- IPsec Versus OpenVPN
- Requirements for the OpenVPN Solution
- Setting Up the Public Key Infrastructure (PKI)
- Setting Up the VPN Serve
- Configuring OpenVPN
- Configuring a Sample Client
- Connecting to the Server
- Configuring the Routing
- Working with Unprivileged Users
- Advantages and Disadvantages of This Solution
Setting Up the VPN Server
Prior to setting up the VPN, equip your server with two network cards: One card needs to be connected to the wireless network's access point and the other to the internal LAN.
Next, you need to install OpenVPN and preferably a firewall. On Windows, this process is easy and only requires the execution of setup.exe. On UNIX and Linux, this step may require compiling code or just installing a prepackaged component.
Once the network cards are installed, make sure that the service starts when the computer is booted:
- The Windows version offers a service wrapper called openvpnserv.exe –install. Once the .exe is added as a service, change the startup behavior from manual to automatic in the Services control panel.
- On UNIX systems, a startup script has to be written and the appropriate links have to be created. Fortunately, this step is often handled by the packed installation.
Setting Up the IP Parameters
The server acts as a router between the wireless and internal networks and has to be configured accordingly. By default, IP packets are not forwarded between IP networks, but this feature is essential for the server to act as a router.
On Windows, you'll need to change this registry value:
HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters=1
Linux uses a file in /proc to enable IP forwarding. The following can be used to activate forwarding:
echo 1 > /proc/sys/net/ipv4/ip_forward
It's very common for Linux distributions to configure firewall and routing settings in a central script in /etc. For other UNIX flavors, consult the vendor's manual. Otherwise, this command must be added to the startup scripts.