GP3.2 OpenVPN (en)

- in Deutsch

- in English

This article is valid for Gemini plugin version GP 3.2 and GP 3.3

OpenVPN with active client

After installing the geminiopenvpn Plugin you have an OpenVPN Server or Client which is easy to configure. The plugin uses certificates (Server-Multi-Client). The connection on the OpenVPN Server is made over an encrypted TLS connection.

For connections the OpenVPN Server Plugin creates a virtual network interface (tap0), which is connected over a network bridge (br0) with the internal network adapter (eth0) of the Dreambox. One or more OpenVPN clients get an IP address of the internal network and can access all available services without additional routing.

The mode used by OpenVPN is Bridging. With this mode the Broadcasts are forwarded without any problem. Same for network protocols like IPv4, IPv6, Netalk, IPX, ...

Requirements for using OpenVPN

• OE 2.0 or OE 2.2 image with GP3 Plugin.
• OpenVPN Plugin must be installed, configured and started.
• The OpenVPN Server supports only a cabled network (no Wlan).
• Portforwarding on the router to the Dreambox (Port 1194/UDP).
• For reaching the Server you need to know your WAN IP, or use a DDNS Service (e.g. No-IP).
• For access you need to create certificates for each client.
• OpenVPN needs to be installed on clients. Protocols like IPSec, IKE, PPTP, or L2TP are not supported.
• Server Lan and Client Lan must be different.

Installation / Deinstallation

The geminiopenvpn plugin can be installed / removed in different ways:

see article: GP3 Addons - Category: Gemini Plugins

see article: WebAdmin - Package name: geminiopenvpn

see article: OPKG - Package name: geminiopenvpn

After the installation restart the Dreambox.

OpenVPN Server

Create Root Certificate

root certificate - Skin example: gp-skin-dmconcinnity-mod

Now we create the keys and certificates for the Certificate Authority (CA). Open the OpenVPN Server Plugin and push the [green] button for certificates.

Choose root-certificate and change the settings as described in the list. For all parameters only letters and numbers can be used.

Parameter	Description
Password	Enter a Password. Memorize the password, you will need the password for creating Server and Client certificates or for blocking a certificate.
valid for x years	Enter the validity period for the certificate in years.
Project	Enter a Project name for the certificate creation.
Country	Enter the country.
City	Enter the city.
State	Enter the state.

Save the settings with the [green] button. The corresponding files will be created and saved in the directory /etc/ssl/openvpn.

Create Server Certificate

Server certificate

Open the OpenVPN Server Plugin and push the [green] button for certificates. Push again the [green] button and choose as type the setting Server and change the settings as described in the list.

Parameter	Description
valid for x years	Enter the validity period for the certificate in years.

Save the settings with the [green] button to create the certificates. You will be prompted to enter the password (which was entered while creating the root certificate). When a wrong password is entered the following error message is displayed: can't generate certificate.

When the correct password is entered the certificates, keys and the Diffie-Hellman parameters are created. This can take some minutes (up to 30 min), the status is displayed in the plugin. The plugin can be closed while the creation is in progress, the process continues in background.

Create Client Certificate(s)

Client certificate

Open the OpenVPN Server Plugin and push the [green] button for certificates. Push again the [green] button and choose as type the setting Client and change the settings as described in the list.

Parameters	Description
valid for x years	Enter the validity period for the certificate in years.
Name:	Desired name for the client. If more client certificates are used, each must have a different name.

Save the settings with the [green] button to create the certificates. You will be prompted to enter the password (which was entered while creating the root certificate). When a wrong password is entered the following error message is displayed: can't generate certificate.

When the correct password is entered the client certificate, key and configuration file can be found in the following directory:

/etc/ssl/openvpn

These files (three files for each client) will be used later on the OpenVPN clients to set up a connection with the server. The needed files look like follows, e.g. if the entered name was 7020hd. In addition to the three files every client needs the Root Certificate (vpn-ca.pem).

File name	Description
7020hd-cert.pem	Client Certificate.
7020hd-key.pem	Key File.
7020hd.ovpn	Configuration file for the client. If multiple certificates for multiple clients are created, every name needs to be different.
vpn-ca.pem	The Root Certificate.

Overview of the configuration

Overview of the configuration

The created configurations can be displayed with the [green] button (certificates) in the OpenVPN Server Plugin. The example shows the configuration for a root certificate, Server settings and the configuration of two clients, with the names htc and 7020hd.

Settings

OpenVPN settings

Open the OpenVPN Server Plugin in the BluePanel under the daemons. Now we check first the settings, before starting the OpenVPN Server. Push the [blue] button and choose the point [Settings]. Use the following list for the descriptions and modify if requires. The network settings should be taken from the Dreambox and should only be changed in rare occasions.

Settings	Description
Number of clients	Amount of clients, which can connect with the OpenVPN Server.
first client IP	From this IP address on the IP's are assigned to the clients. Attention make sure this range is not overlapping with the dhcp server of the network!
IP eth0	The IP Adress of the Dreambox for the lan interface (eth0). This address is only used for the network bridge (br0). Keep in mind the local network card has no IP address in this mode, don't panic when checking the network adapter with ifconfig.
Netzmaske eth0	Enter the subnetmask of the local network.
Broadcast eth0	Enter the broadcast address of the local network.
IP Router Gateway	Enter the IP address of the routers.
Log File	Enable/disable the log file. When activated the log is in /var/log/openvpn.log

Save the settings with the [green] button. After saving the settings the OpenVPN Server is started automatically. The OpenVPN Server will also be started automatically after restarting the Dreambox, when a configuration file and certificates are available.

Restart the Dreambox The OpenVPN Server will also be started automatically after restarting the Dreambox, when a configuration file and certificates are available.

OpenVPN Log File

Log file

Informations about the status of the OpenVPN server can be displayed with the [red] button (Log file). The example shows the OpenVPN server was started successful with two connected clients.

The log file can also be displayed in the terminal with the following command:

cat /var/log/openvpn.log

Overview of connections

Active connections

The OpenVPN Server Plugin controls regularly if clients are connected and shows the connections as in the image Active connections. In this example two clients are connected, with the name htc and 7020hd.

Block certificate(s)

Expired certificate

Certificates can be blocked, when you want to deny access from a client. Blocking is done over the [red] button, when the menu of the certificates is opened. Blocked client certificates are displayed as expired. For blocking the correct password (which was used for creating the root certificate) needs to be entered.

Blocking certificates blocked certificates can not be reactivated. They need to be recreated!

OpenVPN Server - Menu button

Menu button

Open the OpenVPN Server Plugin and push the [blue] button of the remote control. The functions are described in the following list.

Menu point	Description
start / stop openvpn	With this entry you can stop/start the OpenVPN server manually.
show 'Routes'	Shows Routing informations of the network bridge (br0).
Settings	Settings for the OpenVPN server.

Delete certificates

Certificates can not be deleted in the OpenVPN Server Plugin. The files need to be deleted manually in the directory:

/etc/openvpn/ssl

OpenVPN Client

There are many different OpenVPN Frontends, for different operation systems, to connect with a OpenVPN Server. The following points describe the configuration of the OpenVPN client on a Dreambox (with the GP3.2 Plugin) and an Android based Smartphone.

Dreambox as client

When configuring the OpenVPN clients you need to copy the 4 files created on the server before in the directory of the client:

/etc/openvpn

Once more the list of the required 4 files for the OpenVPN client. The xxx stands for the name which was given for the client.

• xxx-cert.pem
• xxx.pem
• xxx.ovpn
• vpn-ca.pem

Edit configuration file

Before setting up a connection the configuration file (*.ovpn) needs to be edited. The line remote needs to be completed with the IP address or the host address and the correct port. the configuration could be similar to the example, when the access uses the host name webaccess.dyndns.tv via port 1194.

.
.
# example 'remote foobar.org 1194'
# example 'remote 97.123.100.236 1194'
remote webaccess.dyndns.tv 1194

resolv-retry infinite
nobind
persist-key
persist-tun
.
.

Make connection

Dreambox Client - Skin example: gp-skin-swan-black

Open the OpenVPN Client Plugin in the BluePanel under Daemons. In the Plugin a line (not connected) appears, when the configuration files were copied in the correct directory (/etc/openvpn).

Start the connection with the OpenVPN Server with the [OK] button. If everything starts the status connected is displayed in the OpenVPN Client Plugin. Disconnecting is possible by pressing the [OK] button again.

Connection after reboot The connection is restored automatically after a reboot of the Dreambox, if a config file (*.ovpn) is available in /etc/openvpn.

Android Smartphone as client

Example - OpenVPN settings Android

The image shows an example of an Android based Smartphone, which is connected with the Dreambox. As App is used OpenVPN settings to connect with the Server. Keep in mind the Smartphone needs to be rooted to use OpenVPN. Additional the tun/tap driver, the Busybox and OpenVPN is required. With many Custom-Roms these requirements are already integrated in the Firmware.

The config file (*.opvn) needs to be edited with the correct server and port. Copy the client files on the SD card, e.g. in a directory openvpn. Now you need to adapt the OpenVPN App (e.g. path to the configuration, certificates) and the tunnel on the OpenVPN Server can be started.

Tips & Tricks

Flash new image

Before flashing a new image with the OpenVPN Plugin you should save the content of 2 directories. Copy the content back in the new image when configuring the box again. You can copy manually, or use the software menu to save / restore the settings.

/etc/ssl/openvpn
/etc/openvpn

Support thread

If you need help with OpenVPN, follow the link ;)

geminiopenvpn (ihaD)