{"id":143,"date":"2015-09-27T19:15:14","date_gmt":"2015-09-27T19:15:14","guid":{"rendered":"https:\/\/carson.fenimorefamily.com\/?p=143"},"modified":"2016-01-01T17:30:56","modified_gmt":"2016-01-01T17:30:56","slug":"key-based-openvpn-for-osxlinuxqnap-howto","status":"publish","type":"post","link":"https:\/\/carson.fenimorefamily.com\/?p=143","title":{"rendered":"Key-based OpenVPN for OSX\/Linux\/QNAP Howto"},"content":{"rendered":"<p>I&#8217;ve had excellent luck setting up\u00a0a key-based authentication VPN for my home network, which is distributed across the country and consists of Linux, Mac (OS X), and QNAP nodes. \u00a0What, you ask, does &#8220;key-based authentication&#8221; refer to? \u00a0It means that I do not allow people to enter passwords. \u00a0Instead, clients must possess the proper key, which is exchanged automatically by openvpn. \u00a0 I think key-based authentication can be more secure in some cases, however I mainly wanted to do it &#8220;just because.&#8221;<\/p>\n<p>Generally speaking the\u00a0<a href=\"https:\/\/openvpn.net\/index.php\/open-source\/documentation\/howto.html\">OpenVPN HOWTO<\/a> is excellent and\u00a0should suffice\u00a0for setting up your VPN. \u00a0Ill briefly parrot this guide here. \u00a0To set things up you:<\/p>\n<ul>\n<li>Pick a vpn network. \u00a0E.g. something that won&#8217;t conflict with any of the LAN networks of the nodes on your distributed network. \u00a0For example, one of my nodes sits on a 192.168.x.x\/16 network, another sits on a 10.246.75.x\/24 network, etc. \u00a0Pretty much anything, other than 10.246.75.x\/24, from the 10.x.x.x\/8 space can be used.<\/li>\n<li>Generate keys:\n<ul>\n<li>From \/etc\/openvpn\/easy-rsa run . .\/vars<\/li>\n<li>.\/clean-all<\/li>\n<li>.\/build-ca \u00a0&#8211; basically accept everything as is, but remember the common-name for the server (as &lt;servername&gt;)<\/li>\n<li>.\/build-key-server &lt;servername&gt;<\/li>\n<li>For each of my clients (i have 5 or 6): .\/build-key &lt;clientName&gt;<\/li>\n<li>Build the diffie-hellman stuff: .\/build-dh<\/li>\n<\/ul>\n<\/li>\n<li>I chose to enable client-client communication, so I added the following in my server config:\n<ul>\n<li>client-to-client (to let clients talk to eachother)<\/li>\n<li><span style=\"line-height: 1.5;\">push &#8220;redirect-gateway def1&#8221; (to redirect all traffic through my vpn)<\/span><\/li>\n<li>client-config-dir \/etc\/openvpn\/clients \u00a0(to let me specify static ips for all my clients). \u00a0For each client (identified by the common name, during the setup above, I create a like-named file with a single line like this:\n<ul>\n<li>ifconfig-push 10.9.1.22 10.9.1.23 (meaning this client will be accessible within the vpn via the\u00a010.9.1.22 address)<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>On each client I scp&#8217;d over the ca, crt, key files, and made up a quick config script (based on the sample provided with openvpn). \u00a0I really only changed the following lines:<\/p>\n<ul>\n<li>remote &lt;hostname&gt; &lt;port&gt; (this line has the hostname\/port of your server)<\/li>\n<li>ca \/abs\/path\/to\/vpn\/directory\/ca.crt<\/li>\n<li>cert\u00a0\/abs\/path\/to\/vpn\/directory\/fenimac.crt<\/li>\n<li>key \/abs\/path\/to\/vpn\/directory\/fenimac.key<\/li>\n<\/ul>\n<p>With that both the server and client should connect; all connected clients should have statically-assigned ips, and they should be able to talk to eachother.<\/p>\n<p>What makes this a bit tricky is QNAP. \u00a0They only provide password-based authentication. \u00a0Thankfully you can just make a crontab to create the vpn connection, if its not up. \u00a0I made a script that looks something like:<\/p>\n<pre class=\"brush: bash; title: ; notranslate\" title=\"\">\r\nVPNLOG=\/mnt\/HDA_ROOT\/vpndir\/vpn.log\r\nif [[ `ps ax | grep openvpn | grep vpndir | grep -v grep` ]]; then\r\n    echo &quot;`date` Already running&quot; | tee -a $VPNLOG\r\n    ping -c 1 &amp;lt;server'sVPNIp&amp;gt;\r\n    PINGRET=$?\r\n    if [[ &quot;0&quot; = &quot;$PINGRET&quot; ]]; then\r\n        echo &quot;`date` Link is good!&quot; | tee -a $VPNLOG\r\n        exit 0\r\n    else\r\n        echo &quot;`date` Link is down (ping gave $PINGRET) - killing current vpn&quot; | tee -a $VPNLOG\r\n        ps ax | grep vpndir | tr -s &quot; &quot; | cut -f 1 -d ' ' | xargs kill -9\r\n    fi\r\nfi\r\necho &quot;`date` Run this thing!&quot; | tee -a $VPNLOG\r\n\/usr\/sbin\/openvpn  --config \/mnt\/HDA_ROOT\/vpndir\/qnap.conf | tee -a $VPNLOG\r\n<\/pre>\n<p>A few important notes:<\/p>\n<ul>\n<li>I run this script on the QNAP every couple minutes in a crontab. \u00a0Just editing crontab (&#8220;crontab -e&#8221;) doesn&#8217;t do the trick &#8211; qnap wipes those entries away upon reboot. To make this work, even across reboots, I followed a guide i found somewhere on the internet. \u00a0Basically you do the following:\n<pre>1. Edit \/etc\/config\/crontab and add your custom entry.\r\n2. Run 'crontab \/etc\/config\/crontab' to load the changes.\r\n3. Restart cron, i.e. '\/etc\/init.d\/crond.sh restart'<\/pre>\n<\/li>\n<li>I couldn&#8217;t get the vpn to stay up unless I turned on the vpn server inside the qnap. \u00a0It wasn&#8217;t my favorite thing to just leave that on, but for now im ok with it.<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>I&#8217;ve had excellent luck setting up\u00a0a key-based authentication VPN for my home network, which is distributed across the country and consists of Linux, Mac (OS X), and QNAP nodes. \u00a0What, you ask, does &#8220;key-based authentication&#8221; refer to? \u00a0It means that I do not allow people to enter passwords. \u00a0Instead, clients must possess the proper key, &hellip; <a href=\"https:\/\/carson.fenimorefamily.com\/?p=143\" class=\"more-link\">Continue reading <span class=\"screen-reader-text\">Key-based OpenVPN for OSX\/Linux\/QNAP Howto<\/span> <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[],"class_list":["post-143","post","type-post","status-publish","format-standard","hentry","category-encryption"],"_links":{"self":[{"href":"https:\/\/carson.fenimorefamily.com\/index.php?rest_route=\/wp\/v2\/posts\/143","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/carson.fenimorefamily.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/carson.fenimorefamily.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/carson.fenimorefamily.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/carson.fenimorefamily.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=143"}],"version-history":[{"count":4,"href":"https:\/\/carson.fenimorefamily.com\/index.php?rest_route=\/wp\/v2\/posts\/143\/revisions"}],"predecessor-version":[{"id":171,"href":"https:\/\/carson.fenimorefamily.com\/index.php?rest_route=\/wp\/v2\/posts\/143\/revisions\/171"}],"wp:attachment":[{"href":"https:\/\/carson.fenimorefamily.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=143"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/carson.fenimorefamily.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=143"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/carson.fenimorefamily.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=143"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}