= OpenVPN as a , forking TCP server which can service multiple clients over a single TCP port? =

{{{
#!html
<div>See the OpenVPN 2.0 release notes.</div>
<div></div>
<div>Also:</div>
<div></div>
<div>Here at work, we wanted to implement a VPN solution for Roadwarriors</div>
<div>which have to connect to the main office. OpenVPN looked like a  nice</div>
<div>solution, as it also works with Windows and can tunnel through an https</div>
<div>proxy.</div>
<div></div>
<div>One problem though, was the unability  to use a constant port number on</div>
<div>the server side.</div>
<div></div>
<div>The --inetd option seemed very promising, but the man-page explicitly</div>
<div>states  that this option can not be used for multiple connections,</div>
<div>although there seemed to be no reason. (The only reason i found</div>
<div>mentioned was,   that there was no config file templating mechanism,</div>
<div>which obviously isn't really a problem).</div>
<div></div>
<div>A test later I found, that the code    was written for inetd with</div>
<div>"wait=yes" in mind, but that was quickly changed[1] (see attached patch).</div>
<div></div>
<div>The attached patch [merged   with OpenVPN as of 1.6-beta5]</div>
<div>adds a new option "--inetd nowait" which makes OpenVPN</div>
<div>work with a connected socket on stdin, like    (x)inetd does with wait=no,</div>
<div>or even netcat with the -e option.</div>
<div></div>
<div>Of course this still runs one OpenVPN process per client. You still    need</div>
<div>one tap device per client, and configure bridging between them.</div>
<div></div>
<div>This also only works with SSL/TLS and tap devices, because    of the single</div>
<div>config file shared between all server processes.</div>
<div></div>
<div>The server config file in our case is easy:</div>
<div></div>
<div>| # OpenVPN    multiple-client-server</div>
<div>| inetd nowait</div>
<div>| proto tcp-server</div>
<div>|</div>
<div>| # 10.254.0.1 is our local VPN endpoint (office).</div>
<div>| dev    tap</div>
<div>| ifconfig 10.254.0.1 255.255.255.0</div>
<div>|</div>
<div>| # Our up script will establish routes</div>
<div>| # once the VPN is alive.</div>
<div>|    ifconfig-noexec</div>
<div>| up /etc/openvpn/vpn-server.up</div>
<div>|</div>
<div>| # We are SSL/TLS Server</div>
<div>| tls-server</div>
<div>| dh /etc/openvpn/dh2048.pem</div>
<div>| ca /etc/openvpn/my-ca.crt</div>
<div>| crl-verify /etc/openvpn/my-ca.crl</div>
<div>| cert /etc/openvpn/server.crt</div>
<div>| key /etc/openvpn/server.key</div>
<div></div>
<div>The only magic thing is the ifconfig-noexec. Of course we can't ifconfig</div>
<div>each of the tap interfaces with the same IP address.    But we don't need</div>
<div>to, as we are using bridging.</div>
<div></div>
<div>My Bridging setup script (run once at bootup):</div>
<div></div>
<div>| # load Bridging-Module</div>
<div>| modprobe bridge</div>
<div>|</div>
<div>| # configure bridge</div>
<div>| brctl addbr br0</div>
<div>| brctl stp   br0 off</div>
<div>| brctl setfd br0 0</div>
<div>|</div>
<div>| # our private vpn network</div>
<div>| ifconfig br0 10.254.0.1 netmask 0xffffff00 broadcast 10.254.0.255</div>
<div></div>
<div>The per-client setup script    (vpn-server.up):</div>
<div></div>
<div>| # add interface to bridge and activate</div>
<div>| brctl addif br0 $1</div>
<div>| ifconfig $1 up</div>
<div></div>
<div></div>
<div>And for    completeness sake, here is the xinetd config file for the</div>
<div>OpenVPN server:</div>
<div></div>
<div>| service openvpn_1</div>
<div>| {</div>
<div>|         type               = UNLISTED</div>
<div>|         port            = 443</div>
<div>|         socket_type     = stream</div>
<div>|         protocol        = tcp</div>
<div><span> </span> |         wait            = no</div>
<div>|         user            = root</div>
<div>|         server          = /usr/sbin/openvpn</div>
<div><span> </span> |         server_args     = --config /etc/openvpn/vpn-server.conf</div>
<div>|         disable         = no</div>
<div>| }</div>
<div></div>
<div><span> </span> And thats it. It works for me. If you have any questions or comments,</div>
<div>contact me, I'd be happy to hear from you.</div>
<div></div>
<div>CU, <span> </span></div>
<div>Stefan `Sec` Zehl</div>
<div></div>
<div>[1]  The necessary code changes are very small.</div>
<div>Only socket_listen_accept needs to be  <span> </span> changed. The accept() and</div>
<div>openvpn_close_socket() calls need to be removed, because the</div>
<div><span> </span> connection on stdin is already the connection we want.  The second</div>
<div>thing is, we have to use getpeername to find the IP and  <span> </span> <span> </span> Port of</div>
<div>our remote peer.</div>
<div></div>
<div>All the other changes in the attached patch deal with adding a new</div>
<div>command-line option, and propagating that new option down to the</div>
<div>correct function.</div>
}}}

[wiki:FAQ Return to FAQ]