Dtyjlui

I get 3 IP addresses from my ISP, so after my modem I have a switch with three things. Two are servers, one is a router. All my personal computers are behind the router. My old server used to have two ethernet ports, so I would put one on the switch and one on the router so that I could keep server traffic off the router and still be able to have samba shares for media.

My new lower-power server only has one LAN. I will eventually get a USB ethernet plug for it, but until then I'd like to still have my samba shares. I thought to myself, there must be some way to achieve this via VPN.

So what I'd like to do is this, set up a VPN server on the server, allow clients behind the router to connect to it. That seemed simple enough, except that all the guides I've seen assume you can allocate addresses on the server's LAN. Since my server's LAN is the public internet I can't really do that. Is there any way I can make up some 'imaginary' LAN that exists only in the mind of the server and put my VPN clients on that?

To clarify, if the server is 68.232.SSS.SSS and if the router is 68.232.RRR.RRR and if computers behind the router are 10.0.0.1-255 then can I make VPN clients use addresses like 192.168.0.VPN?

  OOoOoOOOooOOo

OoO  Public  OoOOo-----Server eth0 (Real)    68.232.SSS.SSS

OoO  Internet OoO             eth1 (Virtual) 192.168.0.1

 OoOoOOoOOoOOOo

     |

     --Router eth0 (WAN) 68.232.RRR.RRR

         |     eth1 (LAN) 10.0.0.1

         |

         -----Client eth1 (Virtual) 192.168.0.2  

                      eth0 (Real)    10.0.0.2

1. install openvpn on your server and your client


2. 
   

   generate the certificates as in the official HOWTO:

   
   
   

   root@server:/etc/openvpn/easy-rsa# cp -r /usr/share/doc/openvpn/examples/easy-rsa/2.0 /etc/openvpn/easy-rsa
   
   root@server:/etc/openvpn/easy-rsa# cd /etc/openvpn/easy-rsa
   
   

   
   
   

   Edit /etc/openvpn/easy-rsa/vars and fill in the appropiate values

   
   
   

   root@server:/etc/openvpn/easy-rsa# . ./vars
   
   NOTE: If you run ./clean-all, I will be doing a rm -rf on /etc/openvpn/easy-rsa/keys
   
   root@server:/etc/openvpn/easy-rsa# ./clean-all
   
   root@server:/etc/openvpn/easy-rsa# ./build-ca
   
   Generating a 1024 bit RSA private key
   
   ......................++++++
   
   ........++++++
   
   writing new private key to 'ca.key'
   
   -----
   
   You are about to be asked to enter information that will be incorporated
   
   into your certificate request.
   
   What you are about to enter is what is called a Distinguished Name or a DN.
   
   There are quite a few fields but you can leave some blank
   
   For some fields there will be a default value,
   
   If you enter '.', the field will be left blank.
   
   -----
   
   Country Name (2 letter code) [HK]:
   
   State or Province Name (full name) [New Territories]:
   
   Locality Name (eg, city) [Tuen Mun]:
   
   Organization Name (eg, company) [Home]:
   
   Organizational Unit Name (eg, section) [changeme]:
   
   Common Name (eg, your name or your server's hostname) [OpenVPN-CA]:
   
   Name [OpenVPN-CA]:
   
   Email Address [test@example.com]:
   
   root@server:/etc/openvpn/easy-rsa# ./build-key-server server
   
   Generating a 1024 bit RSA private key
   
   ...............++++++
   
   ..........++++++
   
   writing new private key to 'server.key'
   
   -----
   
   You are about to be asked to enter information that will be incorporated
   
   into your certificate request.
   
   What you are about to enter is what is called a Distinguished Name or a DN.
   
   There are quite a few fields but you can leave some blank
   
   For some fields there will be a default value,
   
   If you enter '.', the field will be left blank.
   
   -----
   
   Country Name (2 letter code) [HK]:
   
   State or Province Name (full name) [New Territories]:
   
   Locality Name (eg, city) [Tuen Mun]:
   
   Organization Name (eg, company) [Home]:
   
   Organizational Unit Name (eg, section) [changeme]:
   
   Common Name (eg, your name or your server's hostname) [server]:
   
   Name [OpenVPN-CA]:
   
   Email Address [test@example.com]:
   
   
   
   Please enter the following 'extra' attributes
   
   to be sent with your certificate request
   
   A challenge password :
   
   An optional company name :
   
   Using configuration from /etc/openvpn/easy-rsa/openssl-1.0.0.cnf
   
   Check that the request matches the signature
   
   Signature ok
   
   The Subject's Distinguished Name is as follows
   
   countryName           :PRINTABLE:'HK'
   
   stateOrProvinceName   :PRINTABLE:'New Territories'
   
   localityName          :PRINTABLE:'Tuen Mun'
   
   organizationName      :PRINTABLE:'Home'
   
   organizationalUnitName:PRINTABLE:'changeme'
   
   commonName            :PRINTABLE:'server'
   
   name                  :PRINTABLE:'OpenVPN-CA'
   
   emailAddress          :IA5STRING:'test@example.com'
   
   Certificate is to be certified until Mar 18 13:18:09 2022 GMT (3650 days)
   
   Sign the certificate? [y/n]:y
   
   
   
   
   
   1 out of 1 certificate requests certified, commit? [y/n]y
   
   Write out database with 1 new entries
   
   Data Base Updated
   
   root@server:/etc/openvpn/easy-rsa# ./build-key client
   
   Generating a 1024 bit RSA private key
   
   ..........++++++
   
   ...................................................++++++
   
   writing new private key to 'client.key'
   
   -----
   
   You are about to be asked to enter information that will be incorporated
   
   into your certificate request.
   
   What you are about to enter is what is called a Distinguished Name or a DN.
   
   There are quite a few fields but you can leave some blank
   
   For some fields there will be a default value,
   
   If you enter '.', the field will be left blank.
   
   -----
   
   Country Name (2 letter code) [HK]:
   
   State or Province Name (full name) [New Territories]:
   
   Locality Name (eg, city) [Tuen Mun]:
   
   Organization Name (eg, company) [Home]:
   
   Organizational Unit Name (eg, section) [changeme]:
   
   Common Name (eg, your name or your server's hostname) [client]:
   
   Name [OpenVPN-CA]:
   
   Email Address [test@example.com]:
   
   
   
   Please enter the following 'extra' attributes
   
   to be sent with your certificate request
   
   A challenge password :
   
   An optional company name :
   
   Using configuration from /etc/openvpn/easy-rsa/openssl-1.0.0.cnf
   
   Check that the request matches the signature
   
   Signature ok
   
   The Subject's Distinguished Name is as follows
   
   countryName           :PRINTABLE:'HK'
   
   stateOrProvinceName   :PRINTABLE:'New Territories'
   
   localityName          :PRINTABLE:'Tuen Mun'
   
   organizationName      :PRINTABLE:'Home'
   
   organizationalUnitName:PRINTABLE:'changeme'
   
   commonName            :PRINTABLE:'client'
   
   name                  :PRINTABLE:'OpenVPN-CA'
   
   emailAddress          :IA5STRING:'test@example.com'
   
   Certificate is to be certified until Mar 18 13:20:00 2022 GMT (3650 days)
   
   Sign the certificate? [y/n]:y
   
   
   
   
   
   1 out of 1 certificate requests certified, commit? [y/n]y
   
   Write out database with 1 new entries
   
   Data Base Updated
   
   root@server:/etc/openvpn/easy-rsa# ./build-dh
   
   Generating DH parameters, 1024 bit long safe prime, generator 2
   
   This is going to take a long time
   
   ............................................................................+..................+...........+...........................+..............+..............................................................+......................................................................................................+......................................................................................+..............................................................................+..................+.................+..................................................................+.........................................+...........+..........................................................................................+..............................................+....................................+...................+....+..+................+.+.........+..............................................................+....................................................................................................................+...........+.....................................................................................................................................+.........................................................+...........................................................+.......................................................................................................................................................................................................................................+..............+..............................................................................................................................................+............................+..........................................+....................................................................................................................................++*++*++*
   
   

   
   


3. 
   

   copy the needed files from /etc/openvpn/easy-rsa/keys on the server to /etc/openvpn

   
   
   

   for server: ca.crt dh1024.pem server.crt server.key

   
   
   

   for client: ca.crt client.crt client.key

   
   


4. 
   

   copy the appropriate sample configuration files from /usr/share/doc/openvpn/examples/sample-config-files/ to /etc/openvpn and decompress them

   
   
   

   server: server.conf.gz

   
   
   

   client: client.conf

   
   


5. The server configuration file should be workable by default


6. 
   

   edit the "remote" entry on the client /etc/openvpn/client.conf

   
   
   

   Input the server name / IP-address. No other changes needs to be done

   
   


7. Open up UDP 1194 on the server's firewall


8. 
   

   The service is ready to start now, the server is at 10.8.0.1

   
   
   

   I assume you only need to access the server, additional work need to be done if you want to access other internal networks.

   
   



9. configure samba to listen on 10.8.0.0/24

Everything should have been done, leave comment here if something goes wrong.

Install openvpn on the server and the clients. On the server this will bring up a tun0 tunnel interface with an IP subnet of your choosing. The relevant options in the configuration file /etc/openvpn/server.conf are:

dev tun

server 192.168.1.0 255.255.255.0

Unless you want the clients to route all their traffic through the VPN, comment out any lines looking like push "route A.B.C.D W.X.Y.Z" from the configuration.

In addition to the network configuration, you have to generate certificates for the server and for the clients (both sides authenticate). How to do that is covered in OpenVPN documentation.

Finally, you have to configure the clients to be able to use this connection, so you put in their /etc/openvpn/client.conf:

remote 68.232.SSS.SSS 1194

The 1194/udp is OpenVPN standard port, which needs to be open to the world in your firewall (hence the need for certificates).

I hope this answer and the documentation and sample configuration from openvpn will get you started.

While not a direct answer to your question, I suggest you consider mounting your server using sshfs instead. All you need is a running ssh server, instead of a complex combination of samba and a bolted-on vpn solution.

On the client, have a look at How to auto mount using sshfs? for a GUI solution or http://ubuntuforums.org/showthread.php?t=430312 for a system-wide fstab solution.