Table Of ContentBeginning OpenVPN 2.0.9
Build and integrate Virtual Private Networks using
OpenVPN
Markus Feilner
Norbert Graf
BIRMINGHAM - MUMBAI
This material is copyright and is licensed for the sole use by Alison Voyvodich on 4th December 2009
12593 80th Avenue N, , Seminole, , 33776
Beginning OpenVPN 2.0.9
Copyright © 2009 Packt Publishing
All rights reserved. No part of this book may be reproduced, stored in a retrieval
system, or transmitted in any form or by any means, without the prior written
permission of the publisher, except in the case of brief quotations embedded in
critical articles or reviews.
Every effort has been made in the preparation of this book to ensure the accuracy of
the information presented. However, the information contained in this book is sold
without warranty, either express or implied. Neither the authors, Packt Publishing,
nor its dealers or distributors will be held liable for any damages caused or alleged to
be caused directly or indirectly by this book.
Packt Publishing has endeavored to provide trademark information about all the
companies and products mentioned in this book by the appropriate use of capitals.
However, Packt Publishing cannot guarantee the accuracy of this information.
First published: December 2009
Production Reference: 1251109
Published by Packt Publishing Ltd.
32 Lincoln Road
Olton
Birmingham, B27 6PA, UK.
ISBN 978-1-847197-06-1
www.packtpub.com
Cover Image by Filippo Sarti ([email protected])
This material is copyright and is licensed for the sole use by Alison Voyvodich on 4th December 2009
12593 80th Avenue N, , Seminole, , 33776
Credits
Author Editorial Team Leader
Markus Feilner Akshara Aware
Co-author
Project Team Leader
Norbert Graf
Priya Mukherji
Reviewers
Chris Buechler Project Coordinator
Zainab Bagasrawala
Ralf Hildebrandt
Proofreaders
Acquisition Editor
Kevin McGowan
Louay Fatoohi
Chris Smith
Development Editor
Swapna Verlekar Graphics
Nilesh R. Mohite
Technical Editor
Akash Johari Production Coordinator
Dolly Dasilva
Copy Editor
Leonard D'silva Cover Work
Dolly Dasilva
Indexer
Hemangini Bari
This material is copyright and is licensed for the sole use by Alison Voyvodich on 4th December 2009
12593 80th Avenue N, , Seminole, , 33776
About the Author
Markus Feilner is a Linux professional from Regensburg, Germany and has been
working with open source software since the mid 1990s. His first contact with Unix
was with a SUN cluster and with SPARC workstations at Regensburg University
during his studies of geography, computer science, and GIS. Since the year 2000,
he has published several documents used in Linux training all over Germany.
In 2001, he founded his own Linux consulting and training company, Feilner IT
(http://www.feilner-it.net). Here, and as trainer, consultant, and systems
engineer at Millenux, Munich, he focused on groupware, collaboration, and
virtualization with Linux-based systems and networks.
He is working as Stellvertretender Chefredakteur at German Linux-Magazine,
where he writes about open source software for both printed and online magazines,
including the Linux Technical Review and the Linux Magazine International
(http://www.linux-magazine.com). He regularly gives speeches and lectures
at conferences in Germany. Security and VPN have never left his focus in his
publications and articles. Together with Packt, he published OpenVPN: Building and
Integrating Virtual Private Networks in 2006 and Scalix: Linux Administrator's Guide
in 2008.
He is interested in anything concerning geography, traveling, photography,
philosophy (especially that of open source software), global politics, soccer,
and literature, but always has too little time for these hobbies.
Markus Feilner supports Linux4afrika—a project bringing Linux computers into
African schools.
For more information, please visit http://www.linux4afrika.de.
This material is copyright and is licensed for the sole use by Alison Voyvodich on 4th December 2009
12593 80th Avenue N, , Seminole, , 33776
Acknowledgement
I'd like to thank all the people from the OpenVPN project and mailing lists. Thanks
to all the developers and especially to James Yonan for creating such a great
software. Thanks to everyone at Packt for working together through the last few
years (however tough they were). Thank you for your patience, your cooperative
style, and innovative ideas.
And, of course, the most important thank you goes to my co-author Norbert Graf,
who always had the right screenshot or configuration at hand.
Thanks to the fantastic staff at the Regensburg University Clinicum, especially at
station 21 who helped me get well again and cured me from Leukemia. Thanks to the
wonderful city of Regensburg and the great African people all over this continent!
This material is copyright and is licensed for the sole use by Alison Voyvodich on 4th December 2009
12593 80th Avenue N, , Seminole, , 33776
About the Co-author
Norbert Graf is a professional IT specialist from Munich with many years of
experience in network security and server virtualization. His special fields of interest
are Linux-based firewalls, VMware, and XEN virtualization.
Since 2002, he has been working as a consultant for an IT company near Munich,
for customers from the healthcare sector like hospitals or pharmaceutical concerns
to small companies.
He made his first experiences with computers with the Commodore C64 learning
to program in basic, followed by an x86 processor PC with DOS and Windows. He
is still working with Windows and Linux networks every day. His field of work
especially includes integrating Linux servers like Proxies or OpenVPN servers in
Microsoft Active Directory infrastructures.
Since 2007, he has published several articles (mostly about Windows and Linux
cooperation) together with Markus Feilner in the German and International
Linux Magazine.
In November 2007, his son Moritz was born and made the whole family very happy.
This material is copyright and is licensed for the sole use by Alison Voyvodich on 4th December 2009
12593 80th Avenue N, , Seminole, , 33776
About the Reviewers
Chris Buechler is the co-founder and Chief Technology Officer of BSD Perimeter
LLC, the corporate arm of the pfSense open source firewall distribution. He has more
than a decade of IT experience and holds numerous industry certifications including
CISSP, SSCP, MCSE, and CCNA among others. He served as the contributing author
on security for the book SharePoint 2007: The Definitive Guide from O'Reilly and is the
primary author of a book on pfSense to be published by Reed Media in 2009. He has
presented on security topics at more than a dozen conferences in the US and Canada.
He can be reached at [email protected].
Ralf Hildebrandt holds a degree in computer science and has been working with
Unix since 1994. His experience with computers dates back to 1984 and a sturdy
old C64. Recently, he changed employer from T-Systems to Charite and became
[email protected], thus gaining experience in running large listservers.
Ralf is the co-author of The Book of Postfix.
This material is copyright and is licensed for the sole use by Alison Voyvodich on 4th December 2009
12593 80th Avenue N, , Seminole, , 33776
This material is copyright and is licensed for the sole use by Alison Voyvodich on 4th December 2009
12593 80th Avenue N, , Seminole, , 33776
Table of Contents
Preface 1
Chapter 1: VPN—Virtual Private Network 7
Broadband Internet access and VPNs 9
How does a VPN work? 10
What are VPNs used for? 12
Networking concepts—protocols and layers 13
Tunneling and overhead 16
VPN concepts—overview 17
A proposed standard for tunneling 17
Protocols implemented on OSI layer 2 18
Protocols implemented on OSI layer 3 19
Protocols implemented on OSI layer 4 20
OpenVPN—a SSL/TLS-based solution 21
Summary 21
Chapter 2: VPN Security 23
VPN security 23
Privacy—encrypting traffic 24
Symmetric encryption and pre-shared keys 25
Reliability and authentication 26
The problem of complexity in classic VPNs 26
Asymmetric encryption with SSL/TLS 27
SSL/TLS security 28
HTTPS 29
Understanding SSL/TLS certificates 30
Trusted certificates 30
Self-signed certificates 32
This material is copyright and is licensed for the sole use by Alison Voyvodich on 4th December 2009
12593 80th Avenue N, , Seminole, , 33776
Table of Contents
SSL/TLS certificates and VPNs 33
Generating certificates and keys 34
Summary 34
Chapter 3: OpenVPN 35
Advantages of OpenVPN 35
History of OpenVPN 37
OpenVPN Version 1 38
OpenVPN Version 2 41
The road to version 2.1 42
Networking with OpenVPN 44
OpenVPN and firewalls 46
Configuring OpenVPN 47
Problems with OpenVPN 48
OpenVPN compared to IPsec VPN 49
User space versus kernel space 51
Sources for help and documentation 51
The project community 52
Documentation in the software packages 52
Summary 53
Chapter 4: Installing OpenVPN on Windows and Mac 55
Obtaining the software 55
Installing OpenVPN on Windows 56
Downloading and starting installation 56
Selecting the components and location 57
Finishing installation 59
Testing the installation—a first look at the panel applet 60
Installing OpenVPN on Mac OS X (Tunnelblick) 62
Testing the installation—the Tunnelblick panel applet 64
Summary 65
Chapter 5: Installing OpenVPN on Linux and Unix Systems 67
Prerequisites 67
Installing OpenVPN on SuSE Linux 68
Using YaST to install software 69
Installing OpenVPN on Red Hat Fedora using yum 72
Installing OpenVPN on Red Hat Enterprise Linux 75
Installing OpenVPN on RPM-based systems 77
Using wget to download OpenVPN RPMs 78
Installing OpenVPN and the LZO library with wget and RPM 79
Using rpm to obtain information on the installed OpenVPN version 80
[ ii ]
This material is copyright and is licensed for the sole use by Alison Voyvodich on 4th December 2009
12593 80th Avenue N, , Seminole, , 33776
