VPN and GNU/Linux at the University of South Wales

Transcription

1 VPN and GNU/Linux at the University of South Wales These notes are designed to help staff and research students at the University of South Wales connect to their desktop machines using GNU/Linux. You will of course have had to register your username as using vpn with LCSS. The information here is just a consolidation of information held on other publically accessible web servers. Advantages The advantages with this approach are: performance. there is no modification to the kernel, and no proprietry binary modules need to be installed. inpractice both of these advantages mean that the operating system is less likely to crash. ituses thevpnc package which only does one thing and one thing well - namely it creates the vnc connection. using the following steps you should be able to route remote desktop packets to your desktop, any local browsing activity will go to the wider Internet via the ISP rather than via the University. Only DNS queries referencing.glam.ac.uk go to the University nameserver. This improves performance considerably as all packets traversing the vpn tunnel must be encrypted and decrypted. no need to run virtualisation to get the benefits above. Many Windows or Mac users perhaps use VMWare or an equivalent to get the above benefits, that solution does the job however it is really rather like using a sledgehammer to crack a nut. This solution uses much less code to solve the same problem allowing your desktop to run much faster. Disadvantages this solution is not supported by LCSS and you have to follow the instructions below. the instructions only apply to Debian GNU/Linux or Ubuntu - although most of these instructions would probably, with a little modification, work on other GNU/Linux distributions. I think that with even more changes they would also work under MacOS and FreeBSD systems. With a full moon and the realignment of the seven sisters of Pleiades into a regular heptagon they could be adapted to run under cygwin. there is no double click to install all of this.. vpnc Download a copy ofvpnc from here massar/vpnc/ vpnc tar.gz and extract it. You can do this from the command line (open a gnome-terminal) as follows: $ wget massar/vpnc/vpnc tar.gz $ tar zxf vpnc tar.gz now install thelibcrypt11 andlibgpg-error-dev libraries

2 -2- $ sudo apt-get install libgcrypt11-dev libgpg-error-dev (redhat users can install these by) $ sudo yum install libgcrypt-devel libgpg-error-devel now webuild and install the software: $ cd vpnc $ make $ sudo make install download a copy ofthe Windows XP UoG vpn package, extract the pcf file convert and install it into the vpnc directory. $ cd.. $ wget $ mkdir xp-vpn $ cd xp-vpn $ unzip../uogvpn exe $ cd../vpnc $./pcf2vpnc../xp-vpn/uog-vpn.pcf uog.conf $ sudo cp uog.pcf /etc/vpnc/uog.conf at this point you should be able to create a vpn tunnel with the University but it won t bemuch use yet.. Anyhow itwould be a good idea to test what has been installed. To dothis you can: $ sudo vpnc uog VPNC started in background (pid: 15343)... $ sudo route j1vpn3030g-e2.n merlin.example UGH 0 0 0eth * U 0 0 0tun0 default * U 0 0 0tun0 $ sudo vpnc-disconnect Terminating vpnc daemon (pid: 15343) Notice that the tun0 device has come to life and it is set as the default route. The tun0 device will encrypt all packets securely and send them to the University vpn server which in turn decrypts and passes them onto the local network. Now install dnsmasq which will resolve our dns queries and decide which queries need to go along the slow tunnel to work and which ones can be more efficiently sent directly unencrypted to our ISP. The dnsmasq package has a pleasant side effect of caching dns requests, vastly improving the browsing experience. $ sudo apt-get install dnsmasq

3 -3- edit/etc/dnsmasq.conf, and search for the three lines which are: Add other name servers here, with domain specs if they are for non-public domains. server=/localnet/ then add the following line Add other name servers here, with domain specs if they are for non-public domains. server=/localnet/ server=/glam.ac.uk/ this says any dns query matching.glam.ac.uk will be resolved by the University nameserver ( ) also alter the last line of these three Ifyou don t want dnsmasq to poll /etc/resolv.conf or other resolv files for changes and re-read them then uncomment this. no-poll to Ifyou don t want dnsmasq to poll /etc/resolv.conf or other resolv files for changes and re-read them then uncomment this. no-poll Now copy and paste this script into a file called vpn. Essentially all packets which are destined to the University go slowly over thetun0 device and all other go quickly unencrypted to our ISP. You should check (and maybe modify the line following "YOUR desktop net id"). Currently the script will redirect any traffic to the tun0 device. Your desktop net id might be different - to check run /usr/sbin/ifconfig on your desktop and note the network address.

4 -4-!/bin/bash export PATH=/sbin:/usr/local/sbin:$PATH echo "Starting vpn..." vpnc uog default route goes to ISP route add default gw add route for.glam.ac.uk nameserver (remember that dnsmasq only uses this for.glam.ac.uk requests) route add -net netmask dev tun0 add route onto network: mcgreg, floppsie and moppsy route add -net netmask dev tun0 and add route to desktop subnet you might need to alter the following line to match YOUR desktop net id route add -net netmask dev tun0 finally print route info route echo "Press enter to stop vpn" read ans vpnc-disconnect sleep 2 route Now make this script executable via: $ chmod 700 vpn $ cp vpn /usr/local/sbin to invoke the vpn script type: $ sudo /usr/local/sbin/vpn you should see the following:

5 -5- Starting vpn... VPNC started in background (pid: 15972)... j1vpn3030g-e2.n merlin.example UGH 0 0 0eth * U 0 0 0tun * U 0 0 0tun * U 0 0 0tun * U 0 0 0tun0 default merlin.example UG 0 0 0eth1 default * U 0 0 0tun0 Press enter to stop vpn You can now connect to mcgreg.comp.glam.ac.uk using ssh, or to your Windows desktop via the GNU/Linux rdesktop client. To test that different routes are taken try using traceroute: $ traceroute traceroute to ( ), 30 hops max, 52 byte packets 1merlin.example.org ( ) ms ms ms 2sgrs-lns-01-lo0.onetel.net.uk ( ) ms ms ms ˆC $ traceroute mcgreg.comp.glam.ac.uk traceroute to mcgreg.comp.glam.ac.uk ( ), 30 hops max, 52 byte packets 1j1vpn3030g-e2.net.glam.ac.uk ( ) ms ms ms ˆC It is interesting to see that the encrypted route is nearly twice as slow asthe unencrypted route. When you wish to disconnect the vpn tunnel press the <enter> key in the gnome-terminal window. You should see the following messages: Terminating vpnc daemon (pid: 15972) default merlin.example UG 0 0 0eth1