OpenVPN

Overview

Description from the FreeBSD Ports Tree:

OpenVPN is a robust, scalable and highly configurable VPN (Virtual Private Network) daemon which can be used to securely link two or more private networks using an encrypted tunnel over the internet. It can operate over UDP or TCP, can use SSL or a pre-shared secret to authenticate peers, and in SSL mode, one server can handle many clients.

Pointers

• http://openvpn.net/
• http://openvpn.net/howto.html - howto
• http://openvpn.net/man.html - man page
• http://openvpn.net/faq.html - faq
• http://openvpn.net/examples.html - examples
• http://www.tunnelblick.net/ - Mac OS X binaries and gui
• UnixGeekTools - other great tools for unix geeks

Other Articles

• http://openvpn.net/papers/BLUG-talk/ - slideshow on user-space VPNs and OpenVPN
• http://www.onlamp.com/pub/a/security/2004/10/21/vpns_and_pki.html
• http://www.sans.org/rr/whitepapers/vpns/1459.php - OpenVPN and the SSL VPN Revolution
• http://www.cs.auckland.ac.nz/~pgut001/pubs/linux_vpn.txt - linux VPN comparison
• http://www.sans.org/rr/papers/20/1459.pdf
• http://openvpn.net/archive/openvpn-users/2005-06/msg00286.html - OpenVPN Ethernet Bridging with FreeBSD

Features

• tunnel any IP subnetwork or virtual ethernet adapter over a single UDP or TCP port,
• create cross-platform tunnels between any of the operating systems supported by OpenVPN including Linux, Solaris, OpenBSD, FreeBSD, NetBSD, Mac OS X, and Windows 2000/XP,
• in FreeBSD ports tree, and in fink on OS X
• designed to be able to run as user nobody in a chroot jail

Ports

• current versions use port 1194
• OpenVPN 1.6 and older used port 5000

FreeBSD

• /usr/ports/security/openvpn
• /usr/local/etc/rc.d/openvpn.sh

Tunneling options

Routed IP tunnels

best used to route point-to-point IP traffic without broadcasts. Slightly more efficient than bridged ethernet tunnels and easier to configure. The HOWTO covers routed IP tunnels.

Bridged Ethernet Tunnels

can be used to tunnel both IP and non-IP protocols. This type of tunnel is appropriate for applications which communicate via broadcasts, such as Windows networking and LAN games. Slightly more complex to configure. A Mini-HOWTO covers bridged ethernet tunnels.