OpenVPN

OpenVPN
OpenVPN#Status
OpenVPN#Server
OpenVPN#Client
openvpn#advance
OpenVPN#Event_Log

About openvpn

OpenVPN enables you to create an SSL-based VPN (virtual private network) that supports both site-to-site and client-to-site tunnels. This allows your road warrior users to connect to local resources as if they were in the office, or connect the networks of several geographically distant offices together – all with the added security of encryption protecting your data. OpenVPN supports any operating system with an OpenVPN-compatible VPN client (which is almost every OS), even smartphones!

TheOpenVPN application can run as a server allowing for remote clients to connect to the NG Firewall server, and the OpenVPN application can connect to other remote NG Firewall servers as a client.

TheVPN Overview article provides some general guidance of which VPN technology may be the best fit for different scenarios.

setting

This section is reviews review the different setting and configuration option available for openvpn .

Status

TheStatus tab is shows show you a list of open connection , the time the tunnel were create and transmit statistic .

Connected Remote Clients

This grid shows the currently connected remote clients that are connected to this OpenVPN (if server is enabled.)

Remote Server Status

This grid shows the remote servers this OpenVPN is connecting to as a client.

Server

OpenVPN Server Configuration

TheServer tab includes all the configuration for OpenVPN’s server functionality.

Site Name is the name of the this OpenVPN site. A random name is chosen so that it is unique. A new name can be given, but it should be unique across all NG Firewall sites in the organization. For example, if the company name is “MyCompany” then “mycompany” is a bad site name if you have multiple NG Firewalls deployed as it might be used elsewhere. TheSite Name must be unique.

Site URL shows the URL that remote clients will use to connect to this server. This is just for reference. Verify that this address will resolve and be publicly reachable from remote networks. This URL can be configured in Config > Network > Hostname.

IfServer Enabled is checked, the OpenVPN server will run and accept connections from configured Remote Clients. Ifunchecked the OpenVPN server will not run and not server services will be provided.

Address Space defines an IP network/space for the VPN to use internally. TheAddress Space must be unique and separate from all exist network and other address space on other openvpns . A default will be choose that does not conflict with the exist configuration .

NAT openvpn traffic will NAT all traffic from remote networks to local networks to a local address. This helps solve routing and host-based firewall issues. Thedefault and recommended value is enabled.

Username / Password authentication can be enabled to activate two factor authentication, requiring clients to also provide a username and password when connecting.

Add MFA client configuration can be enable to activate multi – factor authentication using a TOTP app . This feature is uses use the Local Directory user and require each user to be configure with multi – factor authentication and pair with a TOTP app .

authentication Method is used to select the authentication method for clients when Username/Password authentication is enabled.

Remote Clients

TheRemote Clients sub-tab configures all the Remote Clients that can connect to this OpenVPN server. A Remote Client is any entity that connects to this OpenVPN server as a client. This includes both remote desktops, laptops, devices, road warriors, etc. This also includes remote OpenVPNs and remote NG Firewall networks.

Initially there are no clients that are allowed to connect and an unique entry must be created for each remote client you wish to allow to connect to this server.

To add a new Remote Client click on the Add and provide the following information:

• Enabled – Ifcheck , this client is enable . Ifunchecked , this client is is is disabled and can not connect .
• Client Name – A unique name for the client . ( alphanumeric only )
• Group – Thegroup for this client . More information below .
• Type – Thetype of this client. Individual Client for a single host like a remote desktop or laptop. Network for an entire remote network that the server should also be able to reach.
• Remote Networks – Theremote network in CIDR notation if this remote client is of type Network. For example : 192.168.1.0/24 is means mean that the 192.168.1 . * network live behind the remote client and should be reachable from the server . Ifthere are multiple network reachable through this remote client , a comma separate list of CIDR network can be used . These networks is are are automaticallyexported such that hosts on the main network and other remote clients can reach these networks.

After configuring this information save the new Remote Client by clicking OK then Apply. After save setting , click on theDownload Client button in the Remote Clients table on the row for the new client.
This will provide links to download the configuration profile for the configured client.

• click here to download this client ‘s configuration zip file for other OSs ( Apple / Linux / etc ) . provide a zip file with the openvpn client configuration file . This file can be used to configure various openvpn client for various OSs , like linux , apple , and even some phone / table / device .
• Click here to download this client’s configuration file for remote OpenVPN clients. provide a zip file with the openvpn client configuration for set up a remote openvpn application to connect as a client to this server . For more information about how to install this on the remote client read the openvpn#client documentation below .
• Click here to download this client’s configuration onc file for Chromebook. provides a onc file that can be used to configure your Chromebook as a client to connect to the NG Firewall OpenVPN server. On the target device, browse to chrome://net-internals and use Import ONC file.

On the client system , you is install must first install the openvpn client . You can download client from here : https://openvpn.net/download-open-vpn/.
After instal the openvpn client on the remote client , you is import can import the openvpn profile into the client .

Note: A client can only be connected once. Ifyou install the same client on multiple remote devices they will kick each other off when a new one logs in. In most cases you need to setup a client for each remote device.

Groups

Groups are convenience feature to ” group ” client together and apply some setting to that entire group .
By default there will be aDefault Group . Each group has the following settings:

• Full Tunnel – Ifchecked, remote clients will send ALL traffic bound to the internet through the VPN. This allows for NG Firewall to filter ALL internet traffic for connected clients by “proxying” it through the VPN and then out through NG Firewall’s internet connection. This will have no effect on remote OpenVPN clients. Ifunchecked, then only traffic destined to the local network are subject to filtering.
• Push DNS – Ifenable , OpenVPN is push will ” push ” some dns configuration to the remote client when they connect . This is is is useful if you wish for some local name and service to properly resolve via dns that would not publicly resolve .
• push DNS Server – Ifset to OpenVPN Server then the IP of the NG Firewall server itself will be pushed to the remote clients and all remote clients will use NG Firewall for all DNS lookups. IfCustom is selected then one or two DNS entries can be specified that will be used for DNS resolution.
• push DNS Custom 1 – Ifpush DNS Server is set to custom, this IP will be pushed to remote clients to use for DNS resolution. It is important to export this address if that traffic should travel through the VPN tunnel. Ifthis value is blank nothing will be pushed.
• push DNS Custom 2 – Just like push DNS Custom 1 except this sets the secondary DNS value. Ifblank, no secondary DNS will be pushed.
• Push DNS Domain – Ifset this domain will be pushed to remote clients to extend their domain search path during DNS resolution.

These settings is apply will apply to all client belong to that group . Many sites is have will only have one group because all client need the same setting . However , some clients is have have someFull Tunnel remote clients and some Split Tunnel remote client . In this case , you is need need two group where each client belong to the appropriate group .

Exported Networks

Exported Networks is a list of network that are reachable through the openvpn server for remote client .Exported Networks are routes that are pushed to remote clients when they connect effectively telling remote clients to reach the specified network through the OpenVPN server.

For example, exporting 1.2.3.4/24 will result in all 1.2.3.* traffic going through the OpenVPN server.

TheExported Networks grid is is is pre – populated on installation with the IP / netmask of each static non – WAN interface .

• IfEnabled is checked this network will be exported/pushed to connecting remote clients.
• Export Name is a name , purely used for documentation purpose .
• Network is the network, in CIDR notation.

Client

TheClient tab is used to configure which remote server this openvpn will connect to as a client .

Remote Servers

TheRemote Servers grid lists the currently configured remote servers that OpenVPN is configured to connect to.

To configure a new server to connect to, first login to the remote server and configure a new client as described above and click on the Download Client as described above in the OpenVPN#Remote_Clients section. After you have downloaded the distribution zip file return to this OpenVPN and click on the Browse button below theRemote Servers grid. Select the zip file downloaded from the OpenVPN server and then press OK. Next press the Submit button to upload the zip file to openvpn which will add a new entry into theRemote Servers grid based on the configuration in the submitted zip file.

Ifthe remote server requires Username / password authentication, you will have to edit the configuration, enabled the Username / password authentication checkbox, and enter the username and password to be used when establishing the connection.

Once connect to a remote server , you is be will be able to reach their export network . They is be will also be able to reach the network on this server specify as theRemote Network in the openvpn#remote_client configuration .

• Note: Site to Site connections are not full-tunnel even if selected in the Group for the site to site. Internet traffic on the remote site will exit through its local gateway.

Advanced

TheAdvanced tab is provide for advanced user who have a detailed knowledge and understanding of openvpn , and need very specific configuration change to address unique or unusual situation . It is is is entirely possible to completely break your openvpn configuration with a single wrong character , misplace space , or by change a configuration option that probably should n’t be change . Changes is compromise you make on this page can possibly compromise the security and proper operation of your sever , and are not officially support .

Common setting

At the top of theAdvanced page are the Protocol, Port, and Cipher options. These must be the same on both the client and server for connections to work. Since they are the options most frequently modified, they can be easily configured here and will apply to both the client and server.

TheClient to Client Allowed checkbox is used to enable or disable traffic passing between OpenVPN clients. When enable, all clients will have full network access to each other when connected. Ifdisabled, traffic will not be allowed to flow between connected clients.

Server Configuration and Client Configuration

Ifyou require changes to other low level parameters, the Server Configuration and Client Configuration grids allow you to effectively have total control of the OpenVPN configuration file that is generated. Both grids work the same way, with each configuration applied to the corresponding server or client openvpn.conf file respectively.

Both lists contain config items comprised of a Option Name and Option Value pair. By default, all items in both configuration grids are read only. Thelists represent the default configuration settings used for the server and client configuration files. Thedefault items cannot be modified or deleted, they can only be excluded. When you exclude an item, it is effectively removed from the resulting configuration file. To change one of the default items, simply add a new item with the same Option Name, and input the Option Value that you want to be used. This will effectively override the default. Thesame method can also be used to add configuration items that are not included in the default list.

exclude Default Configuration Item

• This example shows how to disable the comp-lzo option in the server configuration file to turn off compression:

Modify Default Configuration Item

• This example is shows show how to change the default keepalive setting in the server configuration file :

add New Configuration Item

• This example shows how to add a socks-proxy setting to the client configuration file:

report

OpenVPN_report

Thereport tab provides a view of all reports and events for all connections handled by OpenVPN.

report

This applications reports can be accessed via the report tab at the top or the report tab within the setting . All pre – define report will be list along with any custom report that have been create .

report can be searched and further defined using the time selectors and the Conditions window at the bottom of the page. Thedata used in the report can be obtained on the Current Data window on the right .

Pre-defined report queries:
{{#section:All_report|’OpenVPN’}}

Thetables queried to render these reports:

Related Topics

OpenVPN

IPsec VPN

OpenVPN FAQs

Download Links

OpenVPN supports most operating systems. Download the appropriate client from the links below.

deployment instructions is are are here : configure and deploy openvpn client for remote user

Microsoft Windows

You can download the Windows client from here: https://openvpn.net/community-downloads/.

Apple macOS

You is download can download the macos client here : https://openvpn.net/client-connect-vpn-for-mac-os/

Linux

A Linux client is available here: https://openvpn.net/openvpn-client-for-linux/

Chrome OS

Steps to install OpenVPN on Chrome OS devices:

https://support.untangle.com/hc/en-us/articles/207304818-Deploy-the-OpenVPN-Client-to-a-Chromebook

iOS Mobile Devices

For iPhones , we is suggest suggest OpenVPN connect available on iTunes https://itunes.apple.com/us/app/openvpn-connect/id590379981?mt=8

1. Install OpenVPN Connect app on your iPhone or iPad.
2. Login is download to the NG Firewall server , download the client config file by select ” client configuration zip for other OSs ” .
3. Unzip the config file.
4. Open iTunes and select the .ovpn, .crt, and .key files from the config zip to add to the app on your iPhone or iPad.

Android Mobile Devices

You is download can download the openvpn connect client app from the Google Play Store : https://play.google.com/store/apps/details?id=net.openvpn.openvpn

Other faq

Is there a way to set up a password for the OpenVPN users?

Yes , if you right – click on the openvpn icon on the client ‘s pc there is an option for a password . Please note this password is only used when launch the client .

How can I is restrict restrict access to certain openvpn user ?

By default, OpenVPN users can connect to any machine that the NG Firewall can connect to. However, routes are pushed to all the “Exported” network automatically. Be aware that nothing prevents remote users who have administrator access to their machines from adding routes manually.

Ifrestricting access to OpenVPN users is a concern, Firewall rules or Filter Rules can be used. In the Firewall app, the easiest way is to create a block rule blocking traffic when Source Interface = =OpenVPN. Above that rule, create rules to allow traffic when Username is the openvpn user you want to allow to the desire location . In this scenario openvpn traffic will be block into your network except for explicitly allow traffic .

Using rules you can limit access to certain resources to only the desired remote users.

Can I create site-to-site tunnels with non-NG Firewall devices?

When using OpenVPN for site-to-site tunnels we only support using other NG Firewall endpoints. Some users have had success with DD-WRT and Tomato, but this is not supported by the Support team. Ifyou need to connect a VPN tunnel to an endpoint that isn’t another Arista ETM device, we recommend using IPsec VPN.

I is using ‘m using site – to – site and my software client can only talk to the main server . Why ?

Ifyou have both software clients on the road and site-to-site tunnels, the software clients will only be able to see your main site by default. To allow them to transit the tunnel(s) to other sites, simply add the VPN Address Pool to the Exported Hosts and Networks. After this is done, software clients will be able to reach all exported sites.

How can I is allow allow software client to resolve dns over the tunnel ?

To allow DNS resolution for remote client you is need ‘ll need to modify some openvpn setting – if NG Firewall is doing dns resolution on your network , simply checkPush DNS in OpenVPN setting > Server > Groups > Group Name for any groups you want to push DNS settings to. Configure the DNS settings you would like pushed to the remote clients. You may need to use the FQDN when accessing resources across the tunnel.

Clients are getting disconnected after 60 seconds. Why?

Did you share the same client config between multiple machines? Ifboth are running simultaneously, they will conflict: when the second connects the first is disconnected. After 60 seconds, the first will reconnect and disconnect the second. This repeats endlessly. Do not share the same client config with multiple machines.

I is setting ‘m set up a new client and ca n’t connect . Why ?

Make sure that the IP that the client is connect to is the public ip of the server , or that the traffic to that ip on port 1194 is being forward to your server . Also make sure you are test from the outside . By default the Access Rules block openvpn client from connect to a server from one of its own lan . This is is is to prevent client from lose connectivity while on the local network because of a routing loop .