TKLpatch: OpenVPN
Location: see attached file
Intended for: TKL Core
Description: Installs openvpn (+bridge-utils) and the webmin openvpn module to TKL Core, allowing easier configuration and management of openvpn servers and certificates.
Location: see attached file
Intended for: TKL Core
Description: Installs openvpn (+bridge-utils) and the webmin openvpn module to TKL Core, allowing easier configuration and management of openvpn servers and certificates.
Nicely done!
Regarding the webmin openvpn package, can you provide a link to the source you used. How did you build the package? I'd like to add it to the webmin package in the TurnKey package repo.
BTW, when using sed to change paths, I find it more readable to use a different delimiter and then you don't need to escape slashes:
OpenVPN Updates
Thanks for the advice about sed syntax Alon, it makes the conf file a bit more readable.
I am also attaching a step-by-step tutorial on how to setup a routed openvpn server.
Bonus: I am attaching a all-in-one installation script I used when creating the openvpn machine. I documented the exact commands I used. I later used this script to create the tklpatch, simplifying various parts to fit the tklpatch model.
I will create a new topic to post information about how I made the webmin package. The all-in-one script is a good example as well.
Oh, there appears to be a bug in the forum code which messes up the uploads when I try to re-upload a newer version of tkl-openvpn.tar.gz. For now just right-click, save as, rename.
Enable NAT
Stas,
Thank you for this article and script. It was exactly what I was looking for my simple OpenVPN solution. One configuration setting I had to perform on the TKL system after enabling IP forwarding was to also enable NAT on the server.
sudo iptables -t nat -A POSTROUTING -s 10.8.0.0/24 (ovpn-net + ovpn-net mask) -o eth0 -j MASQUERADE
Everything else worked perfectly.
Some other options I added to force all vpn clients to pass all traffic through the VPN was to add the option below the push "route"
push "redirect-gateway def1"
Again thank you very much for this detailed and awesome article / walkthrough.
Regards,
James
Kudos this is excellent work
But with the help of contributors from the community the sky is the limit! This is why I love open source. We'll be sure to give you credit for this when we make the announcement.
Wow, I'm surprised
I just logged in and noticed the karma bonus and this message. Thanks so much. I knew I was one of the first outside developers but didn't realize I was the first with a release. I am working on a few more random patches.
Thanks to the TKL team for making an excellent linux-based VM appliance platform.
New TKLPatch section on development wiki
apply patch to different appliance
Can I use this patch on the LAMP appliance?
Probably, try it!
OpenVPN appliance available yet?
Hi Guys
Is a non-beta OpenVPN appliance available yet? Looking forward to it!!
It's so helpful that you thought of many things (like instructions) that us newbies really need.
Could the appliance include best-practice instructions for security lock-down of production servers? I'm concerned someone would hack the VPN server and gain access to the entire cloud.
Not yet
But I imagine it will be one of the appliances in "Part 2" of the current v11.0RC release.
IMO unfortunately documentation is one area where TKL could do with some serious improvement. Stas has provided some documentation of this above in the tklopenvpn-howto.txt which should be helpful; beyond that you're out of luck other than having a google and crossing your fingers.
DEV TUN/TAP
Why is everybody talking about PC-to-PC (Level 2 Bridging)? I want level 3 bridging (TAP Tunneling) aka LAN/Ethernet bridging. Can anyone create instructions for this one? Thanks!
Post new comment