Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision
Previous revision
Next revisionBoth sides next revision
docs:guide-user:services:vpn:openvpn:client [2019/08/07 22:04] – [2. Basic client] jeffdocs:guide-user:services:vpn:openvpn:client [2021/09/27 03:25] – [2. Firewall] vgaetera
Line 1: Line 1:
 ====== OpenVPN client ====== ====== OpenVPN client ======
- 
-FIXME Show //results// in the config files of the inscrutable set of commands described here 
- 
 {{section>meta:infobox:howto_links#cli_skills&noheader&nofooter&noeditbutton}} {{section>meta:infobox:howto_links#cli_skills&noheader&nofooter&noeditbutton}}
  
 ===== Introduction ===== ===== Introduction =====
-  * This guide describes how to configure OpenWrt to run [[wp>OpenVPN|OpenVPN]] client+  * This how-to describes the method for setting up [[wp>OpenVPN|OpenVPN]] client on OpenWrt
-  * You can use it to connect to your own OpenVPN server or a commercial OpenVPN provider+  * Follow [[docs:guide-user:services:vpn:openvpn:server|OpenVPN server]] for server setup and [[docs:guide-user:services:vpn:openvpn:extras|OpenVPN extras]] for additional tuning.
-  * Follow [[basic|OpenVPN basic]] for server setup and [[extra|OpenVPN extras]] for additional tuning.+
  
 ===== Goals ===== ===== Goals =====
-{{section>basic#goals&noheader&nofooter&noeditbutton}}+{{section>docs:guide-user:services:vpn:wireguard:server#goals&noheader&nofooter&noeditbutton}}
  
-===== Instructions ===== +===== Command-line instructions ===== 
-==== 1. Firewall ==== +==== 1. Preparation ==== 
-Consider VPN network as public and assign VPN interface to WAN zone to minimize firewall setup.+Install the required packages.
  
 <code bash> <code bash>
-# Configure firewall 
-uci del_list firewall.@zone[1].device="tun0" 
-uci add_list firewall.@zone[1].device="tun0" 
-uci commit firewall 
-service firewall restart 
-</code> 
- 
-Adds to ''/etc/config/firewall'' in the ''config zone'' for WAN 
- 
-  list network 'tun0' 
-==== 2. Basic client ==== 
-Save your client profile. 
-Install and configure VPN client. 
-Drop VPN service privileges and ensure VPN interface name matches network configuration. 
- 
-<code bash> 
-# Save VPN client profile 
-cat << "EOF" > /etc/openvpn/vpnclient.conf 
-COPY_PASTE_CLIENT_PROFILE_HERE 
-EOF 
- 
-# Fix permissions 
-chmod "u=rw,g=,o=" /etc/openvpn/vpnclient.conf 
- 
 # Install packages # Install packages
 opkg update opkg update
 opkg install openvpn-openssl opkg install openvpn-openssl
- 
-# Configure VPN client 
-sed -i -e " 
-/^user/s/^/#/ 
-\$a user nobody 
-/^group/s/^/#/ 
-\$a group nogroup 
-/^dev/s/^/#/ 
-\$a dev $(uci get firewall.@zone[1].device) 
-" /etc/openvpn/vpnclient.conf 
-service openvpn restart 
 </code> </code>
  
-The first portion of this copies the client config to ''/etc/openvpn/vpnclient.conf'' and sets its permissions to 600 (root r/w permission only, others have no access).+==== 2Firewall ==== 
 +Consider VPN network as public. 
 +Assign VPN interface to WAN zone to minimize firewall setup.
  
-After installing the required packages, the ''sed'' command appears to modify that config to contain +<code bash
-<code> +# Configure firewall 
-user nobody +uci rename firewall.@zone[0]="lan" 
-group nogroup +uci rename firewall.@zone[1]="wan" 
-dev tun0+uci del_list firewall.wan.device="tun+" 
 +uci add_list firewall.wan.device="tun+" 
 +uci commit firewall 
 +/etc/init.d/firewall restart
 </code> </code>
-(or whichever device was specified in the previous section) 
  
-It then restarts the openvpn service. +==== 3. VPN service ==== 
- +Save your client profile to configure VPN service.
- +
-==== 3. Commercial provider ==== +
-If using a commercial VPN provider, set up credentials for username/password authentication and enforce gateway redirect.+
  
 <code bash> <code bash>
-# Save username/password credentials +# Save VPN client profile 
-cat << "EOF> /etc/openvpn/vpnclient.auth +umask go= 
-YOUR_VPN_USERNAME +cat << EOF > /etc/openvpn/client.conf 
-YOUR_VPN_PASSWORD+COPY_PASTE_CLIENT_PROFILE_HERE
 EOF EOF
- +/etc/init.d/openvpn restart
-# Fix permissions +
-chmod "u=rw,g=,o=" /etc/openvpn/vpnclient.auth +
- +
-# Configure VPN client +
-sed -i -e " +
-/^auth-user-pass/s/^/#/ +
-\$a auth-user-pass /etc/openvpn/vpnclient.auth +
-/^redirect-gateway/s/^/#/ +
-\$a redirect-gateway def1 ipv6 +
-" /etc/openvpn/vpnclient.conf +
-service openvpn restart+
 </code> </code>
  
-See also: [[extra#instance_management|Instance management]], [[?do=showtag&tag=DNSCrypt+DoH+DoT|DNS encryption]]+Configure credentials for [[docs:guide-user:services:vpn:openvpn:extras#commercial_provider|commercial provider]] if required.
  
 ===== Testing ===== ===== Testing =====
-{{section>basic#testing&noheader&nofooter&noeditbutton}}+{{section>docs:guide-user:services:vpn:wireguard:server#testing&noheader&nofooter&noeditbutton}}
  
 ===== Troubleshooting ===== ===== Troubleshooting =====
-{{section>basic#troubleshooting&noheader&nofooter&noeditbutton}} +{{section>docs:guide-user:services:vpn:openvpn:server#troubleshooting&noheader&nofooter&noeditbutton}}
- +
-{{tag>How-to VPN OpenVPN}}+
  
  • Last modified: 2023/10/14 05:16
  • by vgaetera