Openvpn - Revision history

WFilter: /* User&Pass Clients */

2023-06-30T09:19:45Z

‎User&Pass Clients

2020-06-11T02:42:50Z

‎OpenVPN Client

2019-07-09T12:19:09Z

‎Server Settings

2019-07-09T12:05:15Z

‎Server Settings

2019-05-17T05:37:09Z

‎Client Subnets

2018-10-31T08:43:09Z

‎Server Settings

2018-10-29T10:38:21Z

‎Firewall Rules

2018-10-29T10:37:58Z

‎Firewall Rules

2018-10-29T10:36:41Z

‎Windows Clients

2018-10-25T06:26:23Z

@@ Line 80: / Line 80: @@
 verb 3
 auth-user-pass              #auth by username
 </pre>

← Older revision		Revision as of 02:42, 11 June 2020
Line 58:		Line 58:

	[[File:openvpn_clientsettings2.png\|600px]]		[[File:openvpn_clientsettings2.png\|600px]]
−
−	~~== Import certificates from other openvpn servers ==~~
−	WFilter NGF can import the exported certificates from other WFilter systems. However, if you need to import certificates from other openvpn servers, you need to pay attention to the file format and path.
−	* Import client CA:
−	** The file format shall be tar.gz.
−	** File path: /etc/config/openvpn/ca.crt and /etc/config/openvpn/ca.key
−	** Commands:
−	~~<code>~~
−	$tar -cvzf /tmp/ca.tar.gz /etc/openvpn/ca.*
−	~~</code>~~
−	* Import client certificates:
−	** The file format shall be tar.gz.
−	** File path: /tmp/clientkeys/xxx.crt and /tmp/clientkeys/xxx.key
−	** Commands:
−	~~<code>~~
−	~~$mkdir -p /tmp/clientkeys~~
−
−	$rm -f /tmp/clientkeys/*
−
−	~~$cp -f client1.crt /tmp/clientkeys/~~
−
−	~~$cp -f client1.key /tmp/clientkeys/~~
−
−	~~$tar -czf /tmp/client1.tar.gz /tmp/clientkeys/~~
−
−	~~</code>~~

	= Windows Clients =		= Windows Clients =

@@ Line 9: / Line 9: @@
 = OpenVPN Server =
 == Server Settings ==
-* Auth Type: "by certificate" or "by user&pass".
+* Auth by: "by certificate" or "by user&pass".
 ** Users & Pass(recommended): authenticate by user & password, only "local users" with "VPN" privilege have VPN access.
 ** Certificate: authenticate by certificate, client need to import the certificate created by the server.
@@ Line 15: / Line 15: @@
 * Client Subnet: WFilter's openVPN works in "subnet" mode. In this mode, OpenVPN will setup a new subnet, which can not same as existing LAN subnets.
 * Push Route: The subnets will be pushed to clients routing table, so client can access server's subnets. For example: '''route 192.168.126.0 255.255.255.0'''
-* Authtype:
+* Auth Type:
 ** "Local Auth": authenticate with username and password of local accounts. Only "local users" with "VPN" priviledge have VPN access.
 ** "Email Auth": send credentials to a pop/imap email server for authentication.

@@ Line 15: / Line 15: @@
 * Client Subnet: WFilter's openVPN works in "subnet" mode. In this mode, OpenVPN will setup a new subnet, which can not same as existing LAN subnets.
 * Push Route: The subnets will be pushed to clients routing table, so client can access server's subnets. For example: '''route 192.168.126.0 255.255.255.0'''
 [[File:openvpn_settings1.png|800px]]

@@ Line 22: / Line 22: @@
 * "Client Subnets" defines client subnets for site-to-site VPN.
 * "Client Subnets" defines client subnets for server to access client networks. For example: '''192.168.126.0 255.255.255.0'''
 * For user & pass authentication clients, the client id shall be client username.
 * For certificate authentication clients, you need to download and import the client certificate in client side.

@@ Line 133: / Line 133: @@
 [[File:openvpn_firewall01.png|800px]]
-* Example 2, allow VPN users to target subnet only:
+* Example 2, allow access to target subnet only:
 [[File:openvpn_firewall02.png|800px]]
 [[Category:VPN]]

@@ Line 79: / Line 79: @@
 = Windows Clients =
 * Download and install the offical openvpn client: https://openvpn.net/index.php/open-source/downloads.html
 * Download CA certificate in WFilter NG Firewall, copy it to openvpn's config directoy with name "ca.crt".
-* In config directory of openvpn, create a new text file named "myvpn.ovpn", with below content:
+* Download client configuration.
 <pre>
 client

← Older revision		Revision as of 06:26, 25 October 2018
Line 51:		Line 51:

	[[File:openvpn_clientsettings2.png\|600px]]		[[File:openvpn_clientsettings2.png\|600px]]
		+
		+	== Import certificates from other openvpn servers ==
		+	WFilter NGF can import the exported certificates from other WFilter systems. However, if you need to import certificates from other openvpn servers, you need to pay attention to the file format and path.
		+	* Import client CA:
		+	** The file format shall be tar.gz.
		+	** File path: /etc/config/openvpn/ca.crt and /etc/config/openvpn/ca.key
		+	** Commands:
		+	<code>
		+	$tar -cvzf /tmp/ca.tar.gz /etc/openvpn/ca.*
		+	</code>
		+	* Import client certificates:
		+	** The file format shall be tar.gz.
		+	** File path: /tmp/clientkeys/xxx.crt and /tmp/clientkeys/xxx.key
		+	** Commands:
		+	<code>
		+	$mkdir -p /tmp/clientkeys
		+
		+	$rm -f /tmp/clientkeys/*
		+
		+	$cp -f client1.crt /tmp/clientkeys/
		+
		+	$cp -f client1.key /tmp/clientkeys/
		+
		+	$tar -czf /tmp/client1.tar.gz /tmp/clientkeys/
		+
		+	</code>

	= Windows Clients =		= Windows Clients =