====== OpenVPN Bridges ======
===== Prepare OpenVPN =====
* Rather than repeating the already excellent documentationf from Ubuntu, we are just going to give you the URL with the instructions to follow in order to get a OpenVPN server installed and configured.
* https://ubuntu.com/server/docs/service-openvpn
* You can complete the steps up to and including **Simple Server Configuration**.
* After this we will remove the **/etc/openvpn/server.conf** file and replace it with the following three files.
* Please adapt to your server, especially the value of **local** to reflect the public IP Address of your server.
* We are going to use OpenVPN configured as follows:
* We are not going to use encryption of the tunnel.
* We are not going to use the PKI.
* We are not compressing the data.
* We are using a username and password given by the client and pass it onto a script to verify if the client is valid.
* Remove /etc/openvpn/server.conf
sudo rm /etc/openvpn/server.conf
===== OpenVPN server config for br0.101 =====
* Create a file called **/etc/openvpn/server_vlan_101.conf**.
* Be sure to check the correct value for eth1.101. It might be eth0.101 with your config. (up “/etc/openvpn/up.sh br0.101 eth0.101”)
mode server
auth none
tmp-dir /dev/shm
auth-user-pass-verify "/etc/openvpn/openvpn_auth.pl" via-file
verify-client-cert none
username-as-common-name
script-security 2
local 178.1.1.20
port 1194
proto udp
dev tap
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh.pem
up "/etc/openvpn/up.sh br0.101 eth1.101"
server-bridge 10.101.0.1 255.255.0.0 10.101.0.2 10.101.0.100
ifconfig-pool-persist ipp.txt
;client-config-dir ccd
keepalive 10 120
persist-key
persist-tun
status openvpn-status.log
verb 4
allow-compression no
data-ciphers none
cipher none
===== OpenVPN server config for br0.102 =====
* Create a file called **/etc/openvpn/server_vlan_102.conf**.
* Be sure to check the correct value for eth0.102. It might be eth1.102 with your config. (up “/etc/openvpn/up.sh br0.102 eth1.102”)
mode server
auth none
tmp-dir /dev/shm
auth-user-pass-verify "/etc/openvpn/openvpn_auth.pl" via-file
verify-client-cert none
username-as-common-name
script-security 2
local 178.1.1.20
port 1195
proto udp
dev tap
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh.pem
up "/etc/openvpn/up.sh br0.102 eth1.102"
server-bridge 10.102.0.1 255.255.0.0 10.102.0.2 10.102.0.100
ifconfig-pool-persist ipp.txt
;client-config-dir ccd
keepalive 10 120
persist-key
persist-tun
status openvpn-status.log
verb 4
allow-compression no
data-ciphers none
cipher none
===== OpenVPN server config for br0.103 =====
* Create a file called **/etc/openvpn/server_vlan_103.conf**.
* Be sure to check the correct value for eth0.103. It might be eth1.103 with your config. (up “/etc/openvpn/up.sh br0.103 eth1.103”)
mode server
auth none
tmp-dir /dev/shm
auth-user-pass-verify "/etc/openvpn/openvpn_auth.pl" via-file
verify-client-cert none
username-as-common-name
script-security 2
local 178.1.1.20
port 1196
proto udp
dev tap
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh.pem
up "/etc/openvpn/up.sh br0.103 eth1.103"
server-bridge 10.103.0.1 255.255.0.0 10.103.0.2 10.103.0.100
ifconfig-pool-persist ipp.txt
;client-config-dir ccd
keepalive 10 120
persist-key
persist-tun
status openvpn-status.log
verb 4
allow-compression no
data-ciphers none
cipher none
===== Prepare /etc/openvpn/up.sh =====
* You'll see in the config files there are reference to two scripts.
* **/etc/openvpn/up.sh** is called when the tap interface comes up.
* **/etc/openvpn/openvpn_auth.pl** is used to verify the clients.
* Create the /etc/openvpn/up.sh file
sudo vi /etc/openvpn/up.sh
* Give it the following content:
#!/bin/sh
BR=$1
ETHDEV=$2
TAPDEV=$3
/sbin/ip link set "$TAPDEV" up
/sbin/ip link set "$ETHDEV" promisc on
/sbin/brctl addif $BR $TAPDEV
* Make it executable
sudo chmod 755 /etc/openvpn/up.sh
===== Prepare openvpn_auth.pl =====
* You can run the OpenVPN server separate from the RADIUSdesk server.
* The **openvpn_auth.pl** script can then be copied to the server running the OpenVPN server.
* You just have to configure the **openvpn_auth.pl** script to point to your RADIUSdesk server to do the API calls when authenticating a client.
* The **openvpn_auth.pl** script is traditionally under **/var/www/rdcore/cake4/rd_cake/setup/scripts/**.
* Copy this file to **/etc/openvpn/** on the OpenVPN server and edit the following to point to your RADIUSdesk server.
my $protocol='http';
my $server_name_or_ip='198.27.111.78';
my $api_path="/cake4/rd_cake/openvpn-servers/auth-client.json";
* Make sure this file is executable in its new location:
sudo chmod 755 /etc/openvpn/openvpn_auth.pl
* Make sure the Perl modules that are used by this script are installed.
sudo apt-get install liblwp-protocol-https-perl
===== Test Start OpenVPN service =====
* Be aware that the **systemctl start openvpn** is not starting your openvpn you just defined.
* Openvpn uses templatized systemd jobs, openvpn@CONFIGFILENAME.
* So if for example your configuration file is myserver.conf your service is called openvpn@myserver.
* You can run all kinds of service and systemctl commands like start/stop/enable/disable/preset against a templatized service like openvpn@server.
* With that in view you can tests start the individual servers based on their config files.
#start 101
sudo systemctl start openvpn@server_vlan_101
#check the output for any errors
journalctl -xeu openvpn@server_vlan_101.service
#start 102
sudo systemctl start openvpn@server_vlan_102
#check the output for any errors
journalctl -xeu openvpn@server_vlan_102.service
#start 103
sudo systemctl start openvpn@server_vlan_103
#check the output for any errors
journalctl -xeu openvpn@server_vlan_103.service
===== Check the bridges =====
* Confirm that the bridges each have a tap interface included:
brctl show
bridge name bridge id STP enabled interfaces
br0.101 8000.000c294aafdf no eth0.101
tap0
br0.102 8000.000c294aafdf no eth0.102
tap1
br0.103 8000.000c294aafdf no eth0.103
tap2
===== Install ifconfig =====
* Although ifconfig does not come standard with recent versions of Ubuntu and we try to use the replacement **ip** command where possible, we will install ifconfig to help here.
* It is also required during the next section when we work with CoovaChilli.
sudo apt install net-tools
==== Test ifconfig ====
* ifconfig should also include a list of three tap interfaces
tap0 Link encap:Ethernet HWaddr 22:1a:35:b6:01:d7
inet6 addr: fe80::201a:35ff:feb6:1d7/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:16 errors:0 dropped:0 overruns:0 frame:0
TX packets:10 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:768 (768.0 B) TX bytes:820 (820.0 B)
tap1 Link encap:Ethernet HWaddr ca:e0:7d:c0:ea:a0
inet6 addr: fe80::c8e0:7dff:fec0:eaa0/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:0 (0.0 B) TX bytes:648 (648.0 B)
tap2 Link encap:Ethernet HWaddr f2:36:e7:d2:da:c1
inet6 addr: fe80::f036:e7ff:fed2:dac1/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:0 (0.0 B) TX bytes:648 (648.0 B)
===== OpenVPN Startup =====
* Since we use our own startup script to prepare the environment we will disable the normal startup sequience of OpenVPN.
* We will start it up **after** our environment has been prepared.
* Disable the startup of OpenVPN
sudo systemctl disable openvpn
* Add the following lines to the **/etc/rc.local** file to ensure OpenVPN starts up **after** the bridges have been set up.
/sbin/ip addr add 10.103.0.1/16 dev br0.103
/sbin/ip link set dev br0.103 up
#Add the startup of OpenVPN
systemctl start openvpn@server_vlan_101
systemctl start openvpn@server_vlan_102
systemctl start openvpn@server_vlan_103
exit 0
* We are making good progress. Next we will install and configure **Coova Chilli** so that it runs an instance on each VLAN.
* To confirm everything will come up after a power cycle, go ahead and reboot the server.
sudo reboot