VPN 2-in-1 Sever Quick Start Guide

Transcription

1 VPN 2-in-1 Sever Quick Start Guide Rev E January, 2018 All Rights Reserved 1

2 Table of Content VPN 2-in-1 Sever Quick Start Guide... 1 Table of Content... 2 List of Figures Introduction Configure IPsec VPN Clients Configure IPsec VPN Client on Smart Phone Configure IPsec VPN Client on iphone Test Your iphone IPsec VPN Client Configure IPsec VPN Client on Android Phone Set up Android IPsec VPN Profile Test Android IPsec VPN Profile Configure IPsec VPN Client on Windows Setup Shrew VPN Client Profile Test Shrew VPN Client Profile Configure IPsec VPN Client on MacBook Configure OpenVPN VPN Clients Configure TLS VPN Client on Windows 7 PC Configure TLS VPN Client on iphone Configure TLS VPN Client on Android Configure TLS VPN Client on MacBook Configure Tunnel-in-Tunnel on Windows PC Create IPsec VPN Tunnel over OpenVPN VPN Tunnel Change Default Keys & Username/Password on VPN Server

3 List of Figures Figure 1 How this VPN 2-in-1 server works... 4 Figure 2 Connect VPN Server to Wireless Router... 5 Figure 3 Built-in Web Server on VPN Device... 6 Figure 4 Download Page on VPN Server... 7 Figure 5 iphone Screenhots of Installing VPN profile... 8 Figure 6 Test iphone VPN Connection... 8 Figure 7 Andoid App Screeen... 9 Figure 8 Android Settings... 9 Figure 9 Android VPN Add Profile Figure 10 Edit VPN Profile Figure 11 Enter IPSec pre-shared key Figure 12 Android VPN Profile List Figure 13 Enter VPN Username and Password Figure 14 VPN Tunnel Created Successfully Figure 15 Download Page of VPN Server Figure 16 Shrew VPN Access Manager Figure 17 Test Shrew VPN Profile Figure 18 Shrew VPN Client Successfully Connects Figure 19 OpenVPN Client setup on Windows PC Figure 20 Run OpenVPN GUI as administrator Figure 21 OpenVPN Icon in Task Bar Figure 22 OpenVPN Client Setup on iphone Figure 23 OpenVPN iphone Client Screenshots Figure 24 OpenVPN Client Setup on Android Device Figure 25 Android OpenVPN Client Setup Screenshots Figure 26 Right Click Command Window Icon, Run as administrator Figure 27 Delete TLS VPN Default Route Figure 28 Delete TLS VPN Default Route Figure 29 Take MicroSD Card Out of Device Figure 30 MicroSD Card in USB Reader Plugged in PC Figure 31 MicroSD Card Auto-detected by Windows Figure 32 Files on VPNSERVER Drive Figure 33 Typical vpnconfig.template.txt Figure 35 Safely Remove USB MicroSD Reader Figure 36 Click on "Eject Mass Storage Device"

4 1. Introduction The 2-in-1 VPN server supports both IPsec VPN and TLS/SSL based VPN. Smart phones have IPsec VPN client built in. And there is free OpenVPN client app in both app-store and google play-store to connect to TLS/SSL based VPN. For Windows PC, there are free VPN clients to download, e.g. ShrewSoft VPN for IPsec client, OpenVPN for TLS/SSL VPN. For PC, you can configure tunnel-in-tunnel feature to achieve the most secure VPN tunnel in the world. That is, IPsec tunnel inside TLS tunnel. How It Works Figure 1 How this VPN 2-in-1 server works Plug in the 2-in-1 VPN server at your router at home. Smart phone on the go can either use OpenVPN to create TLS tunnel to VPN server or use ios/android built-in VPN client to create IPsec tunnel to VPN server. Then all traffic from your smart phone will be encrypted and forwarded to VPN server which decrypts the traffic and access internet for your smart phone. For the returning traffic, the VPN server will encrypt it before it forward the returning traffic to your smart phone. For PC, there is a third option. That is, to create IPsec tunnel inside TLS tunnel. This provides an additional layer of data security. For questions, comments or supports, please contact by . vpn.everyone@gmail.com 4

5 Connect VPN Server to Wireless Router 1) Connect VPN server to wireless router by Ethernet cable 2) Connect USB cable to power up VPN server (Figure 2) Figure 2 Connect VPN Server to Wireless Router NOTE: Please put VPN server at well ventilated spot. Do NOT put VPN server on top (or close to the grill) of your router. Otherwise, the heat generated by your router can drive VPN server to overheat. Most wireless routers come with a USB interface. This USB interface on your wireless router can provide enough power for the VPN server. Connect VPN server to your router by USB data sync cable (Figure 2). Device shown in picture may not be the actual device because the same VPN software runs on multiple different versions of hardware. Note 1: Ethernet cable is an optional accessory. Note 2: USB data sync cable is an optional accessory. Please re-use your USB cable for your old Android phones. Nowadays, every household has one or more retired Android phones, therefore USB cables. To save environment, we don t ship USB cables. Note 3: The software only runs on the MicroSD card shipped. Tip: Each VPN server device is pre-configured with default shared-key and a set of user&password. The device can be plug-n-play. We suggest that you try default VPN setting first. Make sure your VPN client works well with default server configuration first. 5

6 2. Configure IPsec VPN Clients 2.1. Configure IPsec VPN Client on Smart Phone Configure IPsec VPN Client on iphone This procedure is based ios 9.0 or later. The VPN server automatically generates a few.mobileconfig profile for ios. This profile is available on the download web page on VPN server device. You should have know your router internal IP address. Simply add :1234 to your router IP to access the VPN server web page. Assume that your router internal IP is Open the Safari web browser. Use to access the download page on VPN device. Note: Some router models don t support internal port forwarding In this case, will not work. You will have to login to your router to find out what IP address is allocated to the VPN server (e.g ). Then use that IP address ( )to access VPN device web page. Figure 3 Built-in Web Server on VPN Device 6

7 Click Download Page. You will see IPsec configuration files prepared by VPN server. Figure 4 Download Page on VPN Server Tap any of the 5 * VPN profiles prepared by VPN server device. Follow the instruction prompted by iphone to finish installing the VPN profile. When asked for password, enter your iphone screen lock password (NOT VPN user password or icloud password). *The actual number of profiles prepared by VPN server device would depend on how many users you configure on VPN server. Sample screenshots from iphone are below. 7

8 Figure 5 iphone Screenhots of Installing VPN profile Test Your iphone IPsec VPN Client Note: You cannot test VPN connection from the same LAN where the VPN server is. You need to use your smart phone data plan to test VPN. Or use your neighbor s WiFi if they give you guest access. To connect VPN, go to iphone Settings, slide the button beside the VPN. Or go to iphone Settings General VPN, slide the button beside the Status or Figure 6 Test iphone VPN Connection 2.2. Configure IPsec VPN Client on Android Phone Android phone does not provide a way to load profile like ios device as installation option. You have to do it step by step. The good thing is the procedure is very straightforward. 8

9 Set up Android IPsec VPN Profile 1) Go to Android Settings (Figure 7) Figure 7 Andoid App Screeen 2) Select Settings, then select More Figure 8 Android Settings 3) Select VPN, then select + 9

10 Figure 9 Android VPN Add Profile 4) Enter any name in Name field, select IPSec Xauth PSK in Type field, enter public IP of VPN server in Service address field. (Figure 10) Figure 10 Edit VPN Profile Note 1: The Name here is NOT the VPN user name you configured on VPN server side. It is just a name to identify this VPN profile. Note 2: If you don t know what your public IP is, simply open a browser on PC at home, access this website to find out your public IP. 5) Scroll up screen a little bit and fill in the preshared-key (Figure 11). 10

11 Figure 11 Enter IPSec pre-shared key Note: Use the pre-shared key you configured on VPN server (Figure 33). Factory default preshared-key is without quote sign. 6) Select Save, now you have successfully created a VPN profile (Figure 12). Figure 12 Android VPN Profile List 7) Click VPN profile just created to fill in username and password. Then click Connect. 11

12 Figure 13 Enter VPN Username and Password Notes: a. Use the username and password you configured on VPN server (Figure 33). You may select Save account information so that you don t need to enter username and password again every time you connect VPN. Factory default user is test1 with password vpneveryone. b. VPN connect would fail if you are using home WiFi of the same router where VPN server is attached. But it s OK, you have finished configuring Android VPN profile Test Android IPsec VPN Profile If you are at home, you may temporarily disable WiFi on your Android phone and turn on your cell phone data plan. Then click on the VPN profile created at section Alternatively, you can use your neighbor s WiFi just to test VPN profile created at section On successful VPN connection, you will see a key sign on top left of the phone screen and see connected on the VPN profile (Figure 14). 12

13 Figure 14 VPN Tunnel Created Successfully 13

14 2.3. Configure IPsec VPN Client on Windows Setup Shrew VPN Client Profile The easiest way to use IPsec VPN on windows 7 is to use shrew VPN client. The standard version is free. Google ShrewVPN to download it for free. If you are in countries where google.com is blocked or VPN software download is blocked, a local copy of ShrewVPN is available on the download page of VPN server device. After you install shrew VPN client, go to the download page of VPN server device. Right click on profile link to download the ShrewVPN profile Figure 15 Download Page of VPN Server Start Shrew VPN Access Manager, click File menu and then click Import, then select the profile saved in last step. Figure 16 Shrew VPN Access Manager Test Shrew VPN Client Profile VPN connect would fail if you are in the same local network where VPN server is attached. If your neighbor allows you to use their WiFi guest, you can connect your Windows 7 laptop to their WiFi to test VPN. Or you can bring laptop to your work place to try. 14

15 Double click the VPN profile just created. Enter the username and password you configured * on VPN server. Then click Connect button (Figure 17). Figure 17 Test Shrew VPN Profile *The factory default username is test1 with password vpneveryone (without quote sign). VPN Tunnel Created Successfully (Figure 18) Figure 18 Shrew VPN Client Successfully Connects 15

16 2.4. Configure IPsec VPN Client on MacBook MacBook has built-in IPsec VPN client. Follow exact the same procedure as in ios in section 2 earlier. The mobileconfig profile generated by VPN device works for MacBook, too. Click any of the mobileconfig profile and simply follow what the direction your MacBook says. It s super easy! 3. Configure OpenVPN VPN Clients 3.1. Configure TLS VPN Client on Windows 7 PC The commercial of-the-shelf free OpenVPN client can be used to create TLS VPN tunnel to TLS VPN server. Google openvpn download to find the software and install it on your PC. If OpenVPN web site is blocked by your country, a local copy is available on Download Page of VPN server device. Figure 19 OpenVPN Client setup on Windows PC 3.2. From windows start menu, find OpenVPN GUI icon. Right click it and click Run as administrator. (Figure 20). 16

17 Figure 20 Run OpenVPN GUI as administrator 3.3. There will be an icon that looks like a lock at bottom right corner of screen. (Figure 21) Figure 21 OpenVPN Icon in Task Bar 3.4. Right click on this lock-like icon and click connect on the menu. You will be asked for user name and password. Use one of the users you created on VPN server. The factory default user is test1 with password vpneveryone (without quote sign) In a short moment, OpenVPN successfully creates VPN tunnel and assign the PC a virtual IP. Now all your internet access will be through this OpenVPN tunnel. 17

18 3.5. Configure TLS VPN Client on iphone Figure 22 OpenVPN Client Setup on iphone The factory default user is test1 with password vpneveryone (without quote sign) Example iphone OpenVPN setup screenshots are blow. 18

19 Figure 23 OpenVPN iphone Client Screenshots 3.6. Configure TLS VPN Client on Android Figure 24 OpenVPN Client Setup on Android Device The factory default user is test1 with password vpneveryone (without quote sign). Example Android OpenVPN setup screenshots are below. 19

20 20

21 continue Done, connected! Figure 25 Android OpenVPN Client Setup Screenshots 3.7. Configure TLS VPN Client on MacBook Download the Tunnelblick disk image file (a ".dmg" file) from Tunnelblick is the popular OpenVPN client. After installing tunnelblick, run it. Download openvpn-home.ovpn prepared by VPN server device (see Figure 19). Drag openvpn-home.ovpn to tunnelblick app. That s it! 4. Configure Tunnel-in-Tunnel on Windows PC 4.1. Create IPsec VPN Tunnel over OpenVPN VPN Tunnel Follow section (3.1) to create TLS VPN tunnel and get a virtual IP, e.g Follow section (2.3) to create IPsec VPN tunnel except that change the IP address in the shrew-vpn-profile to use the VPN server s virtual IP IMPORTANT: Follow the steps below to remove default routing path added by TLS VPN tunnel Run command window as administrator (Figure 26 below). 21

22 Figure 26 Right Click Command Window Icon, Run as administrator Run command route delete mask Figure 27 Delete TLS VPN Default Route Run command route delete mask Figure 28 Delete TLS VPN Default Route 2 22

23 You are done creating IPsec VPN tunnel inside TLS VPN tunnel. All traffic from your PC will go via IPsec tunnel which is inside TLS tunnel. 5. Change Default Keys & Username/Password on VPN Server In a nutshell, fill key and username&password in file vpnconfig/vpnconfig.txt on microsd card and that is it. Tip: Each device is pre-configured with a set of shared-key and password. The device can be plug-n-play. We suggest that you try default VPN setting first. Make sure your VPN client works with default server configuration first. In case you want to pick your own shared-key and password, here is the detail procedure. 1) Power down VPN Server and Take MicroSD Card out of VPN Server Figure 29 Take MicroSD Card Out of Device 2) Put MicroSD Card in USB Reader and Plug It in PC Note: USB Reader is an optional accessory. It s not included in the shipment by default. 23

24 Figure 30 MicroSD Card in USB Reader Plugged in PC Windows will automatically detect the MicroSD card (Figure 31). Figure 31 MicroSD Card Auto-detected by Windows 7 3) Click Open folder to view files 24

25 Figure 32 Files on VPNSERVER Drive!!!WARNING!!! Do NOT touch any files other than files in vpnconfig directory on MicroSD card. Otherwise, the device may not boot any more. 4) Go to Directory vpnconfig, find vpnconfig.template.txt 25

26 Figure 33 Typical vpnconfig.template.txt 5) Make a copy of vpnconfig.templete.txt to vpnconfig.txt and fill in your values for preshared_key, username:password. Tip: You can also fill in value in vpnconfig.template.txt and then SAVE AS vpnconfig.txt WARNING: If you use notepad to edit file, Windows would automatically append.txt in the file name. Do NOT end up file name as vpnconfig.txt.txt So if you use notepad to edit file, simply save it as vpnconfig. Let Windows automatically append.txt in the file name. Note: preshared_key and password requires at least 8 characters. Note: vpnconfig.txt will be moved to a safe place and encrypted if the configuration is accepted. If, after microsd is put back in service and you still see vpnconfig.txt file, either the configuration format is not right or the configuration file name is not right. E.g. the actual configuration file name ends up as vpnconfig.txt.txt or vpnconfig.txt. 6) Make sure you safely remove USB reader. Click the Triangle on left of flag sign at bottom right of your PC screen. Then click USB icon (Figure 34). Figure 34 Safely Remove USB MicroSD Reader Now click Eject Mass Storage Device. And then pull out USB reader from PC (Figure 35). 26

27 Figure 35 Click on "Eject Mass Storage Device" 7) Put MicroSD card back in VPN server device and power up VPN server. You have successfully changed your VPN server setting. Isn t that easy?! If you have any questions/comments, please contact us by vpn.everyone@gmail.com Thanks 27