book

OpenVPN Cookbook - Second Edition

Name: OpenVPN Cookbook - Second Edition
Author: Jan Just Keijser
ISBN: 9781786463128

by Jan Just Keijser

February 2017

Intermediate to advanced

400 pages

7h 35m

English

Packt Publishing

Read now

Unlock full access

OpenVPN Cookbook - Second Edition
OpenVPN Cookbook - Second Edition
Credits
About the Author
About the Reviewer
www.PacktPub.com
Why subscribe?
Customer Feedback
Preface
What this book covers
What you need for this book
Who this book is for

Conventions
Reader feedback
Customer support
Downloading the example codeErrataPiracyQuestions
1. Point-to-Point Networks
Introduction
The shortest setup possible
Getting readyHow to do it...How it works...There's more...Using the TCP protocolForwarding non-IP traffic over the tunnel
OpenVPN secret keys
Getting readyHow to do it...How it works...There's more...See also
Multiple secret keys
Getting readyHow to do it...How it works...There's more...See also
Plaintext tunnel
Getting readyHow to do it...How it works...There's more...
Routing
Getting readyHow to do it...How it works...There's more...Routing issuesAutomating the setupSee also
Configuration files versus the command line
Getting readyHow to do it...How it works...There's more...Exceptions to the rule
Complete site-to-site setup
Getting readyHow to do it...How it works...There's more...See also
Three-way routing
Getting readyHow to do it...How it works...There's more...ScalabilityRouting protocolsSee also
Using IPv6
Getting readyHow to do it...How it works...There's more...Log file errorsIPv6-only tunnelSee also
2. Client-server IP-only Networks
Introduction
Setting up the public and private keys
Getting readyHow to do it...How it works...There's more...Using the easy-rsa scripts on WindowsSome notes on the different variablesSee also
A simple configuration
Getting readyHow to do it...How it works...There's more...
Server-side routing
Getting readyHow to do it...How it works...There's more...Linear addressesUsing the TCP protocolServer certificates and ns-cert-type serverMasquerading
Adding IPv6 support
Getting readyHow to do it...How it works...There's more...IPv6 endpointsIPv6-only setup
Using client-config-dir files
Getting readyHow to do it...How it works...There's more...The default configuration fileTroubleshootingOptions allowed in a client-config-dir file
Routing - subnets on both sides
Getting readyHow to do it...How it works...There's more...MasqueradingClient-to-client subnet routingNo route statements in a CCD fileSee also
Redirecting the default gateway
Getting readyHow to do it...How it works...There's more...Redirect-gateway parametersThe redirect-private optionSplit tunnelingSee also
Redirecting the IPv6 default gateway
Getting readyHow to do it...How it works...There's more...
Using an ifconfig-pool block
Getting readyHow to do it...How it works...There's more..Configuration files on WindowsClient-to-client accessUsing the TCP protocol
Using the status file
Getting readyHow to do it...How it works...There's more...Status parametersDisconnecting clientsExplicit-exit-notify
The management interface
Getting readyHow to do it...How it works...There's more...See Also
Proxy ARP
Getting readyHow to do it...How it works...There's more...TAP-style networksUser nobodyBroadcast traffic might not always workSee also
3. Client-server Ethernet-style Networks
Introduction
Simple configuration - non-bridged
Getting readyHow to do it...How it works...There's more...Differences between TUN and TAPUsing the TCP protocolMaking IP forwarding permanentSee also
Enabling client-to-client traffic
Getting readyHow to do it...How it works...There's more...Broadcast traffic may affect scalabilityFiltering trafficTUN-style networks
Bridging - Linux
Getting readyHow to do it...How it works...There's more...Fixed addresses and the default gatewayName resolutionSee also
Bridging- Windows
Getting readyHow to do it...How it works...See also
Checking broadcast and non-IP traffic
Getting readyHow to do it...How it works...
An external DHCP server
Getting readyHow to do it...How it works...There's more...DHCP server configurationDHCP relayTweaking /etc/sysconfig/network-scripts
Using the status file
Getting readyHow to do it...How it works...There's more...Difference with TUN-style networksDisconnecting clientsSee also
The management interface
Getting readyHow to do it...How it works...There's more...See also
Integrating IPv6 into TAP-style networks
Getting readyHow to do it...How it works...There's more...See also
4. PKI, Certificates, and OpenSSL
Introduction
Certificate generation
Getting readyHow to do it...How it works...There's more...See also
OpenSSL tricks - x509, pkcs12, verify output
Getting readyHow to do it...How it works...
Revoking certificates
Getting readyHow to do it...How it works...There's more...What is needed to revoke a certificateSee also
The use of CRLs
Getting readyHow to do it...How it works...There's more...See also
Checking expired/revoked certificates
Getting readyHow to do it...How it works...There's more...
Intermediary CAs
Getting readyHow to do it...How it works...There's more...
Multiple CAs - stacking, using the capath directive
Getting readyHow to do it...How it works...There's more...Using the -capath directive
Determining the crypto library to be used
Getting readyHow to do it...How it works...There's more...See also
Crypto features of OpenSSL and PolarSSL
Getting readyHow to do it...How it works...There's more...AEAD CiphersEncryption speed
Pushing ciphers
Getting readyHow to do it...How it works...There's more...Future enhancements
Elliptic curve support
Getting readyHow to do it...How it works...There's more...Elliptic curve support
5. Scripting and Plugins
Introduction
Using a client-side up/down script
Getting readyHow to do it...How it works...There's more...Environment variablesCalling the down script before the connection terminatesAdvanced - verify the remote hostname
Using a client-connect script
Getting readyHow to do it...How it works...There's more...Pitfall in using ifconfig-pushThe client-disconnect scriptsEnvironment variablesAbsolute paths
Using a learn-address script
Getting readyHow to do it...How it works...There's more...User nobodyThe update action
Using a tls-verify script
Getting readyHow to do it...How it works...There's more...
Using an auth-user-pass-verify script
Getting readyHow to do it...How it works...There's more...Specifying the username and password in a file on the clientPassing the password via environment variables
Script order
Getting readyHow to do it...How it works...There's more...
Script security and logging
Getting readyHow to do it...How it works...There's more...
Scripting and IPv6
Getting readyHow to do it...How it works...There's more...
Using the down-root plugin
Getting readyHow to do it...How it works...There's more...See also
Using the PAM authentication plugin
Getting readyHow to do it...How it works...There's more...See also
6. Troubleshooting OpenVPN - Configurations
Introduction
Cipher mismatches
Getting readyHow to do it...How it works...There's more...Pushable ciphers
TUN versus TAP mismatches
Getting readyHow to do it...How it works...
Compression mismatches
Getting readyHow to do it...How it works...
Key mismatches
Getting readyHow to do it...How it works...See also
Troubleshooting MTU and tun-mtu issues
Getting readyHow to do it...How it works...There's more...See also
Troubleshooting network connectivity
Getting readyHow to do it...How it works...There's more...
Troubleshooting client-config-dir issues
Getting readyHow to do it...How it works...There's more...More verbose loggingOther frequent client-config-dir mistakesSee also
Troubleshooting multiple remote issues
Getting readyHow to do it...How it works...There's more...See also
Troubleshooting bridging issues
Getting readyHow to do it...How it works...See also
How to read the OpenVPN log files
Getting readyHow to do it...How it works...There's more...
7. Troubleshooting OpenVPN - Routing
Introduction
The missing return route
Getting readyHow to do it...How it works...There's more...MasqueradingAdding routes on the LAN hostsSee also
Missing return routes when iroute is used
Getting readyHow to do it...How it works...There's more...See also
All clients function except the OpenVPN endpoints
Getting readyHow to do it...How it works...There's more...See also
Source routing
Getting readyHow to do it...How it works...There's more...
Routing and permissions on Windows
Getting readyHow to do it...How it works...There's more...
Unable to change Windows network location
Getting readyHow to do it...How it works...There's more...
Troubleshooting client-to-client traffic routing
Getting readyHow to do it...How it works...There's more...See also
Understanding the MULTI: bad source warnings
Getting readyHow to do it...How it works...There's more...Other occurrences of the MULTI: bad source messageSee also
Failure when redirecting the default gateway
Getting readyHow to do it...How it works...There's more...See also
8. Performance Tuning
Introduction
Optimizing performance using ping
Getting readyHow to do it...How it works...There's more...See also
Optimizing performance using iperf
Getting readyHow to do it...How it works...There's more...Client versus server iperf resultsNetwork latencyGigabit networksSee also
Comparing IPv4 and IPv6 speed
Getting readyHow to do it...How it works...There's more...Client versus server iperf results
OpenSSL cipher speed
Getting readyHow to do it...How it works...There's more...See also
OpenVPN in Gigabit networks
Getting readyHow to do it...How it works...There's more...Plain-text tunnelWindows performance
Compression tests
Getting readyHow to do it...How it works...There's more...
Traffic shaping
Getting readyHow to do it...How it works...
Tuning UDP-based connections
Getting readyHow to do it...How it works...There's more...See also
Tuning TCP-based connections
Getting readyHow to do it...How it works...There's more...
Analyzing performance using tcpdump
Getting readyHow to do it...How it works...See also
9. OS Integration
Introduction
Linux - using NetworkManager
Getting readyHow to do it...How it works...There's more...Setting up routes using NetworkManagerDNS settingsScripting
Linux - using pull-resolv-conf
Getting readyHow to do it...How it works...There's more...
Windows - elevated privileges
Getting readyHow to do it...How it works...
Windows - using the CryptoAPI store
Getting readyHow to do it...How it works...There's more...The CA certificate fileCertificate fingerprint
Windows - updating the DNS cache
Getting readyHow to do it...How it works...See also
Windows - running OpenVPN as a service
Getting readyHow to do it...How it works...There's more...Automatic service startupOpenVPN user nameSee also
Windows - public versus private network adapters
Getting readyHow to do it...How it works...See also
Windows - routing methods
Getting readyHow to do it...How it works...There's more...
Windows 8+ - ensuring DNS lookups are secure
Getting readyHow to do it...How it works...There's more...
Android - using the OpenVPN for Android clients
Getting readyHow to do it...How it works...There's more...See also
Push-peer-info - pushing options to Android clients
Getting readyHow to do it...How it works...There's more...
10. Advanced Configuration
Introduction
Including configuration files in config files
Getting readyHow to do it...How it works...
Multiple remotes and remote-random
Getting readyHow to do it...How it works...There's more...Mixing TCP and UDP-based setupsAdvantage of using TCP-based connectionsAutomatically reverting to the first OpenVPN serverSee also
Inline certificates
Getting readyHow to do it...How it works...There's more...
Connection blocks
Getting readyHow to do it...How it works...There's more...Allowed directives inside connection blocksPitfalls when mixing TCP and UDP-based setupsSee also
Details of ifconfig-pool-persist
Getting readyHow to do it...How it works...There's more...Specifying the update intervalCaveat - the duplicate-cn optionWhen topology net30 is used
Connecting using a SOCKS proxy
Getting readyHow to do it...How it works...There's more...PerformanceSOCKS proxies via SSHSOCKS proxies using plain-text authenticationSee also
Connecting via an HTTP proxy
Getting readyHow to do it...How it works...There's more...http-proxy optionsDodging firewallsPerformanceUsing the OpenVPN GUISee also
Connecting via an HTTP proxy with authentication
Getting readyHow to do it...How it works...There's more...NTLM proxy authorizationAuthentication methodsOpenVPN GUI limitationsSee also
IP-less setups - ifconfig-noexec
Getting readyHow to do it...How it works...There's more...Point-to-point and TUN-style networksRouting and firewalling
Port sharing with an HTTPS server
Getting readyHow to do it...How it works...There's more...Alternatives
Routing features - redirect-private, allow-pull-fqdn
Getting readyHow to do it...How it works...There's more...The route-nopull directiveThe max-routes directiveSee also
Filtering out pushed options
Getting readyHow to do it...How it works...
Handing out the public IPs
Getting readyHow to do it...How it works...There's more...See also

Content preview from OpenVPN Cookbook - Second Edition

Windows - using the CryptoAPI store

OpenVPN has the capability of using the Windows CryptoAPI store to retrieve the public and private key needed for setting up a connection. This improves security somewhat, as the CryptoAPI store is more secure than the plaintext .crt and .key files that are normally used to set up an OpenVPN connection.

In this recipe, we will configure an OpenVPN client to retrieve the required information from the CryptoAPI store when connecting to the server. This recipe was tested on Windows 7, but it will also work on other versions of Windows.

Getting ready

Set up the client and server certificates using the first recipe from Chapter 2, Client-server IP-only Networks. For this recipe, the server computer was running CentOS ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 9781786463128

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

OpenVPN Cookbook - Second Edition

by Jan Just Keijser

Windows - using the CryptoAPI store

Getting ready

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.