Building Distributed Networks using VPNs David R Newman
VPN – Virtual Private Network A Definition VPN – Virtual Private Network “ A virtual network that is constructed across the Internet (or other public network) to connect two or more parts of a private network. ”
OSI Model
Types of VPN On top of Data Link Layer On top of Network Layer L2TP/IPsec - Layer 2 Tunnelling Protocol / Internet Protocol security VPLS – Virtual Private LAN Service On top of Network Layer PPTP – Point-to-Point Tunnelling Protocol PPP – Point-to-Point Protocol SSH – Secure Shell VPRN – Virtual Private Routed Network DTLS – Data Transport Layer Security TLS – Transport Layer Security E.g. OpenVPN
Server and Clients
OpenVPN Interfaces
Why OpenVPN? Open Source High connection speed (relative to available bandwidth) Secure Makes it is easy to bypass NATs and Firewalls Well-supported by OpenWRT Extensively configurable
OpenVPN Server (1) server 10.13.112.112 255.255.255.252 local 152.78.189.90 port 5044 proto udp dev tap55 ca /etc/openvpn/package_managment/node_control_2015.crt cert /etc/openvpn/package_managment/server- node_control_2015.crt key /etc/openvpn/package_managment/server- node_control_2015.crt.key dh /etc/openvpn/dh1024.pem push "route 10.12.0.0 255.254.0.0" push "route 152.78.189.82 255.255.255.255" push "dhcp-option DNS 10.13.0.239"
OpenVPN Server (2) client-to-client keepalive 10 120 user openvpn group openvpn persist-key persist-tun log /var/log/openvpn/server55.log status /var/log/openvpn/server55-status.log verb 3 script-security 3 system client-connect "/etc/openvpn/client-routes/connect- node308" client-disconnect "/etc/openvpn/client- routes/disconnect-node308"
OpenVPN Client remote sown-auth2.ecs.soton.ac.uk 5044 proto udp dev tap ca /etc/sown/node_control_2015.crt cert /etc/sown/client.crt key /etc/sown/client.key client nobind resolv-retry infinite user nobody group nogroup persist-key verb 3 script-security 2 down /etc/sown/events/tunnel_down up /etc/sown/events/tunnel_up
Further Reading OSI vs. TCP/IP Model Picking a VPN http://electronicdesign.com/what-s-difference-between/what-s-difference- between-osi-seven-layer-network-model-and-tcpip Picking a VPN http://vpnpick.com/vpn-newbie-guide-picking-openvpn-pptp-l2tp/ https://www.bestvpn.com/blog/4147/pptp-vs-l2tp-vs-openvpn-vs-sstp-vs- ikev2/ OpenVPN Documentation https://openvpn.net/index.php/open-source/documentation OpenVPN on OpenWRT https://wiki.openwrt.org/doc/howto/vpn.openvpn https://wiki.openwrt.org/doc/howto/vpn.client.openvpn.tap Wide Area Wi-Fi https://wiki.openwrt.org/doc/howto/wide.area.wifi
Future SOWN Talks 17th November 2016 After Christmas Firmware Development for Embedded Devices – Chris Malton After Christmas A Mechanism for Global Distributed Authentication – David Newman Administering the SOWN Network – David Newman and Chris Malton
Questions?