|
|
@@ -1,17 +1,86 @@
|
|
|
1
|
+Setting up OpenConnect VPN server
|
|
|
2
|
+=================================
|
|
|
3
|
+
|
|
1
|
4
|
The openconnect server expects to be configured using the uci interface.
|
|
2
|
5
|
|
|
3
|
6
|
It is recommended to setup a dynamic DNS address with openwrt prior
|
|
4
|
7
|
to starting the server. That is because during the first startup
|
|
5
|
8
|
a certificate file which contain the setup dynamic DNS name will be
|
|
6
|
|
-created.
|
|
|
9
|
+created. You can always regenerate the certificate by deleting
|
|
|
10
|
+/etc/ocserv/server-key.pem.
|
|
|
11
|
+
|
|
|
12
|
+There are two approaches to setup the VPN. The proxy-arp approach (1)
|
|
|
13
|
+which provides clients with addresses of the LAN, and the "forwarding"
|
|
|
14
|
+approach (2) which provides clients with addresses of a separate private
|
|
|
15
|
+network. The former is suitable when you have "roadwarrior" type of clients
|
|
|
16
|
+connecting to the LAN, and the latter when you may need to connect
|
|
|
17
|
+multiple networks with the LAN.
|
|
|
18
|
+
|
|
|
19
|
+
|
|
|
20
|
+1. Proxy-ARP Approach
|
|
|
21
|
+=====================
|
|
|
22
|
+
|
|
|
23
|
+[This option is available since ocserv-0.10.9-2 package]
|
|
|
24
|
+
|
|
|
25
|
+To setup a server the provides access to LAN with network address
|
|
|
26
|
+10.100.2.0/255.255.255.0 add the following to /etc/config/ocserv.
|
|
|
27
|
+The following setup will assign the upper 62 addresses for VPN use.
|
|
|
28
|
+
|
|
|
29
|
+```
|
|
|
30
|
+----/etc/config/ocserv-------------------------------------------
|
|
|
31
|
+config ocserv 'config'
|
|
|
32
|
+ option port '443'
|
|
|
33
|
+ option dpd '120'
|
|
|
34
|
+ option max_clients '8'
|
|
|
35
|
+ option max_same '2'
|
|
|
36
|
+ option netmask '255.255.255.192'
|
|
|
37
|
+ option ipaddr '10.100.2.192'
|
|
|
38
|
+ option auth 'plain'
|
|
|
39
|
+ option default_domain 'lan'
|
|
|
40
|
+ option compression '1'
|
|
|
41
|
+ option proxy_arp '1'
|
|
|
42
|
+ option ping_leases '1'
|
|
|
43
|
+ option enable '1'
|
|
|
44
|
+
|
|
|
45
|
+config dns
|
|
|
46
|
+ option ip '10.100.2.1'
|
|
|
47
|
+
|
|
|
48
|
+config routes
|
|
|
49
|
+ option ip '10.100.2.0'
|
|
|
50
|
+ option netmask '255.255.255.0'
|
|
|
51
|
+
|
|
|
52
|
+config ocservusers
|
|
|
53
|
+ option name 'test'
|
|
|
54
|
+ option password '$5$unl8uKAGNsdTh9zm$PnUHEGhDc5VHbFE2EfWwW38Bub6Y6EZ5hrFwZE1r2F1'
|
|
|
55
|
+
|
|
|
56
|
+-----------------------------------------------------------------
|
|
|
57
|
+```
|
|
|
58
|
+
|
|
|
59
|
+This setup re-utilizes the addresses assigned to LAN for the VPN clients.
|
|
|
60
|
+To ensure that there are no conflicts with the DHCP server use the following
|
|
|
61
|
+commands. These will set the maximum address assigned by DHCP to be 10.100.2.191
|
|
|
62
|
+which is below the first VPN assigned address (10.100.2.192).
|
|
|
63
|
+
|
|
|
64
|
+```
|
|
|
65
|
+# uci set dhcp.lan.start=100
|
|
|
66
|
+# uci set dhcp.lan.limit=91
|
|
|
67
|
+```
|
|
|
68
|
+
|
|
|
69
|
+For simple networks like that you may also leave the 'netmask' and 'ipaddr'
|
|
|
70
|
+fields empty and ocserv on startup will set the necessary values.
|
|
|
71
|
+
|
|
|
72
|
+
|
|
|
73
|
+2. Forwarding Approach
|
|
|
74
|
+======================
|
|
7
|
75
|
|
|
8
|
76
|
To setup a server the provides access to LAN with network address
|
|
9
|
77
|
10.100.2.0/255.255.255.0 using the VPN address range
|
|
10
|
78
|
10.100.3.0/255.255.255.0 add the following to /etc/config/ocserv:
|
|
11
|
79
|
|
|
|
80
|
+```
|
|
12
|
81
|
----/etc/config/ocserv-------------------------------------------
|
|
13
|
82
|
config ocserv 'config'
|
|
14
|
|
- option port '4443'
|
|
|
83
|
+ option port '443'
|
|
15
|
84
|
option dpd '120'
|
|
16
|
85
|
option max_clients '8'
|
|
17
|
86
|
option max_same '2'
|
|
|
@@ -34,19 +103,21 @@ config ocservusers
|
|
34
|
103
|
option password '$5$unl8uKAGNsdTh9zm$PnUHEGhDc5VHbFE2EfWwW38Bub6Y6EZ5hrFwZE1r2F1'
|
|
35
|
104
|
|
|
36
|
105
|
-----------------------------------------------------------------
|
|
|
106
|
+```
|
|
37
|
107
|
|
|
38
|
|
-This configuration also adds the user "test" with password "test". The
|
|
39
|
|
-password is specified in the crypt(3) format.
|
|
40
|
108
|
|
|
41
|
|
-The server can be enabled and started using:
|
|
42
|
|
-# /etc/init.d/ocserv enable
|
|
43
|
|
-# /etc/init.d/ocserv start
|
|
|
109
|
+Setting up the firewall
|
|
|
110
|
+=======================
|
|
44
|
111
|
|
|
|
112
|
+Since the connected users will be assigned to other interfaces than the LAN
|
|
|
113
|
+one, it is required to assign the VPN clients to an interface, and enable
|
|
|
114
|
+forwarding for them. That is, you should setup an unmanaged interface (e.g.,
|
|
|
115
|
+called vpn), which will have assigned the 'vpns+' interfaces (i.e., all vpns
|
|
|
116
|
+interfaces). Then a zone called vpn should be setup to handle interactions
|
|
|
117
|
+with lan. An example, which alls all forwarding between LAN and VPN clients,
|
|
|
118
|
+follows.
|
|
45
|
119
|
|
|
46
|
|
-To simplify firewall configuration, you should setup an unmanaged interface
|
|
47
|
|
-(e.g., called vpn), and will have assigned the 'vpns+' interfaces. Then a zone
|
|
48
|
|
-called vpn should be setup to handle interactions with lan. An example
|
|
49
|
|
-follows:
|
|
|
120
|
+```
|
|
50
|
121
|
----/etc/config/network------------------------------------------
|
|
51
|
122
|
config interface 'vpn'
|
|
52
|
123
|
option proto 'none'
|
|
|
@@ -74,17 +145,35 @@ config rule
|
|
74
|
145
|
option target 'ACCEPT'
|
|
75
|
146
|
option src 'wan'
|
|
76
|
147
|
option proto 'tcp'
|
|
77
|
|
- option dest_port '4443'
|
|
|
148
|
+ option dest_port '443'
|
|
78
|
149
|
option name 'vpn'
|
|
79
|
150
|
|
|
80
|
151
|
config rule
|
|
81
|
152
|
option target 'ACCEPT'
|
|
82
|
153
|
option src 'wan'
|
|
83
|
154
|
option proto 'udp'
|
|
84
|
|
- option dest_port '4443'
|
|
|
155
|
+ option dest_port '443'
|
|
85
|
156
|
option name 'vpn'
|
|
86
|
157
|
-----------------------------------------------------------------
|
|
|
158
|
+```
|
|
|
159
|
+
|
|
|
160
|
+Note, that the last two rules, enable connections to port 443 from the
|
|
|
161
|
+Internet. That is the port used by OpenConnect VPN.
|
|
|
162
|
+
|
|
|
163
|
+
|
|
|
164
|
+Starting the server
|
|
|
165
|
+===================
|
|
|
166
|
+
|
|
|
167
|
+Note that both configurations above add the user "test" with password "test". The
|
|
|
168
|
+password is specified in the crypt(3) format.
|
|
|
169
|
+
|
|
|
170
|
+The server can be enabled and started using:
|
|
|
171
|
+# /etc/init.d/ocserv enable
|
|
|
172
|
+# /etc/init.d/ocserv start
|
|
87
|
173
|
|
|
|
174
|
+For any custom configuration options of ocserv you may add values in
|
|
|
175
|
+/etc/ocserv/ocserv.conf.local.
|
|
88
|
176
|
|
|
89
|
177
|
There is a luci plugin to allow configuring the server from
|
|
90
|
178
|
the web environment; see the package luci-app-ocserv.
|
|
|
179
|
+
|
Nikos Mavrogiannopoulos
9 years ago