Skip to Content

Changes for page VPN Access

Last modified by Thomas Coelho (local) on 2024/09/03 14:41
From version 4.2
edited by Thomas Coelho (local)
on 2024/09/03 14:33
Change comment: There is no comment for this version
To version 2.1
edited by Thomas Coelho
on 2022/10/18 14:55
Change comment: There is no comment for this version

Summary

Details

Page properties
Author
... ... @@ -1,1 +1,1 @@
1 -XWiki.coelho
1 +XWiki.thw
Content
... ... @@ -8,12 +8,11 @@
8 8  
9 9  It is available for Windows and MacOS too.
10 10  
11 -=== Install OpenVPN ===
11 +=== Install OpenVPN ===
12 12  
13 -
14 14  It is not part of the default installation, but can easily installed using apt. Enter the following commands:
15 15  
16 -{{{ sudo apt install openvpn}}}
15 + sudo apt install openvpn
17 17  
18 18  This requires to enter your password to get super user privileges.
19 19  
... ... @@ -24,7 +24,7 @@
24 24  This configuration routes all traffic trough ITP. This is useful if you want to download papers, which are restricted to the university network.
25 25  The second examples only routes the traffic going directly to the ITP trough the VPN and leaves your default gateway untouched. The only difference is the missing 'redirect-gateway' statement [http://th.physik.uni-frankfurt.de/~thw/vpn/all-via-itp.ovpn]
26 26  
27 -{{code language="none"}}
26 +<pre>
28 28  client
29 29  dev tun
30 30  proto udp
... ... @@ -36,14 +36,14 @@
36 36  auth-user-pass
37 37  ca private-ca-itp.crt
38 38  # Comment this, if you don't want to redirect the default gateway
39 -redirect-gateway def1
40 -{{/code}}
38 +redirect-gateway def1
39 +</pre>
41 41  
42 42  Download our CA (Certificate of Authority) [http://th.physik.uni-frankfurt.de/~thw/vpn/private-ca-itp.crt] and store it in the same place. This file is needed for the verification of the authenticity of the server.
43 43  
44 44  For only accessing internal services and routing your the normal traffic to your normal uplink use the following configuration: [http://th.physik.uni-frankfurt.de/~thw/vpn/itp.ovpn]
45 45  
46 -{{code language="none"}}
45 +<pre>
47 47  client
48 48  dev tun
49 49  proto udp
... ... @@ -54,35 +54,37 @@
54 54  resolv-retry infinite
55 55  auth-user-pass
56 56  ca private-ca-itp.crt
57 -{{/code}}
56 +</pre>
58 58  
59 59  
60 60  === Start the VPN connection ===
61 61  
62 62  Open a terminal and change to the path where the vpn config file is stored. Start the connection with
63 -\\ sudo openvpn itp.ovpn
62 +
63 + sudo openvpn itp.ovpn
64 64  
65 65  where itp.ovpn is the name of the config file. openvpn needs root access, therefore you must enter your local password for sudo. After this you have to enter your ITP credentials (Username and Password).
66 66  
67 67  If everything went fine the output will look like:
68 68  
69 -{{{Fri Dec 7 15:03:00 2012 WARNING: Make sure you understand the semantics of tls-remote before using it (see the man page).
70 -Fri Dec 7 15:03:00 2012 NOTE: OpenVPN 2.1 requires 'script-security 2' or higher to call user-defined scripts or executables
69 +<pre>
70 +Fri Dec 7 15:03:00 2012 WARNING: Make sure you understand the semantics of --tls-remote before using it (see the man page).
71 +Fri Dec 7 15:03:00 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
71 71  Fri Dec 7 15:03:00 2012 UDPv4 link local: [undef]
72 72  Fri Dec 7 15:03:00 2012 UDPv4 link remote: [AF_INET]141.2.246.2:1194
73 -Fri Dec 7 15:03:00 2012 WARNING: this configuration may cache passwords in memory use the auth-nocache option to prevent this
74 +Fri Dec 7 15:03:00 2012 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
74 74  Fri Dec 7 15:03:00 2012 [FIAS-ITP_Generic_VPN_Service] Peer Connection Initiated with [AF_INET]141.2.246.2:1194
75 75  Fri Dec 7 15:03:02 2012 TUN/TAP device tap0 opened
76 76  Fri Dec 7 15:03:02 2012 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
77 77  Fri Dec 7 15:03:02 2012 /sbin/ifconfig tap0 10.63.131.1 netmask 255.255.0.0 mtu 1500 broadcast 10.63.255.255
78 -Fri Dec 7 15:03:02 2012 Initialization Sequence Completed}}}
79 +Fri Dec 7 15:03:02 2012 Initialization Sequence Completed
80 +</pre>
79 79  
80 -
81 81  Termiate the session by pressing Ctrl-C in this terminal.
82 82  
83 -== OpenVPN for Windows 10 ==
84 +==OpenVPN for Windows 10==
84 84  
85 -At the time of writing, you can download OpenVPN on '[[https:~~/~~/openvpn.net/community-downloads/'.>>https://openvpn.net/community-downloads/'.]]
86 +At the time of writing, you can download OpenVPN on 'https://openvpn.net/community-downloads/'.
86 86  Download the exe-file for Windows 10 and install OpenVPN.
87 87  Start 'OpenVPN GUI'. You will get a message that no config file was found. But starting 'OpenVPN GUI' creates a directory to put the config files into.
88 88  
... ... @@ -92,7 +92,7 @@
92 92  
93 93  You need to copy/save both files to C:/Users/'yourusername'/OpenVPN/config/, where 'yourusername' is your local username. In the picture below, the directory with the two needed files in it for a german Windows 10 is shown (for the username 'user'). (For both is assumed that 'C' is, as for most Windows systems, your main hard drive.)
94 94  
95 -[[image:File_Openvpn-win10-1.png]][[image:File_Openvpn-win10-1.png]]
96 +[[File:Openvpn-win10-1.png|center]]
96 96  
97 97  If 'OpenVPN GUI' is started, you can find it in the lower right corner where the minisymbols are. Most likely you need to click on the small arrow first. It is the symbol with the computer screen and the lock symbol. Right click on the symbol and you get a menu where the first option is to connect. Click this option. This menu has less entries if the settings are not found. Then control the previous step.
98 98  
... ... @@ -106,7 +106,7 @@
106 106  
107 107  [[File:Openvpn-win10-4.png|center]]
108 108  
109 -== MacOS (tunnelblick) ==
110 +==MacOS (tunnelblick)==
110 110  
111 111  First download the itp certificate [http://th.physik.uni-frankfurt.de/~thw/vpn/private-ca-itp.crt] and configuration file [http://th.physik.uni-frankfurt.de/~thw/vpn/all-via-itp.ovpn]. If a '.txt' was added to the configuration file name, remove the ending '.txt'. At the end the two files should normally be namend 'private-ca-itp.crt' and 'all-via-itp.ovpn'.
112 112  
... ... @@ -130,12 +130,11 @@
130 130  
131 131  In this case the configuration file and the certificate are located in '/Library/Application Support/Tunnelblick/Shared/all-via-itp.tblk/Contents/Resources'. If you need to edit or replace the configuration file or the certificate, this can be done in this directory. If there is just the configuration file in the directory, then copy the certificate to the in the log mentioned directory.
132 132  
133 -== Problems changing the vpn settings in tunnelblick (macOS) ==
134 +==Problems changing the vpn settings in tunnelblick (macOS)==
134 134  
135 -There were problems reported when switching in tunnelblick from the old vpn (vpn.th.physik.uni-frankfurt.de with tap) to the new one (vgw.itp.uni-frankfurt.de with tun). You also have this problem if, after applying the new configuration file itp.ovpn, the vpn does not work and the output contains a line containing 'vpn.th.physik.uni-frankfurt.de'. Search the output for a line beginning with '--config' and ending on '.ovpn'. This line specifies which configuration file (.ovpn) is used to establish the vpn connection and where it is located. Edit this file to have the same content as the itp.ovpn [http://th.physik.uni-frankfurt.de/~thw/vpn/itp.ovpn] (most likely the lines 2, 5 and 6 need to be edited).--
136 +There were problems reported when switching in tunnelblick from the old vpn (vpn.th.physik.uni-frankfurt.de with tap) to the new one (vgw.itp.uni-frankfurt.de with tun). You also have this problem if, after applying the new configuration file itp.ovpn, the vpn does not work and the output contains a line containing 'vpn.th.physik.uni-frankfurt.de'. Search the output for a line beginning with '--config' and ending on '.ovpn'. This line specifies which configuration file (.ovpn) is used to establish the vpn connection and where it is located. Edit this file to have the same content as the itp.ovpn [http://th.physik.uni-frankfurt.de/~thw/vpn/itp.ovpn] (most likely the lines 2, 5 and 6 need to be edited).
136 136  
137 -== Warning in tunnelblick (macOS) ==
138 -
138 +==Warning in tunnelblick (macOS)==
139 139  If you get the following warning, you can check the box and click OK.
140 140  [[File:Tb-warn.png|center|500px]]
141 141  
... ... @@ -144,3 +144,4 @@
144 144  When importing the configuration, the crt file is copied to somewhere in the system (see above). If you replace the crt file in your download or whatever folder it will not be used. The simpliest way to fix this is to delete the configuration from Tunnelblick and reimport it. Make sure the option "Route all traffic through the VPN" is checked (see instrcutions above).
145 145  
146 146  This is needed after the replacment of the CA certificate in Nov 2020. This lives for 5 years. Next replacment will be in 2025, if we are still using openVPN then.
147 +
File_Openvpn-win10-1.png
Author
... ... @@ -1,1 +1,0 @@
1 -XWiki.coelho
Size
... ... @@ -1,1 +1,0 @@
1 -16.1 KB
Content