OpenVPN

[donpaul]

Thanks for helping me test it, Krys. Can you verify that you have all of the files needed in the tar, and in your openvpn conf dir? If so, and if it still doesn't work, run the Configure_Users.sh script again and copy the new files over.

lmce-user1.ovpn
user1.crt
user1.key
lmce-ca.crt
lmce-ta.key

[krys]

They are all there, plus I have one additional file lmce-user1.conf

I copied the files over via ftp, I wasnt actually on the network... I assume that is ok?

I will re-run the user config and see if that helps.

-Krys

[krys]

alrighty, tried running user config again and with the new user I get the same error as with the previous one
-Krys

you might wait to mess with it till I get a chance to try it outside of my office... our firewall could be the problem.

[donpaul]

FTP should be fine. The error you had seems to indicate that the lmce-ta.key doesn't match. You can view the .key and .crt files on the server and your clients, they should all match. If not, that is your problem. If they all match, there could be a firewall issue.

[donpaul]

UPDATE: To enable NAT (so that we can get out to the internet while on VPN), a line is needed at the bottom of /usr/pluto/bin/Network_Firewall.sh

Code: [Select]

iptables -t nat -A POSTROUTING -s 10.8.0.0/255.255.255.0 -d ! 10.8.0.0/255.255.255.0 -o $ExtIf -j MASQUERADE
I will add it to my script tonight. But if anyone currently has openvpn configured, you should add it manually and run the Network_Firewall.sh script.

[dlewis]

Have we made the a 100% working script to be implemented into 0810?

Also, how is the webadmin portion going?

[qball4]

I had to change the scripts to reflect the addition of easy-rsa 2.0, but it was just adding the /2.0 on the end of /etc/openvpn/easy-rsa in a few places. Other than that, they work great.  That being said, they default to tun interface on port 1194, so if you want anything different, the generated lmce-server.conf, conf/ovpn files in the user tarballs, and Network_Firewall.sh script still need to be edited by hand.

:Matt

[bulek]

I had to change the scripts to reflect the addition of easy-rsa 2.0, but it was just adding the /2.0 on the end of /etc/openvpn/easy-rsa in a few places. Other than that, they work great.  That being said, they default to tun interface on port 1194, so if you want anything different, the generated lmce-server.conf, conf/ovpn files in the user tarballs, and Network_Firewall.sh script still need to be edited by hand.

:Matt

Hi,

did I understand right, you've setup OpenVPN under 8.10? If yes, please put instructions on wiki - it will be helpful to others...

Thanks ,

regards,

Bulek.

[nite_man]

It'd be very helpful for the rest people if you update the existing article about VPN in the wiki.

[dlewis]

any updates on creating a script/patch for this?

[donpaul]

I wonder if pptp would be easier and more widely accepted? Obviously SSL (OpenVPN) is superior to PPTP, but SSL clients are not always available.

[tschak909]

i'm not sure you guys completely get it... The point is to provide a COMPLETE END TO END SOLUTION.

So that means, we do both the server end, and provide a pre-configured client to connect in.

-Thom

[donpaul]

i'm not sure you guys completely get it... The point is to provide a COMPLETE END TO END SOLUTION.

So that means, we do both the server end, and provide a pre-configured client to connect in.

-Thom

I get it Thom, I just enjoy sharing my finds and progress - that's the point of open source right? I was excited to vpn into the core with my iPhone and make free sip phone calls from Jamaica, and launch the web orbiter to control my house. I think there is value in building some powerful and secure server features that more knowledgeable users can enjoy, even if we can't provide a complete end to end solution right away. Agree?

I have already began trying a script to configure the windows vpn client, but I can't provide a client for the iPhone, besides that would be silly since the iPhone has the built in client. There is no reason we can't use openvpn and pptp, then provide the openvpn client and/or the pptp client configuration. I am working on it in my spare time, which has been extremely scarce lately - sorry.

[davegravy]

cp: cannot stat `/etc/openvpn/easy-rsa/keys/ca.crt': No such file or directory
cp: cannot stat `/etc/openvpn/easy-rsa/keys/server.crt': No such file or directory
cp: cannot stat `/etc/openvpn/easy-rsa/keys/server.key': No such file or directory
25829 Mon May 11 16:32:45 CDT 2009 WaitLock 'Firewall' (Firewall)
25829 Mon May 11 16:32:45 CDT 2009 WaitLock 'Firewall' (Firewall) success
Clearing firewall
Enabling packet forwarding
Setting up firewall
Setting up forwarded ports
  Source port: 3080/tcp; Destination: 127.0.0.1:80
  Source port: 21/tcp; Destination: 192.168.80.254:21
  Source port: 1194/tcp; Destination: 192.168.80.1:1194
  Source port: 3877/tcp; Destination: 192.168.80.1:3877
Opening specified ports to exterior
  Port: 4569:4569/udp
  Port: 5060:5060/udp
  Port: 2000:2000/udp
  Port: 2000:2000/tcp
  Port: 22:22/tcp
  Port: 55237:55237/tcp
25829 Mon May 11 16:32:46 CDT 2009 Unlock 'Firewall' (Firewall)
25829 Mon May 11 16:32:46 CDT 2009 Unlock 'Firewall' (Firewall) success
Stopping virtual private network daemon:.
Starting virtual private network daemon: lmce-server(FAILED).

I just downloaded and ran the script, and got the same errors krys_ got before.

[donpaul]

I just downloaded and ran the script, and got the same errors krys_ got before.

I have intergrated PPTP vpn into LinuxMCE, if you would rather go that route.

http://forum.linuxmce.org/index.php?topic=8767.15

When I get a minute, I'll take a look at the OpenVPN script.