Unix Server Tech Knowledge Base

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== OPNsense openVPN N2N ======

===== Planning =====

==== Considerations ====
To set up a site-to-site (aka net-to-net or lan-to-lan) OpenVPN connection, you have several things you must consider.
  - You must designate one router to be the "master."
     - If you are connecting multiple remote sites to one, it is pretty obvious which would be the central location (the "main office" or something)
     - If you are simply connecting two sites together, consider the following (in order)
        - Static, public IP address
        - More resources on router software
        - Location that has the best technical support
  - You will need to collect/decide on the following
    - remote LAN network(s) you want to access
    - local LAN networks you want to access
    - intermediary [[wp>Private_network]] not used anywhere else in your networks. **Note:** there is a problem I ran into using a /24 subnet. Use a /30 subnet for this.
    - distinct port for [[wp>User_Datagram_Protocol|UDP]] traffic (master will suggest an unused one when you create the new server).

==== Overview ====

  * Create between 1 and 3 certificates, depending on if you want to reuse existing ones or not.
  * Create a server (if not reusing an existing one)
  * Create Client Specific Override
  * Create 1-2 Firewall rules
  * Copy CA, User Certificate, TLS key to client machine
  * Match parameters (TLS key, compression, algorithms) to client creation.

==== What is going on ====

Skip this if you just want to get it set up.

Basically, the client is very similar to a Road Warrior client, except that all authentication is done automatically, without human intervention. The set up is a little more complex, since we use two certificates to verify we are talking to the right machines, and a shared key to ensure initial secure communication.

To initiate the conversation, the client contacts the server on a specific (generally UDP) port. The router then knows which OpenVPN server to point to based on that. OpenVPN can have several virtual servers running on one router, similar to having multiple web sites on one web server.

The client has a certificate (which was generated by the server) by which it identifies itself (user certificate). The server identifies itself via a server certificate, which is signed by the CA (Certificate of Authority) on the server. Thus, you must copy the the CA's certificate to the client so it knows how to verify that. So, the initial conversation is the client saying "hey, I'm joe, and here is my certificate" and the server replying with "oh, I'm mary, and here is my certificate." Thus, they begin to establish trust in each other.

Once trust is established, the server and client agree on secure communication based on TLS shared keys, an encryption algorithm and an authentication digest algorithm. Both sides must be set up the same on these.

This all happens very fast, at the beginning of the session, then traffic begins to flow. The client and server will renegotiate the secure communication regularly so traffic is less likely to be decrypted (decryption is much easier with a larger set of messages with the same keys).

So, when we create this linkage, we must create a certificate for both the client and the server, and a way of verifying it. Then, we need to agree on a shared key for encryption, and the algorithms used to secure future communications.

===== Set up server =====

  - Create or reuse the required certificates. It is just fine to use an existing Certificate of Authority (CA) and Server Certificate, but you should create a client certificate for each remote site. For more security and flexibility, you should create a new CA and server certificate for each server, since that allows you to invalidate one server without impacting others.
    - For the following, use good descriptive names. You will not only be trying to find them when you create the OpenVPN server, but you will be exporting them to import into the client. A name like //ca1// will **not** help you find anything.
    - one CA (you can use an existing one) **Note: with v21.1.2, it appears you have to create a separate one**
      - System | Trust | Authorities | Add or import CA
      - Descriptive Name: You can enter anything here, with spaces. This will be what you will select/identify this certificate with in the future
      - **Method:** Create an internal Certificate Authority
      - Fill in the rest of the form down to Common Name. I generally change the Lifetime depending on the application.
      - **Common Name:** No spaces, but use something you can recognize like "VPN-N2N-office"
      - Save
      - Export the Certificate (do not export the key) to someplace you can use to get to the client.
    - one Server Certificate
      - System | Trust | Certificates | Add or import certificate
      - Descriptive Name: You can enter anything here, with spaces. This will be what you will select/identify this certificate with in the future
      - **Method:** Create an internal Certificate
      - **Certificate Authority:** CA created in previous step
      - **Type:** Server Certificate
      - Fill in the rest of the form down to Common Name. I generally change the Lifetime depending on the application.
      - **Common Name:** again, use something descriptive with no spaces
      - Save
      - **Do not export this certificate**
    - one Client Certificate for each remote (client) site
      - System | Trust | Certificates | Add or import certificate
      - Descriptive Name: You can enter anything here, with spaces. This will be what you will select/identify this certificate with in the future
      - **Method:** Create an internal Certificate
      - **Certificate Authority:** CA created in previous step
      - **Type:** Client Certificate
      - Fill in the rest of the form down to Common Name. I generally change the Lifetime depending on the application.
      - **Common Name:** again, use something descriptive with no spaces. You should really use the target (client) name or something in this.
      - Save
      - Export the client certificate created
      - Export the client key created
  - Create OpenVPN Server
    - VPN | OpenVPN | Servers | Add (or Use a Wizard)
    - **Server Mode:** Peer to Peer (SSL/TLS)
    - **Protocol:** I find it best to set specifically to UDP4 or UDP6
    - **Interface:** WAN
    - **Local Port:** Set to some unused port. 1194 or greater is the norm
    - **TLS Authentication** and create new key
    - **Peer Certificate Authority:** Select the CA you are using (the one you created)
    - **Server Certificate:** Select the Server Cert you created
    - **IPv4 Tunnel Network:** some random private /30 network. It is important with opnSense (as of 18.7) to use a /30 subnet here as otherwise it may hand out two different pairs of IP's to the client and server. See references at bottom
    - **IPV4 Local Networks:** Just your LAN network. You can add other networks by separating by comma's
    - **IPV4 Remote Networks:** The LAN network(s) of the client (separated by comma's, if needed)
    - Modify and record the Encryption Algorithm, Compression, etc.. as needed. You'll need this to match on the client.
    - Click Save
    - Edit the server record, and save the TLS key that was generated for the client (just copy, then paste into a file)
  - Create firewall rules to allow VPN access
    - Firewall | Rules | OPENVPN
      - Interface OPENVPN
      - Everything else default (any protocol, any source, any destination, etc...)
    - Firewall | Rules | WAN
      - **Inteface:** WAN
      - **Protocol:** UDP
      - **Source:** any
      - **Destination:** WAN address
      - **Destination port range:** Port from server definition
  - Go into VPN | OpenVPN | Client Specific Overrides and create a new override
    - Common Name: common name (CN) of client certificate.
    - IPv4 Remote Networks: network(s) on the client (remote) LAN

===== On Client Machine =====
  - Import CA from server
    - System | Trust | Authorities | Add or import CA
    - **Descriptive Name:** Something you can easily identify this with
    - Copy/paste data you exported from server (CA)
  - Import User Cert and Key from server
    - System | Trust | Certificates | add or import certificate
    - **Descriptive Name:** Something you can easily identify this with
    - Copy/paste user certificate from file you exported
    - Copy/paste user key from file you exported
  - Create Client
    - VPN | OpenVPN | Clients | add client
    - **Server Host or Address:** IP or DNS name of master
    - **Server Port:** Port used on the server
    - **TLS Authentication**
      - **Automatically generate a shared TLS authentication key**: uncheck
      - paste TLS key from server
    - **Peer Certificate of Authority:** Select CA you imported from master
    - **Client Certificate:** Select user certificate you imported from master
    - **Auth Digest Algorithm:** match server
    - **Encryption Algorithm:** match server
    - **Compression:** match server
    - Save
  - Set up firewall rule
    - If you want the main site to be able to access machines on the remote
      - Firewall | Rules  | OpenVPN
      - Add
      - Action = Pass (default)
      - Interface = OpenVPN (default)
      - Save (no other entries need to be made)
      - Reload your firewall rules.

===== Troubleshooting =====

When you press save, it should immediately try to connect to the server. If you do not get a connection, check the logs on both client and server.

I had an issue where my tunnel network was using a /24 network and OpenVPN on opnSense was assigning one pair of IP's to the master router and a different set to the client router. It was causing weird behavior where I could ping the LAN behind the master router from the client router, but not from the LAN behind the client router. There were also log entries stating that the BSD route command was failing.

In my case, I simply went into the configuration on both master and client and changed the tunnel network to /30 (just changed /24 to /30, saved and restarted). It gave both routers the same pair, and everything worked from there.

===== Links =====
  * [[https://doc.pfsense.org/index.php/OpenVPN_Site-to-Site_PKI_%28SSL%29]]
  * [[https://forum.opnsense.org/index.php?topic=11046.msg50463#msg50463]]