Trying to setup OpenVPN client on Ubiquti Edge Router Lite

Loki008

2[H]4U
Joined
Jan 14, 2001
Messages
2,678
I am trying to get OctaneVPN setup on my ERL and I have to admit I am a complete fish out of water with trying to get this working.

Basically what i have done was take the .openvpn file and removed the CA, CERT and KEY sections creating new files with the data from these sections. I then attempted to configure vtun0 using these files. When I load this config and do a show interfaces i am not seeing vtun0. I assume I did something wrong here. Hopefully someone who is a bit more familiar with linux / the ERL hardware can assist me

Here is the config info for OctaneVPN:
http://www.octanevpn.com/tutorials.html


and here is my config.boot file

Code I added to create vtun0
Code:
 openvpn vtun0 {
        encryption aes256-cbc
        mode client
        openvpn-option "--auth-user-pass /config/auth/login.conf"
        protocol udp
        remote-host gw1.iad1.octanevpn.com
        remote-port 443
            tls {
            ca-cert-file /config/auth/ca.crt
            cert-file /config/auth/cert.crt
            key-file /config/auth/key.key
                }
        }


full config.boot file

Code:
firewall {
    all-ping enable
    broadcast-ping disable
    conntrack-expect-table-size 4096
    conntrack-hash-size 4096
    conntrack-table-size 32768
    conntrack-tcp-loose enable
    ipv6-receive-redirects disable
    ipv6-src-route disable
    ip-src-route disable
    log-martians enable
    name LAN_IN {
        default-action accept
        description "Internal network to Internet"
    }
    name LAN_LOCAL {
        default-action accept
        description "Internal network to router"
    }
    name WAN_IN {
        default-action drop
        description "Internet to internal networks"
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
    }
    name WAN_LOCAL {
        default-action drop
        description "Internet to router"
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
        rule 5 {
            action accept
            description "ICMP 50/m"
            limit {
                burst 1
                rate 50/minute
            }
            log enable
            protocol icmp
        }
    }
    receive-redirects disable
    send-redirects enable
    source-validation disable
    syn-cookies enable
}
interfaces {
    bridge br0 {
        address 10.0.0.1/16
        aging 300
        description LAN
        firewall {
            in {
                name LAN_IN
            }
            local {
                name LAN_LOCAL
            }
        }
        hello-time 2
        max-age 20
        priority 0
        stp false
    }
    ethernet eth0 {
        bridge-group {
            bridge br0
        }
    }
    ethernet eth1 {
        bridge-group {
            bridge br0
        }
    }
    ethernet eth2 {
        address dhcp
        description WAN
        firewall {
            in {
                name WAN_IN
            }
            local {
                name WAN_LOCAL
            }
        }
    }
    loopback lo {
    }
    openvpn vtun0 {
        encryption aes256-cbc
        mode client
        openvpn-option "--auth-user-pass /config/auth/login.conf"
        protocol udp
        remote-host gw1.iad1.octanevpn.com
        remote-port 443
            tls {
            ca-cert-file /config/auth/ca.crt
            cert-file /config/auth/cert.crt
            key-file /config/auth/key.key
                }
        }
}
service {
    dhcp-server {
        disabled true
        shared-network-name LAN-br0 {
            authoritative disable
            description "LAN Network - br0"
            subnet 10.0.0..0/16 {
				default-router 10.0.0.1
                dns-server 10.0.0.1
                lease 86400
                ntp-server 10.0.0.1
                start 10.0.0.10 {
                    stop 10.0.0.100
                }
                time-server 10.0.0.1
            }
        }
    }
    dns {
        forwarding {
            cache-size 150
            listen-on br0
            system
        }
    }
    gui {
        https-port 443
        listen-address 10.0.0.1
    }
    nat {
        rule 5010 {
            outbound-interface eth2
            type masquerade
        }
    }
    ssh {
        listen-address 10.0.0.1
        port 22
        protocol-version v2
    }
    upnp {
        listen-on br0 {
            outbound-interface eth2
        }
    }
}
system {
    host-name ubnt
    ipv6 {
        disable
    }
    login {
        user ubnt {
            authentication {
                encrypted-password $1$zKNoUbAo$gomzUbYvgyUMcD436Wo66.
            }
            level admin
        }
    }
    name-server 208.67.222.222
    name-server 208.67.220.220
    ntp {
        server 0.ubnt.pool.ntp.org {
        }
        server 1.ubnt.pool.ntp.org {
        }
        server 2.ubnt.pool.ntp.org {
        }
        server 3.ubnt.pool.ntp.org {
        }
    }
    syslog {
        global {
            facility all {
                level notice
            }
            facility protocols {
                level debug
            }
        }
    }
    time-zone UTC
}


/* Warning: Do not remove the following line. */
/* === vyatta-config-version: "config-management@1:dhcp-relay@1:dhcp-server@4:firewall@4:ipsec@3:nat@3:qos@1:quagga@2:system@4:ubnt-pptp@1:vrrp@1:webgui@1:webproxy@1:zone-policy@1" === */
/* Release version: v1.0.2.4507738.121107.1250 */
 

/usr/home

Supreme [H]ardness
Joined
Mar 18, 2008
Messages
6,160
Did you try the ubnt forums? They would have a much better idea or even wiki on it.
 

Loki008

2[H]4U
Joined
Jan 14, 2001
Messages
2,678
I'm heading there next. I've just noticed there seems to be some talk about the ubiqti equipment in here. As for the wiki it's a bit light on this type of config.
 

goodcooper

[H]F Junkie
Joined
Nov 4, 2005
Messages
9,768
I'm heading there next. I've just noticed there seems to be some talk about the ubiqti equipment in here. As for the wiki it's a bit light on this type of config.

yea, not a whole lot of info out on this right now, but it's something i need to tackle as well...

you may find more resources with regards to vyatta and openvpn that would be useful...

http://www.arkf.net/blog/?p=231

like that right there ^ looks actually quite simple....
 

Loki008

2[H]4U
Joined
Jan 14, 2001
Messages
2,678
yea, not a whole lot of info out on this right now, but it's something i need to tackle as well...

you may find more resources with regards to vyatta and openvpn that would be useful...

http://www.arkf.net/blog/?p=231

like that right there ^ looks actually quite simple....

I have found that, the issue is that the client mode (rather than site to site) of OpenVPN doesnt seem well documented.
 

/usr/home

Supreme [H]ardness
Joined
Mar 18, 2008
Messages
6,160
You could also look into vyatta 6.3 documentation as that's what edgeos is based off of.
 
Top