The Bakers Homepage

Background:

When I first decided to create my own server I ran down a list of elements I wanted. The first were obvious, web-server, and e-mail server. However I also realized that I have many games that I would enjoy playing with friends. These are older games that only allow multiplayer over local networks. A very secure and novel solution is to use OpenVPN to make the remote computers appear as though they are on the same local network. So I set out to implement this on my second computer. I used Ubuntu Dapper Drake server edition and then began the painstaking task of configuring all the components. However when I tried to configure OpenVPN the documentation on their web-site was lacking. It has been updated and is very good now (this was in March of 2006) but I wrote a guide to installing and configuring OpenVPN on Ubuntu Dapper Drake. I hope you find this interesting and beneficial.

Purpose:

The purpose of this document is to describe how to install OpenVPN server on an Ubuntu Linux system and have it utilize an Ethernet bridge to access your local network. Ethernet bridges essentially allow the operating system to treat multiple network interfaces as one combined port. When used with OpenVPN a bridge will allow you to easily connect external users to your internal network and have them receive all traffic as though they were locally connected. The alternative is to use OpenVPN with a route but that will not allow some forms of traffic through (such as multicast), multicast traffic is important to me as many games require multicast data.

What is needed:

1. Linux System running Ubuntu (tutorial will work with any Linux install with a few modifications)
2. Root access to the server
3. External computer to test with

Scope:

This tutorial aims to instruct how to install and configure an OpenVPN server with internal network access via an Ethernet bridge. This tutorial does not explain how to install Linux and get the OS environment configured. There are many good tutorials out there that you can use, once you have your Linux server ready simply follow this document.

If you are interested in a tutorial to configure your system I recommend this easy to follow guide:

http://www.howtoforge.com/perfect_setup_ubuntu_6.06

Tutorial:

1. The first thing you should do when installing OpenVPN is to read some of the documentation on the OpenVPN web-site. This seems like a simple step to skip but if you do not know exactly how OpenVPN works then you risk opening your internal network to security problems. Additionally there is a lot of good documentation on the OpenVPN site that will help you understand networking terms and methods. Such as exactly what an Ethernet Bridge is and how it differs from a route.

			# Link to OpenVPN Homepage         
			http://openvpn.net/          
			# Link to Explanation of bridging         
			http://openvpn.net/bridge.html	 
			

2. Now that you have taken some time to understand OpenVPN and Bridges we can begin to implement these technologies into a server on your local network. The first step is to collect information about your network, this tutorial is designed for a network that meets the following:

			Linux Server Internal IP: 173.23.1.5 	
			Internet Gateway: 173.23.1.1 	
			Gateway's IP Address: 139.142.227.155  	
			Network Layout: 	Internet ----- Router/Firewall ----- OpenVPN Server (eth1) 
			

3. To simplify setup for users you should register your IP address with an Internet Domain service. If you are cheap like me simply use "no-ip.com". Create an account then download their dynamic dns update tool and follow their installation instructions. This will give you a free dynamic domain. Additionally the IP address for your server needs to be static, this is due to the fact that the bridge will not update on a DHCP IP address change. You can configure this in your /etc/network/interfaces file. My server has an entry for my network card that looks like this:

			# The primary network interface
			# connects to insecure router
			auto eth0
			iface eth0 inet static
			address 173.23.1.5
			netmask 255.255.255.0
			network 173.23.1.0
			broadcast 173.23.1.255
			gateway 173.23.1.1
			# dns-* options are implemented by the resolvconf package, if installed
			dns-nameservers 142.165.200.5
			

4. Now that the information is collected you can begin by installing OpenVPN and the utilities to manage a bridge, to do this simply type:

			sudo apt-get install openvpn bridge-utils 
			

5. With OpenVPN installed we can now begin to configure, the first step is to move the apt-get directory into /etc/openvpn for easy access, and to preserve the original data (in case you mess up and need to revert).

			 cp -R /usr/share/doc/openvpn/examples/ /etc/openvpn/
			

			cd /etc/openvpn/examples/easy-rsa/ 	
			vi ./vars 	 
			

My vars file looks like this: (key components only)

			#this is to ensure secure data
			export KEY_SIZE=2048
			# These are the default values for fields
			# which will be placed in the certificate.
			# Don't leave any of these fields blank.
			export KEY_COUNTRY=CA
			export KEY_PROVINCE=SK
			export KEY_CITY=Martensville
			export KEY_ORG="TheBakershome"
			export KEY_EMAIL="geoff@thebakershome.net"
			

7. Now we to begin the configuration of the server.

			. ./vars 	
			./clean-all 	
			./build-ca 
			

The purpose of these command are as follows, the first one will clear any old keys or configuration elements, there should not be any there but it does not hurt to be sure. The last command will setup OpenVPN configuration items, be sure to follow the prompt and make sure you fill in using elements to match your situation. Since we loaded the vars file with your settings prior to these steps the default values should work on almost all elements, but the Common Name will need to be specified.

8. Now you need to create the server keys, these are private files that you should keep secure.

			./build-key-server server 
			

I found that if I did not use the same information that I used in the build-ca step above that the "Sign Certificate" and "commit" did not work. If you experience this problem just repeat this step with the same values, it should work at that point. This should not occur for you as we have loaded the default values into the vars file, but just in case be aware of the cause.

9. Now you are ready to generate keys for users, first decide if you wish to password protect the keys or not. I recommend building with passwords if you are not going to implement authentication in OpenVPN, if you are then simply generate without. This tutorial will assume that you are going to implement authentication in OpenVPN, since it is the most trusted method. Make sure that you specify the correct Common Name when prompted.

			#Generate with password 	  
			./build-key-pass username  	
			#Generate without password 	  
			./build-key username 
			

10. Now you need to build the Diffie Hellman parameters, for details on what these are simply check the OpenVPN homepage. The simple answer is that they provide a method to negotiate a secure connection over an insecure channel. This process will take a bit of time so you may want to take a break, just relax we are almost there.

			./build-dh 
			#generate server id key
			openvpn --genkey --secret ta.key
			

11. As an aside I found a very interesting table on the OpenVPN web-page. It provides some information on what to do with the various files we just generated. For the purposes of this tutorial I have "borrowed" their table and pasted it here, to view the original visit the OpenVPN installation guide on their homepage.

12. Now we need to configure the server.conf file to setup the operation. Here is my configuration file:

			# Which local IP address should OpenVPN 
			# listen on? (optional) 
			local 173.23.1.5 
			port 1194
			# TCP or UDP server? 
			proto udp 
			#This is key to configuring our bridge 
			dev tap0 
			#direct these to your generated files 
			ca /etc/openvpn/openvpn/examples/easy-rsa/keys/ca.crt 
			cert /etc/openvpn/openvpn/examples/easy-rsa/keys/server.crt 
			key /etc/openvpn/openvpn/examples/easy-rsa/keys/server.key   
			dh /etc/openvpn/openvpn/examples/easy-rsa/keys/dh2048.pem 
			ifconfig-pool-persist ipp.txt 
			#ensure the range of ip addresses you use in the last  two arguments 
			# of this statement are not in use by  either the DHCP server or any other
			# device on your  internal network. 
			server-bridge 173.23.1.5 255.255.255.0 173.23.1.60 173.23.1.70 
			#needed to allow communication to internal network 
			client-to-client 
			keepalive 10 120 
			#encryption - very important ;) 
			#AES encryption is backed by many security firms
			#however if you are concerned about speed use blowfish: "BF-CB"
			cipher AES-128-CBC  
			#if you have another subnet you need to provide the route
			push "route 173.23.2.0 255.255.255.0"
			#server id protection
			tls-auth ta.key 0
			#compression for network speed 
			comp-lzo 
			# if packets are too large fragment them (only really useful if you have an old router) 
			#fragment 1400 
			#limit the number of connections
			max-clients 5
			#some secuurity settings 
			# do not use if running server on Windows
			user nobody 
			group nogroup 
			persist-key 
			persist-tun 
			#log file settings 
			status openvpn-status.log 
			verb 3 
			# authentication plugin
			#forces client to have a linux acount in order to connect
			plugin /usr/lib/openvpn/openvpn-auth-pam.so login 
			

13. Now that the server is configured we need to create the bridge interface. The bridge is managed by Linux and is only used by OpenVPN so setup is a little different. I did it using a script to start/stop the interface. Place this script in "/etc/init.d/bridge" and then run the following:

			update-rc.d bridge defaults 15 
			

Here is the script, before using you will need to edit it for your network and server settings.

			#!/bin/bash  
			# Create global variables   
			# Define Bridge Interface 
			br="br0" 
			# Define list of TAP interfaces to be bridged, 
			# for example tap="tap0 tap1 tap2". 
			tap="tap0" 
			# Define physical ethernet interface to be bridged 
			# with TAP interface(s) above. 
			eth="eth0" 
			eth_ip="173.23.1.5" 
			eth_netmask="255.255.255.0" 
			eth_broadcast="173.23.1.255" 
			gw="173.23.1.1"   
			start_bridge () {   
			#################################   
			# Set up Ethernet bridge on Linux   
			# Requires: bridge-utils   
			#################################    
			for t in $tap; do
			openvpn --mktun --dev $t   
			done    
			for t in $tap; do
			ifconfig $t 0.0.0.0 promisc up   
			done
			ifconfig $eth 0.0.0.0 promisc up
			brctl addbr $br 
			brctl addif $br $eth
			for t in $tap; do
			brctl addif $br $t   
			done    
			ifconfig $br $eth_ip netmask $eth_netmask broadcast $eth_broadcast up   
			route add default gw $gw $br
			} 
			stop_bridge () {   
			####################################   
			# Tear Down Ethernet bridge on Linux   
			####################################    
			ifconfig $br down
			brctl delbr $br    
			for t in $tap; do
			openvpn --rmtun --dev $t   
			done   
			ifconfig $eth $eth_ip netmask $eth_netmask broadcast $eth_broadcast up   
			route add default gw $gw $eth
			}  
			case "$1" in 
			start)   
			echo -n "Starting Bridge"   
			start_bridge   
			;; 
			stop)   
			echo -n "Stopping Bridge"   
			stop_bridge   
			;; 
			restart)   
			stop_bridge   
			sleep 2   
			start_bridge   
			;; 
			*)   
			echo "Usage: $0 {start|stop|restart}" >&2   
			exit 1   
			;; 
			esac  
			

14. Now you need to edit your client configuration script, client.conf. This will be given to your clients and will be the script they invoke (via openvpn) to connect to your server. In the same way you modified the server.conf file edit the network information to match your internal network. Here is an example of one of my scripts:

			client 
			dev tap 
			proto udp 
			# change this to your server's address 
			remote thebakers.no-ip.org 1194 
			resolv-retry infinite 
			nobind
			persist-key 
			persist-tun 
			# Point the key and crt files to  
			# the ones for this user 
			tls-client
			ca ca.crt 
			cert geoff.crt 
			key geoff.key 
			#ensure that we are talking to a server 
			ns-cert-type server
			#confirm we are talking to the correct server 
			tls-auth ta.key 1
			# Select a cryptographic cipher. 
			# If the cipher option is used on the server 
			# then you must also specify it here. 
			cipher AES-128-CBC 
			# Enable compression on the VPN link. 
			comp-lzo 
			#fragment large packets 
			# I found I needed this for some games but it is 
			# not required
			#fragment 1400  
			# enable user/pass authentication
			auth-user-pass
			

15. Now you are ready to test your server, to do this load the server from the command line:

			sudo /etc/init.d/bridge start 	
			sudo openvpn /etc/openvpn/server.conf 
			

##Look for any errors that may be reported while OpenVPN parses the server.conf file. If it gets to the "Succeeded" state then switch computers to a PC on an external network (I used my PC at work) and open the OpenVPN connection. If everything is working here reboot your server and attempt to open the connection again, this will ensure that everything is booting correctly.

###Once the connection is established by the client test it by pinging devices on your internal network. Assuming everything is connected correctly you should be able to contact them.

16. If you have any troubles with step 16, the first place to look is at firewalls. If your server has firewall restrictions they may be blocking the bridge from operating, check your config and adjust as necessary. At this point your server should be running, good luck and have fun.

Post-Install

I ended up having some difficulty configuring shorewall on my openvpn server. It is a little tricky since you have to tell shorewall to differentiate between a physical input (eth0) and the virtual input (tap0). To do this open "/etc/shorewall/hosts" and add:

			net     br0:eth0
			vpn     br0:tap0
			

This will tell shorewall to differentiate between the vpn and the insecure traffic. Once you have this data you need to add the following to your policy file. This will tell shorewall that the traffic from the vpn is trusted so just let it all through.

vpn all ACCEPT

You will also need to mention the vpn in the zones file by adding

				vpn     ipv4
				

Lastly you will need to tell shorewall that a tunnel is coming through by opening the tunnels file and adding:

				openvpn        net     0.0.0.0/0       vpn
				

Conclusion:

I hope your server is working good and that you can now play your old classic games with friends. The other benefit of this network is that you can access your data on your home PC from anywhere and you will be certain that your connection if free from intrusion.