Installing and Configuring OpenVPN 2.3 on Microsoft Windows Small Business Server 2003

My previous posts (http://nkush.blogspot.com.au/2012/08/installing-openvpn-22-on-centos-63-64bit.html and http://nkush.blogspot.com.au/2011/10/installing-openvpn-22-on-centos-57.html) have been on installing OpenVPN on Linux.

This post is slightly different as it installs and configures OpenVPN on a Microsoft Windows Small Business Server (SBS). The SBS installation is also different from the previous write-ups since this configuration uses Ethernet bridging instead of tunneling.

Although SBS comes with Layer2 Tunneling Protocol (L2TP) and Point-to-point Tunelling Protocol (PPTP) for Virtual Private Network (VPN), some users may want to use an Secure Sockets Layer (SSL) based VPN such as OpenVPN. The default installation location, i.e. C:\Program Files\OpenVPN\ is used in the instructions below

Installation:

1. Before downloading and installing OpenVPN, the server needs to have IP forwarding enabled. This is trivial in *nix based systems, but requires a hack in the Windows registry. Edit the parameters and set IPEnableRouter to 1
1. HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\IPEnableRouter
2. Reboot the server to ensure the changes made above take effect
2. Download and install the OpenVPN application[1] from http://openvpn.net/index.php/open-source/downloads.html
3. Open a command prompt and change to the default installation directory
1. Start> Run> cmd
2. cd C:\Program Files\OpenVPN
4. Ensure that the path C:\Program Files\OpenVPN\bin\ is added to the system environment PATH
1. set PATH=%PATH%;C:\Program Files\OpenVPN\bin\
5. Copy the file C:\Program Files\OpenVPN\easy-rsa\vars.bat.sample to C:\Program Files\OpenVPN\easy-rsa\vars.bat
1. cd C:\Program Files\OpenVPN\easy-rsa\
2. copy vars.bat.sample vars.bat OR run the init-config.bat script
6. Edit the file (edit) and change the following
1. Since key lengths less than 2048 are not recommended[2], change the key size to be 4096
1. set KEY_SIZE=4096
2. Configure the following
1. KEY_COUNTRY
2. KEY_PROVINCE
3. KEY_CITY
4. KEY_ORG
5. KEY_EMAIL
6. KEY_CN
7. KEY_NAME
8. KEY_OU
9. PKCS11_MODULE_PATH
10. PKCS11_PIN
7. Setup environment variables by executing the vars.bat script
8. Initialise the keys directory and empty the keys database and serial number by executing clean-all.bat. WARNING: this will delete any existing keys
9. Create certificate for the certificate authority (CA), this will generate the certificate signing request, the CA certificate (ca.crt) and CA key (ca.key).
1. build-ca.bat
10. Create the Diffie Hellman files. These files are used for the key exchange to ensure the confidentiality over an insecure channel. Based on the length of the key used (KEY_SIZE) it may take a while
1. build-dh.bat
11. Create the server certificate and key and commit them
1. build-key-server.bat <SERVER-NAME>
12. Create user machine certificates and keys and commit them (one for each user/machine)
1. build-key.bat <USER-MACHINE>
2. Note: when generating individual user/machine certificate and keys ensure that the common names are unique and for maintenance reasons, its easier if you match the user/machine and the common name
13. Copy the server configuration file to the configuration directory
1. cd C:\Program Files\OpenVPN\sample-config
2. copy server.ovpn ..\config\
14. Edit the server config file. You may use the full path of the certificates and keys, or copy them into the same directory as your configuration file.
1. cd  C:\Program Files\OpenVPN\config
2. edit server.ovpn
1. port 1194
2. proto udp
3. dev tap
4. dev-node MyTap
6. ca ca.crt
7. cert <SERVER-NAME>.crt
8. key <SERVER-NAME>.key
9. dh dh<KEY_SIZE>.pem
10. ifconfig-pool-persist ipp.txt
11. server-bridge 10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100
12. push "route <LAN-NETWORK> <LAN-NETMASK>"
13. keepalive 10 120
14. comp-lzo
15. max-clients 5
16. status openvpn-status.log
17. log-append  openvpn.log
18. verb 3
19. mute 5
15. Change the TAP adapter 
1. Rename to suit the configured name above, in the case of this example "MyTap"
2. Set a static IPv4 address of 10.8.0.4 (or whatever is specified in 14.11 in the server-bridge setting
16. Start the OpenVPN service and check the logs for any errors

Routing changes:

1. You may also need to make routing changes. Depending on your router the settings may differ, but the basic requirement is to add a static route to the VPN tunnel network, i.e. 10.8.0.0/24 to the OpenVPN server.
2. If the server does not have a WAN IP address and is located behind a router performing NAT, then port forwarding rules should be implemeneted to port formward traffic on UDP port 1194 to the VPN server.

Client Configuration:

1. client
2. dev tap
3. proto udp
4. remote <SERVER-WAN> 1194
5. resolv-retry infinite
6. nobind
7. persist-key
8. persist-tun
9. ca ca.crt
10. cert <USER-MACHINE>.crt
11. key <USER-MACHINE>.key
12. comp-lzo
13. verb 3
14. route-method exe
15. route-delay 5

Note: SBS running as the Domain Controller (DC) only allows Terminal Services to run in Administration mode, i.e. only two concurrent Remote Desktop Protocol (RDP) sessions, and one local console session. It does not run in Application mode, which allows additional licenses to be installed

References:

1. http://openvpn.net/index.php/open-source/downloads.html
2. http://csrc.nist.gov/publications/nistpubs/800-131A/sp800-131A.pdf

Connecting to OpenVPN from a Mac using Tunnelblink

To connect to an OpenVPN server you need an appropriate OpenVPN client installed to establish the SSL link. For Apple Mac OS X systems, TunnelBlick (http://code.google.com/p/tunnelblick/) is a good graphical user interface. At the time of this blog the current latest stable version of TunnelBlick available was 3.2.7. These instructions were executed on an Apple iMac running Mac OS X 10.7.4. As with all other posts on this blog, the purpose of this post is not to provide a tutorial, but instead to documents the steps taken, for my own benefit.

Download and install Tunnelblink

1. Download the latest stable version of TunnelBlick (3.2.7).
2. Click on the downloaded dmg package file to mount it.
3. Once the Tunnelblink window is open double-click the Tunnelblink.app icon
4. A warning may be displayed to indicate that the package may be unsafe as it was downloaded, continue by clicking the "Open" button
5. Enter the system administrator credentials to start the install
6. Once installation is completed, the installation succeeded window will be displayed, click the "Quit" button
7. Close the Tunnelblink window, and eject the dmg package
8. Start the Tunnelblink GUI by going to Applications and clicking Tunnelblink.app
9. You should see a Tunnelblink icon up the top

The first time you start the Tunnelblink application

1. A warning may be displayed to indicate that the package may be unsafe as it was downloaded, continue by clicking "Open" button
2. When prompted, click on the "I have configuration files" button

Setting up the OpenVPN connection

1. Then click on "OpenVPN Configuration(s)" button
2. Select the "Create Tunnelblick VPN Configuration" button to generate a configuration based on your OpenVPN configuration files
3. Take a note of the instructions in the dialog box and Click the "Done" button
4. You may be prompted for automatic updates
1. To prevent your system details (although it is anonymous) from being transmitted, uncheck the "Include anonymous system profile" 
2. Then click on "Check Automatically" button to enable automatic checking of updates
5. You should have a directory called "Empty Tunnelblick VPN Configuration" on your desktop
6. Get the CA certificate (ca.crt), your private key (I used MACHINE.key as an example) and certificate (e.g. MACHINE.crt) and your client configuration file (this may be something like client.ovpn or client.conf). These should be provided by your network administrator.
1. ca.crt
2. MACHINE.crt
3. MACHINE.key
4. client-config.ovpn
7. Copy or move the files above into the directory on your desktop
8. Rename the directory into something meaningful with a .tblk extension, e.g. Office-VPN.tblk
9. When prompted to add the .tblk extension click on the "Add" button, you should see the directory icon change to a Tunnelblink icon
10. Double-click the renamed directory to install the configuration
11. When prompted to continue the installation click the "Only Me" button
12. Enter the system administrator credentials to complete the install
13. Once installed, click the "OK button"

Changing DNS settings

1. Right click on the Tunnelblink icon up the top
2. Select VPN Details, then select the VPN connection you wish to edit, e.g. "Office-VPN"
3. Select the "Settings" option on the middle of the window
4. Change the "Set DNS/WINS" option to suit, e.g. You may want to disable DNS changes to be pushed through from the VPN tunnel, thus to use your existing nameserver configuration select "Do not set nameserver"

Connecting to the VPN

1. Once Tunnelblink has been installed and the configuration completed
2. Right click the Tunnelblink icon up the top
3. You should see the VPN connection, e.g. "Connect Office-VPN", select it to connect

Disconnecting from the VPN

1. Once the VPN connection has been established and you wish to disconnect
2. Right click the Tunnelblink icon up the top
3. You should see the VPN connection, e.g. "Disconnect Office-VPN", select it to disconnect

Here is a sample client configuration file for reference, substitute the SERVER, PORT and MACHINE as appropriate

client

dev tun

proto udp

remote SERVER PORT

resolv-retry infinite

nobind

persist-key

persist-tun

ca ca.crt

cert MACHINE.crt

key MACHINE.key

comp-lzo

verb 3

; the following lines are needed for Windows Vista, 7 and 8 machines, not needed for Windows XP

route-method exe

route-delay 2

References:

1. http://code.google.com/p/tunnelblick/

Installing OpenVPN 2.2 on CentOS 6.3 64bit

This post is just an update of a previous post that used CentOS 5.7 and OpenVPN 2.2 (http://nkush.blogspot.com.au/2011/10/installing-openvpn-22-on-centos-57.html). The basic instructions are the same, however this post uses some newer packages which may have been relocated to new URLs. Again this blog and the posts are mostly for my own reference and not intended as step-by-step instuctions for other systems/network administrators

Install RPMForge or RepoForge as it's now known[1]

1. wget http://pkgs.repoforge.org/rpmforge-release/rpmforge-release-0.5.2-2.el6.rf.x86_64.rpm
2. rpm -ivh rpmforge-release-0.5.2-2.el6.rf.x86_64.rpm
3. yum update

Install and set-up the OpenVPN Server[2]

1. yum -y install openvpn 
2. cd /etc/openvpn/
3. cp /usr/share/doc/openvpn-*/sample-config-files/server.conf .
4. mkdir -p /etc/openvpn/easy-rsa/keys
5. cd /etc/openvpn/easy-rsa
6. cp -rf /usr/share/doc/openvpn-2.2.0/easy-rsa/2.0/* .
7. chmod o+x,g+x clean-all, build-* vars whichopensslcnf pkitool inherit-inter list-crl revoke-full sign-req

 Set-up the OpenVPN Server environment, keys and certificates

1. vi /etc/openvpn/easy-rsa/vars
1. Also consider setting the key length using KEY_SIZE variable, 1024 is the default 2048 is better, but slows down the TLS, but I am paranoid and use 4096 bit keys
2. Set the country (KEY_COUNTRY), state (KEY_PROVINCE), locality (KEY_CITY), organisation name (KEY_ORG), and support email (KEY_EMAIL)
3. I used  PKCS11_MODULE_PATH=/ and a random PIN value
2. Create a link to the openssl config file as openssl.cnf
1. ln -s /etc/openvpn/easy-rsa/openssl-1.0.0.cnf /etc/openvpn/easy-rsa/openssl.cnf   
3. Create certificate for the server
1. ./build-key-server NAME_OF_SERVER
2. Answer the questions and commit the certificate into the database
4. Create the Diffie Hellman files
1. These files are used for the actual key exchange to ensure the confidentiality over an insecure channel. Based on the length of the key used (KEY_SIZE) it may take a while.
2. ./build-dh
5. Create the certificate for each client
1. ./build-key CLIENT
6. Edit the server configuration file 
1. vi /etc/openvpn/server.conf
2. Check/change
1. local
2. proto
3. dev
4. port
5. ca
6. cert
7. key
8. dh
9. max-clients
10. user
11. group
12. log-append
13. verb
7. Start everything
1. /etc/rc.d/init/openvpn start
2. chkconfig --level 235 openvpn on

Future post may include instructions on configuration of client as well as set-up of firewall rules for specific topologies (time permitting)

References

1. http://wiki.centos.org/AdditionalResources/Repositories/RPMForge/#head-f0c3ecee3dbb407e4eed79a56ec0ae92d1398e01
2. http://nkush.blogspot.com.au/2011/10/installing-openvpn-22-on-centos-57.htm 

Installing OpenVPN 2.2 on Centos 5.7

OpenVPN is an SSL based VPN. There are other VPN solutions such as IPsec, etc. but OpenVPN provides a cost effective alternative. I like OpenVPN as it support two-way authentication, i.e. both the client and server authenticate using certificates. To install OpeVPN on CentOS we need a number of cryptographic libraries. The simplest way is to use the DAG/RPMForge repository.

Set-up the RPMForge repository [1], as this contains the packages necessary for the installation and the instructions are provided below. The instructions below are just to document this specific installation and therefore this blog post is not to be misinterpreted as a best practises guide. The instructions are adapted from the OpenVPN website [2], but this blog post is intended more as a quick and dirty guide to getting OpenVPN running on CentOS 5.7. Additionally the set-up and configuration of the client is considered beyond the scope of this blog post.

1. Install packages
1. rpm -Uhv http://apt.sw.be/redhat/el5/en/i386/rpmforge/RPMS/rpmforge-release-0.3.6-1.el5.rf.i386.rpm
2. yum -y update
3. yum -y openvpn
2. Set-up configuration files
1. cd /etc/openvpn/
2. cp /usr/share/doc/openvpn-2.2.0/sample-config-files/server.conf .
3. mkdir -p /etc/openvpn/easy-rsa/keys
4. cd /etc/openvpn/easy-rsa
5. cp -rf /usr/share/doc/openvpn-2.2.0/easy-rsa/2.0/* .
6. chmod o+x,g+x clean-all, build-* vars whichopensslcnf pkitool inherit-inter list-crl revoke-full sign-req
3. Edit the PKI configuration
1. vi /etc/openvpn/easy-rsa/vars
1. Also consider setting the key length using KEY_SIZE variable, 1024 is the default 2048 is better, but slows down the TLS, but I am paranoid and use 4096 bit keys
2. Set the country (KEY_COUNTRY), state (KEY_PROVINCE), locality (KEY_CITY), organisation name (KEY_ORG), and support email (KEY_EMAIL)
4. Set-up the PKI infrastructure. This involves make a certificate authority and then generate the server certificate and any client machine certificates
1. Create the certificate authority
1. . ./vars
2. ./clean-all
3. ./build-ca
4. The CA key and certificate should not be in the keys directory inside the easy-rsa directory.
2. Create certificate for the server
1. ./build-key-server NAME_OF_SERVER
2. Answer the questions and commit the certificate into the database
3. Create the Diffie Hellman files
1. These files are used for the actual key exchange to ensure the confidentiality over an insecure channel, aka the Internet. Based on the length of the key used (KEY_SIZE) it may take a while.
2. ./build-dh
4. Create the certificate for each client
1. When doing this for clients, I generate one for each device a client may use, that way if a device is stolen or goes missing, I only have to revoke a single certificate and the others keep working as they do. Not sure if this a good approach, but its definitely my quick and dirty (lazy) approach.
2. ./build-key LAPTOP
3. ./build-key HOME-DESKTOP
4. ./build-key PDA
5. Edit the server configuration file 
1. vi /etc/openvpn/server.conf
2. Check/change
1. local
2. proto
3. dev
4. port
5. ca
6. cert
7. key
8. dh
9. max-clients
10. user
11. group
12. log-append
13. verb
6. Start everything
1. /etc/rc.d/init/openvpn start
2. chkconfig --level 235 openvpn on

Possible Errors:

1. If the OpenVPN server fails to start, ensure that logging is enabled, i.e. refer to log-append in the configuration file and examine the log. A common error is that OpenVPN fails to open certain files, check that the paths to these files are specified correctly.

References:

1. http://dag.wieers.com/rpm/FAQ.php
2. http://openvpn.net/howto.html

Linux Jump Box VPN

With the Linux Desktop out of the way, and my impending studies in Network Security coming up, I thought I'd preempt the studies with some initial ground work on my old Linux Server. Previously we had an old server at home, that was used mostly as a web proxy (Squid) and Windows (Samba) server to share files and the home printer.

Well, it was time for a change and I decided to rebuilt it into a bastion jump box, with a restructure of the home network as well. I started off by installing a second Network Interface Card (NIC) on it. Then installed a bare CentOS on it. I did a yum update on it to ensure the latest patches and stable packages we installed. Next went through the services and disabled all the unnecessary stuff.

The idea is to separate the internal network from the De-militarized Zone (DMZ). The purpose of the jump box is to sit on the DMZ between the access and choke routers. The jump box will provide Virtual Private Network (VPN) access into the network, as well as providing proxy services such as web proxy, syslog, ssh  and other services.

In the network, both the access and choke router perform Network Address Translation (NAT), Quality of Serverice (QoS), as well as stateful packet inspection (SPI) firewall functions. In addition to SPI, the choke also performs some port forwards to the jump box and the sip phone. All other traffic is dropped.

So to get home from university, I need to VPN in, then use SCP to transfer my files (assignments, reports, etc) and get out again.

To install OpenVPN, perform the following tasks;

1. sudo wget http://centos.karan.org/kbsingh-CentOS-Extras.repo
2. sudo yum --enablerepo=kbs-CentOS-Testing install openvpn
3. sudo find / -name "easy-rsa" # returns something like "/usr/share/openvpn/easy-rsa/"
4. sudo cp -R /usr/share/openvpn/easy-rsa /etc/openvpn/
5. sudo cd /etc/openvpn/easy-rsa/2.0/
6. sudo mkdir keys
7. sudo vi ./vars
8. Change the following variables
1. export KEY_SIZE=2048
2. export KEY_COUNTRY=""
3. export KEY_PROVINCE=""
4. export KEY_CITY=""
5. export KEY_ORG=""
6. export KEY_EMAIL=""
9. sudo bash
10. source ./vars
11. ./clean-all
12. ./build-ca
13. ./build-key-server server #server is the unique name to identify the server
14. ./build-key client #client is the unique name to identify the client (repeat for each client)
15. ./build-dh
16. find / -name "server.conf" # returns something like "/usr/share/doc/openvpn-2.1/sample-config-files/server.conf"
17. cp /usr/share/doc/openvpn-2.1/sample-config-files/server.conf /etc/openvpn
18. Edit the file to suit
19. Copy the Diffie-Hellman pem file (dh2048.pen), the server key file (server.key), and the CA certificate file (ca.crt) to the working directory and start the OpenVPN server (/etc/rc.d/init.d/openvpn start).