Linux Networking Cookbook

9.3. Testing Encryption with Static Keys

Problem

Now you want to test using encryption keys with OpenVPN, and you want the simplest method for testing possible.

Solution

Use shared static keys. This is less secure than creating a proper Public Key Infrastructure (PKI), but is easy to set up for testing. Follow these steps:

1. Follow the previous recipes.

2. Generate a special static encryption key, and copy the static key to the server and client.

3. Create simple configuration files on both of your test PCs.

4. Fire up OpenVPN from the command line to test it.

In this recipe, the OpenVPN server is again Xena at IP address 192.168.3.10, and the client is Stinkpad at 192.168.2.100. First, create the shared static key on the OpenVPN server with this command:

	root@xena:~# openvpn --genkey --secret static.key

Then, copy it to the client PC:

	root@xena:~# scp static.key 192.168.2.100:/etc/openvpn/keys/

Now, create the server configuration file. I call it /etc/openvpn/server1.conf; you can call it anything you like. Use IP addresses that are on a different subnet than your server. Xena is at 192.168.3.10, so let's make Xena's tunnel endpoint address 10.0.0.1:

	## openvpn server1.conf
	dev tun
	ifconfig 10.0.0.1 10.0.0.2
	secret /etc/openvpn/keys/static.key
	local 192.168.3.10

Then, create the client configuration file on Stinkpad. Stinkpad's tunnel endpoint address is 10.0.0.2:

	## openvpn client1.conf
	remote 192.168.3.10
	dev tun
	ifconfig 10.0.0.2 10.0.0.1
	secret /etc/openvpn/keys/static.key

Make sure that OpenVPN ...