How to install OpenVPN inside a jail in FreeNAS 9.2.1.6+ with access to remote hosts via NAT

Requirements

• FreeNAS 9.10+
• Domain updated by DDNS or a static IP
• Internet access
• Router forwarding of your port of choice (in my case 10011 UDP internal to 443 UDP external).
• SFTP Client (Winscp, Transmit or plain scp)

Route all traffic?
If you want to route all traffic through the VPN Tunnel, be sure to read the Know This section

Overview
In this guide, we’ll do the server/client configuration as follows:

Server configuration:

• Creating the Jail.
• Optional: mounting local storage.
• Installing OpenVPN inside the jail.
• Creating all the certificates needed: the server root cert, the OpenVPN server cert and each of the client’s cert.
• OpenVPN configuration file.
• Firewall settings so NAT can work.
• Registering OpenVPN as a service so it can start automatically with the jail.

Client configuration:

• OpenVPN configuration file.
• Certificate installation in client

Network Setup
Understanding how the OpenVPN networking works is very important, so I’m going to explain it here (you can skip this and go straight to the configuration). Since I’m a very visual person, here’s the diagram of the logical network we’ll be creating:

This diagram shows how FreeNAS, its jails and even the how remote client will exist in the network. As they are all connected to the same switch*, they can talk to each other. So myCrashplan Jail (10.0.0.12) can talk to a computer in my home network called Other Host** (10.0.0.30) and my FreeNAS server can access the internet via the Gateway (10.0.0.254).
*They are all connected to switches in the same broadcast domain, which logically places them as if they were all connected to the same switch.
**”Host” we refer to as any device, could be a jail, a computer or your latest internet-connected thermostat.

This diagram is divided into three main sections and it shows how FreeNAS looks at the world:

• Yellow network (home): With addressing 10.0.0.0/24. This is the network in which our FreeNAS server exists.
• Blue network (internet): The internet routes traffic from my home where FreeNAS is, to my remote location.
• Purple network (NAT): The network inside my jail which contains all of the clients which will connect remotely. It uses addressing 172.16.8.0/24

Now, let’s see how this same diagram appears not logically, but physically (i.e. how the cables are connected).

This is the same diagram as before, but it includes a new section:

• Green network (remote): This has 192.168.1.0/24 addressing. It’s the external network from which we’ll be connecting from and it’s the simplest network you’ll find, in which traffic goes to the gateway and from there, to the internet.

Notice that even though the jails are connected to a switch (FreeNAS Virtual Switch) and that switch is connected to the Gateway Switch, they are all still in the same yellow network (10.0.0.0/24) so they can still talk to each other.

When connecting through VPN, the connection highlighted in orange is created. Now the Remote Client will have two IPs, one inside the green network (192.168.1.200) which lets it communicate with other hosts inside the same green network, and one inside the purple network (172.16.8.4) which by itself only lets you communicate with other hosts inside the purple network. You can imagine as if the Remote Client (our computer in a far away network) is transported from the green network to the purple network.

Topology as it appears after VPN connection is made​

You may notice that the OpenVPN jail is halfway inside the yellow and purple networks. One side talks to the yellow network (the jail has an outside IP of 10.0.0.14) and the other to the purple network (the jail has inside IP of 172.16.8.1). Using some Firewall configuration, we can allow the Remote Client and anyone inside the purple network to talk to the yellow network. This is what allows any remote client to connect and access other computers in the yellow network. Now you understand how the VPN tunnel works.

Example:

​

If Remote Client wants to ping Other Host (or any other host in the yellow network, could be another jail), it will forward that packet to OpenVPN Jail, then the OpenVPN Jail will translate the packet from the purple network to the yellow one, and forward the packet to Other Host.

Since Other Host will only see a ping coming from 10.0.0.14/24 (OpenVPN Jail), it will respond to it. When OpenVPN Jail sees it, it will translate it back from the yellow to the purple network and send it to Remote Client.

OpenVPN Jail Setup
Create a new jail in the webgui

You can name it whatever you like. Take a note of the IPv4 Address that was assigned to your Jail. If you’d like to change it, go to Jails > Edit Jail > IPv4. This jail must have an IP in your yellow network.

Optional: Add storage from outside the jail, I’ll mount mine in /mnt/keys but you can store them inside the jail in /usr/local/etc/openvpn.

SSH to your FreeNAS install and enter the jail:

You can list your installed jails with the jls command, notice how my openvpn jail has the JID 7. To get inside the jail, use the jexec command as shown.

Upgrade your jail (optional), install bash, nano (optional) and openvpn using the pkg command:

pkg update
pkg upgrade
pkg install bash nano openvpn
exit

Note: The first time it will have to upgrade repositories, so don’t worry if it spurts a lot of data. We need bash because the ./easyrsa command behaves weirdly using tcsh. If you run into a “shared object not found” problem, run pkg upgradeagain so it repairs the missing packages.

Using the jexec command, enter your jail now using bash:

Easy-RSA Prep
First, let’s move the example files to their destination. Then we’ll edit the vars file to suit our needs

Inside the vars file, look for the line EASYRSA_KEY_SIZE and uncomment it by removing the pound symbol. Do the same for the line with EASYRSA_DIGEST.

Optional: You can uncomment the EASYRSA_REQ_COUNTRY lines above to default to your local address. You can also uncomment the EASYRSA_CA_EXPIRE to change your certificate expiration from 10 years to something more sensible.

To close nano, press ctrl+x. To save the changes answer “y”.

Certificate Creation
>Note: Easy-RSA 3.1’s output is much more verbose. This instructions omit long explanations by the program wherever you find the […] symbol. The relevant information is underlined.

Creating the Root Certificate
Let’s create our NAS’ Cert Authority

Creating the OpenVPN Server Certificate
Answer the questions appropriately. Now let’s create a server key, this will identify your OpenVPN server against any other server.

This is a two step process: first we create a request for the certificate, and then we sign it. Let’s create the server’s certificate request:

Step two: now, we’ll sign the request (the file with the *.req extension)

Again, answer the questions appropriately, when asked if you want to sign it and if you want to commit, type yes . Afterwards, we’ll create the Diffie-Hellman parameters (this one takes a long time):

Creating the User’s Certificates
The next step can be repeated for as many users as you want to allow in your VPN. They will all be assigned an IP inside the purple network. First we create the user’s request:

Then we sign the new user’s request:

All of the generated keys are inside the pki folder: we’ll find our public keys in pki/issued, and the private keys in pki/private. Now copy the generated keys to your permanent storage, I mounted mine in /mnt/keys:

After listing your keys, you should see your CA, OpenVPN and user’s private and public keys (*.crt and *.key) and Diffie-Hellman file (dh.pem)

OpenVPN Server Configuration
Now we’ll place our OpenVPN configuration in /mnt/keys/openvpn.conf using nano

Insert the next configuration:

port 10011
proto udp
dev tun
ca ca.crt
cert openvpn-server.crt #Server public key
key openvpn-server.key #Server private key
dh dh.pem #Diffie-Hellman parameters
server 172.16.8.0 255.255.255.0 #Purple network
ifconfig-pool-persist ipp.txt
push "route 10.0.0.0 255.255.255.0" #Yellow network
tls-auth ta.key 0
#crl-verify crl.pem
keepalive 10 120
cipher AES-256-CBC
auth SHA256
group nobody
user nobody
comp-lzo
persist-key
persist-tun
verb 3

A couple of notes about this configuration:

• The port in which the OpenVPN service listens to is UDP 10011. That’s because my router maps OpenVPN Jail‘s IP port 10011 to the 443 WAN (internet) port for security reasons.
• Change the 10.0.0.0 address to your yellow network.
• The file ipp.txt will store the active connections and give you the same IP the last time you connected.
• Note how a static route is pushed to the client, which indicates that the yellow network can be accessed through this jail (OpenVPN Jail).

Exit and save this file (ctrl+x in nano). Now let’s configure NAT so we can create the purple network.

Server NAT Configuration
Next, we’ll create the firewall rules for the server:

This will create a new file in /usr/local/etc/ named ipfw.rules. Insert the next rules in that file:

#!/bin/sh

EPAIR=$(/sbin/ifconfig -l | tr " " "\n" | /usr/bin/grep epair)
ipfw -q -f flush
ipfw -q nat 1 config if ${EPAIR}
ipfw -q add nat 1 all from 172.16.8.0/24 to any out via ${EPAIR}
ipfw -q add nat 1 all from any to any in via ${EPAIR}

TUN=$(/sbin/ifconfig -l | tr " " "\n" | /usr/bin/grep tun)
ifconfig ${TUN} name tun0

Important: Avoid copying and pasting any command from the internet. But if you have to do it, make sure that on ${EPAIR} there’s no space between the $ and the brackets.

A couple of notes about this configuration:

• After EPAIR, the first line flushes any previous configuration in the firewall
• The second one, creates the purple network.
• The third one, creates a rule saying that all traffic from the purple network should be translated and outputted through the epair0b interface (the one connected to the yellow network.
• The last one accepts any traffic coming from the yellow network (i.e. the one connected through epair0b interface) back into the jail.
• This configurations are the backbone of the translation between the yellow and purple networks.

Finally, let’s edit /etc/rc.conf so our configuration can be properly read:

Insert this after the last line:

openvpn_enable="YES"
openvpn_if="tun"
openvpn_configfile="/mnt/keys/openvpn.conf"
openvpn_dir="/mnt/keys"
cloned_interfaces="tun"
gateway_enable="YES"
firewall_enable="YES"
firewall_script="/usr/local/etc/ipfw.rules"

Replace /mnt/keys/ for the path where you mounted your permanent storage. This enables the OpenVPN service, tells it where to find the configuration we saved and tells it where to find the NAT configuration.

Now go to your FreeNAS Web-gui and restart the jail.

Use jexec to get inside your jail again. Lets confirm the firewall is configured properly.

To check that OpenVPN is listening in your configured port, run

This means that OpenVPN is successfully listening on the configured port.

Client Configuration
For each client that was configured, we need to obtain their certificates and the CA root cert. Go to /mnt/keys and type:

We need to change the private key’s permissions so we can download them from the jail and insert it into our client configuration file. Do this for each client you created.

Using any SFTP program you like, copy the files in /mnt/keys: ca.crt, john.appleseed.key, john.appleseed.crt and ta.key to a folder in your desktop. In a text editor, type the next client configuration:

client
dev tun
proto udp
remote myddnsdomain.com 443
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert john.appleseed.crt
key john.appleseed.key
remote-cert-tls server
cipher AES-256-CBC
tls-auth ta.key 1
#dhcp-option DNS 0.0.0.0
#redirect-gateway def1
comp-lzo
verb 3

Replace myddnsdomain.com with your DDNS domain or with your static ip. If your router is configured to another port mapping, replace 443 with your custom UDP port.

Save that file as home-vpn.ovpn in the folder in your desktop where you saved your certificates.

Now use any OpenVPN client you like to import the OVPN file you just created. It will automatically detect your certificates and import them into configuration. Congratulations, you now have a working VPN!

Know this
This will only help you access clients in the yellow network. If you want to route all of your traffic (act as a default gateway), uncomment the lines dhcp-option and redirect-gateway.

Replace 0.0.0.0 with your local DNS server. This is almost always your gateway’s IP address, in this case, it’s my ISP’s modem in the Yellow Network.

Security Hardening
This section is completely optional and will help you protect your server from DoS and unauthorized intruders.

DoS mitigation
There’s an option called tls-auth that checks for a signature in each packet so unsigned ones can be dropped much easily, it helps to obfuscate your OpenVPN service and protects against DoS by creating a static pre-shared hash-based message authentication code (HMAC) key.

What this means is that if the someone doesn’t provide this key first, the OpenVPN server won’t even entertain the idea of authenticating any request from it.

This key is generated in the server and must be included in each client along with the other files (ca.crt, john.appleseed.crt and john.appleseed.key). It is included in the main instructions, so if you followed them correctly, this is already implemented.

Troubleshooting

Is it running?
[root@openvpn /]# ps aux
USER PID %CPU %MEM   VSZ  RSS TT  STAT STARTED TIME COMMAND
nobody  4977  0.0  0.0 21704 3536  –  SsJ  10:20PM 0:00.08 /usr/local/sbin/openvpn –cd /usr/local/
Here I can confirm that my OpenVPN server is running inside the jail as a service. If you don’t see your process, run OpenVPN manually (next step).

Check OpenVPN’s output
Stop the OpenVPN service (if running) and run it manually to see the output.
[root@openvpn /]# service openvpn stop
[root@openvpn /]# openvpn –config /mnt/keys/openvpn.conf

Reboot
Have you tried turning it on and off again? No seriously, FreeNAS seems to not update its routing tables properly using the newly created tunnel interface, but it seems that after a reboot, OpenVPN does connect properly.

Check the firewall rules
You can prompt the firewall to output its current rules, if after restarting your jail your output looks like this:

Then there’s something wrong with your firewall configuration. Check if /usr/local/etc/ipfw.rules contains the proper rules and that your paths are correct in /etc/rc.conf.

—
I hope this helps reduce the time it took me to originally figure out how to do everything without messing with static routes in the gateway router, firewall configurations and NAT issues.

If you find some mistake or have a suggestion or improvement, please don’t forget to comment!

Versão para Impressão