OS2 World Community Forum

OS/2, eCS & ArcaOS - Technical => Networking => Topic started by: Michael Snyder on December 09, 2017, 01:42:32 pm

Title: openvpn configuration?
Post by: Michael Snyder on December 09, 2017, 01:42:32 pm
I see that there is a port of openvpn in the unix ports section of Netlabs Projects.  I can't tell who created it, maintains it, or how to configure it.  I have openvpn working on a Linux box, but don't know where to put the pieces in ArcaOS5.  Can anyone offer some knowledge about this?
Title: Re: openvpn configuration?
Post by: Pete on December 11, 2017, 04:22:53 pm
Hi Michael

I must admit to not knowing anything about openvpn myself so had a quick look.

Looking at the webpage http://trac.netlabs.org/ports/wiki/openvpn I think the sections Reporting Bugs and Credits are the closest answers to the "who created it, maintains it" questions - although it is more a case of who ported it rather than created it.

Looking at the zip file contents I would guess that the executable can be placed in a directory of your choice.
The supporting dll files look like they should be in the \user\lib\ directory - possibly on the boot drive if that directory does not already exist on your system and possibly added to the LibPath. You may have to experiment a little.

Due to lack of docs included I suggest you check out the links found in the Community section of the wiki https://en.wikipedia.org/wiki/OpenVPN - hopefully you will get some clues about configuration from those links.


Regards

Pete


Title: Re: openvpn configuration?
Post by: Michael Snyder on December 11, 2017, 06:50:55 pm
I put the executable in x:/etc/openvpn, and also put one of the config files from a vpn provider that I have set up on a linux box in the same directory.  I put the .dlls in x:/usr/lib.  Openvpn actually starts and asks for my userid and password, but then gives several error messages that I don't understand or know how to deal with that have to do with routing and gateway information.  I suspect that I need someone who understands OS/2, rather than Linux or Windows, to help me with those.

Thanks for the information.  I'll look there.
Title: Re: openvpn configuration?
Post by: Martin Iturbide on December 11, 2017, 08:22:09 pm
Hi Michael.

I also have zero experience with openvpn. Maybe you can post the several error messages that it produce. Maybe someone may see those errors familiar.

Regards
Title: Re: openvpn configuration?
Post by: Andreas Schnellbacher on December 11, 2017, 09:15:48 pm
The chance is low for your case, but Cisco routers are that much popular, that it may be of interest for some people:

Maybe you are trying to connect to a Cisco router. That can only work, if you also have the IPSec protocol available, which doesn't exist for OS/2, AFAIK.
Title: Re: openvpn configuration?
Post by: Ian Manners on December 12, 2017, 02:20:42 pm
Injoy Firewall has IPSec support, see http://www.bitwiseworks.com/ (http://www.bitwiseworks.com/)
Title: Re: openvpn configuration?
Post by: Andreas Kohl on December 12, 2017, 02:51:12 pm
The chance is low for your case, but Cisco routers are that much popular, that it may be of interest for some people:

Maybe you are trying to connect to a Cisco router. That can only work, if you also have the IPSec protocol available, which doesn't exist for OS/2, AFAIK.
The 32-bit version of MPTS contains SSL and IPSec. Quite easy to check on a system with OS/2 TCP/IP Security Services.
Title: Re: openvpn configuration?
Post by: Jan-Erik Lärka on September 15, 2019, 08:15:08 am
Download this package and extract the relevant files as it contain the network driver and .nif file as well as some configuration info.

ftp://cyberia.dnsalias.com/pub/filebase/gfd/net/misc/openvpn.zip (ftp://cyberia.dnsalias.com/pub/filebase/gfd/net/misc/openvpn.zip) (OW built version 2.0.9)

Then use the package from Netlabs to update the application files and packages to version 2.1.3.

I've got a script that can detect the mac address of the computer... a shortened version could automatically write the .nif file to the X:\IBMCOM\MACS folder with 1:st position altered to 0 and and 7:th to 1?

Add the adapter to MPTS/Adapters and protocols...

What more has to be done?

//Jan-Erik
Title: Re: openvpn configuration?
Post by: Paul Smedley on September 30, 2019, 11:47:45 am
Hi Jan-Erik,

From what I can tell, the mac address set for the openvpn driver isn't critical, it just has to be valid. You also need to add TCPIP to this NIC.

The openvpn.zip package from hobbes also has information on how to configure this interface in setup.cmd:
ie:                   ifconfig lan1 10.7.7.2 netmask 255.255.255.0 metric 0 mtu 1500

In theory you can then start openvpn.exe with:
openvpn sample.ovpn

I found the following:
specifying dev-node on the command line didn't work, but having 'dev-node lan1' in the ovpn file did

The ovpn also needs to have:
dev tap

as
dev tun

is not supported....
Title: Re: openvpn configuration?
Post by: Bernhard Pöttinger on September 30, 2019, 07:58:33 pm
I am reading this forum already some time. Now it's time to participate actively. I am using openvpn to support my clients.

OpenVPN is very easy. Place DEVICE=E:\IBMCOM\MACS\OpenVPN.SYS in config.sys and make an entry in protocol.ini:

[OpenVPN_nif]
  DriverName = OVPNET$
  NETADDRESS = "004030123456"

Create a config file for openvpn (lan0=lan, lan1=wlan, lan2=openvpn), for example:

dev tap
dev-type tap
dev-node lan2
proto udp
cipher AES-128-CBC
auth SHA1
remote aaa.bbb.ccc.ddd 1194
resolv-retry infinite
pull
auth-user-pass
tls-client
pkcs12 <p12file>.p12
tls-auth <tlskey>.key 1
script-security 3
verb 3

As Server you can use  a linux machine, or ipcop, ipfire, pfsense firewall (the example above is for an pfsense firewall). In the case of pfsense the firewall creates the client config file, the p12 file and the tls key file. Start openvpn with:

openvpn --cd <config-dir> --config <config file>

Example:
{0}[e:\sys\apps\openvpn] ovpn_argon.cmd
openvpn --cd .\config --config argon.ovpn
Mon Sep 30 19:49:43 2019 OpenVPN 2.1.3 i386-pc-os2-emx [SSL] [LZO2] built on Sep
 21 2010
Enter Auth Username:openit_admin
Enter Auth Password:
Mon Sep 30 19:49:53 2019 WARNING: No server certificate verification method has
been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Mon Sep 30 19:49:53 2019 NOTE: the current --script-security setting may allow t
his configuration to call user-defined scripts
Mon Sep 30 19:49:53 2019 NOTE: --script-security method='system' is deprecated d
ue to the fact that passed parameters will be subject to shell expansion
Mon Sep 30 19:49:53 2019 WARNING: file 'openit_admin-TO-argon.p12' is group or o
thers accessible
Mon Sep 30 19:49:53 2019 WARNING: file 'openit_admin-TO-argon.key' is group or o
thers accessible
Mon Sep 30 19:49:53 2019 Control Channel Authentication: using 'openit_admin-TO-
argon.key' as a OpenVPN static key file
Mon Sep 30 19:49:53 2019 LZO compression initialized
Mon Sep 30 19:49:53 2019 UDPv4 link local (bound): [undef]:1194
Mon Sep 30 19:49:53 2019 UDPv4 link remote: <IP>:1196
Mon Sep 30 19:49:54 2019 WARNING: this configuration may cache passwords in memo
ry -- use the auth-nocache option to prevent this
Mon Sep 30 19:49:55 2019 [openit_admin] Peer Connection Initiated with 81.223.17
3.68:1196
Mon Sep 30 19:49:57 2019 ifconfig.exe lan2 10.125.211.2 netmask 255.255.255.0 mt
u 1500 up
sem reset rc=300
up: Operation not supported
add net 10.0.0.0: gateway 10.125.211.1

Mon Sep 30 19:49:57 2019 Initialization Sequence Completed

{0}[e:\] ping 10.0.0.12
PING 10.0.0.12: 56 data bytes
64 bytes from 10.0.0.12: icmp_seq=0. time=90. ms
64 bytes from 10.0.0.12: icmp_seq=1. time=20. ms

----10.0.0.12 PING Statistics----
2 packets transmitted, 2 packets received, 0% packet loss
round-trip (ms)  min/avg/max = 20/55/90

That's it. Easy and Robust and with openvpn you need only one port for comunication. You can use tcp or udp.

best regards
Bernhard




Title: Re: openvpn configuration?
Post by: Paul Smedley on October 01, 2019, 04:48:18 am
Hi Bernhard,

Thanks for sharing - are you also able to test with https://smedley.id.au/tmp/openvpn-2.2.2-os2-20190929.zip

I'll try bump our port to a currently supported one, however, from 2.3.x onwards, ipv6 support is included and will need to be worked around in the code.

Cheers,

Paul.
Title: Re: openvpn configuration?
Post by: Jan-Erik Lärka on October 02, 2019, 08:57:29 pm
Thank you Paul for the updated build!

Many assume that one just want to connect to "home", when away.
I'm looking at that but qputty refuse to connect to my router with a batch file here so the long and tedious configuration has to be done manually. :(

But how do one use those "free" or paid OpenVPN services out there from "home" to the outside to secure the connection? Here it just say "Connection refused".
Would be interesting to read and follow a description with images how to set it up with ArcaOS (ArcaOS is OS/2 with all available fixes applied, so upgrade to and use it).

Most providers seem to have "tun" set in their config files btw.
Title: Re: openvpn configuration?
Post by: Rich Walsh on October 02, 2019, 09:50:34 pm
I'm trying to use Paul's build to connect to a commercial VPN provider but I'm not having any luck (the problems aren't specific to his build - all 3 versions act the same ).

At first I thought it would be easy because the provider (TigerVPN) offers customized '.ovpn' files for each of its servers. After changing "dev tun" to "dev tap", I tried to connect and got this:
Code: [Select]
Wed Oct  2 12:37:36 2019 C:/MPTN/BIN/ifconfig.exe lan1 100.97.0.2 100.97.0.2 netmask 255.255.0.0 mtu 1500 up
sem reset rc=300
Error: Interface is not point-to-point.
Wed Oct  2 12:37:36 2019 OS/2 ifconfig failed: external program did not exit normally


Note that it's supplying both local and remote IPs, rather than just the local address. My guess is that it's trying to configure lan1 as though it were a "tun" device rather than a "tap". Setting "dev-type tap" didn't help. Also, our 'ifconfig' complains if you include "up" when setting the address and netmask, so that's another minor problem.

Next, I tried to do a workaround by having it run a script using the "up" and "ifconfig-noexec" options rather than letting it run 'ifconfig' directly. No such luck, doing so produces this:
Code: [Select]
Wed Oct  2 12:48:30 2019 Assertion failed at misc.c:222

I got the same results regardless of whether I used 'cmd.exe' or 'sh.exe' (and the appropriate type of script). Having it run the same dummy script at an earlier point in the process worked just fine, so the issue isn't OpenVPN's ability to run a script or the script itself.

Finally, I considering writing a wrapper for 'ifconfig' that would fix the command line, but then I discovered that the path to 'ifconfig.exe' appears to be hard-coded as "x:/MPTN/BIN". This makes the wrapper idea impractical because it would affect normal use of 'ifconfig' during startup. (IMHO, the .exe should be found via a PATH search.)

Does anyone have any suggestions on how to get this working?
Title: Re: openvpn configuration?
Post by: Doug Bissett on October 03, 2019, 03:11:05 am
Quote
That's it. Easy and Robust and with openvpn you need only one port for comunication. You can use tcp or udp.

Sounds easy enough, but I don't have a linux machine to play with. What I would like, is to be able to connect, as Jan-Erik suggests, to my "home"machine, from anywhere, using OS/2 (specifically ArcaOS). I have no interest in using a "free" or paid OpenVPN service (spyware, at best). I tried what is suggested, but it simply refuses to connect (this is on my home LAN). Does anyone have a "cookbook" on how to get this to work between two OS/2 machines?
Title: Re: openvpn configuration?
Post by: Paul Smedley on October 03, 2019, 04:47:35 am
Hey Rich,

I'm trying to use Paul's build to connect to a commercial VPN provider but I'm not having any luck (the problems aren't specific to his build - all 3 versions act the same ).

At first I thought it would be easy because the provider (TigerVPN) offers customized '.ovpn' files for each of its servers. After changing "dev tun" to "dev tap", I tried to connect and got this:
Code: [Select]
Wed Oct  2 12:37:36 2019 C:/MPTN/BIN/ifconfig.exe lan1 100.97.0.2 100.97.0.2 netmask 255.255.0.0 mtu 1500 up
sem reset rc=300
Error: Interface is not point-to-point.
Wed Oct  2 12:37:36 2019 OS/2 ifconfig failed: external program did not exit normally


Note that it's supplying both local and remote IPs, rather than just the local address. My guess is that it's trying to configure lan1 as though it were a "tun" device rather than a "tap". Setting "dev-type tap" didn't help. Also, our 'ifconfig' complains if you include "up" when setting the address and netmask, so that's another minor problem.

Next, I tried to do a workaround by having it run a script using the "up" and "ifconfig-noexec" options rather than letting it run 'ifconfig' directly. No such luck, doing so produces this:
Code: [Select]
Wed Oct  2 12:48:30 2019 Assertion failed at misc.c:222

I got the same results regardless of whether I used 'cmd.exe' or 'sh.exe' (and the appropriate type of script). Having it run the same dummy script at an earlier point in the process worked just fine, so the issue isn't OpenVPN's ability to run a script or the script itself.

Finally, I considering writing a wrapper for 'ifconfig' that would fix the command line, but then I discovered that the path to 'ifconfig.exe' appears to be hard-coded as "x:/MPTN/BIN". This makes the wrapper idea impractical because it would affect normal use of 'ifconfig' during startup. (IMHO, the .exe should be found via a PATH search.)

Does anyone have any suggestions on how to get this working?

I had some similar issues attempting connection to a Getflix VPN service, but it seems to connect OK to my local OpenVPN instance running on Ubuntu.

I'm sure I can tweak the code around loading ifconfig.exe - I'll try and remember to zip up the source tonight.

I have no idea how difficult it might be to create a tun driver for OS/2 - from what I've read, almost all VPN services prefer tun to tap - which is awkward as our port only supports tap!

Cheers,

Paul
Title: Re: openvpn configuration?
Post by: Rich Walsh on October 03, 2019, 04:42:37 pm
I have no idea how difficult it might be to create a tun driver for OS/2 - from what I've read, almost all VPN services prefer tun to tap - which is awkward as our port only supports tap!

I wouldn't worry about 'tap' vs 'tun'. Win uses 'tap', so it's going to be supported by commercial providers if they want any customers. Writing a new device driver for 'tun' is a tall order and best avoided if possible.

Quote
I'm sure I can tweak the code around loading ifconfig.exe - I'll try and remember to zip up the source tonight.

I suspect that this warning is the cause for the misconfiguration:
> WARNING: 'dev-type' is used inconsistently, local='dev-type tap', remote='dev-type tun'

My _guess_ is that there's some code or flag in the Win version that tells the server to use 'tap' during the initial connection setup - code that's being bypassed because Win32 isn't #defined.

If you'd care to share a diff of your changes, I'd be happy to pull the source and start looking.
Title: Re: openvpn configuration?
Post by: Paul Smedley on October 04, 2019, 05:02:39 am
Hi Rich!

I wouldn't worry about 'tap' vs 'tun'. Win uses 'tap', so it's going to be supported by commercial providers if they want any customers. Writing a new device driver for 'tun' is a tall order and best avoided if possible.

OK - from my reading I thought tun was more common, but happy to be wrong.


I suspect that this warning is the cause for the misconfiguration:
> WARNING: 'dev-type' is used inconsistently, local='dev-type tap', remote='dev-type tun'

My _guess_ is that there's some code or flag in the Win version that tells the server to use 'tap' during the initial connection setup - code that's being bypassed because Win32 isn't #defined.

If you'd care to share a diff of your changes, I'd be happy to pull the source and start looking.

I forgot to run a diff last night, but the netlabs build source (based on Pasha's original source on hobbes for 2.0.x) is at http://trac.netlabs.org/ports/browser/openvpn/trunk

Cheers,

Paul
Title: Re: openvpn configuration?
Post by: Paul Smedley on October 04, 2019, 11:05:08 am
diff at http://smedley.id.au/tmp/openvpn-2.2.2.diff
Title: Re: openvpn configuration?
Post by: Bernhard Pöttinger on October 05, 2019, 06:12:11 pm
Hi Paul,

excuse the delay.

Hi Bernhard,

Thanks for sharing - are you also able to test with https://smedley.id.au/tmp/openvpn-2.2.2-os2-20190929.zip

I'll try bump our port to a currently supported one, however, from 2.3.x onwards, ipv6 support is included and will need to be worked around in the code.

Cheers,

Paul.

Your new openvpn executable version 2.2 worked like a charm with all my vpn connections. As i said, on severside I use linux machines or pfSense firewalls. In former times I have used ipcop / ipfire as openvn servers and they worked too with os/2 or arcaos.

best regards
Bernhard.
Title: Re: openvpn configuration?
Post by: David McKenna on October 06, 2019, 02:16:20 am
 @Doug,

  In the openvpn.zip file found on Hobbes, in the 'another' folder, there is a good cookbook for setting up a server and client on OS/2. I gave it a shot and it works great... Paul's new build too. Now I can use ArcaMapper to access my shares remotely on my laptop. Had to set up a port forward on my router to do it....

Regards,
Title: Re: openvpn configuration?
Post by: Doug Bissett on October 07, 2019, 06:55:57 am
@Doug,

  In the openvpn.zip file found on Hobbes, in the 'another' folder, there is a good cookbook for setting up a server and client on OS/2. I gave it a shot and it works great... Paul's new build too. Now I can use ArcaMapper to access my shares remotely on my laptop. Had to set up a port forward on my router to do it....

Thanks. I tried that but it wasn't connecting. I will try it again, when I find a few minutes.
Title: Re: openvpn configuration?
Post by: Paul Smedley on October 07, 2019, 11:16:01 am
Hi All,

I managed to build OpenVPN 2.3.18 & 2.4.7 today. I had to add some ipv6 stuff to the libc headers as there's no way to disable ipv6 support in OpenVPN 2.3.x

It's now compiling, but I'm getting some select() errors - I suspect that some sockets are being created using non-ipv4 flags causing 'socket operation on non-socket' errors...

Will try work through it...

Cheers,

Paul
Title: Re: openvpn configuration?
Post by: Paul Smedley on October 08, 2019, 10:39:37 am
With thanks to Rich for some fixes to the default gateway code, the 2.3.18 code seems to be working....

http://smedley.id.au/tmp/openvpn-2.3.18-os2-20191008.zip

Feedback appreciated - this still will only work for providers that use the tap interface....
Title: Re: openvpn configuration?
Post by: Bernhard Pöttinger on October 08, 2019, 01:43:53 pm
Hallo Paul,
I tested your version 2.3 and it's working as expected. Thank's for the excelent work.
best regards
Bernhard
Title: Re: openvpn configuration?
Post by: TeLLie on October 08, 2019, 06:23:13 pm
Hi all,
I saw this passing by, its a gui for openvpn.
You can download from https://tellie.stackstorage.com/s/4iYPdyALJyH36uh
Its build with QT5.
Not sure it works there i have not ever use openvpn..
Title: Re: openvpn configuration?
Post by: Paul Smedley on October 08, 2019, 10:55:05 pm
Hi Bernard,

I tested your version 2.3 and it's working as expected. Thank's for the excelent work.

Great! Next step 2.4.7 - then to try get tun working .....

Cheers,

Paul
Title: Re: openvpn configuration?
Post by: Doug Bissett on October 09, 2019, 04:36:11 am
Quote
@Doug,

  In the openvpn.zip file found on Hobbes, in the 'another' folder, there is a good cookbook for setting up a server and client on OS/2. I gave it a shot and it works great...

Hmmm. Yes, it does work, once you realize that this section is sort of misleading:

Quote
Starting the client:
  The client makes an outgoing connection to the server, so it shouldn't matter
  if you are behind a Firewall/NAT. Making connections out through a http-
  proxy is beyond the scope of this document (see openvpn.net).
  You need to change 1 line in the client configuration file - client.ovpm -
  before you can use it. Look for this line:

  remote microsoft.com

  and change the hostname to the hostname of the server you wich to connect to.
  You can use an IP address instead, if you want to.
  Save file, and start Openvpn client this way:

In client.ovpm, it is not "remote microsoft.com" it is "remote 10.3.3.54", and then you need to realize, that the address that you change it to is the address of the other machine that you wish to connect to, and that has nothing to do with the address range that is used by the virtual network.

In testing, I am using a machine on my local network, that has address 192.168.0.116 for the server, and another local machine at address 192.168.0.107 for the client. The virtual connection is 10.7.7.1 and 10.7.7.2, but that path travels over the local network on the local addresses. To go over the internet, you would need to use your outside IP address, and have port 1194 open in your router(s).

There has got to be a better way to describe this, but my main problem was that the "remote" statement in the instructions, was not what was in the sample client.ovpn.

Okay, now, to figure out how to actually use this thing.   :o

Thanks...

BTW, I got Paul's 20191008 version, and it works too, now that I have decoded the instructions. There are a few warning messages, about security, that I need to figure out, but it seems to connect okay.
Title: Re: openvpn configuration?
Post by: Paul Smedley on October 09, 2019, 10:32:45 am
BTW, I got Paul's 20191008 version, and it works too, now that I have decoded the instructions. There are a few warning messages, about security, that I need to figure out, but it seems to connect okay.

Assuming you're talking about:
Tue Oct  8 19:06:02 2019 WARNING: file 'pass.txt' is group or others accessible

That should be addressed (actually just suppressed per WIN32) in http://smedley.id.au/tmp/openvpn-2.3.18-os2-20191009.zip
Title: Re: openvpn configuration?
Post by: Doug Bissett on October 09, 2019, 11:31:10 pm
Quote
Assuming you're talking about:
Tue Oct  8 19:06:02 2019 WARNING: file 'pass.txt' is group or others accessible

I don't think so. This is what I see, when starting the server, or the client (this is from the client):
Code: [Select]
[W:\TOOLS\OPENVPN]OpenVPN.exe client.ovpn
Wed Oct  9 15:14:39 2019 OpenVPN 2.3.18 i386-pc-os2-emx [SSL (OpenSSL)] [LZO] [MH] [IPv6] built on Oct  7 2019
Wed Oct  9 15:14:39 2019 library versions: OpenSSL 1.0.2n  7 Dec 2017, LZO 2.04
Wed Oct  9 15:14:39 2019 WARNING: INSECURE cipher with block size less than 128 bit (64 bit).  This allows attacks like SWEET32.  Mitigate by using a --cipher with a larger block size (e.g. AES-256-CBC).
Wed Oct  9 15:14:39 2019 WARNING: INSECURE cipher with block size less than 128 bit (64 bit).  This allows attacks like SWEET32.  Mitigate by using a --cipher with a larger block size (e.g. AES-256-CBC).
dev_node = (null)
Wed Oct  9 15:14:39 2019 UDPv4 link local (bound): [undef]
sem reset rc=300
Wed Oct  9 15:14:39 2019 UDPv4 link remote: [AF_INET]192.168.0.107:1194
Wed Oct  9 15:14:50 2019 Peer Connection Initiated with [AF_INET]192.168.0.107:1194
Wed Oct  9 15:14:51 2019 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Wed Oct  9 15:14:51 2019 Initialization Sequence Completed

It does work, but it seems that the program is suggesting that better security settings should be used. I am using the suggested setup from the "another" directory in the openvpn package, from HOBBES, updated to the new openvpn.exe, and minimally modified to match my local network. It looks like a good place to start, but I need to figure out what to change, to make it happy (LOW priority on my part).
Title: Re: openvpn configuration?
Post by: Doug Bissett on October 09, 2019, 11:41:01 pm
Quote
That should be addressed (actually just suppressed per WIN32) in http://smedley.id.au/tmp/openvpn-2.3.18-os2-20191009.zip

I downloaded this file, and the Archive Tool says the data is invalid.
Title: Re: openvpn configuration?
Post by: David Graser on October 10, 2019, 01:36:02 am
Quote
That should be addressed (actually just suppressed per WIN32) in http://smedley.id.au/tmp/openvpn-2.3.18-os2-20191009.zip

I downloaded this file, and the Archive Tool says the data is invalid.

There is no file(s) contained in the zip.
Title: Re: openvpn configuration?
Post by: Dave Yeo on October 10, 2019, 02:06:21 am
Quote
Assuming you're talking about:
Tue Oct  8 19:06:02 2019 WARNING: file 'pass.txt' is group or others accessible

I don't think so. This is what I see, when starting the server, or the client (this is from the client):
Code: [Select]
[W:\TOOLS\OPENVPN]OpenVPN.exe client.ovpn
Wed Oct  9 15:14:39 2019 OpenVPN 2.3.18 i386-pc-os2-emx [SSL (OpenSSL)] [LZO] [MH] [IPv6] built on Oct  7 2019
Wed Oct  9 15:14:39 2019 library versions: OpenSSL 1.0.2n  7 Dec 2017, LZO 2.04
Wed Oct  9 15:14:39 2019 WARNING: INSECURE cipher with block size less than 128 bit (64 bit).  This allows attacks like SWEET32.  Mitigate by using a --cipher with a larger block size (e.g. AES-256-CBC).
Wed Oct  9 15:14:39 2019 WARNING: INSECURE cipher with block size less than 128 bit (64 bit).  This allows attacks like SWEET32.  Mitigate by using a --cipher with a larger block size (e.g. AES-256-CBC).
dev_node = (null)
Wed Oct  9 15:14:39 2019 UDPv4 link local (bound): [undef]
sem reset rc=300
Wed Oct  9 15:14:39 2019 UDPv4 link remote: [AF_INET]192.168.0.107:1194
Wed Oct  9 15:14:50 2019 Peer Connection Initiated with [AF_INET]192.168.0.107:1194
Wed Oct  9 15:14:51 2019 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Wed Oct  9 15:14:51 2019 Initialization Sequence Completed

It does work, but it seems that the program is suggesting that better security settings should be used. I am using the suggested setup from the "another" directory in the openvpn package, from HOBBES, updated to the new openvpn.exe, and minimally modified to match my local network. It looks like a good place to start, but I need to figure out what to change, to make it happy (LOW priority on my part).

The cipher warning is the one to worry about, as it suggests, use the parameter  --cipher with a larger block size (e.g. AES-256-CBC), so --cipher AES-256-CBC. Probably can add it to the configuration file somewhere.
The password in memory thing is only a worry in a few cases such as a trp file containing it or someone with access to the computer. Should always double check trp files towards the bottom where the memory dumps are in case of sensitive info being there.
Title: Re: openvpn configuration?
Post by: Doug Bissett on October 10, 2019, 03:48:24 am
Quote
The cipher warning is the one to worry about, as it suggests, use the parameter  --cipher with a larger block size (e.g. AES-256-CBC), so --cipher AES-256-CBC. Probably can add it to the configuration file somewhere.
The password in memory thing is only a worry in a few cases such as a trp file containing it or someone with access to the computer. Should always double check trp files towards the bottom where the memory dumps are in case of sensitive info being there.

That saved me some time. I added:
Code: [Select]
--cipher AES-256-CBC
auth-nocache
to both *.ovpn files, and the warnings are gone. It still works, so I guess that is good. This setup uses a file called static.key, created according to the instructions, as a "password", so that wasn't really a problem, in this case.

I still need to figure out how to actually use it.   ;D
Title: Re: openvpn configuration?
Post by: Dave Yeo on October 10, 2019, 04:33:36 am
As a proxy?
Title: Re: openvpn configuration?
Post by: Paul Smedley on October 10, 2019, 07:34:09 am
Quote
That should be addressed (actually just suppressed per WIN32) in http://smedley.id.au/tmp/openvpn-2.3.18-os2-20191009.zip

I downloaded this file, and the Archive Tool says the data is invalid.

There is no file(s) contained in the zip.

Yup, all of a sudden, I can't create a working zip file :/

Edit: fixed now....
Title: Re: openvpn configuration?
Post by: Doug Bissett on October 10, 2019, 04:59:00 pm
Quote
Yup, all of a sudden, I can't create a working zip file

That seems to be caused when the ZIP program finds the file static.key (I don't know if it is the file name, or the contents, that causes the problem). RSync also crashes, when it finds that file. I put the file name in exclude lists, and it doesn't cause a problem any more. It seems to be a good way to authenticate, but if it is going to do things like that, I will go back to using ID and password.

Quote
As a proxy?

Probably not. More likely, I will use if for RSync, FTP, and SAMBA, if I can figure out how to do it. I am also not on a fixed IP address, so I need to figure out a way to be able to automatically get my actual IP address, and easily insert it into the config. Currently, I am on my local LAN, but that won't do me much good, when I am not at home. The MyIP program looks like it should do the job, and I can set it to use PMMSend to let me know when it changes. The details are still to be worked out.
Title: Re: openvpn configuration?
Post by: Richard Dunkle on October 11, 2019, 05:57:36 pm
Is there a possibility to create a tun driver?
I prefer to set up openvpn servers with tun, less traffic and perhaps better security.
Title: Re: openvpn configuration?
Post by: Paul Smedley on October 11, 2019, 11:17:22 pm
Hi Rich,

Is there a possibility to create a tun driver?
I prefer to set up openvpn servers with tun, less traffic and perhaps better security.

There is definitely a *desire* to create a tun driver - largely for compatability with commercial VPN providers, most of which only support tun.

There's some investigation going on to see what might be required - unfortunately, it seems the source to Pasha's original tap driver has been lost - the original thought was to build on this driver and add the tun part (in a similar way to the win32 openvpn driver).

SO... anything is possible, but don't hold your breath - if a ndis driver is required - there's not many people left with the skills to do this....

Cheers,

Paul.
Title: Re: openvpn configuration?
Post by: Paul Smedley on October 12, 2019, 11:14:01 pm
Hi All,

I seem to have gotten 2.4.7 running. http://smedley.id.au/tmp/openvpn-2.4.7-os2-20191013.zip

Feedback appreciated.

Cheers,

Paul
Title: Re: openvpn configuration?
Post by: David McKenna on October 13, 2019, 01:22:08 am
Hi Paul,

 I am using your new 2.4.7 build here on both OS/2 client and server with no issues so far. It's great being able to log on to my home network shares with ArcaMapper anywhere I can connect to the internet.

 There is one minor issue with ArcaMapper (happened with all the OpenVPN builds I've tried) - when started, on the 'Network Neighborhood' tab, all of the SAMBA machines show up, but none of the shares on them. I can mount 'All shares on server' on any of the machines and shares appear when I browse the drive mounted, but no shared folder can be mounted individually. This does not happen when I am connected directly to my LAN at home. Not a big deal, but maybe there is some setting not quite right.... need to read more about OpenVPN

 Thanks for all you do for OS/2!

Regards,

 PS. - the OpenVPN_src.zip on Hobbes doesn't have the TAP driver source in it?

 

 
Title: Re: openvpn configuration?
Post by: Paul Smedley on October 13, 2019, 07:06:26 am
Hey Dave!

I am using your new 2.4.7 build here on both OS/2 client and server with no issues so far. It's great being able to log on to my home network shares with ArcaMapper anywhere I can connect to the internet.

 There is one minor issue with ArcaMapper (happened with all the OpenVPN builds I've tried) - when started, on the 'Network Neighborhood' tab, all of the SAMBA machines show up, but none of the shares on them. I can mount 'All shares on server' on any of the machines and shares appear when I browse the drive mounted, but no shared folder can be mounted individually. This does not happen when I am connected directly to my LAN at home. Not a big deal, but maybe there is some setting not quite right.... need to read more about OpenVPN

Wow! That was quick! The main reason I had an interest in updating OpenVPN is that I've been using it myself quite a bit recently to connect to my home LAN from remote - mainly from my phone.

Sorry, I can't help with the ArcaMapper issue - I think it's just calling smbtree or smbclient to try and list the available shares...

Thanks for all you do for OS/2!

 PS. - the OpenVPN_src.zip on Hobbes doesn't have the TAP driver source in it?

I wish I had more free time for OS/2 related stuff - life keeps seeming to get in the way :P

Unfortunately OpenVPN_src.zip only has the source for the openvpn client itself, not the tap driver :(

Cheers,

Paul
Title: Re: openvpn configuration?
Post by: David McKenna on October 13, 2019, 06:39:02 pm
 Paul,

  Thanks for the smbtree hint. Here is what I get when I run it:

[C:\]smbtree
Registered MSG_REQ_POOL_USAGE
Registered MSG_REQ_DMALLOC_MARK and LOG_CHANGED
rlimit_max: increasing rlimit_max (10000) to minimum Windows limit (16384)
_get_interfaces: Failed to retrieve interface index for 'lan1': No such file or directory
added interface lan0 ip=192.168.0.100 bcast=192.168.0.255 netmask=255.255.255.0
added interface lan1 ip=10.7.7.2 bcast=10.7.7.255 netmask=255.255.255.0
IBMPEERS
        \\MUSICMACHINE                  MusicMachine
         \\MAINMACHINE                   MAINMACHINE Samba Server for OS/2 based systems
                \\MAINMACHINE\IPC$              IPC Service (MAINMACHINE Samba Server for OS/2 based systems)
                \\MAINMACHINE\D                 Drive D: (JFS)
                \\MAINMACHINE\Printer           Printer

 Seems there is an error from 'get interfaces' with 'lan1'. (the TAP driver) MusicMachine is Windows 10 with several shares not shown, but do show on the drive when mounted. Not sure what to do about it. I'm guessing this may be a SAMBA config issue with multiple interfaces. Google brings up nothing on this error....