Linux Networking Cookbook

9.4. Connecting a Remote Linux Client Using Static Keys

Problem

You followed the previous recipes and everything works. Now, what do you do for a production VPN server? You want to set it up so that you can connect to your work network from your home Linux PC. Your work Internet account has a static, routable IP address. Your home PC has no overlapping addresses with your work network or your OpenVPN addressing. Your OpenVPN server is on your border router.

Solution

Again, keep in mind that using a static key is less secure than using a proper Public Key Infrastructure (PKI).

Follow the previous recipe to generate and distribute the shared static key. Then, you'll need more options in your configuration files, and to configure your firewall to allow the VPN traffic.

Your setup should look something like Figure 9-2.

Next, copy these client and server configurations, using your own IP addresses and domain names. The local IP address must be your WAN address. These files have different names than in the previous recipe, which speeds up testing as you will see:

Figure 9-2. Remote user logging in over VPN from home

	## openvpn server2.conf
	dev tun
	proto udp
	ifconfig 10.0.0.1 10.0.0.2
	local 208.201.239.37
	secret /etc/openvpn/keys/static.key
	keepalive 10 60
	comp-lzo
	daemon

Next, the client configuration file:

 ## openvpn client2.conf remote router.alrac.net dev tun ifconfig 10.0.0.2 10.0.0.1 route ...