App_Guide_OpenVPN_UserPassword Mode

Application Guide for Easy OpenVPN via IR700 ------User Password Mode, IR700 as Client/Server   1. Summary This guide will show you how to configure IR700 Cellular Router as both OpenVPN Server and Client. We are using user/password mode here. Any questions please contact us: support@inhandnetworks.com   Attention: 1) This application is suit for customers with small monitor center and small amount of usage, IR700 here used as server can support LESS THAN 10 points, if you have large amount, we suggest you to use large Linux OpenVPN Server and faster cable access for monitor center; 2) Before using VPN, please make sure both IR700 and remote PC can access to internet; 3) IR700 must be the following models: IR791WH01, IR791GSxx, IR794WH01, IR791UE, IR794UE.   2. Configure IR700 as OpenVPN Server Attention: 1) Before using VPN, please make sure both IR700 can access to internet; 2) For OpenVPN Server, IR700 must be with fixed IP or dynamic public IP with DDNS; 1. Configure LAN address After entering configure web, click “Network”????”LAN”, make sure IR700 and the application server are in the right subnet: 192.168.123.0/24, here we use: IR700: 192.168.123.250/24: Application Server: 192.168.123.123/24. 2. Insert CA Attention: You should insert all three CAs before click “Apply button”. Click “VPN”???? “Certificate Management”: Click the “Browse” button at the left side of “Import CA Certificate” and then choose the right “root certificate” (e.g.: ca. crt), then click “Import CA Certificate” button, and you will see: 3. Configure OpenVPN Advanced Options Click “VPN”????”OpenVPN Advanced”, configure as below: Enable Client-to-Client (Server Mode Only), and click “Add” to add this tunnel setting: And then click “Apply”. Notice: The “Local Static Route” is a route added in the server to tell itself what the subnet of OpenVPN Client is. The “Remote Static Route” is a route pushed to the OpenVPN client to tell what’ the server’s subnet. If you have one more subnet, please divide routes using “,”, e.g.: 192.168.220.0/24, 192.168.221.0/24. 4. Add OpenVPN Tunnel Click “VPN”????”OpenVPN Tunnels”: Configure as below: Then click “Save”, after a few seconds, you will see: The server is now created successfully! 3. Configure another IR700 as OpenVPN Client Attention: 1) Before using VPN, please make sure both IR700 can access to internet; 2) For OpenVPN client, IR700 can access to internet via any cellular or wired form; 1. Configure LAN address After entering configure web, click “Network”????”LAN”, make sure IR700 and the PC are in the right subnet: 192.168.220.0/24, here we use: IR700: 192.168.220.1/24: PC: 192.168.220.10/24. 2. Insert CA Attention: You should insert the root CA (e.g.: ca.crt) before click “Apply button”. Click “VPN”???? “Certificate Management”: Click the “Browse” button at the left side of “Import CA Certificate” and then choose the right “root certificate” (e.g.: ca. crt), then click “Import CA Certificate” button, and you will see: Click “Back” button and return to the former page. Then remember to click “Apply” button. 3. Add OpenVPN Tunnel Click “VPN”????”OpenVPN Tunnels”: Then click “Add” to add a new tunnel: Configure as below: Attention: if you are using DDNS at the server side, you should configure DDN in the client IR700: Click “Network”????”DNS”, configure as below and then click “Apply”: (The DNS: 8.8.8.8 and 8.8.4.4 is Google’s and available across global) Then click “Save”, after a few seconds, you will see the tunnel created: The server is now created successfully! And at the client side, you can easily get access to the server subnet: Official OpenVPN client software is also supported (please see http://openvpn.net/ for the latest release). The next chapter (Advanced Configuration) will show you how to realize. 4. Advanced Configuration One of the practical utility for OpenVPN is that the server can create tunnels with different clients: At the former steps, we have already configured one tunnel, here we add another. If you need add more, you can use similar method. 1. Entering the server’s web, click “VPN”????”OpenVPN Advanced” and change the settings as below: The “Remote Static Route” will tell your pc what the subnets of both client IR700 and server IR700 are. Then click “Apply”. The OpenVPN service will restart. Meanwhile, the clients will loss the old OpenVPN connection and then restart to connect to the new server automatically. 2. Configure PC using OpenVPN client software Here we provide a configure file, please put this .ovpn file and ca.crt in the directory: /OpenVPN/config ############################################## # Sample client-side OpenVPN 2.0 config file # # for connecting to multi-client server. # # # # This configuration can be used by multiple # # clients, however each client should have # # its own cert and key files. # # # # On Windows, you might want to rename this # # file so it has a .ovpn extension # ############################################## # Specify that we are a client and that we # will be pulling certain config file directives # from the server. client # Use the same setting as you are using on # the server. # On most systems, the VPN will not function # unless you partially or fully disable # the firewall for the TUN/TAP interface. ;dev tap dev tun # Windows needs the TAP-Win32 adapter name # from the Network Connections panel # if you have more than one. On XP SP2, # you may need to disable the firewall # for the TAP adapter. ;dev-node MyTap # Are we connecting to a TCP or # UDP server? Use the same setting as # on the server. proto tcp ;proto udp # The hostname/IP and port of the server. # You can have multiple remote entries # to load balance between the servers. ;remote digidata.dynalias.com 1194 remote 203.86.63.237 1194 # Choose a random host from the remote # list for load-balancing. Otherwise # try hosts in the order specified. ;remote-random # Keep trying indefinitely to resolve the # host name of the OpenVPN server. Very useful # on machines which are not permanently connected # to the internet such as laptops. resolv-retry infinite # Most clients don't need to bind to # a specific local port number. nobind # Downgrade privileges after initialization (non-Windows only) ;user nobody ;group nobody # Try to preserve some state across restarts. persist-key persist-tun # If you are connecting through an # HTTP proxy to reach the actual OpenVPN # server, put the proxy server/IP and # port number here. See the man page # if your proxy server requires # authentication. ;http-proxy-retry # retry on connection failures ;http-proxy [proxy server] [proxy port #] # Wireless networks often produce a lot # of duplicate packets. Set this flag # to silence duplicate packet warnings. ;mute-replay-warnings # SSL/TLS parms. # See the server config file for more # description. It's best to use # a separate .crt/.key file pair # for each client. A single ca # file can be used for all clients. ca ca.crt ;cert pub.crt ;key pri.key # Verify server certificate by checking # that the certicate has the nsCertType # field set to "server". This is an # important precaution to protect against # a potential attack discussed here: # http://openvpn.net/howto.html#mitm # # To use this feature, you will need to generate # your server certificates with the nsCertType # field set to "server". The build-key-server # script in the easy-rsa folder will do this. ;ns-cert-type server auth-user-pass # If a tls-auth key is used on the server # then every client must also have the key. ;tls-auth ta.key 1 # Select a cryptographic cipher. # If the cipher option is used on the server # then you must also specify it here. ;cipher x # Enable compression on the VPN link. # Don't enable this unless it is also # enabled in the server config file. comp-lzo # Set log file verbosity. verb 3 # Silence repeating messages ;mute 20 Then the VPN is successfully created: You can also access to the remote site IR700 client.