You are previewing Beginning OpenVPN 2.0.9.
O'Reilly logo
Beginning OpenVPN 2.0.9

Book Description

Build and integrate Virtual Private Networks using OpenVPN

  • A practical guide to using OpenVPN for building both basic and complex Virtual Private Networks (VPNs)

  • Learn how to make use of OpenVPNs modules, high-end-encryption and how to combine it with servers for your individual privacy

  • Advanced management of security certificates

  • Get to know the new features of the forthcoming version 2.1 of OpenVPN

  • In Detail

    OpenVPN is a powerful, open source SSL VPN application. It can secure site-to-site connections, WiFi, and enterprise-scale remote connections. While being a full-featured VPN solution, OpenVPN is easy to use and does not suffer from the complexity that characterizes other IPsec VPN implementations. It uses the secure and stable TLS/SSL mechanisms for authentication and encryption. This book is an easy introduction to this popular VPN application. After introducing the basics of security and VPN, it moves on to cover using OpenVPN, from installing it on various platforms, through configuring basic tunnels, to more advanced features, such as using the application with firewalls, routers, proxy servers, and OpenVPN scripting.

    This is a practical guide to using OpenVPN for building both basic and complex Virtual Private Networks. It will save you a lot of time and help you build better VPNs that suit your requirements. While providing only necessary theoretical background, the book takes a practical approach, presenting plenty of examples. It starts with an introduction into the theory of VPNs and OpenVPN, followed by a simple installation example on almost every available platform. After a concise and ordered list of OpenVPN's parameters, we dive into connecting several machines in a safe way. The last third of the book deals with professional and high-end scenarios, and also mobile integration. After having read the whole book and followed and understood all the examples, you will be an expert in VPN, Security, and especially in OpenVPN Technology. This book was written for version 2.0.9 of OpenVPN, but all examples have been tested and run smoothly on version 2.1 too.

    Table of Contents

    1. Beginning OpenVPN 2.0.9
      1. Beginning OpenVPN 2.0.9
      2. Credits
      3. About the Author
      4. Acknowledgement
      5. About the Co-author
      6. About the Reviewers
      7. Preface
        1. What this book covers
        2. What you need for this book
        3. Who this book is for
        4. Conventions
        5. Reader feedback
        6. Customer support
          1. Errata
          2. Piracy
          3. Questions
      8. 1. VPN—Virtual Private Network
        1. Broadband Internet access and VPNs
        2. How does a VPN work?
        3. What are VPNs used for?
        4. Networking concepts—protocols and layers
        5. Tunneling and overhead
        6. VPN concepts—overview
          1. A proposed standard for tunneling
          2. Protocols implemented on OSI layer 2
          3. Protocols implemented on OSI layer 3
          4. Protocols implemented on OSI layer 4
          5. OpenVPN—a SSL/TLS-based solution
        7. Summary
      9. 2. VPN Security
        1. VPN security
        2. Privacy—encrypting traffic
          1. Symmetric encryption and pre-shared keys
        3. Reliability and authentication
          1. The problem of complexity in classic VPNs
          2. Asymmetric encryption with SSL/TLS
        4. SSL/TLS security
          1. HTTPS
          2. Understanding SSL/TLS certificates
          3. Trusted certificates
          4. Self-signed certificates
          5. SSL/TLS certificates and VPNs
          6. Generating certificates and keys
        5. Summary
      10. 3. OpenVPN
        1. Advantages of OpenVPN
        2. History of OpenVPN
          1. OpenVPN Version 1
          2. OpenVPN Version 2
          3. The road to version 2.1
        3. Networking with OpenVPN
          1. OpenVPN and firewalls
          2. Configuring OpenVPN
          3. Problems with OpenVPN
        4. OpenVPN compared to IPsec VPN
          1. User space versus kernel space
        5. Sources for help and documentation
        6. The project community
          1. Documentation in the software packages
        7. Summary
      11. 4. Installing OpenVPN on Windows and Mac
        1. Obtaining the software
        2. Installing OpenVPN on Windows
          1. Downloading and starting installation
          2. Selecting the components and location
          3. Finishing installation
          4. Testing the installation—a first look at the panel applet
        3. Installing OpenVPN on Mac OS X (Tunnelblick)
          1. Testing the installation—the Tunnelblick panel applet
        4. Summary
      12. 5. Installing OpenVPN on Linux and Unix Systems
        1. Prerequisites
        2. Installing OpenVPN on SuSE Linux
          1. Using YaST to install software
        3. Installing OpenVPN on Red Hat Fedora using yum
        4. Installing OpenVPN on Red Hat Enterprise Linux
        5. Installing OpenVPN on RPM-based systems
          1. Using wget to download OpenVPN RPMs
          2. Installing OpenVPN and the LZO library with wget and RPM
          3. Using rpm to obtain information on the installed OpenVPN version
        6. Installing OpenVPN on Debian and Ubuntu
          1. Installing Debian packages
          2. Using Aptitude to search and install packages
          3. OpenVPN—the files installed on Debian
        7. Installing OpenVPN on FreeBSD
          1. Installing a newer version of OpenVPN on FreeBSD—the ports system
            1. Installing the port system with sysinstall
            2. Downloading and installing a BSD port
        8. Summary
      13. 6. Advanced OpenVPN Installation
        1. Troubleshooting—advanced installation methods
        2. Installing OpenVPN from source code
        3. Building and distributing .deb packages
        4. Building your own RPM file
        5. Enabling Linux kernel TUN/TAP support
            1. Using menuconfig
        6. Summary
      14. 7. Configuring an OpenVPN Server—The First Tunnel
        1. OpenVPN on Microsoft Windows
          1. Generating a static OpenVPN key
            1. Creating a sample connection
            2. Adapting the sample configuration file provided by OpenVPN
            3. Starting and testing the tunnel
          2. A brief look at Windows OpenVPN network interfaces
        2. Connecting Windows and Linux
          1. File exchange between Windows and Linux
            1. WinSCP
            2. Transferring the key file from Windows to Linux with WinSCP
            3. The second pitfall—carriage return/end of line
          2. Configuring the Linux system
          3. Testing the tunnel
            1. A look at the Linux network interfaces
          4. Running OpenVPN automatically
            1. OpenVPN as a server on Windows
            2. OpenVPN as a server on Linux
            3. Runlevels and init scripts on Linux
            4. Using runlevel and init to change and check runlevels
            5. The system control for runlevels
            6. Managing init scripts
          5. Using SuSE's YaST module system services (runlevel)
        3. Troubleshooting firewall issues
          1. Deactivating the Windows XP service pack 2 firewall
          2. Stopping the SuSE firewall
        4. Summary
      15. 8. Setting Up OpenVPN with X.509 Certificates
        1. Creating certificates
        2. Certificate generation on Windows Server 2008 with easy-rsa
          1. Setting variables—editing vars.bat
          2. Creating the Diffie-Hellman key
          3. Building the certificate authority
          4. Generating server and client keys
        3. Distributing the files to the VPN partners
        4. Configuring OpenVPN to use certificates
        5. Using easy-rsa on Linux
          1. Preparing variables in vars
          2. Creating the Diffie-Hellman key and the certificate authority
          3. Creating the first server certificate/key pair
          4. Creating further certificates and keys
        6. Troubleshooting
        7. Summary
      16. 9. The Command openvpn and Its Configuration File
        1. Syntax of openvpn
          1. OpenVPN command-line parameters
        2. Using OpenVPN at the command line
          1. Parameters used in the standard configuration file for a static key client
          2. Compressing the data
          3. Controlling and restarting the tunnel
          4. Debugging output—troubleshooting
        3. Configuring OpenVPN with certificates—simple TLS mode
        4. Overview of OpenVPN parameters
          1. General tunnel options
          2. Routing
          3. Controlling the tunnel
          4. Scripting
          5. Modules
          6. Logging
          7. Specifying a user and group
          8. The management interface
          9. Proxies
          10. Encryption parameters
          11. Testing the crypto system with --test-crypto
          12. SSL information—command line
          13. Server mode
            1. Server mode parameters
            2. --client-config options
          14. Client mode parameters
            1. Push options
        5. Important Windows-specific options
        6. New in Version 2.1
          1. Connection profiles
          2. Topology mode
          3. Script-security
          4. Port-sharing
        7. Test
        8. Summary
      17. 10. Securing OpenVPN Tunnels and Servers
        1. Securing and stabilizing OpenVPN
        2. Authentication
          1. Using authentication methods
          2. Authentication plugins overview
          3. Authentication with tokens
          4. Individual authentication with Pam-per-user
        3. Linux and Firewalls
          1. Debian Linux and Webmin with Shorewall
            1. Installing Webmin and Shorewall
            2. Looking at Webmin
            3. Preparing Webmin and Shorewall for the first start
            4. Preparing the Shoreline firewall
            5. Troubleshooting Shorewall—editing the configuration files
          2. OpenVPN and SuSEfirewall
          3. Routing and firewalls
            1. Configuring a router without a firewall
            2. iptables—the standard Linux firewall tool
        4. Configuring the Windows Firewall for OpenVPN
        5. Summary
      18. 11. Advanced Certificate Management
        1. Certificate management and security
        2. Installing xca
        3. Using xca
          1. Creating a database
        4. Importing a CA certificate
          1. Creating and signing a new server/client certificate
          2. Revoking certificates with xca
        5. Using TinyCA2 to manage certificates
            1. Importing our CA
            2. Using TinyCA2 for CA administration
            3. Creating new certificates and keys
            4. Exporting keys and certificates with TinyCA2
            5. Revoking certificates with TinyCA2
        6. Other tools worth mentioning
        7. Summary
      19. 12. OpenVPN GUI Tools
        1. OpenVPN server administration: Webmin's OpenVPN plugin
        2. Client GUIs for Linux
          1. KVpnc
          2. GAdmin-OpenVPN-Client
        3. NetworkManager
        4. Summary
      20. 13. Advanced OpenVPN Configuration
        1. Tunneling a proxy server and protecting the proxy
        2. Scripting OpenVPN—an overview
        3. Using a client configuration directory with per‑client configurations
        4. Individual firewall rules for connecting clients
        5. Distributed compilation through VPN tunnels with distcc
        6. Ethernet bridging with OpenVPN
        7. Automatic installation for Windows clients
        8. Clustering and redundancy
        9. Summary
      21. 14. Mobile Security with OpenVPN
        1. Anonymous and uncensored Internet Access
        2. OpenVPN on Windows Mobile
        3. Embedded Linux Maemo
        4. Summary
      22. 15. Troubleshooting and Monitoring
        1. Testing network connectivity
        2. Checking interfaces, routing, and connectivity on the VPN servers
        3. Debugging with tcpdump and IPTraf
        4. Using OpenVPN protocol and status files for debugging
        5. Scanning servers with Nmap
        6. Monitoring tools
          1. ntop
          2. Munin
          3. Nagios
        7. OpenVPNgraph
        8. Summary
      23. A. Internet Resources and More