdev tunproto udpremote my.dyndns.name 1194resolv-retry infinitenobind# Downgrade privileges after initialization (non-Windows only)user nobodygroup nobodypersist-keypersist-tunca ca.crtcert client.crtkey client.keyns-cert-type servertls-auth ta.key 1comp-lzoverb 3

Debug tool: ngrep (packet sniffer)ngrep -d eth0 -Wbyline port 1194

Router Setup (Implementation 1)

OpenVPN on dd-wrt

● dd-wrt– Open-source Linux-based router firmware

– “vpn” version includes openvpn

– Operates in client or server mode

● http://www.dd-wrt.com● http://www.dd-wrt.com/wiki/index.php/OpenVPN_-_Site-to-

Site_routed_VPN_between_two_routers

dd-wrt router client configurationcd /tmpln -s /usr/sbin/openvpn /tmp/myvpn./myvpn --mktun --dev tun0ifconfig tun0 0.0.0.0 promisc upsleep 5echo "clientdaemondev tun0proto udpremote my.server.name 1194resolv-retry infinitetls-auth ta.key 1nobindpersist-keypersist-tunca ca.crtcert client.crtkey client.keyns-cert-type servercomp-lzoverb 3" > /tmp/client.conf#CONTINUED NEXT COLUMN

echo "****CERT CONTENTS****" > ca.crt

echo "****CERTIFICATE CONTENTS****" > client.crt

echo "****KEY CONTENTS***" > client.key

echo “***ta.key contents***” > ta.key

./myvpn --config client.conf

FIREWALL SCRIPT (REMOVE #COMMENTS):iptables -I FORWARD -i br0 -o tun0 -j ACCEPT#Allows VPN traffic outiptables -I FORWARD -i tun0 -o br0 -j ACCEPT#Allows VPN traffic iniptables -I INPUT -i tun0 -j ACCEPT# Allows VPN to connect to GUI

dd-wrt router server changesAdd a client config file directorymkdir /etc/openvpn/ccd

Create a client config file for each remote router (filename must match client name!)nano -w /etc/openvpn/ccd/client2iroute my.sub.net.addr 255.255.255.0

Modify the server.conf file and add these lines:client-config-dir /etc/openvpn/ccdroute my.sub.net.addr 255.255.255.0

VITAL: make sure /etc/openvpn/ccd is world readable, along with all files inside! Otherwise, the downgraded daemon won't be able to read the files.

You can also make each remote router's subnets available to the other routers, but it's a bit more complicated – the ccd files may need to include a push-reset followed by a push off all relevant parameters except for it's own route

Implementation 2

● Routed VPN with static keys● Between two sites using dd-wrt routers

dd-wrt router 1 client configuration# STARTUP SCRIPTcd /tmpln -s /usr/sbin/openvpn /tmp/myvpnecho "remote REMOTEADDRESSproto udp port 2000dev tun0secret /tmp/static.keyverb 3comp-lzokeepalive 15 60daemon" > SiteA-SiteB.confecho "YOUR STATIC KEY" > static.key/tmp/myvpn --mktun --dev tun0ifconfig tun0 10.0.0.2 netmask 255.255.255.0 promisc uproute add -net OTHERSUBNET netmask 255.255.255.0 gw 10.0.0.1sleep 5/tmp/myvpn --config SiteA-SiteB.conf

#FIREWALL SCRIPTiptables -I INPUT 2 -p udp --dport 2000 -j ACCEPTiptables -I FORWARD -i br0 -o tun0 -j ACCEPTiptables -I FORWARD -i tun0 -o br0 -j ACCEPT

dd-wrt router 2 client configuration# STARTUP SCRIPTcd /tmpln -s /usr/sbin/openvpn /tmp/myvpnecho "proto udp port 2000dev tun0secret /tmp/static.keyverb 3comp-lzokeepalive 15 60daemon" > SiteA-SiteB.confecho "YOUR STATIC KEY" > static.key/tmp/myvpn --mktun --dev tun0ifconfig tun0 10.0.0.1 netmask 255.255.255.0 promisc uproute add -net OTHERSUBNET netmask 255.255.255.0 gw 10.0.0.2sleep 5/tmp/myvpn --config SiteA-SiteB.conf

#FIREWALL SCRIPTiptables -I INPUT 2 -p udp --dport 2000 -j ACCEPTiptables -I FORWARD -i br0 -o tun0 -j ACCEPTiptables -I FORWARD -i tun0 -o br0 -j ACCEPT

References

● http://www.openvpn.net● http://openvpn.net/index.php/documentation/howto.html

● http://en.wikipedia.org/wiki/Secure_Sockets_Layer

● http://en.wikipedia.org/wiki/Transport_Layer_Security● http://pbxinaflash.com/forum/showpost.php?p=12108&postcount=24