Knowledgebase
|
Configuring a VPN Appliance for Remote Access
Posted by on 16 July 2018 10:19 AM
|
|
VPN Appliance Powered by OPNsenseThe eApps VPN Appliance is powered by OPNsense, a leading open source network security platform based on FreeBSD. See https://www.opnsense.org. OPNsense supports OpenVPN, a widely used SSL VPN technology that is well suited for client/server VPN tunnels. The configuration of the VPN Appliance is done using the OPNsense user interface. Some configuration settings on your eApps Virtual Servers must be performed via the command line. This guide explains how to set up your remote access VPN. If you would like to have eApps perform the setup and configuration for you, contact sales@eapps.com PrerequisitesIn order to configure a remote access VPN server, you will need to have the following:
You will also need the following:
To log in to your dashboard, follow these steps:
Create a Certificate AuthorityThis step is only required for the first time setup. If you decide to create more VPN servers, you can use the same Certificate Authority and Server Certificate you create now, or you can create new ones for each tunnel.In your VPN Appliance dashboard, navigate to System -> Trust -> Authorities and click on + Add or Import CA. We will use these settings for this example: Descriptive name: My Internal CANote that you can select a higher value for Lifetime. This can be useful if you want to avoid having to create a new Certificate Authority and Server Certificate every year. Click Save to add the new Certificate Authority. Create a Server CertificateNow we will use this Certificate Authority to create a new Server Certificate. This step is only required for the first time setup. If you decide to create more VPN servers, you can use the same Certificate Authority and Server Certificate you create now, or you can create new ones for each tunnel.In your VPN Appliance dashboard, navigate to System -> Trust -> Certificates and click + add or import certificate. We will use these settings for this example: Method: Create an internal CertificateNote that you can select a higher value for Lifetime. This can be useful if you want to avoid having to create a new Certificate Authority and Server Certificate every year. Click Save to create the certificate. Add a VPN ServerIn your VPN Appliance dashboard, navigate to VPN -> OpenVPN -> Servers and click on + add server. We will use these settings for this example:===General information===Click Save to add the new VPN Server. The VPN Server setup is now complete. From now on, you will only need to add a user for each new client you want to connect to the VPN. This means if you want to connect one of your eApps Virtual Servers to the VPN, you will need to create a "user" for each server. Add UsersIn your VPN Appliance dashboard, navigate to System -> Access -> Users. Click on the + sign to add a new user. We will use the following settings for this example:Disabled: UncheckedClick Save and you will be redirected to the User Certificate creation page. We will use the following settings for this example: Method: Create an internal CertificateClick Save to finish creating the User Certificate Click Save again to finish creating the User Configuring ClientsOPNsense provides easy to install packages for personal clients on various platforms such as Windows, Mac, iPhone, Android and Linux. You can export an installation package and find instructions for setting up each client depending on the platform directly on your VPN Appliance.In your VPN Appliance dashboard, navigate to VPN -> OpenVPN -> Client Export. Leave the default settings and scroll down to Client Install Packages. Select the package you want in the Export dropdown to automatically download the files you need to set up your clients. You can find documentation and client download links in the Links to OpenVPN clients section. Configure Access to Your Virtual Server(s)In your VPN Appliance dashboard, navigate to VPN -> OpenVPN -> Client Export. Select the Archive file from the Export dropdown. Copy this.zip file to your eApps Virtual Server. In this example, we have copied it to the /root directory of the server appserver1CentOS 7Install OpenVPN usingyum[root@appserver1 ~]# yum -y install openvpnUnzip the archive you downloaded from your VPN Appliance. You should have a .crt file, a .key file, and a .ovpn file.[root@appserver1 ~]# unzip OPNsense-udp-1194-config.zipMove the files to the appropriate directory and rename the .ovpn configuration file to a more descriptive name (such as this server's hostname) with a .conf extension.
[root@appserver1 ~]# mv OPNsense-udp-1194/OPNsense-udp-1194* /etc/openvpn/client/Copy the default systemd service file to a new file and name it something more descriptive, such as the name of your VPN.[root@appserver1 ~]# cp /usr/lib/systemd/system/openvpn-client\@.service /usr/lib/systemd/system/corporate-vpn\@.serviceRemove an unnecessary option from the newly created systemd service file[root@appserver1 ~]# sed -i 's/--nobind //g' /usr/lib/systemd/system/corporate-vpn\@.serviceCreate an authentication file that will have the username and password this server will use to authenticate to your VPN Server. The ^C means to hit ENTER after the password and then CTRL+C[root@appserver1 ~]# cat > /etc/openvpn/client/auth.txtEdit the OpenVPN configuration file to include your authentication file [root@appserver1 ~]# sed -i 's/auth-user-pass/auth-user-pass auth.txt/'g /etc/openvpn/client/appserver1.confChange the permissions of the files so only root has access to them[root@appserver1 ~]# chmod 600 /etc/openvpn/client/*Reload systemd and enable the service so it will start up automatically after a reboot[root@appserver1 ~]# systemctl daemon-reloadYour server should now be connected to the VPN Server. It should have an IP assigned from the IP pool you selected earlier. In the following example, the server was assigned the IP 172.16.0.14[root@appserver1 ~]# systemctl status corporate-vpn@appserver1 CentOS 6Install OpenVPN usingyum[root@appserver4 ~]# yum -y install openvpnUnzip the archive you downloaded from your VPN Appliance. You should have a .crt file, a .key file, and a .ovpn file.[root@appserver4 ~]# unzip OPNsense-udp-1194-config.zipMove the files to the appropriate directory and rename the .ovpn configuration file to a more descriptive name (such as this server's hostname) with a .conf extension.[root@appserver4 ~]# mv OPNsense-udp-1194/OPNsense-udp-1194* /etc/openvpn/Create an authentication file that will have the username and password this server will use to authenticate to your VPN Server. The ^C means to hit ENTER after the password and then CTRL+C[root@appserver4 ~]# cat > /etc/openvpn/auth.txtEdit the OpenVPN configuration file to include your authentication file [root@appserver4 ~]# sed -i 's/auth-user-pass/auth-user-pass auth.txt/'g /etc/openvpn/appserver4.confChange the permissions of the files so only root has access to them[root@appserver4 ~]# chmod 600 /etc/openvpn/*Add the OpenVPN service to the startup system services so it will start up automatically after a reboot [root@appserver4 ~]# chkconfig openvpn onYour server should now be connected to the VPN Server. It should have an IP assigned from the IP pool you selected earlier. In the following example, the server was assigned the IP 172.16.0.18[root@appserver4 ~]# service openvpn status Debian 8, 9, Ubuntu 16, and Ubuntu 17Install OpenVPN usingaptroot@appserver3:~# apt-get install openvpnUnzip the archive you downloaded from your VPN Appliance. You should have a .crt file, a .key file, and a .ovpn file.root@appserver3:~# unzip OPNsense-udp-1194-config.zipMove the files to the appropriate directory and rename the .ovpn configuration file to a more descriptive name (such as this server's hostname) with a .conf extension.root@appserver3:~# mv OPNsense-udp-1194/OPNsense-udp-1194* /etc/openvpn/Create an authentication file that will have the username and password this server will use to authenticate to your VPN Server. The ^C means to hit ENTER after the password and then CTRL+Croot@appserver3:~# cat > /etc/openvpn/auth.txtEdit the OpenVPN configuration file to include your authentication file root@appserver3:~# sed -i 's/auth-user-pass/auth-user-pass auth.txt/'g /etc/openvpn/appserver3.confCopy the default systemd service file to a new file and name it something more descriptive, such as the name of your VPN.root@appserver3:~# cp /lib/systemd/system/openvpn\@.service /lib/systemd/system/corporate-vpn\@.serviceChange the permissions of the files so only root has access to themroot@appserver3:~# chmod 600 /etc/openvpn/*Reload systemd and enable the service so it will start up automatically after a rebootroot@appserver3:~# systemctl daemon-reloadYour server should now be connected to the VPN Server. It should have an IP assigned from the IP pool you selected earlier. In the following example, the server was assigned the IP 172.16.0.10root@appserver3:~# systemctl status corporate-vpn@appserver3 Windows 2016 and Windows 2012Install the OpenVPN client by downloading the.exe file from https://openvpn.net/index.php/open-source/downloads.html. It is in the Installer, Windows Vista and later row.Extract the files from the .zip archive you downloaded from your VPN Appliance to C:\Program Files\OpenVPN\configOpen Notepad and type your username in the first line, and your password in the second line. Save it as auth.txt in the C:\Program Files\OpenVPN\config directory. The final file should be C:\Program Files\OpenVPN\config\auth.txtRight click your .ovpn file in C:\Program Files\OpenVPN\config and click Open with... to open it with Notepad.Edit the file to add auth.txt to the end of the auth-user-pass line. If your file displays everything in a single line, you can break it up into multiple lines for better formatting. Here is an example file for your reference:dev tunSave the file and start the OpenVPN GUI. You can do this by clicking the icon on your desktop or right clicking the OpenVPN GUI icon on your taskbar then clicking Connect. It should connect without prompting for a username or password. Do not confuse it with the network system tray icon. The network system tray icon is a computer with an ethernet cable, while the OpenVPN GUI icon is a computer with a lock icon. Open PowerShell or Command Prompt and type services.msc. Press ENTERIn the Services window, right click on OpenVPNService and click on Properties Select Automatic from the Startup type dropdown Click Apply Click OK Note that the next time the server boots, OpenVPN will connect automatically. If you connect to your Windows server via Remote Desktop and check the OpenVPN GUI status icon, you will NOT see it connected. This is intended since the service is actually running as a system service in the background. You can check you have an IP from the private IP pool you selected above by opening PowerShell or Command Prompt and issuing the ipconfig command. The output should look something like thisWindows PowerShell PleskFollow the above VPN setup instructions depending on the operating system your Plesk control panel is installed on.To be able to manage the new private IP through Plesk, log in to your Plesk panel and navigate to Tools & Settings -> IP Addresses. Click Reread IP and the IP address will be added to the list of available IP addresses. You can now host a website, set up email, and use any other Plesk function with this IP address. cPanel/WHMFollow the above VPN setup instructions depending on the operating system your cPanel/WHM control panel is installed on.To be able to manage the new private IP through cPanel/WHM, log in to your WHM administration panel and navigate to Home -> IP Functions -> Rebuild the IP Address Pool. Click Proceed and the IP address will be added to the list of available IP addresses. You can now host a website, set up email, and use any other cPanel/WHM function with this IP address. | |
 (3 vote(s)) |
Comments (0)