Building Distributed Networks using VPNs David R Newman
VPN – Virtual Private Network A Definition VPN – Virtual Private Network “ A virtual network that is constructed across the Internet (or other public network) to connect two or more parts of a private network. ”
OSI Model
Types of VPN On top of Data Link Layer On top of Network Layer L2TP/IPsec - Layer 2 Tunnelling Protocol / Internet Protocol security VPLS – Virtual Private LAN Service On top of Network Layer PPTP – Point-to-Point Tunnelling Protocol SSH – Secure Shell VPRN – Virtual Private Routed Network DTLS – Data Transport Layer Security TLS – Transport Layer Security E.g. OpenVPN
Server and Clients
Why OpenVPN? Open Source High connection speed (relative to available bandwidth) Secure Makes it is easy to bypass NATs and Firewalls Well-supported by OpenWRT Extensively configurable
OpenVPN Server (1) server 10.13.112.112 255.255.255.252 local 152.78.189.90 port 5044 proto udp dev tap55 ca /etc/openvpn/package_managment/node_control_2015.crt cert /etc/openvpn/package_managment/server- node_control_2015.crt key /etc/openvpn/package_managment/server- node_control_2015.crt.key dh /etc/openvpn/dh1024.pem push "route 10.12.0.0 255.254.0.0" push "route 152.78.189.82 255.255.255.255" push "dhcp-option DNS 10.13.0.239"
OpenVPN Server (2) client-connect "/etc/openvpn/client-routes/connect- node308" client-disconnect "/etc/openvpn/client- routes/disconnect-node308" client-to-client keepalive 10 120 user openvpn group openvpn persist-key persist-tun log /var/log/openvpn/server55.log status /var/log/openvpn/server55-status.log verb 3 script-security 3 system
OpenVPN Client client remote sown-auth2.ecs.soton.ac.uk 5044 proto udp dev tap ca /etc/sown/node_control_2015.crt cert /etc/sown/client.crt key /etc/sown/client.key down /etc/sown/events/tunnel_down up /etc/sown/events/tunnel_up nobind resolv-retry infinite user nobody group nogroup persist-key verb 3 script-security 2
Now For Some Magic!!!
/27 /24 /30 Saving Address Space = 32 addresses = 256 addresses 10.13.77.1 10.13.0.8 10.13.77.2 169.254.13.113 10.13.121.113 169.254.13.114 10.13.121.114 10.13.77.30 10.13.77.254 10.13.77.3 /30 = 4 addresses
Proxying to a VPN Server sown-auth2 DNAT + ACCEPT SNAT sown-vpn2 Firewall
IPv6 Tunnelbroker Sound Familiar? Provides globally routable IPv6 networking to isolated LANs. Replacement for discontinued SIXXS tunnel broker. Intended for existing and new research projects that require IPv6 connectivity in unusual locations. Needs to be easy to configure client side across a number of different platforms. Needs to easily bypass NATs and Firewalls whilst having a high level of security. Sound Familiar?
Users of IPv6 Tunnelbroker
How Things Get IPv6 from the Tunnelbroker brain Generate a client config tarball on tunnelbroker. Deploy tarball on interface Raspberry pi Get OpenVPN client on interface to connect to server on tunnelbroker IPv6 addresses configured using RADVD. Devices inside the University firewall can connect to all the pis. 2001:630:d0:f301: ba27:ebff:fe8e:6270 2001:630:d0:f300::1 mech 2001:630:d0:f301: ba27:ebff:fe86:f3ba interface 2001:630:d0:f300::1001 2001:630:d0:f301::1 left-eye 2001:630:d0:f301: ba27:ebff:fe9f:d0e7 right-eye 2001:630:d0:f301: ba27:ebff:fe33:9304
Further Reading OSI vs. TCP/IP Model Picking a VPN http://electronicdesign.com/what-s-difference-between/what-s-difference- between-osi-seven-layer-network-model-and-tcpip Picking a VPN http://vpnpick.com/vpn-newbie-guide-picking-openvpn-pptp-l2tp/ https://www.bestvpn.com/blog/4147/pptp-vs-l2tp-vs-openvpn-vs-sstp-vs- ikev2/ OpenVPN Documentation https://openvpn.net/index.php/open-source/documentation OpenVPN on OpenWRT https://wiki.openwrt.org/doc/howto/vpn.openvpn https://wiki.openwrt.org/doc/howto/vpn.client.openvpn.tap Wide Area Wi-Fi https://wiki.openwrt.org/doc/howto/wide.area.wifi
Future SOWN Talks Firmware Development for Embedded Devices – Chris Malton A Mechanism for Global Distributed Authentication – David Newman Administering the SOWN Network – David Newman and Chris Malton
Questions?