Hopp-rsk-owr01: Difference between revisions
Acmeraptor (talk | contribs) No edit summary Tags: Mobile edit Mobile web edit |
Acmeraptor (talk | contribs) No edit summary |
||
| Line 6: | Line 6: | ||
[https://forum.openwrt.org/search?context=topic&context_id=51852&q=openvpn%20server&skip_context=true Forum topics] | [https://forum.openwrt.org/search?context=topic&context_id=51852&q=openvpn%20server&skip_context=true Forum topics] | ||
[https://support.linksys.com/kb/article/6710-en/] | [https://support.linksys.com/kb/article/6710-en/ Linksys help] | ||
[https://www.reddit.com/r/LinksysOfficial/comments/165zrj9/insecure_openvpn_implementation_in_wrt3200acm/?rdt=40669] | [https://www.reddit.com/r/LinksysOfficial/comments/165zrj9/insecure_openvpn_implementation_in_wrt3200acm/?rdt=40669 Reddit info] | ||
[https://forum.openwrt.org/t/solved-configuring-linksys-wrt3200acm-with-openvpn-client/27528] | [https://forum.openwrt.org/t/solved-configuring-linksys-wrt3200acm-with-openvpn-client/27528 OpenWRT link] | ||
[https://forums.openvpn.net/viewtopic.php?t=33309] | [https://forums.openvpn.net/viewtopic.php?t=33309 OpenVPN link] | ||
==WireGuard== | ==WireGuard== | ||
| Line 18: | Line 18: | ||
OpenWrt Wiki | OpenWrt Wiki | ||
Command-line instructions | Command-line instructions | ||
1. Preparation | 1. Preparation | ||
Install the required packages. Specify configuration parameters for VPN server. | Install the required packages. Specify configuration parameters for VPN server. | ||
# Install packages | |||
# Install packages | opkg update | ||
opkg update | opkg install wireguard-tools | ||
opkg install wireguard-tools | |||
# Configuration parameters | # Configuration parameters | ||
VPN_IF="vpn" | VPN_IF="vpn" | ||
VPN_PORT="51820" | VPN_PORT="51820" | ||
VPN_ADDR="192.168.9.1/24" | VPN_ADDR="192.168.9.1/24" | ||
VPN_ADDR6="fd00:9::1/64" | VPN_ADDR6="fd00:9::1/64" | ||
2. Key management | 2. Key management | ||
Generate and exchange keys between server and client. | Generate and exchange keys between server and client. | ||
# Generate keys | |||
# Generate keys | umask go= | ||
umask go= | wg genkey | tee wgserver.key | wg pubkey > wgserver.pub | ||
wg genkey | tee wgserver.key | wg pubkey > wgserver.pub | wg genkey | tee wgclient.key | wg pubkey > wgclient.pub | ||
wg genkey | tee wgclient.key | wg pubkey > wgclient.pub | wg genpsk > wgclient.psk | ||
wg genpsk > wgclient.psk | |||
# Server private key | # Server private key | ||
VPN_KEY="$(cat wgserver.key)" | VPN_KEY="$(cat wgserver.key)" | ||
# Pre-shared key | # Pre-shared key | ||
VPN_PSK="$(cat wgclient.psk)" | VPN_PSK="$(cat wgclient.psk)" | ||
# Client public key | # Client public key | ||
VPN_PUB="$(cat wgclient.pub)" | VPN_PUB="$(cat wgclient.pub)" | ||
3. Firewall | 3. Firewall | ||
Consider VPN network as private. Assign VPN interface to LAN zone to minimize firewall setup. Allow access to VPN server from WAN zone. | Consider VPN network as private. Assign VPN interface to LAN zone to minimize firewall setup. Allow access to VPN server from WAN zone. | ||
# Configure firewall | |||
# Configure firewall | uci rename firewall.@zone[0]="lan" | ||
uci rename firewall.@zone[0]="lan" | uci rename firewall.@zone[1]="wan" | ||
uci rename firewall.@zone[1]="wan" | uci del_list firewall.lan.network="${VPN_IF}" | ||
uci del_list firewall.lan.network="${VPN_IF}" | uci add_list firewall.lan.network="${VPN_IF}" | ||
uci add_list firewall.lan.network="${VPN_IF}" | uci -q delete firewall.wg | ||
uci -q delete firewall.wg | uci set firewall.wg="rule" | ||
uci set firewall.wg="rule" | uci set firewall.wg.name="Allow-WireGuard" | ||
uci set firewall.wg.name="Allow-WireGuard" | uci set firewall.wg.src="wan" | ||
uci set firewall.wg.src="wan" | uci set firewall.wg.dest_port="${VPN_PORT}" | ||
uci set firewall.wg.dest_port="${VPN_PORT}" | uci set firewall.wg.proto="udp" | ||
uci set firewall.wg.proto="udp" | uci set firewall.wg.target="ACCEPT" | ||
uci set firewall.wg.target="ACCEPT" | uci commit firewall | ||
uci commit firewall | service firewall restart | ||
service firewall restart | |||
4. Network | 4. Network | ||
Configure VPN interface and peers. | Configure VPN interface and peers. | ||
# Configure network | |||
# Configure network | uci -q delete network.${VPN_IF} | ||
uci -q delete network.${VPN_IF} | uci set network.${VPN_IF}="interface" | ||
uci set network.${VPN_IF}="interface" | uci set network.${VPN_IF}.proto="wireguard" | ||
uci set network.${VPN_IF}.proto="wireguard" | uci set network.${VPN_IF}.private_key="${VPN_KEY}" | ||
uci set network.${VPN_IF}.private_key="${VPN_KEY}" | uci set network.${VPN_IF}.listen_port="${VPN_PORT}" | ||
uci set network.${VPN_IF}.listen_port="${VPN_PORT}" | uci add_list network.${VPN_IF}.addresses="${VPN_ADDR}" | ||
uci add_list network.${VPN_IF}.addresses="${VPN_ADDR}" | uci add_list network.${VPN_IF}.addresses="${VPN_ADDR6}" | ||
uci add_list network.${VPN_IF}.addresses="${VPN_ADDR6}" | |||
# Add VPN peers | |||
# Add VPN peers | uci -q delete network.wgclient | ||
uci -q delete network.wgclient | uci set network.wgclient="wireguard_${VPN_IF}" | ||
uci set network.wgclient="wireguard_${VPN_IF}" | uci set network.wgclient.public_key="${VPN_PUB}" | ||
uci set network.wgclient.public_key="${VPN_PUB}" | uci set network.wgclient.preshared_key="${VPN_PSK}" | ||
uci set network.wgclient.preshared_key="${VPN_PSK}" | uci add_list network.wgclient.allowed_ips="${VPN_ADDR%.*}.2/32" | ||
uci add_list network.wgclient.allowed_ips="${VPN_ADDR%.*}.2/32" | uci add_list network.wgclient.allowed_ips="${VPN_ADDR6%:*}:2/128" | ||
uci add_list network.wgclient.allowed_ips="${VPN_ADDR6%:*}:2/128" | uci commit network | ||
uci commit network | service network restart | ||
service network restart | |||
LuCI Web Interface instructions | LuCI Web Interface instructions | ||
1. Installing packages | 1. Installing packages | ||
| Line 128: | Line 106: | ||
5. Configure WireGuard Peers | 5. Configure WireGuard Peers | ||
To create a new WireGuard peer configuration go to LuCI → Network → Interfaces → wg0 → Edit → Peers | To create a new WireGuard peer configuration go to LuCI → Network → Interfaces → wg0 → Edit → Peers | ||
*Click on Add peer | |||
Click on Add peer | *Click on Generate new key pair to populate the public and private key fields | ||
Click on Generate new key pair to populate the public and private key fields | *Allowed IPs: 10.0.0.10 or whatever other address you will assign to the client | ||
Allowed IPs: 10.0.0.10 or whatever other address you will assign to the client | *Endpoint port: 51820 | ||
Endpoint port: 51820 | *Persistent Keep Alive: 25 | ||
Persistent Keep Alive: 25 | *Save | ||
Save | |||
Click on Edit for the peer just created | Click on Edit for the peer just created | ||
| Line 143: | Line 120: | ||
To transfer the peer configuration to the client device either: | To transfer the peer configuration to the client device either: | ||
Use a Wireguard client on a phone / tablet that can scan the generated QR code or | *Use a Wireguard client on a phone / tablet that can scan the generated QR code or | ||
Copy and paste the generated configuration data into a device.conf file for import into a WireGuard client | *Copy and paste the generated configuration data into a device.conf file for import into a WireGuard client | ||
Once you have saved the changes to the wg0 interface, click Save & Apply on the Interfaces page, then Restart wg0. This is necessary for the new peer list to take effect. “Save & Apply” alone is not enough! | Once you have saved the changes to the wg0 interface, click Save & Apply on the Interfaces page, then Restart wg0. This is necessary for the new peer list to take effect. “Save & Apply” alone is not enough! | ||
6. Configure Firewall for WireGuard traffic | 6. Configure Firewall for WireGuard traffic | ||
Go to LuCI → Network → Firewall → General Settings and under Zones add a new zone: | Go to LuCI → Network → Firewall → General Settings and under Zones add a new zone: | ||
*Name: WireguardVPN (or preferred name) | |||
Name: WireguardVPN (or preferred name) | *Input: accept | ||
Input: accept | *Output: accept | ||
Output: accept | *Intra zone forward: accept | ||
Intra zone forward: accept | *Masquerading: checked | ||
Masquerading: checked | *MSS Clamping: checked | ||
MSS Clamping: checked | *Covered networks: wg0 | ||
Covered networks: wg0 | *Allow forward to destination zones: lan and wan | ||
Allow forward to destination zones: lan and wan | *Allow forward from source zones: lan | ||
Allow forward from source zones: lan | *Save | ||
Save | |||
Create rule to allow IPv4 & IPv6 traffic through from internet for connecting from client device using IPv4 (if router has public IPv4 address) or from client device using IPv6 (if router has public IPv6 address available). | Create rule to allow IPv4 & IPv6 traffic through from internet for connecting from client device using IPv4 (if router has public IPv4 address) or from client device using IPv6 (if router has public IPv6 address available). | ||
Go to LuCI → Network → Firewall → Traffic Rules | Go to LuCI → Network → Firewall → Traffic Rules | ||
*Name: WireGuard-incoming (or preferred name) | |||
Name: WireGuard-incoming (or preferred name) | *Protocol: UDP | ||
Protocol: UDP | *Source zone: wan | ||
Source zone: wan | *Source address: -- add IP -- | ||
Source address: -- add IP -- | *Source port: any | ||
Source port: any | *Destination zone: Device | ||
Destination zone: Device | *Destination address: -- add IP-- | ||
Destination address: -- add IP-- | *Destination port: 51820 | ||
Destination port: 51820 | *Action: accept | ||
Action: accept | *Save, Save & apply | ||
Save, Save & apply | |||
Note: If only IPv4 is being used to connect to the WireGuard server the above firewall traffic rule could be replaced with a Port Forward rule instead. | Note: If only IPv4 is being used to connect to the WireGuard server the above firewall traffic rule could be replaced with a Port Forward rule instead. | ||
| Line 180: | Line 155: | ||
Testing | Testing | ||
Establish the VPN connection. Verify your routing with traceroute and traceroute6. | Establish the VPN connection. Verify your routing with traceroute and traceroute6. | ||
traceroute openwrt.org | |||
traceroute openwrt.org | traceroute6 openwrt.org | ||
traceroute6 openwrt.org | |||
Check your IP and DNS provider. | Check your IP and DNS provider. | ||
*ipleak.net | |||
ipleak.net | *dnsleaktest.com | ||
dnsleaktest.com | |||
On router: | On router: | ||
*Go to LuCI > Status > Wireguard and look for peer device connected with an IPv4 or IPv6 address and with a recent handshake time | |||
Go to LuCI > Status > Wireguard and look for peer device connected with an IPv4 or IPv6 address and with a recent handshake time | *Go to LuCI > Network > Diagnostics and ipv4 ping client device IP eg. 10.0.0.10 | ||
Go to LuCI > Network > Diagnostics and ipv4 ping client device IP eg. 10.0.0.10 | |||
On client device depending on wireguard software: | On client device depending on wireguard software: | ||
*Check transfer traffic for tx & rx | |||
Check transfer traffic for tx & rx | *Ping router internal lan IP | ||
Ping router internal lan IP | *Check public IP address in a browser – https://whatsmyip.com – should see public IP address of ISP for the router | ||
Check public IP address in a browser – https://whatsmyip.com – should see public IP address of ISP for the router | |||
Troubleshooting | Troubleshooting | ||
Collect and analyze the following information. | Collect and analyze the following information. | ||
# Restart services | |||
# Restart services | service log restart; service network restart; sleep 10 | ||
service log restart; service network restart; sleep 10 | |||
# Log and status | # Log and status | ||
logread -e vpn; netstat -l -n -p | grep -e "^udp\s.*\s-$" | logread -e vpn; netstat -l -n -p | grep -e "^udp\s.*\s-$" | ||
# Runtime configuration | # Runtime configuration | ||
pgrep -f -a wg; wg show; wg showconf wg0 | pgrep -f -a wg; wg show; wg showconf wg0 | ||
ip address show; ip route show table all | ip address show; ip route show table all | ||
ip rule show; ip -6 rule show; nft list ruleset | ip rule show; ip -6 rule show; nft list ruleset | ||
# Persistent configuration | # Persistent configuration | ||
uci show network; uci show firewall; crontab -l | uci show network; uci show firewall; crontab -l | ||