OpenVPN Server & Client for Site-to-Site Quick Start Guide

Transcription

1 OpenVPN Server & Client for Site-to-Site Quick Start Guide Rev A April, 2017 By: vpneveryone.ddns.net All Rights Reserved 1

2 Table of Content OpenVPN Server & Client for Site-to-Site Quick Start Guide... 1 Table of Content... 2 Table of Figures... 3 Introduction Simple Configuration on Your Router... 4 Main Office... 4 Branch Office OpenVPN Device Configuration... 5 VPN Server Setting... 5 OpenVPN Client Device Setting OpenVPN Server Road Warrior Access Configure OpenVPN Client on Windows PC Setup OpenVPN Client to Make VPN Tunnel to VPN Server

3 Table of Figures Figure 1 Take MicroSD Card Out of Device... 6 Figure 2 MicroSD Card in USB Reader Plugged in PC... 6 Figure 3 MicroSD Card Auto-detected by Windows Figure 4 Files on VPNSERVER Drive... 7 Figure 5 Files in vpnconfig directory... 7 Figure 6 VPN Site-to-Site Server vpnconfig.template.txt... 8 Figure 7 Safely Remove USB MicroSD Reader... 9 Figure 8 Click on "Eject Mass Storage Device"... 9 Figure 9 VPN Client Configuration Template Figure 10 OpenVPN Server Web Page Figure 11 OpenVPN Server Download Page Figure 12 Save openvpn-home.ovpn in OpenVPN config dirctory Figure 13 Run OpenVPN GUI as administrator Figure 14 OpenVPN Icon in Task Bar

4 Introduction Setting up VPN site-to-site is made easy with this pair of OpenVPN server & client for dummy. You don t need to know anything about VPN. All you need to configure is username, password, etc. in this pair of VPN devices. In some cases, IPsec VPN could be blocked by firewall that you don t have control, this OpenVPN flavor VPN is a great alternative to IPsec site-to-site VPN deployment. E.g. Some customers are using Verizon MiFi as their office uplink to internet and they found Version MiFi blocks IPsec. This OpenVPN site-to-site VPN is a great rescue to such situation. For questions, comments, supports or customization, please contact us by . vpn.everyone@gmail.com 1. Simple Configuration on Your Router Main Office Connect VPN server to main office network by Ethernet cable. If your router has a USB port, this USB port can provide power for the VPN server device. On your router s Advanced Routing Rule (or equivalent) section, add two static routes like below, a. To the branch office network, go via this VPN server device. b. To network /24, go via this VPN server device Note: /24 network is the virtual IP network used among VPN server & client device and any PC on-the-go. 4

5 !!!TIPs!!! VPN server use DHCP to get its IP address. It is highly recommended that you configure your DHCP server to reserve a fixed IP for VPN server. Otherwise, each time VPN server IP changes, you have to reconfigure the static route to branch office.!!!note!!! If have more than one branch office to connect, for each branch office network, you need to add one static route on your router to go via this VPN server. Branch Office Connect VPN client device to your branch office network by Ethernet cable. Again, if your router at branch office has a USB port, this USB port can provide power for this VPN client device. On your router s Advanced Routing Rule (or equivalent) section, add two static routes like below, a. To the branch office network, go via this VPN client device. b. To network /24, go via this VPN client device Note: /24 network is the virtual IP network used among VPN server & client device and any PC on-the-go.!!!tips!!! VPN client uses DHCP to get its IP address. It is highly recommended that you configure your DHCP server to reserve a fixed IP for VPN client device. Otherwise, each time VPN client IP changes, you have to reconfigure router to update the static route to main office.!!!note!!! If have more than one branch office connected to main office, for each network (other than this office), you need to add one static route on your router to go via this VPN client. 2. OpenVPN Device Configuration Overall, the configuration on device side is extremely simple. Do not over think. VPN Server Setting 1) Power down VPN Device and Take MicroSD Card out of VPN Device 5

6 Figure 1 Take MicroSD Card Out of Device 2) Put MicroSD Card in USB Reader and Plug It in PC Note: USB Reader is an optional accessory. It s not included in the shipment by default. Figure 2 MicroSD Card in USB Reader Plugged in PC Windows will automatically detect the MicroSD card (Figure 3). Figure 3 MicroSD Card Auto-detected by Windows 7!!!Note!!! Even if you are configuring VPN client device, the MicroSD card volume name is shown as VPNSERVER. Don t worry. 3) Click Open folder to view files 6

7 Figure 4 Files on VPNSERVER Drive!!!WARNING!!! Do NOT touch any files other than files in vpnconfig directory on MicroSD card. Otherwise, the device may not boot any more. 4) Go to Directory vpnconfig Figure 5 Files in vpnconfig directory Here we see a template file for VPN server configuration. Just double click it. The content is like below (Figure 6). 7

8 Figure 6 VPN Site-to-Site Server vpnconfig.template.txt 5) Make a copy of vpnconfig.templete.txt to vpnconfig.txt and create a few users (sites) The example below creates 2 branch offices (assume the main office network is / ). user=boston:vpneveryone: : / user=sanjose:vpneveryone: : / The configuration above assumes you have two branch office networks ( / and / ). Their OpenVPN client device will be assigned static IP and Note: /24 network is the virtual IP network reserved among VPN server & client device and any PC on-the-go. If your network happens to be /24, you will have to change your own network to something else. WARNING: By default, the traffic between VPN server and client devices are wrapped in HTTPS tunnel (TCP port 443). Your router is asked by VPN server device to automatically forward TCP port 443 to VPN sever device. In case that your router already use TCP port 443 for something else (e.g. your own website), you need to disable HTTPS wrap on VPN server device. Simply add one line below in your vpnconfig.txt file. 8

9 https_wrap=0 Tip: You can also fill in value in vpnconfig.template.txt and then SAVE AS vpnconfig.txt.!!!warning!!! In windows, the file postfix.txt may be hidden. Make sure that you don t add extra.txt in config filename. E.g. Do NOT end up with file as vpnconfig.txt.txt. 6) Make sure you safely remove USB reader. Click the triangle sign on left of flag sign at bottom right of your PC screen. Then click USB icon (Figure 7). Figure 7 Safely Remove USB MicroSD Reader Now click Eject Mass Storage Device. And then pull out USB reader from PC (Figure 8). Figure 8 Click on "Eject Mass Storage Device" 9

10 7) Put MicroSD card back in VPN server device and power up VPN server. You have successfully changed your Site-to-Site OpenVPN server setting. Brag about it! OpenVPN Client Device Setting Setting up your Site-to-Site OpenVPN client device is even simpler than setting up VPN server device. You only need to configure one username & passoword and the public IP of your VPN server. This difference is shown in the vpnconfig.template.txt file. Figure 9 VPN Client Configuration Template Note: Make sure the user/password matches the network. E.g. if this branch office network is / , you will have to use user=boston:vpneveryone (created on server side). WARNING: By default, the traffic between VPN server and client devices are wrapped in HTTPS tunnel (TCP port 443). If your VPN server side has disabled HTTPS tunnel, you have to disable HTTPS wrap on VPN client side. Simply add one line below in your vpnconfig.txt file. https_wrap=0. 10

11 Tip: All hardware devices shipped are the same. They are inter-changeable. The difference is on software in the MicroSD card. For questions, comments, supports or customization, please contact us by . 11

12 3. OpenVPN Server Road Warrior Access The OpenVPN site-to-site server also includes road warriror access for PC from anywhere in the internet. Simply add a few user=username:password:virtual-ip combination (Compared to user setting for client site, the network/mask part is skipped) in the vpnconfig.txt file. Below is an example that creates two user john and mike. They will be assigned static IP and user=john:vpneveryone: user=mike:password: Together, the whole mixed (pc and site user) vpnconfig.txt for OpenVPN server can be like below. user=boston:vpneveryone: : / user=sanjose:vpneveryone: : / user=john:vpneveryone: user=mike:password: IMPORTANT: You may have noticed that the PCs are using virtual IPs ( /24) different than any of your network ( or or ). So, for all routers (main office and branch offices), you need to add one more static route like this. To access network / , go via the VPN device 4. Configure OpenVPN Client on Windows PC Setup OpenVPN Client to Make VPN Tunnel to VPN Server The commercial of-the-shelf free OpenVPN client can be used to created tunnel to OpenVPN Server at main office. After you install OpenVPN client, follow the stepby-step procedure below. The overall process is simple: Download sample openvpn-home.ovpn from VPN server. Change the IP address on the last line. Import/save it in openvpn config directory. 1. Assume that your OpenVPN Server device gets From the same LAN, open a browser to access 12

13 2. Click Download Page Figure 10 OpenVPN Server Web Page Figure 11 OpenVPN Server Download Page 3. Right click openvpn-home.ovpn and save as. 13

14 Figure 12 Save openvpn-home.ovpn in OpenVPN config dirctory 4. In openvpn-home.ovpn file, if your real public IP is not automatically filled in, replace it with your real public IP of OpenVPN site-to-site server. Then you are done with OpenVPN configuration file. 5. From windows start menu, find OpenVPN GUI icon. Right click it and click Run as administrator. (Figure 13). 14

15 Figure 13 Run OpenVPN GUI as administrator 6. There will be an icon that looks like a lock at bottom right corner of screen. (Figure 14) Figure 14 OpenVPN Icon in Task Bar 7. Right click on this lock-like icon and click connect on the menu. You will be asked for user name and password. Use one of the users you created on VPN server, e.g. john. In a short moment, OpenVPN successfully creates VPN tunnel and assign the PC a virtual IP, e.g John PC will be able to access all 3 offices ( , and ) from anywhere using OpenVPN client. 8. For smart phone or tablet, please install the OpenVPN Connect free app. Then simply import the openvpn-home.ovpn file from step 4 to your OpenVPN Connect app and fill in username/password setup on VPN server side, e.g. john with password vpneveryone. 15