mirror of
https://gitlab.com/shorewall/code.git
synced 2024-12-22 06:10:42 +01:00
Add bridge example to OpenVPN doc
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2855 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep
parent
34f8ff258e
commit
639b383c4c
@ -417,4 +417,169 @@ verb 3</programlisting>
|
|||||||
url="http://www.iut-lannion.fr/ZONZON/memos_index.php?part=Network&section=WRTMemo&subsec=vpnwithshorewall">this
|
url="http://www.iut-lannion.fr/ZONZON/memos_index.php?part=Network&section=WRTMemo&subsec=vpnwithshorewall">this
|
||||||
article</ulink> by Marc Zonzon</para>
|
article</ulink> by Marc Zonzon</para>
|
||||||
</section>
|
</section>
|
||||||
|
|
||||||
|
<section>
|
||||||
|
<title>Securing a Home Wireless Network with OpenVPN</title>
|
||||||
|
|
||||||
|
<para>This section will discuss how I secured my home wireless network
|
||||||
|
using OpenVPN. Our network is as shown in the following diagram.</para>
|
||||||
|
|
||||||
|
<graphic fileref="images/network3.png" />
|
||||||
|
|
||||||
|
<para>The Wireless zone is in the lower right of the diagram and consists
|
||||||
|
of two laptops: Eastepnc6000 (Windows XP - SP1) and Tipper (SuSE 10.0). We
|
||||||
|
use OpenVPN to bridge those two laptops with the Local Zone shown in the
|
||||||
|
lower left hand corner.</para>
|
||||||
|
|
||||||
|
<section>
|
||||||
|
<title>Configuring the Bridge</title>
|
||||||
|
|
||||||
|
<para>The firewall runs Debian Sarge so the bridge is defined in
|
||||||
|
<filename>/etc/network/interfaces</filename>.</para>
|
||||||
|
|
||||||
|
<programlisting># LAN interface
|
||||||
|
auto br0
|
||||||
|
iface br0 inet static
|
||||||
|
address 192.168.1.254
|
||||||
|
netmask 255.255.255.0
|
||||||
|
pre-up /usr/sbin/openvpn --mktun --dev tap0
|
||||||
|
pre-up /sbin/ip link set tun0 up
|
||||||
|
pre-up /sbin/ip link set eth3 up
|
||||||
|
pre-up /usr/sbin/brctl addbr br0
|
||||||
|
pre-up /usr/sbin/brctl addif br0 eth3
|
||||||
|
pre-up /usr/sbin/brctl addif br0 tap0
|
||||||
|
up ip route add 224.0.0.0/4 dev br0
|
||||||
|
post-down /usr/sbin/brctl delif br0 eth3
|
||||||
|
post-down /usr/sbin/brctl delif br0 tap0
|
||||||
|
post-down /usr/sbin/brctl delbr br0
|
||||||
|
post-down /usr/sbin/openvpn --rmtun --dev tap0</programlisting>
|
||||||
|
|
||||||
|
<para>Note that the IP address assigned to the bridge is 192.168.1.254
|
||||||
|
-- that is the default gateway address for hosts in the local
|
||||||
|
zone.</para>
|
||||||
|
</section>
|
||||||
|
|
||||||
|
<section>
|
||||||
|
<title>Configuring OpenVPN</title>
|
||||||
|
|
||||||
|
<para>We use X.509 certificates for authentication.</para>
|
||||||
|
|
||||||
|
<section>
|
||||||
|
<title>Firewall (Server) configuration.</title>
|
||||||
|
|
||||||
|
<para>/etc/openvpn/server-bridge.conf defines a bridge and reserves IP
|
||||||
|
addresses 192.168.1.64-192.168.1.71 for VPN clients.</para>
|
||||||
|
|
||||||
|
<programlisting>dev tap0
|
||||||
|
|
||||||
|
local 192.168.3.254
|
||||||
|
|
||||||
|
server-bridge 192.168.1.254 255.255.255.0 192.168.1.64 192.168.1.71
|
||||||
|
|
||||||
|
dh dh1024.pem
|
||||||
|
|
||||||
|
ca /etc/certs/cacert.pem
|
||||||
|
|
||||||
|
crl-verify /etc/certs/crl.pem
|
||||||
|
|
||||||
|
cert /etc/certs/gateway.pem
|
||||||
|
key /etc/certs/gateway_key.pem
|
||||||
|
|
||||||
|
port 1194
|
||||||
|
|
||||||
|
comp-lzo
|
||||||
|
|
||||||
|
user nobody
|
||||||
|
group nogroup
|
||||||
|
|
||||||
|
ping 15
|
||||||
|
ping-restart 45
|
||||||
|
ping-timer-rem
|
||||||
|
persist-tun
|
||||||
|
persist-key
|
||||||
|
|
||||||
|
verb 3</programlisting>
|
||||||
|
</section>
|
||||||
|
|
||||||
|
<section>
|
||||||
|
<title>Tipper Configuration</title>
|
||||||
|
|
||||||
|
<para>/etc/openvpn/wireless.conf:</para>
|
||||||
|
|
||||||
|
<programlisting>dev tap
|
||||||
|
|
||||||
|
remote 192.168.3.254
|
||||||
|
tls-remote gateway.shorewall.net
|
||||||
|
|
||||||
|
client
|
||||||
|
|
||||||
|
route-gateway 192.168.1.254
|
||||||
|
|
||||||
|
up /etc/openvpn/wireless.up
|
||||||
|
down /etc/openvpn/wireless.down
|
||||||
|
|
||||||
|
ca /etc/certs/cacert.pem
|
||||||
|
|
||||||
|
cert /etc/certs/tipper.pem
|
||||||
|
key /etc/certs/tipper_key.pem
|
||||||
|
|
||||||
|
port 1194
|
||||||
|
|
||||||
|
comp-lzo
|
||||||
|
|
||||||
|
ping 15
|
||||||
|
ping-restart 45
|
||||||
|
ping-timer-rem
|
||||||
|
persist-tun
|
||||||
|
persist-key
|
||||||
|
|
||||||
|
mute-replay-warnings
|
||||||
|
|
||||||
|
verb 3</programlisting>
|
||||||
|
|
||||||
|
<para>/etc/openvpn/wireless.up changes the default gateway to
|
||||||
|
192.168.1.254</para>
|
||||||
|
|
||||||
|
<programlisting>ip route replace default via 192.168.1.254 dev tap0</programlisting>
|
||||||
|
|
||||||
|
<para>/etc/openvpn/wireless.down restores the default gateway to
|
||||||
|
192.168.3.254</para>
|
||||||
|
|
||||||
|
<programlisting>ip route replace default via 192.168.3.254 dev eth0</programlisting>
|
||||||
|
</section>
|
||||||
|
</section>
|
||||||
|
|
||||||
|
<section>
|
||||||
|
<title>Configuring Shorewall</title>
|
||||||
|
|
||||||
|
<para>In this configuration, we don't need any firewalling between the
|
||||||
|
laptops and the local LAN so we set BRIDGING=No in shorewall.conf. The
|
||||||
|
configuration of the bridge then becomes as described in the <ulink
|
||||||
|
url="SimpleBridge.xml">Simple Bridge documentation</ulink>.</para>
|
||||||
|
|
||||||
|
<section>
|
||||||
|
<title>/etc/shorewall/interfaces</title>
|
||||||
|
|
||||||
|
<para>Note that the bridge (br0) is defined as the interface to the
|
||||||
|
local zone and has the <emphasis role="bold">routeback</emphasis>
|
||||||
|
option.</para>
|
||||||
|
|
||||||
|
<programlisting>#ZONE INTERFACE BROADCAST OPTIONS
|
||||||
|
net eth2 206.124.146.255 dhcp,norfc1918,logmartians,blacklist,tcpflags,nosmurfs
|
||||||
|
loc br0 192.168.1.255 dhcp,<emphasis role="bold">routeback</emphasis>
|
||||||
|
dmz eth1 - logmartians
|
||||||
|
Wifi eth0 192.168.3.255 dhcp,maclist
|
||||||
|
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE</programlisting>
|
||||||
|
</section>
|
||||||
|
|
||||||
|
<section>
|
||||||
|
<title>/etc/shorewall/tunnels</title>
|
||||||
|
|
||||||
|
<programlisting>#TYPE ZONE GATEWAY GATEWAY
|
||||||
|
# ZONE
|
||||||
|
openvpn-server:1194 Wifi 192.168.3.0/24
|
||||||
|
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE</programlisting>
|
||||||
|
</section>
|
||||||
|
</section>
|
||||||
|
</section>
|
||||||
</article>
|
</article>
|
||||||
Loading…
Reference in New Issue
Block a user