Skip to content
Snippets Groups Projects
Commit e8127892 authored by Vivek Dutta's avatar Vivek Dutta
Browse files

openvpn: Updated config and datamodel

parent 673caca1
No related branches found
No related tags found
1 merge request!63openvpn: Updated config and datamodel
Hide whitespace changes
Inline Side-by-side
net/openvpn/files/etc/bbfdm/plugins/OpenVPN_DM.json
+ 46
− 4
View file @ e8127892
...@@ -28,10 +28,26 @@ ...@@ -28,10 +28,26 @@
"protocol": [ "protocol": [
"usp" "usp"
] ]
},
"Username": {
"type": "string",
"read": "true",
"write": "true",
"protocol": [
"usp"
]
},
"Password": {
"type": "string",
"read": "true",
"write": "true",
"protocol": [
"usp"
]
} }
}, },
"output": { "output": {
"Instance": { "Name": {
"type": "string", "type": "string",
"read": "true", "read": "true",
"write": "true", "write": "true",
...@@ -39,7 +55,7 @@ ...@@ -39,7 +55,7 @@
"usp" "usp"
] ]
}, },
"Config_Path": { "Status": {
"type": "string", "type": "string",
"read": "true", "read": "true",
"write": "true", "write": "true",
...@@ -56,18 +72,44 @@ ...@@ -56,18 +72,44 @@
"method": "import_ovpn", "method": "import_ovpn",
"args": { "args": {
"name": "@Input.Name", "name": "@Input.Name",
"url": "@Input.URL" "url": "@Input.URL",
"user": "@Input.Username",
"pass": "@Input.Password"
} }
} }
} }
] ]
}, },
"ClientNumberOfEntries": {
"type": "unsignedInt",
"read": true,
"write": false,
"version": "2.14",
"protocols": [
"usp"
],
"description": "<<numentries>>",
"mapping": [
{
"type": "uci",
"uci": {
"file": "openvpn",
"section": {
"type": "openvpn"
},
"option": {
"name": "@Count"
}
}
}
]
},
"Device.{BBF_VENDOR_PREFIX}OpenVPN.Client.{i}.": { "Device.{BBF_VENDOR_PREFIX}OpenVPN.Client.{i}.": {
"type": "object", "type": "object",
"protocols": [ "protocols": [
"usp" "usp"
], ],
"access": false, "access": true,
"array": true, "array": true,
"mapping": { "mapping": {
"type": "uci", "type": "uci",
......
net/openvpn/files/openvpn.config
+ 0
− 506
View file @ e8127892
package openvpn
#################################################
# Sample to include a custom config file. #
#################################################
config openvpn custom_config
# Set to 1 to enable this instance:
option enabled 0
# Credentials to login
#option username 'login'
#option password 'password'
# Password for client certificate
#option cert_password 'cert_password'
# Include OpenVPN configuration
option config /etc/openvpn/my-vpn.conf
#################################################
# Sample OpenVPN 2.0 uci config for #
# multi-client server. #
#################################################
config openvpn sample_server
# Set to 1 to enable this instance:
option enabled 0
# Which local IP address should OpenVPN
# listen on? (optional)
# option local 0.0.0.0
# Which TCP/UDP port should OpenVPN listen on?
# If you want to run multiple OpenVPN instances
# on the same machine, use a different port
# number for each one. You will need to
# open up this port on your firewall.
option port 1194
# TCP or UDP server?
# option proto tcp
option proto udp
# "dev tun" will create a routed IP tunnel,
# "dev tap" will create an ethernet tunnel.
# Use "dev tap0" if you are ethernet bridging
# and have precreated a tap0 virtual interface
# and bridged it with your ethernet interface.
# If you want to control access policies
# over the VPN, you must create firewall
# rules for the the TUN/TAP interface.
# On non-Windows systems, you can give
# an explicit unit number, such as tun0.
# On Windows, use "dev-node" for this.
# On most systems, the VPN will not function
# unless you partially or fully disable
# the firewall for the TUN/TAP interface.
# option dev tap
option dev tun
# SSL/TLS root certificate (ca), certificate
# (cert), and private key (key). Each client
# and the server must have their own cert and
# key file. The server and all clients will
# use the same ca file.
#
# See the "easy-rsa" directory for a series
# of scripts for generating RSA certificates
# and private keys. Remember to use
# a unique Common Name for the server
# and each of the client certificates.
#
# Any X509 key management system can be used.
# OpenVPN can also use a PKCS #12 formatted key file
# (see "pkcs12" directive in man page).
option ca /etc/openvpn/ca.crt
option cert /etc/openvpn/server.crt
# This file should be kept secret:
option key /etc/openvpn/server.key
# Diffie hellman parameters.
# Generate your own with:
# openssl dhparam -out dh2048.pem 2048
# Substitute 2048 for 1024 if you are using
# 1024 bit keys.
option dh /etc/openvpn/dh2048.pem
# Configure server mode and supply a VPN subnet
# for OpenVPN to draw client addresses from.
# The server will take 10.8.0.1 for itself,
# the rest will be made available to clients.
# Each client will be able to reach the server
# on 10.8.0.1. Comment this line out if you are
# ethernet bridging. See the man page for more info.
option server "10.8.0.0 255.255.255.0"
# Maintain a record of client <-> virtual IP address
# associations in this file. If OpenVPN goes down or
# is restarted, reconnecting clients can be assigned
# the same virtual IP address from the pool that was
# previously assigned.
option ifconfig_pool_persist /tmp/ipp.txt
# Configure server mode for ethernet bridging.
# You must first use your OS's bridging capability
# to bridge the TAP interface with the ethernet
# NIC interface. Then you must manually set the
# IP/netmask on the bridge interface, here we
# assume 10.8.0.4/255.255.255.0. Finally we
# must set aside an IP range in this subnet
# (start=10.8.0.50 end=10.8.0.100) to allocate
# to connecting clients. Leave this line commented
# out unless you are ethernet bridging.
# option server_bridge "10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100"
# Push routes to the client to allow it
# to reach other private subnets behind
# the server. Remember that these
# private subnets will also need
# to know to route the OpenVPN client
# address pool (10.8.0.0/255.255.255.0)
# back to the OpenVPN server.
# list push "route 192.168.10.0 255.255.255.0"
# list push "route 192.168.20.0 255.255.255.0"
# To assign specific IP addresses to specific
# clients or if a connecting client has a private
# subnet behind it that should also have VPN access,
# use the subdirectory "ccd" for client-specific
# configuration files (see man page for more info).
# EXAMPLE: Suppose the client
# having the certificate common name "Thelonious"
# also has a small subnet behind his connecting
# machine, such as 192.168.40.128/255.255.255.248.
# First, uncomment out these lines:
# option client_config_dir /etc/openvpn/ccd
# list route "192.168.40.128 255.255.255.248"
# Then create a file ccd/Thelonious with this line:
# iroute 192.168.40.128 255.255.255.248
# This will allow Thelonious' private subnet to
# access the VPN. This example will only work
# if you are routing, not bridging, i.e. you are
# using "dev tun" and "server" directives.
# EXAMPLE: Suppose you want to give
# Thelonious a fixed VPN IP address of 10.9.0.1.
# First uncomment out these lines:
# option client_config_dir /etc/openvpn/ccd
# list route "10.9.0.0 255.255.255.252"
# list route "192.168.100.0 255.255.255.0"
# Then add this line to ccd/Thelonious:
# ifconfig-push "10.9.0.1 10.9.0.2"
# Suppose that you want to enable different
# firewall access policies for different groups
# of clients. There are two methods:
# (1) Run multiple OpenVPN daemons, one for each
# group, and firewall the TUN/TAP interface
# for each group/daemon appropriately.
# (2) (Advanced) Create a script to dynamically
# modify the firewall in response to access
# from different clients. See man
# page for more info on learn-address script.
# option learn_address /etc/openvpn/script
# If enabled, this directive will configure
# all clients to redirect their default
# network gateway through the VPN, causing
# all IP traffic such as web browsing and
# and DNS lookups to go through the VPN
# (The OpenVPN server machine may need to NAT
# the TUN/TAP interface to the internet in
# order for this to work properly).
# CAVEAT: May break client's network config if
# client's local DHCP server packets get routed
# through the tunnel. Solution: make sure
# client's local DHCP server is reachable via
# a more specific route than the default route
# of 0.0.0.0/0.0.0.0.
# list push "redirect-gateway"
# Certain Windows-specific network settings
# can be pushed to clients, such as DNS
# or WINS server addresses. CAVEAT:
# http://openvpn.net/faq.html#dhcpcaveats
# list push "dhcp-option DNS 10.8.0.1"
# list push "dhcp-option WINS 10.8.0.1"
# Uncomment this directive to allow different
# clients to be able to "see" each other.
# By default, clients will only see the server.
# To force clients to only see the server, you
# will also need to appropriately firewall the
# server's TUN/TAP interface.
# option client_to_client 1
# Uncomment this directive if multiple clients
# might connect with the same certificate/key
# files or common names. This is recommended
# only for testing purposes. For production use,
# each client should have its own certificate/key
# pair.
#
# IF YOU HAVE NOT GENERATED INDIVIDUAL
# CERTIFICATE/KEY PAIRS FOR EACH CLIENT,
# EACH HAVING ITS OWN UNIQUE "COMMON NAME",
# UNCOMMENT THIS LINE OUT.
# option duplicate_cn 1
# The keepalive directive causes ping-like
# messages to be sent back and forth over
# the link so that each side knows when
# the other side has gone down.
# Ping every 10 seconds, assume that remote
# peer is down if no ping received during
# a 120 second time period.
option keepalive "10 120"
# For extra security beyond that provided
# by SSL/TLS, create an "HMAC firewall"
# to help block DoS attacks and UDP port flooding.
#
# Generate with:
# openvpn --genkey --secret ta.key
#
# The server and each client must have
# a copy of this key.
# The second parameter should be '0'
# on the server and '1' on the clients.
# This file is secret:
# option tls_auth "/etc/openvpn/ta.key 0"
# For additional privacy, a shared secret key
# can be used for both authentication (as in tls_auth)
# and encryption of the TLS control channel.
#
# Generate a shared secret with:
# openvpn --genkey --secret ta.key
#
# The server and each client must have
# a copy of this key.
#
# tls_auth and tls_crypt should NOT
# be combined, as tls_crypt implies tls_auth.
# Use EITHER tls_crypt, tls_auth, or neither option.
# option tls_crypt "/etc/openvpn/ta.key"
# Set the minimum required TLS protocol version
# for all connections.
#
# Require at least TLS 1.1
# option tls_version_min "1.1"
# Require at least TLS 1.2
# option tls_version_min "1.2"
# Require TLS 1.2, or the highest version supported
# on the system
# option tls_version_min "1.2 'or-highest'"
# List the preferred ciphers to use for the data channel.
# Run openvpn --show-ciphers to see all supported ciphers.
# list data_ciphers 'AES-256-GCM'
# list data_ciphers 'AES-128-GCM'
# list data_ciphers 'CHACHA20-POLY1305'
# Set a fallback cipher in order to be compatible with
# peers that do not support cipher negotiation.
#
# Use AES-256-CBC as fallback
# option data_ciphers_fallback 'AES-128-CBC'
# Use AES-128-CBC as fallback
# option data_ciphers_fallback 'AES-256-CBC'
# Use Triple-DES as fallback
# option data_ciphers_fallback 'DES-EDE3-CBC'
# Use BF-CBC as fallback
# option data_ciphers_fallback 'BF-CBC'
# OpenVPN versions 2.4 and later will attempt to
# automatically negotiate the most secure cipher
# between the client and server, regardless of a
# configured "option cipher" (see below).
# Automatic negotiation is recommended.
#
# Uncomment this option to disable this behavior,
# and force all OpenVPN peers to use the configured
# cipher option instead (not recommended).
# option ncp_disable
# Enable compression on the VPN link.
# If you enable it here, you must also
# enable it in the client config file.
#
# Compression is not recommended, as compression and
# encryption in combination can weaken the security
# of the connection.
#
# LZ4 requires OpenVPN 2.4+ client and server
# option compress lz4
# LZO is available by default only in openvpn-openssl variant
# LZO is compatible with most OpenVPN versions
# option compress lzo
# Control how OpenVPN handles peers using compression
#
# Do not allow any connections using compression
# option allow_compression 'no'
# Allow incoming compressed packets, but do not send compressed packets to other peers
# This can be useful when migrating old configurations with compression activated
# option allow_compression 'asym'
# Both incoming and outgoing packets may be compressed
# option allow_compression 'yes'
# The maximum number of concurrently connected
# clients we want to allow.
# option max_clients 100
# The persist options will try to avoid
# accessing certain resources on restart
# that may no longer be accessible because
# of the privilege downgrade.
option persist_key 1
option persist_tun 1
option user nobody
# Output a short status file showing
# current connections, truncated
# and rewritten every minute.
option status /tmp/openvpn-status.log
# By default, log messages will go to the syslog (or
# on Windows, if running as a service, they will go to
# the "\Program Files\OpenVPN\log" directory).
# Use log or log-append to override this default.
# "log" will truncate the log file on OpenVPN startup,
# while "log-append" will append to it. Use one
# or the other (but not both).
# option log /tmp/openvpn.log
# option log_append /tmp/openvpn.log
# Set the appropriate level of log
# file verbosity.
#
# 0 is silent, except for fatal errors
# 4 is reasonable for general usage
# 5 and 6 can help to debug connection problems
# 9 is extremely verbose
option verb 3
# Silence repeating messages. At most 20
# sequential messages of the same message
# category will be output to the log.
# option mute 20
##############################################
# Sample client-side OpenVPN 2.0 uci config #
# for connecting to multi-client server. #
##############################################
config openvpn sample_client
# Set to 1 to enable this instance:
option enabled 0
# Specify that we are a client and that we
# will be pulling certain config file directives
# from the server.
option client 1
# Use the same setting as you are using on
# the server.
# On most systems, the VPN will not function
# unless you partially or fully disable
# the firewall for the TUN/TAP interface.
# option dev tap
option dev tun
# Are we connecting to a TCP or
# UDP server? Use the same setting as
# on the server.
# option proto tcp
option proto udp
# The hostname/IP and port of the server.
# You can have multiple remote entries
# to load balance between the servers.
list remote "my_server_1 1194"
# list remote "my_server_2 1194"
# Choose a random host from the remote
# list for load_balancing. Otherwise
# try hosts in the order specified.
# option remote_random 1
# Keep trying indefinitely to resolve the
# host name of the OpenVPN server. Very useful
# on machines which are not permanently connected
# to the internet such as laptops.
option resolv_retry infinite
# Most clients don't need to bind to
# a specific local port number.
option nobind 1
# Try to preserve some state across restarts.
option persist_key 1
option persist_tun 1
option user nobody
# If you are connecting through an
# HTTP proxy to reach the actual OpenVPN
# server, put the proxy server/IP and
# port number here. See the man page
# if your proxy server requires
# authentication.
# retry on connection failures:
# option http_proxy_retry 1
# specify http proxy address and port:
# option http_proxy "192.168.1.100 8080"
# Wireless networks often produce a lot
# of duplicate packets. Set this flag
# to silence duplicate packet warnings.
# option mute_replay_warnings 1
# SSL/TLS parms.
# See the server config file for more
# description. It's best to use
# a separate .crt/.key file pair
# for each client. A single ca
# file can be used for all clients.
option ca /etc/openvpn/ca.crt
option cert /etc/openvpn/client.crt
option key /etc/openvpn/client.key
# Verify server certificate by checking
# that the certicate has the key usage
# field set to "server". This is an
# important precaution to protect against
# a potential attack discussed here:
# http://openvpn.net/howto.html#mitm
#
# To use this feature, you will need to generate
# your server certificates with the nsCertType
# field set to "server". The build_key_server
# script in the easy_rsa folder will do this.
# option remote_cert_tls server
# If a tls_auth key is used on the server
# then every client must also have the key.
# option tls_auth "/etc/openvpn/ta.key 1"
# If a tls_crypt key is used on the server
# every client must also have the key.
# option tls_crypt "/etc/openvpn/ta.key"
# Set the minimum required TLS protocol version
# for all connections.
#
# Require at least TLS 1.1
# option tls_version_min "1.1"
# Require at least TLS 1.2
# option tls_version_min "1.2"
# Require TLS 1.2, or the highest version supported
# on the system
# option tls_version_min "1.2 'or-highest'"
# List the preferred ciphers for the data channel.
# list data_ciphers 'AES-256-GCM'
# list data_ciphers 'AES-128-GCM'
# list data_ciphers 'CHACHA20-POLY1305'
# Set a fallback cipher if you connect to a peer that does
# not support cipher negotiation.
# Use AES-256-CBC as fallback
# option data_ciphers_fallback 'AES-128-CBC'
# Use AES-128-CBC as fallback
# option data_ciphers_fallback 'AES-256-CBC'
# Use Triple-DES as fallback
# option data_ciphers_fallback 'DES-EDE3-CBC'
# Use BF-CBC as fallback
# option data_ciphers_fallback 'BF-CBC'
# Enable compression on the VPN link.
# Don't enable this unless it is also
# enabled in the server config file.
#
# Compression is not recommended, as compression and
# encryption in combination can weaken the security
# of the connection.
#
# LZ4 requires OpenVPN 2.4+ on server and client
# option compress lz4
# LZO is available by default only in openvpn-openssl variant
# LZO is compatible with most OpenVPN versions
# option compress lzo
# Set log file verbosity.
option verb 3
# Silence repeating messages
# option mute 20
net/openvpn/files/usr/libexec/rpcd/openvpn
+ 6
− 2
View file @ e8127892
...@@ -8,7 +8,7 @@ case "$1" in ...@@ -8,7 +8,7 @@ case "$1" in
echo '{ echo '{
"connect": {"instance": "String", "username": "String", "password": "String", "store": "String"}, "connect": {"instance": "String", "username": "String", "password": "String", "store": "String"},
"disconnect": {"instance": "String"}, "disconnect": {"instance": "String"},
"import_ovpn": {"instance": "String", "name": "String", "url": "String"}, "import_ovpn": {"instance": "String", "name": "String", "url": "String", "user": "String", "pass":"String"},
"status": {"instance": "String"} "status": {"instance": "String"}
}' }'
;; ;;
...@@ -101,6 +101,8 @@ case "$1" in ...@@ -101,6 +101,8 @@ case "$1" in
# Import OpenVPN configuration from a file or URL # Import OpenVPN configuration from a file or URL
json_get_var name name json_get_var name name
json_get_var url url json_get_var url url
json_get_var user user
json_get_var pass pass
# Check for empty or existing name # Check for empty or existing name
if [ -z "${url}" ]; then if [ -z "${url}" ]; then
...@@ -145,10 +147,12 @@ case "$1" in ...@@ -145,10 +147,12 @@ case "$1" in
# Configure OpenVPN instance # Configure OpenVPN instance
uci -q set openvpn."${name}"=openvpn uci -q set openvpn."${name}"=openvpn
uci -q set openvpn."${name}".config="${file_name}" uci -q set openvpn."${name}".config="${file_name}"
uci -q set openvpn."${name}".username="${user}"
uci -q set openvpn."${name}".password="${pass}"
uci -q set openvpn."${name}".log="/tmp/openvpn_${name}.log" uci -q set openvpn."${name}".log="/tmp/openvpn_${name}.log"
uci -q commit openvpn uci -q commit openvpn
echo "{\"Instance\": \"${name}\", \"Config_Path\": \"${file_name}\"}" echo "{\"Name\": \"${name}\", \"Status\": \"Completed\"}"
;; ;;
esac esac
;; ;;
......
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment