Gentoo/OpenVPN Server
Page last edited 4,060 days ago
From Alon Bar-Lev's Site
< Gentoo
Jump to navigation
Jump to search
OpenVPN Server
net-misc/openvpn network Configuration:
Internet <---> Router <---> (eth0, 192.168.253.253/24)Gateway(eth1, 10.10.50.253/21) <---> Internet Network (10.10.48.0/21)
Minimal server, with simple hardening.
This page is provided as OEM, a complete setup.
Installation
Linux Kernel Configuration: Add tap |
Device Drivers ---> [*] Network device support ---> <M> Universal TUN/TAP device driver support |
File: /etc/portage/make.conf
CFLAGS="-O2 -pipe -mtune=native -fomit-frame-pointer -pipe" CXXFLAGS="${CFLAGS}" MAKEOPTS="-j4" CHOST="x86_64-pc-linux-gnu" PORTDIR="/var/gentoo/portage" DISTDIR="/var/gentoo/distfiles" PKGDIR="/var/gentoo/packages" PORTAGE_GPG_DIR="/etc/portage/gnupg" FEATURES="webrsync-gpg parallel-fetch userfetch userpriv usersandbox" ACCEPT_LICENSE="-* @FSF-APPROVED @FSF-APPROVED-OTHER freedist" USE="${USE} mmx sse sse2 sse3 caps fam" USE="${USE} logrotate" USE="${USE} -gnome -qt3 -X" USE="${USE} -ruby -perl -fortran -python -lua -java" USE="${USE} -berkdb -gdbm -hal"
Note: Refer to Gentoo/Secured_Portage_Sync for sync setup
File: /etc/portage/package.license/base.conf
sys-devel/flex FLEX app-arch/bzip2 BZIP2 sys-libs/cracklib CRACKLIB sys-process/lsof lsof dev-perl/Crypt-PasswdMD5 BEER-WARE sys-apps/debianutils SMAIL sys-apps/tcp-wrappers tcp_wrappers_license sys-apps/man-pages-posix man-pages-posix
File: /etc/portage/package.use/openvpn.conf
net-misc/openvpn iproute2
Modify:
File: /etc/rc.conf
rc_hotplug="*"
File: /var/lib/portage/world
app-admin/logrotate app-admin/syslog-ng app-arch/tarsync app-crypt/gnupg app-editors/vim app-portage/gentoolkit net-dns/openresolv net-misc/dhcpcd net-misc/ntp sys-apps/ifplugd sys-kernel/genkernel sys-kernel/gentoo-sources sys-process/vixie-cron
emerge net-misc/openvpn
Firehol installation see Gentoo/Firewall_Using_Firehol.
Cryptographic configuration
TODO
Network Configuration
File: /etc/firehol/firehol.conf
version 5 interface eth0 internal policy reject protection strong 10/sec 10 server ident reject with tcp-reset server all drop dst "10.10.50.255" server all drop dst "255.255.255.255" client all drop dst "228.67.43.91" #rtsp something server all drop dst "228.67.43.91" #rtsp something client all drop dst "224.0.0.1" #igmp something server all drop dst "224.0.0.1" #igmp something server netbios_dgm drop server netbios_ns drop server time drop server ssh accept server snmp accept client ssh accept client dns accept client ntp accept client http accept client https accept interface eth1 external policy reject protection strong 10/sec 10 server ident reject with tcp-reset server netbios_dgm drop server netbios_ns drop server time drop server https accept client http accept client https accept client smtp accept interface vpn0 vpn policy reject protection strong 10/sec 10 server ident reject with tcp-reset server ssh accept router vpn_nat inface eth0 outface vpn0 route ident reject with tcp-reset server ident reject with tcp-reset masquerade reverse client all accept
File: /etc/conf.d/net
dns_domain="mydomain.com" dns_search="mydomain.com" rc_net_eth0_need="firewall" config_eth0="10.10.50.253/21" dns_servers_eth0="10.10.50.2 10.10.50.39" rc_net_eth1_need="firewall" config_eth1="192.168.253.253/24" routes_eth1="default via 192.168.253.254" rc_net_vpn0_need="firewall" rc_net_vpn0_provide="!net" tuntap_vpn0="tun" config_vpn0="null" txqueuelen_vpn0="100" metric_vpn0="1"
ln -s net.lo /etc/init.d/net.vpn0
OpenVPN Configuration
ln -s openvpn /etc/init.d/openvpn.vpn0
File: /etc/conf.d/openvpn.vpn0
rc_need="net.vpn0 net.eth1"
Add:
File: /etc/openvpn/vpn0.conf
dev vpn0 dev-type tun user nobody group nobody persist-key persist-tun
Example:
File: /etc/openvpn/vpn0.conf
dev vpn0 dev-type tun proto tcp-server tls-cipher DHE-RSA-AES256-SHA cipher AES-256-CBC server 192.168.252.0 255.255.255.0 local 192.168.253.253 lport 443 comp-lzo user nobody group nobody persist-key persist-tun chroot /var/openvpn keepalive 60 120 ca ca.crt cert server.crt key server.key dh dh4096.pem crl-verify /crl.pem # after chroot push "route 10.10.48.0 255.255.248.0" push "dhcp-option DOMAIN mydomain.com" push "dhcp-option DNS 10.10.50.2" push "dhcp-option DNS 10.10.50.39"
Note: As OpenVPN runs under nobody, it cannot clear the vpn0 interface when it goes down, /etc/init.d/net.vpn0 restart is required
Maintainer
Authors
Originally written by: Alon Bar-Lev - 2011-11-16
Authors are people who have worked on this document and have made significant changes to its content. If you have edited this article and wish to add yourself to the authors list please read "Who are Authors".