Introduction

Motivation

How about a secure access from outside into the own home network? So we can maintain machines, change configurations, getting files, .. from where ever we are. For this we let a VPN tunnel be established between a local RPi in our network to a hosted server. If this hosted server that offers a web based console we only need a web browser to access our own resources at home.

The idea of the project comes from my colleague Michael and I like to thank him for the first inputs to get that running.

Starting point

Instead of mess up your official hosted server I can only recommend to start with one of the cheap offers to start. I take www.digitalocean.com for such server playgrounds, which has a real nice package for only $5 per month. But in reality you pay only cents, because only running systems count. So my account, initially charged with $5 has still more than $4 for further tests.

But beside this, they also make it so easy to get a new machine up. For the creation you only define the name, choose the “hardware” specification and select the operation system – and seconds later you receive a mail with the credential and the information, that your machine is up and running. Amazing!

In case you are interested in testing this provider, let me know. Currently I can send you an invitation with a value of $10 or use this link https://www.digitalocean.com/?refcode=5fde389ac6da (be aware, they request your credit card details, but don’t charge from it. it is only for future business with you and you can delete the details later). $10 - that’s enough for a long time play period.

Realization

Preparing the server

For this sample I choose a Debian based machine with the smallest hardware specification in New York.

btw: having a server somewhere outside your residence country, it offers you some interesting benefits. Why? Because you get an IP which let the surfed page not track where you really come from – you obfuscate the one your router gets from your provider – and location based services could offer you other things. 
So far I found the following:

• Cheaper flight tickets
  Typical price watching portals try to offer you the prices from the area you come from, but the prices vary. www.skyscanner.com offered my a 10% better offer for the same connection by another location.
• Avoid blocked YouTube videos
  In Germany the GEMA (and others) let YouTube block a lot videos because of licensing issues (http://en.wikipedia.org/wiki/Blocking_of_YouTube_videos_in_Germany). Notably for videos with music you end up in “Dieses Video ist in Deutschland leider nicht verfügbar” (“Unfortunately, this video is not available in your country.”).

Okay – so let’s take this configuration now:

And not a half minute later your machine is online with a public IP address (here 104.131.97.68) and after a few minutes you get the mail with your credentials.

Connect to the new server, update it and install OpenVPN

Now ssh to this machine, confirm the following question with yes and update your password. Use the IP and password you get via mail.

ssh root@104.131.97.68 

Let’s update the installation with

apt-get update

and install OpenVPN with

apt-get install openvpn

Creating the certificates and keys

The OpenVPN package contains some nice scripts (called easy-rsa) to create all the certificate stuff we need later. So let’s copy that stuff to a place with easier access and go to this folder.

cp -r /usr/share/doc/openvpn/examples/easy-rsa /etc/openvpn

cd /etc/openvpn/easy-rsa/2.0/

There is a file which contains the default properties for further certificate creations. So we adjust the content for our needs

nano vars

the last lines contain some export commands and that’s the place where we have to specify our values

export KEY_COUNTRY="DE"
export KEY_PROVINCE="BY"
export KEY_CITY="Freising"
export KEY_ORG="Private"
export KEY_EMAIL="dont@spam.me"
export KEY_EMAIL=dont@spam.me   
export KEY_CN=Private
export KEY_NAME=Private
export KEY_OU=Private

After saving the file and quitting nano we source these variables

source ./vars

and clean our environment for the new certificates and keys

./clean-all

We don’t have certificates from a Certificate Authority so we create our own ones.
Therefore we start by faking us an own Certificate Authority

./build-ca

You see during the input that the default values are taken from our exported ones.

This creates some files below the “keys” folder

 

    -rw-r--r-- 1 root root 1306 Dec  5 13:49 ca.crt
    -rw------- 1 root root  920 Dec  5 13:49 ca.key

 

Time to create the keys for our OpenVPN server. You see the same game with default values here. At the end you confirm the two questions with “y”.

./build-key-server OpenVpnServer

We get some new files under the key folder

 

    -rw-r--r-- 1 root root 4002 Dec  5 13:53 OpenVpnServer.crt
    -rw-r--r-- 1 root root  712 Dec  5 13:53 OpenVpnServer.csr
    -rw------- 1 root root  916 Dec  5 13:53 OpenVpnServer.key

 

With the next command we create the Duffie Hellman stuff. On the Digital Ocean server this is done in seconds. I did the same on a Raspberry Pi for a similar project and had to wait around half an hour. So you can image how powerful the Digital Ocean equipment is!

./build-dh

which creates the next file

 

    -rw-r--r-- 1 root root  245 Dec  5 13:57 dh1024.pem

Creating the keys for the client

Later we need the keys for our client so let create them now too. The name of our Raspberry Pi will be alarmpi, so we use this name for key too. Again you have to confirm the last two questions with “y”.

./build-key AlArmPi

The next set of files was created

 

    -rw-r--r-- 1 root root 3870 Dec  5 14:08 AlArmPi.crt
    -rw-r--r-- 1 root root  704 Dec  5 14:08 AlArmPi.csr
    -rw------- 1 root root  912 Dec  5 14:08 AlArmPi.key

 

Again we copy the necessary files to a place with easier access in further steps

cp /etc/openvpn/easy-rsa/2.0/keys/ca.* /etc/openvpn/

cp /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem /etc/openvpn/

cp /etc/openvpn/easy-rsa/2.0/keys/OpenVpnServer.* /etc/openvpn/

Later we copy the client relevant stuff via scp to our Raspberry

 

Under /usr/share/doc/openvpn/examples/sample-config-files/ you can find a zipped configuration file for the server.

You can unzip it end use it as a template or documentation for the content we paste in the next step

gunzip -d /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz

But for now to make it easy, lets start with a simplified own one starting from the scratch

nano /etc/openvpn/server.conf

Paste the following content into it

port 1194
proto udp
dev tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/OpenVpnServer.crt
key /etc/openvpn/OpenVpnServer.key
dh /etc/openvpn/dh1024.pem
cipher BF-CBC
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
client-to-client
keepalive 10 120
comp-lzo
max-clients 10
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
log /etc/openvpn/openvpn.log
verb 6

lets activate IP forwarding via

echo 1 > /proc/sys/net/ipv4/ip_forward

and modify the routes

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

Now we can start our OpenVPN server

openvpn /etc/openvpn/server.conf &

check the last line of the log file

tail /etc/openvpn/openvpn.log

if everything is fine you see the last words

 

    Initialization Sequence Completed

 

additionally you can check the existence of the new /etc/net/tun device. This is our device for the tunneled traffic.

ifconfig

But be aware it can take a while to see it!

 

    tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 
              inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255
              UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1

 

Our OpenVPN server is now up and running and we can switch to the client configuration.

 

Preparing the client

For this tutorial the Raspberry Pi get a complete fresh Arch Linux for ARM distribution. Unfortunately the Arch Linux team provides no up to date image. So we use the latest one (http://downloads.raspberrypi.org/arch/images/arch-2014-06-22/) and let the pacman package manager make the update for us.

After burning the image an SD card and booting the RPi you can ssh that machine via

ssh root@alarmpi.local

It is important that server and client have around the same date and time. So first at all let’s set the clock of the system

timedatectl set-timezone Europe/London

timedatectl set-time "2014-12-05 20:02"

Be aware, Digital Ocean’s server run in UTC. So I try to use Europe/London to have the same time. For sure this is not the right way, but it works.

Otherwise I got errors by starting the service (SSL3_GET_SERVER_CERTIFICATE:certificate verify failed).

 

And next, let’s update the installation. This will download a lot (more than 100MB), because our image is from JUN 2014 and therefore a little bit outdated. Confirm all questions with “Y”.

pacman -Syu

and install openvpn

pacman -S openvpn

Yes, both sides – the server and the client – are using the same package. The used configuration during startup of the openvpn decides whether to act as a server or client.

Now check the availability of the client-side tun device

test ! -c /dev/net/tun && echo openvpn requires tun support || echo tun is available

You should get that output

 

    tun is available

 

Now we have to copy the key files from our server to the client. Again, use the IP of your server

scp root@104.131.97.68:/etc/openvpn/easy-rsa/2.0/keys/ca.crt /etc/openvpn/

scp root@104.131.97.68:/etc/openvpn/easy-rsa/2.0/keys/AlArmPi.crt /etc/openvpn/

scp root@104.131.97.68:/etc/openvpn/easy-rsa/2.0/keys/AlArmPi.key /etc/openvpn/

Now we have the necessary files on our Raspberry

 

    AlArmPi.crt          100% 3891     3.8KB/s   00:01   
    AlArmPi.csr          100%  708     0.7KB/s   00:00   
    AlArmPi.key          100%  920     0.9KB/s   00:00

 

On a Arch Linux system you can find the samples for client configuration files here:

/usr/share/openvpn/examples/

But again we start from the scratch.

nano /etc/openvpn/client.conf

And paste these lines

client
dev tun
proto udp
remote 104.131.97.68 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/AlArmPi.crt
key /etc/openvpn/AlArmPi.key
ns-cert-type server
comp-lzo
verb 3
log /etc/openvpn/openvpn.log

 

Start the client-side of OpenVPN

openvpn /etc/openvpn/client.conf &

and check again the last lines of the log file

tail /etc/openvpn/openvpn.log

if everything is fine you see again these last words

 

    Initialization Sequence Completed

 

If you see this message

 

    You must define TUN/TAP device

 

reboot your Raspberry

shutdown -r now

Verify the configuration

Traceroute

With traceroute it is easy to see the hops of our communication. To use is we have first to install the package

pacman -S traceroute

and then we can trace our traffic with

traceroute www.bmw.de

This should produce something like

 

    traceroute to www.bmw.de (23.44.193.230), 30 hops max, 60 byte packets
     1  10.8.0.1 (10.8.0.1)  261.505 ms  
     2  104.131.0.254 (104.131.0.254)  262.644 ms  
     3  162.243.188.229 (162.243.188.229)  261.967 ms 
     4  162.243.188.249 (162.243.188.249)  262.589 ms 
     5  net2ez-ewr.netarch.akamai.com (206.130.10.100)  262.931 ms

 

Outside visible IP

There are some of these “what is my IP address” services available, which shows you the IP of you entry-point to the internet. Usually that is the IP your router got. But with tunneled traffic it should be the IP of our OpenVPN server – the IP of our Digital Ocean server. Let’s check this.

Therefore we install a console based browser.

pacman -S w3m

and then we check our outside visible IP with

w3m www.whatismyip.com

In one of the first lines you see the interesting output

 

    Your IP:
    104.131.97.68

 

This is exactly what we expect – the IP of our Digital Ocean’s server and not the IP of our internet provider.