Difference between revisions of "OpenVPN-Setup"
| Line 1: | Line 1: | ||
| − | This is an experimental setup, using the command line, so please report any error or problems | + | This is an experimental setup, using the command line from the forum, so please report any error or problems in this [https://forums.openpli.org/topic/47406-build-a-server-vpn-with-openvpn-create-certificate-files-configure-client-side/#entry650397<span style="color:SteelBlue">thread</span>] |
| − | + | on the forum. | |
* Install openvpn using the command line | * Install openvpn using the command line | ||
| Line 14: | Line 14: | ||
c:\OpenSSL-Win32\bin\openssl.exe | c:\OpenSSL-Win32\bin\openssl.exe | ||
| − | * Now, in this mode, you can convert .crt and .key files to .pem for server files, and put these files in your stb\receiver at | + | * Now, in this mode, you can convert .crt and .key files to .pem for server files, and put these files in your stb\receiver at /etc/openvpn/ |
| − | |||
| − | |||
$ openssl> x509 -in filename.crt -inform DER -out filename.crt.pem -outform PEM | $ openssl> x509 -in filename.crt -inform DER -out filename.crt.pem -outform PEM | ||
$ openssl> rsa -in filename.key -out filename.key.pem -outform PEM | $ openssl> rsa -in filename.key -out filename.key.pem -outform PEM | ||
| − | The ca.cert file, | + | The ca.cert file, we have to open the certificate in windows OS and select details tab> copy file>convert to binary DER x509 and select destination folder to save. |
| Line 29: | Line 27: | ||
OpenSSL>x509 -inform DER -in ca.cer -outform PEM -out ca.pem | OpenSSL>x509 -inform DER -in ca.cer -outform PEM -out ca.pem | ||
| − | All these conversions to .pem extension is based on openvpn --help | + | All these conversions to .pem extension is based on openvpn --help binary information of our installation of openvpn in our STB, maybe it's not necessary. |
| Line 37: | Line 35: | ||
| − | I add two extra .pem files to the directory 01.pem and 02.pem, they have been generated on the files creation, they contains key info, I | + | I add two extra .pem files to the directory 01.pem and 02.pem, they have been generated on the files creation, they contains key info, I don't know if there is duplicity of information. |
Revision as of 10:50, 27 January 2019
This is an experimental setup, using the command line from the forum, so please report any error or problems in this thread
on the forum.
- Install openvpn using the command line
opkg install openvpn
- Create files ca.crt, server.crt, server.key, same files for clients, client.crt, client.key, following this link
- All files have to be .pem extension, so convert the files, please follow this guide up to finish this three last steps:
set RANDFILE=c:\demo\.rnd set OPENSSL_CONF=C:\OpenSSL-Win32\bin\openssl.cfg c:\OpenSSL-Win32\bin\openssl.exe
- Now, in this mode, you can convert .crt and .key files to .pem for server files, and put these files in your stb\receiver at /etc/openvpn/
$ openssl> x509 -in filename.crt -inform DER -out filename.crt.pem -outform PEM $ openssl> rsa -in filename.key -out filename.key.pem -outform PEM
The ca.cert file, we have to open the certificate in windows OS and select details tab> copy file>convert to binary DER x509 and select destination folder to save.
Then we convert the ca.cer file to .pem file:
OpenSSL>x509 -inform DER -in ca.cer -outform PEM -out ca.pem
All these conversions to .pem extension is based on openvpn --help binary information of our installation of openvpn in our STB, maybe it's not necessary.
dh2048.pem have to locate at openvpn config directory too, /etc/openvpn
I add two extra .pem files to the directory 01.pem and 02.pem, they have been generated on the files creation, they contains key info, I don't know if there is duplicity of information.
Lets to put the server config file parameters /etc/openvpn/server.conf
local 192.168.xxx.xxx (local network IP) server 10.8.0.0 255.255.255.0 (for example) tls-server proto udp port 443 (sample port) dev tun ca ca.pem dh dh2048.pem cert server.crt.pem key server.key.pem extra-certs 01.pem extra-certs 02.pem ifconfig-pool-persist ipp.txt comp-lzo float ping-timer-rem persist-key persist-tun status openvpn-status.log log openvpn.log verb 3 keepalive 10 120
Client profile *.ovpn (tested on android openvpn app).
client dev tun proto udp remote 'hostname(NOIP) or Public IP' 443 (sample port) resolv-retry infinite nobind persist-key persist-tun mute-replay-warnings ca /file_path/ca.crt cert /file_path/client.crt key /file_path/client.key ns-cert-type server cipher bf-cbc comp-lzo verb 3 mute 20
The port we are going to use to vnp connection have to be opened, of course, and you can forward to other external different port as you know.
Happy VPN connection.
