1 # OpenVPN Layer 2 Server
5 Librecmc can operate as an OpenVPN server. OpenVPN technology connects
6 two networks via an encrypted tunnel. With proper server, network, and
7 client configuration, OpenVPN allows a client outside of your LAN to
8 see the LAN as though it were physically connected to the LAN.
10 OpenVPN can run in layer 2 or layer 3 mode. In layer 3 mode, the
11 remote client sees your LAN as though it is on the other side of an IP
12 router. In layer 2 mode, the remote client sees your LAN as though
13 they are both on the same Data Link segment (e.g., the same Ethernet
14 link). Layer 3 mode is easier to set up, but layer 2 mode is sometimes
15 desired to give clients a more direct exposure to services on the LAN.
19 This information is provided for educational purposes only and is not
20 meant to be a guide to best network security practices. Readers are
21 advised to study all relevant OpenVPN and network security
24 ## Required LibreCMC packages
34 ## Certificate and Key Setup Instructions
42 build-key-server myvpn
43 openvpn --genkey --secret /etc/easy-rsa/keys/ta.key
46 N.B.: Using easy-rsa is a straightforward approach, but it may be
47 possible to produce more secure certificates using openssl directly.
49 ## Server configuration
51 For the `server bridge` option: The first two parameters are the ip
52 and netmask of the gateway on the bridged subnet. The next two
53 parameters indicate the pool-start-IP and pool-end-IP, which is the
54 part of your IP address pool that you have reserved just for VPN
55 clients. You must to make sure that the DHCP server for your LAN is
56 not leasing out those IP addresses to local (non-vpn) clients.
60 config openvpn 'myvpn'
65 option status '/var/log/openvpn_status.log'
66 option log '/tmp/openvpn.log'
69 option keepalive '10 120'
70 option persist_key '1'
71 option persist_tun '1'
73 option group 'nogroup'
74 option ca '/etc/easy-rsa/keys/ca.crt'
75 option cert '/etc/easy-rsa/keys/myvpn.crt'
76 option key '/etc/easy-rsa/keys/myvpn.key'
77 option dh '/etc/easy-rsa/keys/dh2048.pem'
79 option tls_auth '/etc/easy-rsa/keys/ta.key 0'
80 option server_bridge '10.0.0.1 255.255.255.0 10.0.0.201 10.0.0.220'
81 option topology 'subnet'
82 option client_to_client '1'
83 list push 'persist-key'
84 list push 'persist-tun'
85 list push 'redirect-gateway def1'
86 # allow your clients to access to your network
87 list push 'route 10.0.0.0 255.255.255.0'
88 # push DNS to your clients
89 list push 'dhcp-option DNS 10.0.0.1'
90 # option comp_lzo 'no'
93 ## Client setup information