openvpn configuration?

[Mike Snyder]

I see that there is a port of openvpn in the unix ports section of Netlabs Projects.  I can't tell who created it, maintains it, or how to configure it.  I have openvpn working on a Linux box, but don't know where to put the pieces in ArcaOS5.  Can anyone offer some knowledge about this?

[Pete]

Hi Michael

I must admit to not knowing anything about openvpn myself so had a quick look.

Looking at the webpage http://trac.netlabs.org/ports/wiki/openvpn I think the sections Reporting Bugs and Credits are the closest answers to the "who created it, maintains it" questions - although it is more a case of who ported it rather than created it.

Looking at the zip file contents I would guess that the executable can be placed in a directory of your choice.
The supporting dll files look like they should be in the \user\lib\ directory - possibly on the boot drive if that directory does not already exist on your system and possibly added to the LibPath. You may have to experiment a little.

Due to lack of docs included I suggest you check out the links found in the Community section of the wiki https://en.wikipedia.org/wiki/OpenVPN - hopefully you will get some clues about configuration from those links.


Regards

Pete

[Mike Snyder]

I put the executable in x:/etc/openvpn, and also put one of the config files from a vpn provider that I have set up on a linux box in the same directory.  I put the .dlls in x:/usr/lib.  Openvpn actually starts and asks for my userid and password, but then gives several error messages that I don't understand or know how to deal with that have to do with routing and gateway information.  I suspect that I need someone who understands OS/2, rather than Linux or Windows, to help me with those.

Thanks for the information.  I'll look there.

[Martin Iturbide]

Hi Michael.

I also have zero experience with openvpn. Maybe you can post the several error messages that it produce. Maybe someone may see those errors familiar.

Regards

[Andreas Schnellbacher]

The chance is low for your case, but Cisco routers are that much popular, that it may be of interest for some people:

Maybe you are trying to connect to a Cisco router. That can only work, if you also have the IPSec protocol available, which doesn't exist for OS/2, AFAIK.

[Ian B Manners]

Injoy Firewall has IPSec support, see http://www.bitwiseworks.com/

[ak120]

The chance is low for your case, but Cisco routers are that much popular, that it may be of interest for some people:

Maybe you are trying to connect to a Cisco router. That can only work, if you also have the IPSec protocol available, which doesn't exist for OS/2, AFAIK.

The 32-bit version of MPTS contains SSL and IPSec. Quite easy to check on a system with OS/2 TCP/IP Security Services.

[Jan-Erik Lärka]

Download this package and extract the relevant files as it contain the network driver and .nif file as well as some configuration info.

ftp://cyberia.dnsalias.com/pub/filebase/gfd/net/misc/openvpn.zip (OW built version 2.0.9)

Then use the package from Netlabs to update the application files and packages to version 2.1.3.

I've got a script that can detect the mac address of the computer... a shortened version could automatically write the .nif file to the X:\IBMCOM\MACS folder with 1:st position altered to 0 and and 7:th to 1?

Add the adapter to MPTS/Adapters and protocols...

What more has to be done?

//Jan-Erik

[Paul Smedley]

Hi Jan-Erik,

From what I can tell, the mac address set for the openvpn driver isn't critical, it just has to be valid. You also need to add TCPIP to this NIC.

The openvpn.zip package from hobbes also has information on how to configure this interface in setup.cmd:
ie:                   ifconfig lan1 10.7.7.2 netmask 255.255.255.0 metric 0 mtu 1500

In theory you can then start openvpn.exe with:
openvpn sample.ovpn

I found the following:
specifying dev-node on the command line didn't work, but having 'dev-node lan1' in the ovpn file did

The ovpn also needs to have:
dev tap

as
dev tun

is not supported....

[Bernhard Pöttinger]

I am reading this forum already some time. Now it's time to participate actively. I am using openvpn to support my clients.

OpenVPN is very easy. Place DEVICE=E:\IBMCOM\MACS\OpenVPN.SYS in config.sys and make an entry in protocol.ini:

[OpenVPN_nif]
  DriverName = OVPNET$
  NETADDRESS = "004030123456"

Create a config file for openvpn (lan0=lan, lan1=wlan, lan2=openvpn), for example:

dev tap
dev-type tap
dev-node lan2
proto udp
cipher AES-128-CBC
auth SHA1
remote aaa.bbb.ccc.ddd 1194
resolv-retry infinite
pull
auth-user-pass
tls-client
pkcs12 <p12file>.p12
tls-auth <tlskey>.key 1
script-security 3
verb 3

As Server you can use  a linux machine, or ipcop, ipfire, pfsense firewall (the example above is for an pfsense firewall). In the case of pfsense the firewall creates the client config file, the p12 file and the tls key file. Start openvpn with:

openvpn --cd <config-dir> --config <config file>

Example:
{0}[e:\sys\apps\openvpn] ovpn_argon.cmd
openvpn --cd .\config --config argon.ovpn
Mon Sep 30 19:49:43 2019 OpenVPN 2.1.3 i386-pc-os2-emx [SSL] [LZO2] built on Sep
 21 2010
Enter Auth Username:openit_admin
Enter Auth Password:
Mon Sep 30 19:49:53 2019 WARNING: No server certificate verification method has
been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Mon Sep 30 19:49:53 2019 NOTE: the current --script-security setting may allow t
his configuration to call user-defined scripts
Mon Sep 30 19:49:53 2019 NOTE: --script-security method='system' is deprecated d
ue to the fact that passed parameters will be subject to shell expansion
Mon Sep 30 19:49:53 2019 WARNING: file 'openit_admin-TO-argon.p12' is group or o
thers accessible
Mon Sep 30 19:49:53 2019 WARNING: file 'openit_admin-TO-argon.key' is group or o
thers accessible
Mon Sep 30 19:49:53 2019 Control Channel Authentication: using 'openit_admin-TO-
argon.key' as a OpenVPN static key file
Mon Sep 30 19:49:53 2019 LZO compression initialized
Mon Sep 30 19:49:53 2019 UDPv4 link local (bound): [undef]:1194
Mon Sep 30 19:49:53 2019 UDPv4 link remote: <IP>:1196
Mon Sep 30 19:49:54 2019 WARNING: this configuration may cache passwords in memo
ry -- use the auth-nocache option to prevent this
Mon Sep 30 19:49:55 2019 [openit_admin] Peer Connection Initiated with 81.223.17
3.68:1196
Mon Sep 30 19:49:57 2019 ifconfig.exe lan2 10.125.211.2 netmask 255.255.255.0 mt
u 1500 up
sem reset rc=300
up: Operation not supported
add net 10.0.0.0: gateway 10.125.211.1

Mon Sep 30 19:49:57 2019 Initialization Sequence Completed

{0}[e:\] ping 10.0.0.12
PING 10.0.0.12: 56 data bytes
64 bytes from 10.0.0.12: icmp_seq=0. time=90. ms
64 bytes from 10.0.0.12: icmp_seq=1. time=20. ms

----10.0.0.12 PING Statistics----
2 packets transmitted, 2 packets received, 0% packet loss
round-trip (ms)  min/avg/max = 20/55/90

That's it. Easy and Robust and with openvpn you need only one port for comunication. You can use tcp or udp.

best regards
Bernhard

[Paul Smedley]

Hi Bernhard,

Thanks for sharing - are you also able to test with https://smedley.id.au/tmp/openvpn-2.2.2-os2-20190929.zip

I'll try bump our port to a currently supported one, however, from 2.3.x onwards, ipv6 support is included and will need to be worked around in the code.

Cheers,

Paul.

[Jan-Erik Lärka]

Thank you Paul for the updated build!

Many assume that one just want to connect to "home", when away.
I'm looking at that but qputty refuse to connect to my router with a batch file here so the long and tedious configuration has to be done manually.

But how do one use those "free" or paid OpenVPN services out there from "home" to the outside to secure the connection? Here it just say "Connection refused".
Would be interesting to read and follow a description with images how to set it up with ArcaOS (ArcaOS is OS/2 with all available fixes applied, so upgrade to and use it).

Most providers seem to have "tun" set in their config files btw.

[Rich Walsh]

I'm trying to use Paul's build to connect to a commercial VPN provider but I'm not having any luck (the problems aren't specific to his build - all 3 versions act the same ).

At first I thought it would be easy because the provider (TigerVPN) offers customized '.ovpn' files for each of its servers. After changing "dev tun" to "dev tap", I tried to connect and got this:

Code: [Select]

Wed Oct  2 12:37:36 2019 C:/MPTN/BIN/ifconfig.exe lan1 100.97.0.2 100.97.0.2 netmask 255.255.0.0 mtu 1500 up
sem reset rc=300
Error: Interface is not point-to-point.
Wed Oct  2 12:37:36 2019 OS/2 ifconfig failed: external program did not exit normally


Note that it's supplying both local and remote IPs, rather than just the local address. My guess is that it's trying to configure lan1 as though it were a "tun" device rather than a "tap". Setting "dev-type tap" didn't help. Also, our 'ifconfig' complains if you include "up" when setting the address and netmask, so that's another minor problem.

Next, I tried to do a workaround by having it run a script using the "up" and "ifconfig-noexec" options rather than letting it run 'ifconfig' directly. No such luck, doing so produces this:

Code: [Select]

Wed Oct  2 12:48:30 2019 Assertion failed at misc.c:222

I got the same results regardless of whether I used 'cmd.exe' or 'sh.exe' (and the appropriate type of script). Having it run the same dummy script at an earlier point in the process worked just fine, so the issue isn't OpenVPN's ability to run a script or the script itself.

Finally, I considering writing a wrapper for 'ifconfig' that would fix the command line, but then I discovered that the path to 'ifconfig.exe' appears to be hard-coded as "x:/MPTN/BIN". This makes the wrapper idea impractical because it would affect normal use of 'ifconfig' during startup. (IMHO, the .exe should be found via a PATH search.)

Does anyone have any suggestions on how to get this working?

[Doug Bissett]

That's it. Easy and Robust and with openvpn you need only one port for comunication. You can use tcp or udp.

Sounds easy enough, but I don't have a linux machine to play with. What I would like, is to be able to connect, as Jan-Erik suggests, to my "home"machine, from anywhere, using OS/2 (specifically ArcaOS). I have no interest in using a "free" or paid OpenVPN service (spyware, at best). I tried what is suggested, but it simply refuses to connect (this is on my home LAN). Does anyone have a "cookbook" on how to get this to work between two OS/2 machines?

[Paul Smedley]

Hey Rich,

I'm trying to use Paul's build to connect to a commercial VPN provider but I'm not having any luck (the problems aren't specific to his build - all 3 versions act the same ).

At first I thought it would be easy because the provider (TigerVPN) offers customized '.ovpn' files for each of its servers. After changing "dev tun" to "dev tap", I tried to connect and got this:

Code: [Select]

Wed Oct  2 12:37:36 2019 C:/MPTN/BIN/ifconfig.exe lan1 100.97.0.2 100.97.0.2 netmask 255.255.0.0 mtu 1500 up
sem reset rc=300
Error: Interface is not point-to-point.
Wed Oct  2 12:37:36 2019 OS/2 ifconfig failed: external program did not exit normally


Note that it's supplying both local and remote IPs, rather than just the local address. My guess is that it's trying to configure lan1 as though it were a "tun" device rather than a "tap". Setting "dev-type tap" didn't help. Also, our 'ifconfig' complains if you include "up" when setting the address and netmask, so that's another minor problem.

Next, I tried to do a workaround by having it run a script using the "up" and "ifconfig-noexec" options rather than letting it run 'ifconfig' directly. No such luck, doing so produces this:

Code: [Select]

Wed Oct  2 12:48:30 2019 Assertion failed at misc.c:222

I got the same results regardless of whether I used 'cmd.exe' or 'sh.exe' (and the appropriate type of script). Having it run the same dummy script at an earlier point in the process worked just fine, so the issue isn't OpenVPN's ability to run a script or the script itself.

Finally, I considering writing a wrapper for 'ifconfig' that would fix the command line, but then I discovered that the path to 'ifconfig.exe' appears to be hard-coded as "x:/MPTN/BIN". This makes the wrapper idea impractical because it would affect normal use of 'ifconfig' during startup. (IMHO, the .exe should be found via a PATH search.)

Does anyone have any suggestions on how to get this working?

I had some similar issues attempting connection to a Getflix VPN service, but it seems to connect OK to my local OpenVPN instance running on Ubuntu.

I'm sure I can tweak the code around loading ifconfig.exe - I'll try and remember to zip up the source tonight.

I have no idea how difficult it might be to create a tun driver for OS/2 - from what I've read, almost all VPN services prefer tun to tap - which is awkward as our port only supports tap!

Cheers,

Paul