- OpenVPN Cookbook - Second Edition
- OpenVPN Cookbook - Second Edition
- Credits
- About the Author
- About the Reviewer
- www.PacktPub.com
- Customer Feedback
- Preface
- 1. Point-to-Point Networks
- 2. Client-server IP-only Networks
- Introduction
- Setting up the public and private keys
- A simple configuration
- Server-side routing
- Adding IPv6 support
- Using client-config-dir files
- Routing - subnets on both sides
- Redirecting the default gateway
- Redirecting the IPv6 default gateway
- Using an ifconfig-pool block
- Using the status file
- The management interface
- Proxy ARP
- 3. Client-server Ethernet-style Networks
- 4. PKI, Certificates, and OpenSSL
- Introduction
- Certificate generation
- OpenSSL tricks - x509, pkcs12, verify output
- Revoking certificates
- The use of CRLs
- Checking expired/revoked certificates
- Intermediary CAs
- Multiple CAs - stacking, using the capath directive
- Determining the crypto library to be used
- Crypto features of OpenSSL and PolarSSL
- Pushing ciphers
- Elliptic curve support
- 5. Scripting and Plugins
- 6. Troubleshooting OpenVPN - Configurations
- Introduction
- Cipher mismatches
- TUN versus TAP mismatches
- Compression mismatches
- Key mismatches
- Troubleshooting MTU and tun-mtu issues
- Troubleshooting network connectivity
- Troubleshooting client-config-dir issues
- Troubleshooting multiple remote issues
- Troubleshooting bridging issues
- How to read the OpenVPN log files
- 7. Troubleshooting OpenVPN - Routing
- Introduction
- The missing return route
- Missing return routes when iroute is used
- All clients function except the OpenVPN endpoints
- Source routing
- Routing and permissions on Windows
- Unable to change Windows network location
- Troubleshooting client-to-client traffic routing
- Understanding the MULTI: bad source warnings
- Failure when redirecting the default gateway
- 8. Performance Tuning
- 9. OS Integration
- Introduction
- Linux - using NetworkManager
- Linux - using pull-resolv-conf
- Windows - elevated privileges
- Windows - using the CryptoAPI store
- Windows - updating the DNS cache
- Windows - running OpenVPN as a service
- Windows - public versus private network adapters
- Windows - routing methods
- Windows 8+ - ensuring DNS lookups are secure
- Android - using the OpenVPN for Android clients
- Push-peer-info - pushing options to Android clients
- 10. Advanced Configuration
- Introduction
- Including configuration files in config files
- Multiple remotes and remote-random
- Inline certificates
- Connection blocks
- Details of ifconfig-pool-persist
- Connecting using a SOCKS proxy
- Connecting via an HTTP proxy
- Connecting via an HTTP proxy with authentication
- IP-less setups - ifconfig-noexec
- Port sharing with an HTTPS server
- Routing features - redirect-private, allow-pull-fqdn
- Filtering out pushed options
- Handing out the public IPs
OpenVPN supports on-the-fly compression of the traffic that is sent over the VPN tunnel. This can improve the performance over a slow network line, but it does add a little overhead. When transferring uncompressible data (such as ZIP files), the performance actually decreases slightly.
If the compression is enabled on the server but not on the client, then the VPN connection will fail.
Set up the client and server certificates using the Setting up public and private keys recipe from Chapter 2, Client-server IP-only Networks. For this recipe, the server computer was running CentOS 6 Linux and OpenVPN 2.3.11. The client was running Fedora 22 Linux and OpenVPN 2.3.11. Keep the configuration file, basic-udp-server.conf, from the Server-side routing recipe from Chapter 2, Client-server IP-only Networks, as well as the client configuration file, basic-udp-client.conf, at hand.
- Append a line to the server configuration file,
basic-udp-server.conf:comp-lzo
Save it as
example6-3-server.conf. - Start the server:
[root@server]# openvpn --config example6-3-server.conf - Next, start the client:
[root@client]# openvpn --config basic-udp-client.confThe connection will initiate, but when data is sent over the VPN connection, the following messages will appear:
Initialization Sequence Completed ... write to TUN/TAP : Invalid argument (code=22) ... write to TUN/TAP : Invalid argument (code=22)
During the connection phase, no compression is used to transfer information between the client and the server. One of the parameters that is negotiated is the use of compression for the actual VPN payload. If there is a configuration mismatch between the client and the server, then both the sides will get confused by the traffic that the other side is sending.
This error can easily be fixed for all the clients by just adding another line:
push "comp-lzo"
-
No Comment