2

I need to be able to connect my windows users to my Ubuntu Server through a VPN via Internet so that they can brows the Shared Folder once connected to the Server. I basically have 2 NIC's already Installed. Here is my etc/network/Interface configuration FYI. I have 2 Virtual Servers Running on Ubuntu and have a 2nd HDD sharing my Files.

auto lo
iface lo inet loopback

#The Primary network interface
auto eth0
iface eth0 inet manual
auto br0
iface br0 inet static
address 192.168.2.100
netmask 255.255.255.0
network 192.168.2.0
broadcast 192.168.2.255
gateway 192.168.2.1
dns-nameservers 208.67.222.222 208.67.220.220
dns-search google.com

bridge_ports eth0
bridge_stp off
bridge_fd 0
bridge_hello 2
bridge_maxwait 0
post-up ip link set br0 address 00:10:18:77:5e:46

#Secondary network interface
# auto eth1
# iface eth1 inet static
# address 192.168.2.150
# netmask 255.255.255.0
# network 192.168.2.0
# broadcast 192.168.2.255
# gateway 192.168.2.1
# dns-nameserver 192.168.2.1 8.8.8.8

Any help is much appreciated. Please also note that I am not an expert rather a newbee.

  • do u want to implement openvpn server? – Wilo Jul 7 '14 at 10:18
  • The second interface is commented out and the bridge only has 1 interface. May I ask why do you configure a bridge with 1 interface? Will you merge both in the future or something? Do they belong to the same network? – CijcoSistems Jul 7 '14 at 10:42
  • @Wilo; I do not mind implement openvpn as long as its hassle free to configure and meet my requirement...:) – Nilanga Jul 8 '14 at 6:53
  • @CijcoSistems; well, to begin with I already had 2 NIC's in the BOX . Then I thought I could use it to either run DMZ or VPN but every time I enable it the rest of the network does not work... so I commented it out. Probably the 2nd NIC configuration I am entering is wrong. but right now the issue is VPN SERVER. Most of the tut's are very confusing :( – Nilanga Jul 8 '14 at 6:59
2

You can use OpenVPN software to create a VPN server.

On Ubuntu, sudo apt-get install openvpn.

You have to create a configuration file in /etc/openvpn for the server :

port 1194
proto tcp
dev tun
pkcs12 openvpn.p12
dh dh1024.pem
server 192.168.10.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 10 120
comp-lzo
persist-key
persist-tun

Just name this file server.conf for instance and start your OpenVPN instance :

sudo service openvpn start

This will start up a VPN server using a TUN device running on all IP's of the server on TCP port 1194. The VPN tunnels will be in the subnet 192.168.10.0/24, where the server receives the 192.168.10.1 address.
LZO compression is activated and a file, ipp.txt will be used to retain IP given to clients to gave them all the time the same IP.

Pointed by the dh parameter is a file that you will have to generate yourself using the following command :

openssl dhparam -out dh1024.pem 1024

The tricky part in this configuration is the use of certificates. Here I'm using a PKCS12 file which contain a private key and its certificate and the certificate of the CA.

To manage the keys and certificates, to export them easily, I've found the GUI tool tinyca2 that you can install on Ubuntu with sudo apt-get install tinyca2. This tool will create a local and standalone CA that you can use to generate and export private & public keys and X.509 certificates.

All files mentioned in the configuration that doesn't have an absolute path name are located into the /etc/openvpn directory.

Once your OpenVPN server is running, you will have to download the OpenVPN version for Windows (free of charge) and install it onto your Windows clients.

This information & software are available on the OpenVPN website.

2

You need to accomplish several points:

1. Choose your technology

Choose which protocols will you use to implement the VPN.

The main options are: PPTP, L2TP/IPsec and OpenVPN.

PPTP

Point-to-Point Tunneling Protocol has been around for more than 15 years (Windows 95 already had a client!). It's kind of a PPP-remake by Microsoft. Authentication and encryption relies in PPP itself so it can support several methods. To make long story short, don't use it. Security can be considered broken nowadays.

L2TP/IPsec

Layer 2 Tunneling Protocol (L2TP) does not provide encryption by itself either. It is provided by IPsec instead. This is a well-supported configuration in Windows environments. Configuring it on Linux may be troublesome sometimes but it might be your best choice since your clients are running Windows.

OpenVPN

Excerpt from Wikipedia:

It uses a custom security protocol that utilizes SSL/TLS for key exchange. It is capable of traversing network address translators (NATs) and firewalls.

when configuring OpenVPN, you can choose between creating a tun adapter or a tap adapter.

  • The tun adapter works at layer 3, which means you can assign it an IP and think of it like a next-hop router for your VPN network behind the tunnel.
  • The tap adapter works at layer 2, so you can merge both ends in the same network. This can be really useful if you need your ARP requests/replies (or any layer 2 broadcast) to reach the other end of the VPN tunnel. The downside: more bandwidth usage.

This is the easiest configuration and should cover most needs on GNU/Linux environments.

2. Configure the server

This depends of course of the choice you made before. Instead of posting a full walk-through, let me point you some useful guides:

  • PPTP - Setting up a PPTP server in Ubuntu Server 12.4. Should not be very different for current version.
  • L2TP/IPsec - Here you need to configure 2 subsystems: The IPsec part is managed by Openswan, but could be managed by other like strongSwan or ipsec-tools. 3 similar guides for you to choose: Ubuntu Server 12.4, Ubuntu Server 14.04 and a generic one. All of them rely on Openswan.
  • OpenVPN - this is by far the easier way but has a heavy drawback: no native windows support. This is not a huge problem because it is supported on Windows too, but its installation is not so seamless. You have a great guide in the Community Help Wiki.

In addition, you will face another challange: how the clients authenticate themselves, PSK or PKI?

  • Pre-Shared Key (PSK): If your clients have dynamic IPs, or you want them to be able to roam freely and still be able to connect to your server, all the clients will have to share the same PSK. This means (at least when working with the IPsec solution) that the server will not be able to distinguish who is who (when configuring the tunnel).
  • Public Key Infrastructure (PKI): this is the complex configuration, with one certificate per client and a Root CA to rule them all (or sub-CAs). Just in case you choose certificates, let me point you to another resource.

3. Configure the clients

Just because PPTP and L2TP/IPsec are Windows native, it doesn't mean you won't run into trouble.

  • PPTP is kind of legacy, you should not have problems with this.
  • L2TP/IPsec: you will need to copy the Root certificate and configure the connection to use it or configure the IPsec PSK
  • OpenVPN: Windows installation should be quite straightforward, but it "must" be run as administrator. If you don't want to, or it is not an option, it is possible to run as non-admin.

Conclusion

  1. Don't use PPTP.
  2. Even if L2TP/IPsec may be the best choice for Windows environments, the over-killing configuration and setup may stop you from considering it feasible. Not to mention the double-edged benefit of native Windows protocols: client-side is not always Linux-friendly.
  3. OpenVPN is not a standard solution, but it is easy to install and configure, it is quite extended in the Linux world and there is plenty of support in both Linux and Windows communities.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.