Info about back-tunnel here - Revision history

Spideralex at 17:28, 22 February 2020

2020-02-22T17:28:27Z

← Older revision		Revision as of 17:28, 22 February 2020
Line 23:		Line 23:
	Initialization Sequence Completed		Initialization Sequence Completed

	# Run client openvpn as daemon in the background - see `man openvpn` for more options		Run client openvpn as daemon in the background - see `man openvpn` for more options
	sudo openvpn --config <client-name>.ovpn --daemon		sudo openvpn --config <client-name>.ovpn --daemon

	To stop the daemon:		To stop the daemon:
	# Find the daemon process		Find the daemon process
	pgrep -lf openvpn		pgrep -lf openvpn

	# Kill the process		Kill the process
	sudo kill <process number>		sudo kill <process number>

	# Run client openvpn in the foreground for troubleshooting the tunnel:		Run client openvpn in the foreground for troubleshooting the tunnel:
	sudo openvpn --config <client-name>.ovpn		sudo openvpn --config <client-name>.ovpn
	if your verbosity in the client conf file is set to 4, then stdout of the above command should end with		if your verbosity in the client conf file is set to 4, then stdout of the above command should end with
	Initialization Sequence Completed		Initialization Sequence Completed

	# Run client openvpn systemd unit file:		Run client openvpn systemd unit file:
	Copy your client conf file to /etc/openvpn/client/ directory		Copy your client conf file to /etc/openvpn/client/ directory

Line 53:		Line 53:
	This unit file which changes dir to /etc/openvpn/client and executes openvpn --config <name>.conf		This unit file which changes dir to /etc/openvpn/client and executes openvpn --config <name>.conf

	# Run server openvpn systemd unit file:		Run server openvpn systemd unit file:
	sudo systemctl start\|stop\|status openvpn@server.service		sudo systemctl start\|stop\|status openvpn@server.service

	#Check tunnel is up		Check tunnel is up
	sudo ifconfig		sudo ifconfig
	ip addr show dev tun0		ip addr show dev tun0
Line 104:		Line 104:
	https://raspberrypi.stackexchange.com/questions/46171/how-do-i-mount-my-nas		https://raspberrypi.stackexchange.com/questions/46171/how-do-i-mount-my-nas

	# DISK		DISK
	In the fstab file, the disk partition is identified by the universally unique identifier		In the fstab file, the disk partition is identified by the universally unique identifier

Line 112:		Line 112:
	UUID=a164f220-cc96-450f-aa4a-27849ed21d44 /mnt/meme_bak ext4 defaults,auto,users,rw,nofail 0 0		UUID=a164f220-cc96-450f-aa4a-27849ed21d44 /mnt/meme_bak ext4 defaults,auto,users,rw,nofail 0 0

	# mount cloud		mount cloud
	NAS		NAS

Line 137:		Line 137:

	LATER		LATER
	# Add local subnet to vpn		Add local subnet to vpn
	https://openvpn.net/community-resources/how-to/#pki		https://openvpn.net/community-resources/how-to/#pki
	https://community.openvpn.net/openvpn/wiki/FAQ		https://community.openvpn.net/openvpn/wiki/FAQ
Line 143:		Line 143:
	https://openvpn.net/archive/openvpn-users/2007-09/msg00094.html		https://openvpn.net/archive/openvpn-users/2007-09/msg00094.html

	# Enable two-way traffic client-server		Enable two-way traffic client-server
	Reach OpenVPN clients directly from a private network		Reach OpenVPN clients directly from a private network
	https://openvpn.net/vpn-server-resources/reach-openvpn-clients-directly-from-a-private-network/		https://openvpn.net/vpn-server-resources/reach-openvpn-clients-directly-from-a-private-network/

Spideralex at 17:27, 22 February 2020

2020-02-22T17:27:08Z

← Older revision		Revision as of 17:27, 22 February 2020
Line 23:		Line 23:
	Initialization Sequence Completed		Initialization Sequence Completed

	~~####################################~~
	# Run client openvpn as daemon in the background - see `man openvpn` for more options		# Run client openvpn as daemon in the background - see `man openvpn` for more options
	sudo openvpn --config <client-name>.ovpn --daemon		sudo openvpn --config <client-name>.ovpn --daemon

Spideralex: Created page with "S14 tunnel https://e2h.totalism.org/e2h.php?_=X-s14-net local/ S14 machine ssh tunnel@10.94.185.76 sudo openvpn --config /home/tunnel/client.conf '''HOW TO START OPENVPN ON..."

2020-02-22T17:26:33Z

Created page with "S14 tunnel https://e2h.totalism.org/e2h.php?_=X-s14-net local/ S14 machine ssh tunnel@10.94.185.76 sudo openvpn --config /home/tunnel/client.conf '''HOW TO START OPENVPN ON..."

New page

S14 tunnel
https://e2h.totalism.org/e2h.php?_=X-s14-net

local/ S14 machine

ssh tunnel@10.94.185.76
sudo openvpn --config /home/tunnel/client.conf

'''HOW TO START OPENVPN ON REBOOT?'''

https://www.smarthomebeginner.com/configure-openvpn-to-autostart-linux/

edit /etc/default/openvpn

Remove the ‘#' infront of ‘AUTOSTART=”all”‘ so that OpenVpn allows to start the .conf files

sudo systemctl enable openvpn-client@.service

sudo systemctl daemon-reload
sudo systemctl restart openvpn-client@anarcha.service

sudo openvpn --config <client-name>.ovpn
Initialization Sequence Completed

####################################
# Run client openvpn as daemon in the background - see `man openvpn` for more options
sudo openvpn --config <client-name>.ovpn --daemon

To stop the daemon:
# Find the daemon process
pgrep -lf openvpn

# Kill the process
sudo kill <process number>

# Run client openvpn in the foreground for troubleshooting the tunnel:
sudo openvpn --config <client-name>.ovpn
if your verbosity in the client conf file is set to 4, then stdout of the above command should end with
Initialization Sequence Completed

# Run client openvpn systemd unit file:
Copy your client conf file to /etc/openvpn/client/ directory

in this way you can stop, start and check status of the vpn with the systemctl command:
e.x if your client file is called myvpn.conf, then the command goes:

sudo systemctl start|stop|status openvpn-client@anarcha.service

(All system unit files are in /lib/systemd/system/)

Explanation:
the system unit script is in /lib/systemctl/system/openvpn-client@.service
whatever name you put between openvpn-client@ and .service is passed inside this unit file.
This unit file which changes dir to /etc/openvpn/client and executes openvpn --config <name>.conf

# Run server openvpn systemd unit file:
sudo systemctl start|stop|status openvpn@server.service

#Check tunnel is up
sudo ifconfig
ip addr show dev tun0
tun0 should appear

Ping from your pi the server's tun0 IP 10.8.0.1
ping 10.8.0.1
traceroute 10.8.0.1

From your pi run ifconfig and find your tun0 IP,
let's say it's 10.8.0.10

Ping from the anarchaserver your pi_tunnel_ip

SSH to tunnel pi from anarchaserver (2 ways)
1. edit /root/.ssh/config and update the Hostname IP to match the one of the pi's tun0
(once pi gets a dns or a static IP we won't have to edit this config file)
then do: ssh tunnel-pi
2. OR do: ssh tunnel@1.8.0.10
OK*

copy files

MOUNT HARD DRIVE
tunnel@<pi_tunnel_ip>:/mnt/S14-backup
tunnel@<pi_tunnel_ip>:/mntmeme_bak

STORAGE
Mount disks

NAS
http://water.local:5000/
sudo mount.cifs -o user=tunnel,password=*****,uid=1001,rw,vers=2.0 //10.94.185.9/web/anarcha /mnt/S14-backup
/mnt/S14-backup

DISK
sudo mount /dev/sda1 /mnt/meme_bak

HOW TO DO THAT IN STARTUP?
add the above mount command in /etc/fstab (double check online tips)
to tell where the storage device will be automatically mounted when the Raspberry Pi starts up.
https://www.raspberrypi.org/documentation/configuration/external-storage.md

REF:
https://confluence.jaytaala.com/display/TKB/Mount+drive+in+linux+and+set+auto-mount+at+boot
https://kwilson.io/blog/force-your-raspberry-pi-to-mount-an-external-usb-drive-every-time-it-starts-up/
https://raspberrypi.stackexchange.com/questions/46171/how-do-i-mount-my-nas

# DISK
In the fstab file, the disk partition is identified by the universally unique identifier

sudo blkid

ADD
UUID=a164f220-cc96-450f-aa4a-27849ed21d44 /mnt/meme_bak ext4 defaults,auto,users,rw,nofail 0 0

# mount cloud
NAS

ADD
//10.94.185.9/web/anarcha /mnt/S14-backup cifs user=tunnel,password=****,uid=1001,rw,iocharset=utf8,vers=2.0 0 0

Next challenge
HOW TO REACH NAS water from the browser when tunnel is UP
Need to mount NAS water on startup with adding the mount command also in /etc/fstab
Register a domain name for the pi and either request from your internet provider a fixed IP
or run a script in pi to update the dns service reqularly with its dynamic public IP. (mara has done the latter with her pi)
install samba server on pi, or apache2, or nginx to serve content of the mounted disks
Edit the /etc/openvpn/server.conf to push traffic to pi IP subnet. (lines 134- 140)
The user's device which wants to reach pi or NAS via the browser, needs also to install openvpn and a client certificate

FIND tunnel pi IP when outside the house
You need to know the CN in your certificate, Lookup the line starting with Subject: located in the file .cert or in the client conf if all keys and certs are bundled within.
E.x Subject: C=SP, ST=Catalunya, L=Barcelona, O=AnarchaServer, OU=AnarchaServer, CN=FutureVintage/name=EasyRSA/emailAddress=anarchaserver@autistiche.org
SSH to anarcha, and do: tail /var/log/openvpn.log
search for the CN name, in our example FutureVintage, and check the IP
In our example in openvpn.log it looks like:
Fri Feb 7 21:14:57 2020 us=535934 MULTI: Learn: 10.8.0.10 -> FutureVintage/5.135.58.235:50855

LATER
# Add local subnet to vpn
https://openvpn.net/community-resources/how-to/#pki
https://community.openvpn.net/openvpn/wiki/FAQ
https://forums.openvpn.net/viewtopic.php?t=14358
https://openvpn.net/archive/openvpn-users/2007-09/msg00094.html

# Enable two-way traffic client-server
Reach OpenVPN clients directly from a private network
https://openvpn.net/vpn-server-resources/reach-openvpn-clients-directly-from-a-private-network/

diagram
https://e2h.totalism.org/e2h.php?_=X-s14-net