README 5.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198
  1. Setting up OpenConnect VPN server
  2. =================================
  3. The openconnect server expects to be configured using the uci interface.
  4. It is recommended to setup a dynamic DNS address with openwrt prior
  5. to starting the server. That is because during the first startup
  6. a certificate file which will contain the dynamic DNS name will be
  7. created. You can always regenerate the certificate by deleting
  8. /etc/ocserv/server-key.pem.
  9. There are two approaches to setup the VPN. The proxy-arp approach (1)
  10. which provides clients with addresses of the LAN, and the "forwarding"
  11. approach (2) which provides clients with addresses of a separate private
  12. network. The former is suitable when you have "roadwarrior" type of clients
  13. connecting to the LAN, and the latter when you may need to connect
  14. multiple networks with the LAN.
  15. If for the client side you use OpenWRT it is recommended to check you
  16. have the latest vpnc-scripts and openconnect packages.
  17. 1. Proxy-ARP Approach
  18. =====================
  19. [This option is available since ocserv-0.10.9-2 package]
  20. To setup a server the provides access to LAN with network address
  21. 10.100.2.0/255.255.255.0 add the following to /etc/config/ocserv.
  22. The following setup will assign the upper 62 addresses for VPN use.
  23. ```
  24. ----/etc/config/ocserv-------------------------------------------
  25. config ocserv 'config'
  26. option port '443'
  27. option dpd '120'
  28. option max_clients '8'
  29. option max_same '2'
  30. option netmask '255.255.255.192'
  31. option ipaddr '10.100.2.192'
  32. option auth 'plain'
  33. option default_domain 'lan'
  34. option compression '1'
  35. option proxy_arp '1'
  36. option ping_leases '1'
  37. option enable '1'
  38. config dns
  39. option ip '10.100.2.1'
  40. config routes
  41. option ip '10.100.2.0'
  42. option netmask '255.255.255.0'
  43. config ocservusers
  44. option name 'test'
  45. option password '$5$unl8uKAGNsdTh9zm$PnUHEGhDc5VHbFE2EfWwW38Bub6Y6EZ5hrFwZE1r2F1'
  46. -----------------------------------------------------------------
  47. ```
  48. This setup re-utilizes the addresses assigned to LAN for the VPN clients.
  49. To ensure that there are no conflicts with the DHCP server use the following
  50. commands. These will set the maximum address assigned by DHCP to be 10.100.2.191
  51. which is below the first VPN assigned address (10.100.2.192).
  52. ```
  53. # uci set dhcp.lan.start=100
  54. # uci set dhcp.lan.limit=91
  55. ```
  56. For simple networks like that you may also leave the 'netmask' and 'ipaddr'
  57. fields empty and ocserv on startup will set the necessary values.
  58. 2. Forwarding Approach
  59. ======================
  60. To setup a server the provides access to LAN with network address
  61. 10.100.2.0/255.255.255.0 using the VPN address range
  62. 10.100.3.0/255.255.255.0 add the following to /etc/config/ocserv:
  63. ```
  64. ----/etc/config/ocserv-------------------------------------------
  65. config ocserv 'config'
  66. option port '443'
  67. option dpd '120'
  68. option max_clients '8'
  69. option max_same '2'
  70. option netmask '255.255.255.0'
  71. option ipaddr '10.100.3.0'
  72. option auth 'plain'
  73. option default_domain 'lan'
  74. option compression '1'
  75. option enable '1'
  76. config dns
  77. option ip '10.100.2.1'
  78. config routes
  79. option ip '10.100.2.0'
  80. option netmask '255.255.255.0'
  81. config ocservusers
  82. option name 'test'
  83. option password '$5$unl8uKAGNsdTh9zm$PnUHEGhDc5VHbFE2EfWwW38Bub6Y6EZ5hrFwZE1r2F1'
  84. -----------------------------------------------------------------
  85. ```
  86. Setting up split-dns
  87. ====================
  88. To allow the clients to resolv with the local domain add the following
  89. to the ocserv configuration file.
  90. ```
  91. ----/etc/config/ocserv-------------------------------------------
  92. config ocserv 'config'
  93. option split_dns '1'
  94. option default_domain 'mydomain'
  95. ```
  96. The ```default_domain``` is optional and if not set, it will be autodetected
  97. from dnsmasq's configuration.
  98. Setting up the firewall
  99. =======================
  100. Since the connected users will be assigned to other interfaces than the LAN
  101. one, it is required to assign the VPN clients to an interface, and enable
  102. forwarding for them. That is, you should setup an unmanaged interface (e.g.,
  103. called vpn), which will have assigned the 'vpns+' interfaces (i.e., all vpns
  104. interfaces). Then a zone called vpn should be setup to handle interactions
  105. with lan. An example, which alls all forwarding between LAN and VPN clients,
  106. follows.
  107. ```
  108. ----/etc/config/network------------------------------------------
  109. config interface 'vpn'
  110. option proto 'none'
  111. option ifname 'vpns+'
  112. -----------------------------------------------------------------
  113. ----/etc/config/firewall-----------------------------------------
  114. config zone
  115. option input 'ACCEPT'
  116. option forward 'ACCEPT'
  117. option output 'ACCEPT'
  118. option name 'vpn'
  119. option device 'vpns+'
  120. option network 'vpn'
  121. config forwarding
  122. option dest 'lan'
  123. option src 'vpn'
  124. config forwarding
  125. option dest 'vpn'
  126. option src 'lan'
  127. config rule
  128. option target 'ACCEPT'
  129. option src 'wan'
  130. option proto 'tcp'
  131. option dest_port '443'
  132. option name 'vpn'
  133. config rule
  134. option target 'ACCEPT'
  135. option src 'wan'
  136. option proto 'udp'
  137. option dest_port '443'
  138. option name 'vpn'
  139. -----------------------------------------------------------------
  140. ```
  141. Note, that the last two rules, enable connections to port 443 from the
  142. Internet. That is the port used by OpenConnect VPN.
  143. Starting the server
  144. ===================
  145. Note that both configurations above add the user "test" with password "test". The
  146. password is specified in the crypt(3) format.
  147. The server can be enabled and started using:
  148. # /etc/init.d/ocserv enable
  149. # /etc/init.d/ocserv start
  150. For any custom configuration options of ocserv you may add values in
  151. /etc/ocserv/ocserv.conf.local.
  152. There is a luci plugin to allow configuring the server from
  153. the web environment; see the package luci-app-ocserv.