Linux:Configuration d'un client VPN sur un pfSense
De WIKI.minetti.org
But
Installer et configurer un client VPN avec OpenVPN sur un dispositif pfSense.
Étape préliminaire
Avant de commencer:
- il est impératif de disposer d'un serveur VPN;
- et assurez-vous que votre dispositif pfSense répond bien au PING.
Installation
Sur PfSense, OpenVPN est installé par défaut.
Configuration
- Commencer par créer la clé et le certificat SSL de votre client en vous assurant d'avoir:
- un CN correspondant au nom ou à l'adresse IP du client vue par le serveur VPN (en principe il s'agit de l'adresse publique - dans notre exemple ce sera siteA.minetti.org);
- un keyUsage avec uniquement digitalSignature et/ou keyAgreement;
- un extendedKeyUsage avec clientAuth (TLS Web Client Authentication);
- et un nsCertType avec client.
- Récupérer le certificat CA ayant servi à la certification du certificat client et l'enregistrer dans pfSense dans les CAs (menu System / Certificate Manager) en cliquant sur le bouton Add et en renseignant les champs suivants:
- Descriptive name: le nom que vous voulez donner à votre CA (par exemple: cacert);
- Method: Import an existing Certificate Authority;
- Certificate data: tous le contenu de votre certificat;
- Private key data: le contenu de votre clé comprenant BEGIN CERTIFICATE et END CERTIFICATE;
- Mettre la clé et le certificat SSL précédemment créé dans pfSense dans les Certificates (menu System / Certificate Manager) en cliquant sur le bouton Add/Sign et en renseignant les champs suivants:
- Method: Import an existing Certificate;
- Descriptive name: le nom que vous voulez donner à votre certificat (par exemple: siteA);
- Certificate data: le contenu de votre CA comprenant BEGIN CERTIFICATE et END CERTIFICATE;
- Afficher la liste des clients OpenVPN (onglet Clients du menu VPN / OpenVPN) et cliquer sur le bouton Add;
- Renseigner les champs suivants:
- Server mode: Peer to Peer (SSL/TLS);
- Protocol: UDP on IPv4 only;
- Device mode: tun - Layer 3 Tunnel mode;
- Interface: WAN;
- Server host or address: l'adresse IP du serveur VPN (par exemple: vps.minetti.org);
- Server port: 1194;
- Description: la description du serveur VPN;
- TLS Configuration: cocher la case à cocher Use a TLS Key;
- TLS Key: récupérer la clé du HMAC firewall, ta.key, sur le serveur et mettre son contenu ici;
- TLS Key Usage Mode: TLS Authentication;
- Peer Certificate Authority: votre CA (par exemple: cacert);
- Client Certificate: votre certificat (par exemple: siteA);
- Encryption Algorithm: BF-CBC (128 bit key by default, 64 bit block);
- Enable NCP: non coché;
- Auth digest algorithm: SHA1 (160-bit);
- Hardware Crypto: No Hardware Crypto Acceleration;
- Compression: LZO Compression [compress lzo, equivalent to comp-lzo yes for compatibility];
- Topology: Subnet - One IP address per client in a common subnet;
- Custom options:
remote-cert-tls server
Test
- Une fois le client VPN créé, vérifier que les logs ressemblent à ceci (onglet OpenVPN du menu Status / System Logs):
Dec 29 13:38:57 openvpn 30851 OpenVPN 2.4.4 amd64-portbld-freebsd11.1 [SSL (OpenSSL)] [LZO] [LZ4] [MH/RECVDA] [AEAD] built on Nov 16 2017 Dec 29 13:38:57 openvpn 30851 library versions: OpenSSL 1.0.2m-freebsd 2 Nov 2017, LZO 2.10 Dec 29 13:38:57 openvpn 31054 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts Dec 29 13:38:57 openvpn 31054 TCP/UDP: Preserving recently used remote address: [AF_INET]x.x.x.x:1194 Dec 29 13:38:57 openvpn 31054 UDPv4 link local (bound): [AF_INET]y.y.y.y:0 Dec 29 13:38:57 openvpn 31054 UDPv4 link remote: [AF_INET]x.x.x.x:1194 Dec 29 13:38:57 openvpn 31054 [vps.minetti.org] Peer Connection Initiated with [AF_INET]x.x.x.x:1194 Dec 29 13:38:58 openvpn 31054 WARNING: INSECURE cipher with block size less than 128 bit (64 bit). This allows attacks like SWEET32. Mitigate by using a --cipher with a larger block size (e.g. AES-256-CBC). Dec 29 13:38:58 openvpn 31054 WARNING: INSECURE cipher with block size less than 128 bit (64 bit). This allows attacks like SWEET32. Mitigate by using a --cipher with a larger block size (e.g. AES-256-CBC). Dec 29 13:38:58 openvpn 31054 WARNING: cipher with small block size in use, reducing reneg-bytes to 64MB to mitigate SWEET32 attacks. Dec 29 13:38:58 openvpn 31054 TUN/TAP device ovpnc1 exists previously, keep at program end Dec 29 13:38:58 openvpn 31054 TUN/TAP device /dev/tun1 opened Dec 29 13:38:58 openvpn 31054 do_ifconfig, tt->did_ifconfig_ipv6_setup=0 Dec 29 13:38:58 openvpn 31054 /sbin/ifconfig ovpnc1 10.8.0.10 10.8.0.1 mtu 1500 netmask 255.255.255.0 up Dec 29 13:38:58 openvpn 31054 /usr/local/sbin/ovpn-linkup ovpnc1 1500 1542 10.8.0.10 255.255.255.0 init Dec 29 13:38:58 openvpn 31054 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this Dec 29 13:38:58 openvpn 31054 Initialization Sequence Completed
- Du côté du serveur, les logs doivent ressembler à ceci:
Tue Apr 12 17:23:35 2016 y.y.y.y:3013 TLS: Initial packet from [AF_INET]y.y.y.y:3013, sid=1aa82210 f0ed027b Tue Apr 12 17:23:35 2016 y.y.y.y:3013 VERIFY OK: depth=1, C=FR, ST=Herault, L=Saint-Jean-de-Vedas, O=Minetti, CN=MINETTI CA, emailAddress=jp@minetti.org Tue Apr 12 17:23:35 2016 y.y.y.y:3013 VERIFY OK: depth=0, C=FR, ST=Herault, L=Saint-Jean-de-Vedas, O=Minetti, OU=siteA (client), CN=siteA.minetti.org, emailAddress=root@minetti.org Tue Apr 12 17:23:35 2016 y.y.y.y:3013 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key Tue Apr 12 17:23:35 2016 y.y.y.y:3013 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication Tue Apr 12 17:23:35 2016 y.y.y.y:3013 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key Tue Apr 12 17:23:35 2016 y.y.y.y:3013 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication Tue Apr 12 17:23:35 2016 y.y.y.y:3013 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 1024 bit RSA Tue Apr 12 17:23:35 2016 y.y.y.y:3013 [siteA.minetti.org] Peer Connection Initiated with [AF_INET]y.y.y.y:3013 Tue Apr 12 17:23:35 2016 siteA.minetti.org/y.y.y.y:3013 OPTIONS IMPORT: reading client specific options from: ccd/siteA.minetti.org Tue Apr 12 17:23:35 2016 siteA.minetti.org/y.y.y.y:3013 MULTI: Learn: 10.8.0.10 -> siteA.minetti.org/y.y.y.y:3013 Tue Apr 12 17:23:35 2016 siteA.minetti.org/y.y.y.y:3013 MULTI: primary virtual IP for siteA.minetti.org/y.y.y.y:3013: 10.8.0.10 Tue Apr 12 17:23:35 2016 siteA.minetti.org/y.y.y.y:3013 MULTI: internal route 192.168.3.0/24 -> siteA.minetti.org/y.y.y.y:3013 Tue Apr 12 17:23:35 2016 siteA.minetti.org/y.y.y.y:3013 MULTI: Learn: 192.168.3.0/24 -> siteA.minetti.org/y.y.y.y:3013 Tue Apr 12 17:23:35 2016 siteA.minetti.org/y.y.y.y:3013 MULTI: internal route 192.168.2.0/24 -> siteA.minetti.org/y.y.y.y:3013 Tue Apr 12 17:23:35 2016 siteA.minetti.org/y.y.y.y:3013 MULTI: Learn: 192.168.2.0/24 -> siteA.minetti.org/y.y.y.y:3013 Tue Apr 12 17:23:35 2016 siteA.minetti.org/y.y.y.y:3013 MULTI: internal route 192.168.1.0/24 -> siteA.minetti.org/y.y.y.y:3013 Tue Apr 12 17:23:35 2016 siteA.minetti.org/y.y.y.y:3013 MULTI: Learn: 192.168.1.0/24 -> siteA.minetti.org/y.y.y.y:3013 Tue Apr 12 17:23:35 2016 siteA.minetti.org/y.y.y.y:3013 MULTI: internal route 192.168.0.0/24 -> siteA.minetti.org/y.y.y.y:3013 Tue Apr 12 17:23:35 2016 siteA.minetti.org/y.y.y.y:3013 MULTI: Learn: 192.168.0.0/24 -> siteA.minetti.org/y.y.y.y:3013 Tue Apr 12 17:23:38 2016 siteA.minetti.org/y.y.y.y:3013 PUSH: Received control message: 'PUSH_REQUEST' Tue Apr 12 17:23:38 2016 siteA.minetti.org/y.y.y.y:3013 send_push_reply(): safe_cap=940 Tue Apr 12 17:23:38 2016 siteA.minetti.org/y.y.y.y:3013 SENT CONTROL [siteA.minetti.org]: 'PUSH_REPLY,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,route 192.168.5.0 255.255.255.0 10.8.0.1,ifconfig 10.8.0.10 255.255.255.0' (status=1) Tue Apr 12 17:24:01 2016 siteA.minetti.org/y.y.y.y:3013 MULTI: Learn: 192.168.0.229 -> siteA.minetti.org/y.y.y.y:3013
- Vérifier le routage (Diagnostics / Routes):
Destination Gateway Flags Use Mtu Netif Expire default 88.127.168.254 UGS 499905 1500 igb1 10.8.0.0/24 10.8.0.1 UGS 0 1500 ovpnc1 10.8.0.1 link#8 UH 20454 1500 ovpnc1 10.8.0.10 link#8 UHS 3 16384 lo0 88.127.168.0/24 link#2 U 19642 1500 igb1 88.127.168.146 link#2 UHS 0 16384 lo0 127.0.0.1 link#4 UH 301 16384 lo0 192.168.0.0/24 link#3 U 908469 1500 igb2 192.168.0.254 link#3 UHS 0 16384 lo0 192.168.1.0/24 10.8.0.1 UGS 26 1500 ovpnc1 192.168.5.0/24 10.8.0.1 UGS 1247 1500 ovpnc1 192.168.11.0/24 link#1 U 0 1500 igb0 192.168.11.254 link#1 UHS 0 16384 lo0
- Faire un ping vers le serveur VPN (Diagnostics / Ping):
PING 10.8.0.1 (10.8.0.1): 56 data bytes 64 bytes from 10.8.0.1: icmp_seq=0 ttl=64 time=104.899 ms 64 bytes from 10.8.0.1: icmp_seq=1 ttl=64 time=105.345 ms 64 bytes from 10.8.0.1: icmp_seq=2 ttl=64 time=107.325 ms --- 10.8.0.1 ping statistics --- 3 packets transmitted, 3 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 104.899/105.856/107.325/1.054 ms
