Oct 032013
 October 3, 2013  Posted by at 4:15 pm documentation, vpn Tagged with: , , ,  Add comments

This outlines a typical VPN implementation with server, clients and routing. Using Attitude Adjustment 12.09. Although, this should work on any new version of OpenWRT. Last tested on version 17.

Start by ssh’ing into the router.

root@myWRT:~# opkg update
root@myWRT:~# opkg install openvpn-openssl openvpn-easy-rsa

Create a “openvpnconfig” directory under config and move the easy-rsa directory into it. The nice thing about this setup is that backups will include all openvpn relevant files automatically, because they are under /etc/config/

root@myWRT:~# mkdir /etc/config/openvpnconfig
root@myWRT:~# mv /etc/easy-rsa/ /etc/config/openvpnconfig/
root@myWRT:~# cd /etc
root@myWRT:~# ln -s config/openvpnconfig/easy-rsa
(this creates a relative symlink)

edit the following or don’t if you want to enter it manually on certificate creation.
At the end of the /etc/easy-rsa/vars file:

# These are the default values for fields
# which will be placed in the certificate.
# Don't leave any of these fields blank.
export KEY_COUNTRY="US" <-*edit*
export KEY_PROVINCE="CA" <-*edit*
export KEY_CITY="SanFrancisco" <-*edit*
export KEY_ORG="Fort-Funston" <-*edit*
export KEY_EMAIL="me@myhost.mydomain"
export KEY_EMAIL=mail@host.domain
export KEY_CN=changeme <-*edit - servers hostname*
export KEY_NAME=changeme
export KEY_OU=changeme
export PKCS11_MODULE_PATH=changeme
export PKCS11_PIN=1234

root@myWRT:~# clean-all (run this to ensure your starting with a clean slate)
root@myWRT:~# build-ca
root@myWRT:~# build-dh (very slow.. this can be run elsewhere and copied to the openwrt)
root@myWRT:~# build-key-server servername_server (don’t set a challenge password, Answer yes to sign the certificate and yes to commit.)

Moving on to the config files.

Instead of using UCI syntax we can break this out to be more openvpn standard and troubleshooting friendly. Also, I have added the ability to set static ip’s for the openvpn clients.

Overwrite /etc/config/openvpn with the following config

package openvpn
config openvpn openvpn_WRT
option enabled 1
option config /etc/config/openvpnconfig/openvpnWRT.conf

The following is the openvpn server config (which is called by /etc/config/openvpn) in /etc/config/openvpnconfig/openvpnWRT.conf

port 1194                                                                                                                                        
proto udp                                                                                                                                        
dev tun                                                                                                                                          
comp-lzo yes                                                                                                                                     
dh   easy-rsa/keys/dh2048.pem                                                                                                                    
ca   easy-rsa/keys/ca.crt                                                                                                                        
key  easy-rsa/keys/server.key                                                                                                                    
cert easy-rsa/keys/server.crt                                                                                                                    
#crl-verify /etc/config/openvpnconfig/easy-rsa/keys/crl.pem                                                                                      
ifconfig-pool-persist /tmp/ipp.txt                                                                                                               
client-config-dir clients                                                                                                                        
status /var/log/openvpn-status.log                                                                                                               
##Don't enable unless you disable all static ip options below#                                                                                   
#server []                                                                                                               
##begin VPN options for static ip mode (mode server)##                                                                                           
mode server                                                                                                                                      
topology subnet                                                                                                                                  
push "topology subnet"                                                                                                                           
push "route-gateway"                                                                                                                  
##end VPN options for static ip##                                                                                                                
##general LAN options##                                                                                                                          
push "route"                                                                                                            
push "dhcp-option DOMAIN lan.local"                                                                                                              
push "dhcp-option DNS"                                                                                                                
mute 5                                                                                                                                           
log /tmp/openvpn.log                                                                                                                             
verb 5                                                                                                                                           
keepalive 10 120                                                                                                                                 

If you want to enable the static client ip assignments, be sure to uncomment the client-config-dir above and make a directory as such.
root@myWRT:~# mkdir /etc/config/openvpnconfig/clients
write a file inside the clients directory with the same name as the “common name” of the openvpn client certificate.
For example, in a file /etc/config/openvpnconfig/clients/jason
root@myWRT:~# ifconfig-push
This will reserve for user jason.

Enable and start the service:
root@myWRT:~# /etc/init.d/openvpn enable
root@myWRT:~# /etc/init.d/openvpn restart

root@myWRT:~# cd /etc/config/openvpnconfig/
root@myWRT:~# openvpn --config openvpnWRT.conf
check for errors
root@myWRT:~# cat /tmp/openvpn.log

Check for errors in the openvpn config syntax using uci show
root@myWRT:~# uci show openvpn
The following will be displayed if there are no syntax issues. Use of the quotes are common mistakes.


Now lets setup the tun interface so that we can add zones
in /etc/config/network or in LuCI.

config interface 'vpn0'
	option proto 'none'
	option ifname 'tun0'



Create a zone called openvpn_zone with vpn0 network.

in /etc/config/firewall

config zone
	option input 'ACCEPT'
	option output 'ACCEPT'
	option name 'openvpn_zone'
	option network 'vpn0'
	option forward 'REJECT'


We now explicitly declare the forwards like this.
openvpn_zone to lan zone allow

config forwarding
	option dest 'lan'
	option src 'openvpn_zone'

openvpn_zone to wan allow, if you want openvpn clients to use the wan for example if using redirect-gateway

config forwarding
	option dest 'wan'
	option src 'openvpn_zone'

openvpn_zone to lan allow

config forwarding
	option dest 'openvpn_zone'
	option src 'lan'



Allow the openvpn server to accept connections from clients out in the world.

config rule
	option target 'ACCEPT'
	option src 'wan'
	option proto 'udp'
	option dest_port '1194'
	option name 'openvpn2device'
	option enabled '0'

An overview of traffic rules







** NOTE: Occasionally, I have had to reboot for the above zone’s to work **

== Optional firewall rules to use, instead of using the zones. Not recommended ==
in /etc/firewall.user

# This file is interpreted as shell script.
# Put your custom iptables rules here, they will
# be executed with each firewall (re-)start.

# Allow all traffic in and out of the tun interface.
iptables -A input_rule      -i tun+ -j ACCEPT
iptables -A output_rule     -o tun+ -j ACCEPT
# This rule will allow traffic towards internet from tun
iptables -A forwarding_rule -i tun+ -j ACCEPT
iptables -A forwarding_rule -o tun+ -j ACCEPT


root@myWRT:~# build-key jason
or you can run build-key-pass to issue a key that asks the user to enter the password before it is used (more secure).
Once you have completed the build-key, being sure to answer yes to signing the certificate and commit.

Now you need to get the keys for jason and the ca.crt (not ca.key!). Each client needs these files to connect.
You can secure copy them to your computer similar to this:
root@myWRT:~# scp /etc/config/openvpnconfig/easy-rsa/keys/jason.* you@[your computer]:jason-vpn
root@myWRT:~# scp /etc/easy-rsa/keys/ca.crt you@[your computer]:jason-vpn
Then create the client config in the same directory as the crt’s and keys. Call it jason.ovpn and place it in our jason-vpn directory. This is what you will populate jason.ovpn with:

cipher AES-256-CBC
dev tun
remote [your-server-name] 1194 udp
ca ca.crt
cert jason.crt
key jason.key
remote-cert-tls server
mute 5
resolv-retry infinite
keepalive 10 60
#redirect-gateway def1

I have a script to help auto generate the above client config http://jasonschaefer.com/stuff/easyrsa-user-setup-openwrt.sh.txt

Test the server by connecting from off-site.
cd into your local config directory where your certs, keys and .ovpn config are.
sudo openvpn jason.ovpn
enter your sudo password

You should see something like this at the end of the openvpn output:

Fri Feb 28 22:19:01 2014 /sbin/ifconfig tun0 netmask mtu 1500 broadcast
Fri Feb 28 22:19:01 2014 /sbin/route add -net netmask gw
Fri Feb 28 22:19:01 2014 Initialization Sequence Completed

and you will see a newly built tun interface

# ip a
38: tun0: mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 100
inet brd scope global tun0
valid_lft forever preferred_lft forever

and the correct route has been pushed to you
root@myWRT:~# ip r via dev tun0


uncomment the following line in /etc/config/openvpnconfig/openvpnWRT.conf:
crl-verify /etc/config/openvpnconfig/easy-rsa/keys/crl.pem

run “revoke-full” with users key as argument:

revoke-full [key-to-revoke]

or run my script easyrsa-user-setup-openwrt.sh [username] revoke

then restart the vpn service so changed take effect:
root@myWRT:~# /etc/init.d/openvpn restart

Let me know in the comments or use the contact form if you find errors or need clarification. This is a concise tutorial with lots of room for confusion.

 Leave a Reply

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>