diff --git a/Shorewall-docs2/OPENVPN.xml b/Shorewall-docs2/OPENVPN.xml
index e810f75dc..136576e39 100644
--- a/Shorewall-docs2/OPENVPN.xml
+++ b/Shorewall-docs2/OPENVPN.xml
@@ -21,7 +21,7 @@
- 2005-10-19
+ 2005-10-25
2003
@@ -434,7 +434,7 @@ verb 3
article by Marc Zonzon
-
+
Securing a Home Wireless Network with OpenVPN (OpenVPN
Bridge)
diff --git a/Shorewall-docs2/myfiles.xml b/Shorewall-docs2/myfiles.xml
index f2f496083..9e61de11d 100644
--- a/Shorewall-docs2/myfiles.xml
+++ b/Shorewall-docs2/myfiles.xml
@@ -53,38 +53,40 @@
I have DSL service with 5 static IP addresses (206.124.146.176-180).
- My DSL modem
(Westell 2200) is connected to eth2 and has IP
- address 192.168.1.1 (factory default). The modem is configured in
- bridge
mode so PPPoE is not involved. I have a local
- network connected to eth3 which is bridged to interface tun0 via bridge
- br0 (subnet 192.168.1.0/24), a wireless network (192.168.3.0/24) connected
- to eth0, and a DMZ connected to eth1 (206.124.146.176/32). Note that I
- configure the same IP address on both eth1 and modem (Westell 2200) is
+ connected to eth2 and has IP address 192.168.1.1 (factory default). The
+ modem is configured in bridge
mode so PPPoE is not
+ involved. I have a local network connected to eth3 which is bridged to
+ interface tun0 via bridge br0 (subnet 192.168.1.0/24), a wireless network
+ (192.168.3.0/24) connected to eth0, and a DMZ connected to eth1
+ (206.124.146.176/32). Note that I configure the same IP address on both
+ eth1 and eth2.
In this configuration:
- I use one-to-one NAT for Ursa (my personal system that run SuSE
- 10.0) - Internal address 192.168.1.5 and external address
- 206.124.146.178.
+ I use one-to-one NAT for "Ursa" (my
+ personal system that run SuSE 10.0) - Internal address 192.168.1.5 and
+ external address 206.124.146.178.
- I use one-to-one NAT for Eastepnc6000 (My work system -- Windows
- XP SP1). Internal address 192.168.1.6 and external address
- 206.124.146.180.
+ I use one-to-one NAT for "Eastepnc6000" (My
+ work system -- Windows XP SP1). Internal address 192.168.1.6 and
+ external address 206.124.146.180.
I use SNAT through 206.124.146.179 for my Wife's Windows XP
- system Tarry
, my crash and burn
- system "Wookie", our SuSE 10.0 laptop Tipper
which
- connects through the Wireless Access Point (wap) via a Wireless Bridge
- (wet), and my work laptop (eastepnc6000) when it is not docked in my
- office.
+ system Tarry
, my crash
+ and burn system "Wookie", our SuSE
+ 10.0 laptop Tipper
which connects
+ through the Wireless Access Point (wap) via a Wireless Bridge (wet),
+ and my work laptop (eastepnc6000) when it is not
+ docked in my office.
While the distance between the WAP and where I usually use
the laptop isn't very far (50 feet or so), using a WAC11 (CardBus
wireless card) has proved very unsatisfactory (lots of lost
@@ -107,36 +109,38 @@
The firewall runs on a P-II/233 with Debian Sarge (testing).
- Ursa runs Samba for file sharing with the Windows systems and is
- configured as a Wins server.
+ Ursa runs Samba for file sharing with the
+ Windows systems and is configured as a Wins server.
The wireless network connects to the firewall's eth0 via a LinkSys
WAP11. In additional to using the rather weak WEP 40-bit encryption
(64-bit with the 24-bit preamble), I use MAC verification and OpenVPN in bridge mode.
+ url="OPENVPN.html#Bridge">OpenVPN in bridge mode.
- The single system in the DMZ (address 206.124.146.177) runs postfix,
- Courier IMAP (imap and imaps), DNS (Bind 9), a Web server (Apache) and an
- FTP server (Pure-ftpd) under Fedora Core 4. The system also runs fetchmail
- to fetch our email from our old and current ISPs. That server is
- accessible from the Internet through Proxy
- ARP.
+ The single system in the DMZ (address 206.124.146.177) runs Postfix, Courier IMAP (imap and
+ imaps), DNS (Bind 9), a
+ Web server (Apache) and an
+ FTP server (Pure-ftpd) under
+ Fedora Core 4. The system
+ also runs fetchmail to fetch our
+ email from our old and current ISPs. That server is accessible from the
+ Internet through Proxy ARP.
- The firewall system itself runs a DHCP server that serves the local
- and wireless networks.
+ The firewall system itself runs a DHCP server that serves the
+ local and wireless networks.
All administration and publishing is done using ssh/scp. I have a
desktop environment installed on the firewall but I usually don't start
- it. X applications tunnel through SSH to Ursa or one of the laptops. The
- server also has a desktop environment installed but it is seldom started
- either. For the most part, X tunneled through SSH is used for server
- administration and the server runs at run level 3 (multi-user console mode
- on Fedora).
-
- I run an SNMP server on my firewall to serve MRTG running
- in the DMZ.
+ it. X applications tunnel through SSH to Ursa or one
+ of the laptops. The server also has a desktop environment installed but it
+ is seldom started either. For the most part, X tunneled through SSH is
+ used for server administration and the server runs at run level 3
+ (multi-user console mode on Fedora).
The ethernet interface in the Server is configured with IP address
206.124.146.177, netmask 255.255.255.0. The server's default gateway is
@@ -145,16 +149,17 @@
/etc/network/interfaces file (see below) adds a host route to
206.124.146.177 through eth1 when that interface is brought up.
- In addition to the Openvpn bridge, the firewall hosts an OpenVPN
+ In addition to the OpenVPN bridge, the firewall hosts an OpenVPN
Tunnel server for VPN access from our second home in Omak, Washington or when we are
otherwise out of town.
![]()
- Eastepnc6000 is shown in both the local LAN and in the Wifi zone
- with IP address 192.168.1.6 -- clearly, the computer can only be in
- one place or the other. Tipper can also be in either place and will
- have the IP address 192.168.1.8 regardless.
+ Eastepnc6000 is shown in both the local LAN
+ and in the Wifi zone with IP address 192.168.1.6 -- clearly, the
+ computer can only be in one place or the other.
+ Tipper can also be in either place and will have
+ the IP address 192.168.1.8 regardless.
@@ -818,19 +823,28 @@ client-config-dir /etc/openvpn/clients
ccd-exclusive
client-to-client
-verb 3
-
+verb 3
+
+ Tipper and Eastepnc6000 Configuration in the Wireless
+ Network
+
+ Please find this information in the OpenVPN bridge mode documentation.
+
+
+
Tipper Configuration while on the Road
This laptop is either configured on our wireless network
(192.168.3.8) or as a standalone system on the road.
- Tipper's view of the world is shown in the following diagram:
+ Tipper's view of the world is shown in the
+ following diagram:
![]()