1 Setting up OpenConnect VPN server
2 =================================
4 The openconnect server expects to be configured using the uci interface.
6 It is recommended to setup a dynamic DNS address with openwrt prior
7 to starting the server. That is because during the first startup
8 a certificate file which will contain the dynamic DNS name will be
9 created. You can always regenerate the certificate by deleting
10 /etc/ocserv/server-key.pem.
12 There are two approaches to setup the VPN. The proxy-arp approach (1)
13 which provides clients with addresses of the LAN, and the "forwarding"
14 approach (2) which provides clients with addresses of a separate private
15 network. The former is suitable when you have "roadwarrior" type of clients
16 connecting to the LAN, and the latter when you may need to connect
17 multiple networks with the LAN.
19 If for the client side you use OpenWRT it is recommended to check you
20 have the latest vpnc-scripts and openconnect packages.
26 [This option is available since ocserv-0.10.9-2 package]
28 To setup a server the provides access to LAN with network address
29 10.100.2.0/255.255.255.0 add the following to /etc/config/ocserv.
30 The following setup will assign the upper 62 addresses for VPN use.
33 ----/etc/config/ocserv-------------------------------------------
34 config ocserv 'config'
37 option max_clients '8'
39 option netmask '255.255.255.192'
40 option ipaddr '10.100.2.192'
42 option default_domain 'lan'
43 option compression '1'
45 option ping_leases '1'
49 option ip '10.100.2.1'
52 option ip '10.100.2.0'
53 option netmask '255.255.255.0'
57 option password '$5$unl8uKAGNsdTh9zm$PnUHEGhDc5VHbFE2EfWwW38Bub6Y6EZ5hrFwZE1r2F1'
59 -----------------------------------------------------------------
62 This setup re-utilizes the addresses assigned to LAN for the VPN clients.
63 To ensure that there are no conflicts with the DHCP server use the following
64 commands. These will set the maximum address assigned by DHCP to be 10.100.2.191
65 which is below the first VPN assigned address (10.100.2.192).
68 # uci set dhcp.lan.start=100
69 # uci set dhcp.lan.limit=91
72 For simple networks like that you may also leave the 'netmask' and 'ipaddr'
73 fields empty and ocserv on startup will set the necessary values.
76 2. Forwarding Approach
77 ======================
79 To setup a server the provides access to LAN with network address
80 10.100.2.0/255.255.255.0 using the VPN address range
81 10.100.3.0/255.255.255.0 add the following to /etc/config/ocserv:
84 ----/etc/config/ocserv-------------------------------------------
85 config ocserv 'config'
88 option max_clients '8'
90 option netmask '255.255.255.0'
91 option ipaddr '10.100.3.0'
93 option default_domain 'lan'
94 option compression '1'
98 option ip '10.100.2.1'
101 option ip '10.100.2.0'
102 option netmask '255.255.255.0'
106 option password '$5$unl8uKAGNsdTh9zm$PnUHEGhDc5VHbFE2EfWwW38Bub6Y6EZ5hrFwZE1r2F1'
108 -----------------------------------------------------------------
114 To allow the clients to resolv with the local domain add the following
115 to the ocserv configuration file.
118 ----/etc/config/ocserv-------------------------------------------
119 config ocserv 'config'
121 option default_domain 'mydomain'
124 The ```default_domain``` is optional and if not set, it will be autodetected
125 from dnsmasq's configuration.
128 Setting up the firewall
129 =======================
131 Since the connected users will be assigned to other interfaces than the LAN
132 one, it is required to assign the VPN clients to an interface, and enable
133 forwarding for them. That is, you should setup an unmanaged interface (e.g.,
134 called vpn), which will have assigned the 'vpns+' interfaces (i.e., all vpns
135 interfaces). Then a zone called vpn should be setup to handle interactions
136 with lan. An example, which alls all forwarding between LAN and VPN clients,
140 ----/etc/config/network------------------------------------------
141 config interface 'vpn'
143 option ifname 'vpns+'
144 -----------------------------------------------------------------
146 ----/etc/config/firewall-----------------------------------------
148 option input 'ACCEPT'
149 option forward 'ACCEPT'
150 option output 'ACCEPT'
152 option device 'vpns+'
164 option target 'ACCEPT'
167 option dest_port '443'
171 option target 'ACCEPT'
174 option dest_port '443'
176 -----------------------------------------------------------------
179 Note, that the last two rules, enable connections to port 443 from the
180 Internet. That is the port used by OpenConnect VPN.
186 Note that both configurations above add the user "test" with password "test". The
187 password is specified in the crypt(3) format.
189 The server can be enabled and started using:
190 # /etc/init.d/ocserv enable
191 # /etc/init.d/ocserv start
193 For any custom configuration options of ocserv you may add values in
194 /etc/ocserv/ocserv.conf.local.
196 There is a luci plugin to allow configuring the server from
197 the web environment; see the package luci-app-ocserv.