Requirements
- FreeNAS 9.10+
- Domain updated by DDNS or a static IP
- Internet access
- Router forwarding of your port of choice (in my case 10011 UDP internal to 443 UDP external).
- SFTP Client (Winscp, Transmit or plain scp)
Route all traffic?
If you want to route all traffic through the VPN Tunnel, be sure to read the Know This section
Overview
In this guide, we’ll do the server/client configuration as follows:
Server configuration:
- Creating the Jail.
- Optional: mounting local storage.
- Installing OpenVPN inside the jail.
- Creating all the certificates needed: the server root cert, the OpenVPN server cert and each of the client’s cert.
- OpenVPN configuration file.
- Firewall settings so NAT can work.
- Registering OpenVPN as a service so it can start automatically with the jail.
Client configuration:
- OpenVPN configuration file.
- Certificate installation in client
Network Setup
Understanding how the OpenVPN networking works is very important, so I’m going to explain it here (you can skip this and go straight to the configuration). Since I’m a very visual person, here’s the diagram of the logical network we’ll be creating:
This diagram shows how FreeNAS, its jails and even the how remote client will exist in the network. As they are all connected to the same switch*, they can talk to each other. So myCrashplan Jail (10.0.0.12) can talk to a computer in my home network called Other Host** (10.0.0.30) and my FreeNAS server can access the internet via the Gateway (10.0.0.254).
*They are all connected to switches in the same broadcast domain, which logically places them as if they were all connected to the same switch.
**”Host” we refer to as any device, could be a jail, a computer or your latest internet-connected thermostat.
This diagram is divided into three main sections and it shows how FreeNAS looks at the world:
- Yellow network (home): With addressing 10.0.0.0/24. This is the network in which our FreeNAS server exists.
- Blue network (internet): The internet routes traffic from my home where FreeNAS is, to my remote location.
- Purple network (NAT): The network inside my jail which contains all of the clients which will connect remotely. It uses addressing 172.16.8.0/24
Now, let’s see how this same diagram appears not logically, but physically (i.e. how the cables are connected).
This is the same diagram as before, but it includes a new section:
- Green network (remote): This has 192.168.1.0/24 addressing. It’s the external network from which we’ll be connecting from and it’s the simplest network you’ll find, in which traffic goes to the gateway and from there, to the internet.
Notice that even though the jails are connected to a switch (FreeNAS Virtual Switch) and that switch is connected to the Gateway Switch, they are all still in the same yellow network (10.0.0.0/24) so they can still talk to each other.
When connecting through VPN, the connection highlighted in orange is created. Now the Remote Client will have two IPs, one inside the green network (192.168.1.200) which lets it communicate with other hosts inside the same green network, and one inside the purple network (172.16.8.4) which by itself only lets you communicate with other hosts inside the purple network. You can imagine as if the Remote Client (our computer in a far away network) is transported from the green network to the purple network.
![[IMG]](http://i.imgur.com/bTDAERI.png)
Topology as it appears after VPN connection is made
You may notice that the OpenVPN jail is halfway inside the yellow and purple networks. One side talks to the yellow network (the jail has an outside IP of 10.0.0.14) and the other to the purple network (the jail has inside IP of 172.16.8.1). Using some Firewall configuration, we can allow the Remote Client and anyone inside the purple network to talk to the yellow network. This is what allows any remote client to connect and access other computers in the yellow network. Now you understand how the VPN tunnel works.
Example:
![[IMG]](http://i.imgur.com/qmahTjU.png)
If Remote Client wants to ping Other Host (or any other host in the yellow network, could be another jail), it will forward that packet to OpenVPN Jail, then the OpenVPN Jail will translate the packet from the purple network to the yellow one, and forward the packet to Other Host.
Since Other Host will only see a ping coming from 10.0.0.14/24 (OpenVPN Jail), it will respond to it. When OpenVPN Jail sees it, it will translate it back from the yellow to the purple network and send it to Remote Client.
OpenVPN Jail Setup
Create a new jail in the webgui
You can name it whatever you like. Take a note of the IPv4 Address that was assigned to your Jail. If you’d like to change it, go to Jails > Edit Jail > IPv4. This jail must have an IP in your yellow network.
Optional: Add storage from outside the jail, I’ll mount mine in /mnt/keys but you can store them inside the jail in /usr/local/etc/openvpn.
SSH to your FreeNAS install and enter the jail:
Last login: Tue Aug 19 12:29:05 2014 from 10.0.0.192
Welcome to FreeNAS
[robles@nas] ~> jls
JID IP Address Hostname Path
7 – openvpn /mnt/vault/pluginjails/openvpn
[robles@nas] ~> sudo jexec 7 tcsh
Password:
root@openvpn:/ #
You can list your installed jails with the jls command, notice how my openvpn jail has the JID 7. To get inside the jail, use the jexec command as shown.
Upgrade your jail (optional), install bash, nano (optional) and openvpn using the pkg command:
pkg update pkg upgrade pkg install bash nano openvpn exit
Note: The first time it will have to upgrade repositories, so don’t worry if it spurts a lot of data. We need bash because the ./easyrsa command behaves weirdly using tcsh. If you run into a “shared object not found” problem, run pkg upgradeagain so it repairs the missing packages.
Using the jexec command, enter your jail now using bash:
[root@openvpn /]# cd /usr/local/share/easy-rsa
[root@openvpn /usr/local/share/easy-rsa]#
Easy-RSA Prep
First, let’s move the example files to their destination. Then we’ll edit the vars file to suit our needs
[root@OpenVPN /usr/local/share/easy-rsa]# mv vars.example vars
[root@OpenVPN /usr/local/share/easy-rsa]# nano vars
Inside the vars file, look for the line EASYRSA_KEY_SIZE and uncomment it by removing the pound symbol. Do the same for the line with EASYRSA_DIGEST.
Optional: You can uncomment the EASYRSA_REQ_COUNTRY lines above to default to your local address. You can also uncomment the EASYRSA_CA_EXPIRE to change your certificate expiration from 10 years to something more sensible.
To close nano, press ctrl+x. To save the changes answer “y”.
Certificate Creation
>Note: Easy-RSA 3.1’s output is much more verbose. This instructions omit long explanations by the program wherever you find the […] symbol. The relevant information is underlined.
Creating the Root Certificate
Let’s create our NAS’ Cert Authority
[…]
Your newly created PKI dir is: /usr/local/share/easy-rsa/pki
[root@OpenVPN /usr/local/share/easy-rsa]# ./easyrsa build-ca nopass
[…]Generating a 2048 bit RSA private key
………….+++…..+++………..
writing new private key to ‘/usr/local/share/easy-rsa/pki/private/ca.key.#########'[…]
Common Name (eg: your user, host, or server name) [Easy-RSA CA]:Robles NAS CA
[…]
Your new CA certificate file for publishing is at:
/usr/local/share/easy-rsa/pki/ca.crt
Creating the OpenVPN Server Certificate
Answer the questions appropriately. Now let’s create a server key, this will identify your OpenVPN server against any other server.
This is a two step process: first we create a request for the certificate, and then we sign it. Let’s create the server’s certificate request:
[…] Generating a 2048 bit RSA private key
……………………………..+++……….+++ […]
Common Name (eg: your user, host, or server name) [openvpn-server]: [return]
[…]
req: /usr/local/share/easy-rsa/pki/reqs/openvpn-server.req
key: /usr/local/share/easy-rsa/pki/private/openvpn-server.key
Step two: now, we’ll sign the request (the file with the *.req extension)
[…]
commonName = openvpn-server
[…]
Confirm request details: yes
[…]
Certificate is to be certified until Aug 14 01:21:20 2026 GMT (3650 days) […]
Certificate created at: /usr/local/share/easy-rsa/pki/issued/openvpn-server.crt
Again, answer the questions appropriately, when asked if you want to sign it and if you want to commit, type yes . Afterwards, we’ll create the Diffie-Hellman parameters (this one takes a long time):
[…]
This is going to take a long time
…………+…….+….+………….[…]
DH parameters of size 2048 created at /usr/local/share/easy-rsa/pki/dh.pem
[root@vpnserver /usr/local/share/easy-rsa]# openvpn –genkey –secret ta.key
[root@vpnserver /usr/local/share/easy-rsa]# chmod 400 ta.key
Creating the User’s Certificates
The next step can be repeated for as many users as you want to allow in your VPN. They will all be assigned an IP inside the purple network. First we create the user’s request:
[…]
Common Name (eg: your user, host, or server name) [john.appleseed]: [return]
[…]
req: /usr/local/share/easy-rsa/pki/reqs/john.appleseed.req
key: /usr/local/share/easy-rsa/pki/private/john.appleseed.key
Then we sign the new user’s request:
[…]
Type the word ‘yes’ to continue, or any other input to abort.
Confirm request details: yes
[…]
Certificate created at: /usr/local/share/easy-rsa/pki/issued/john.appleseed.crt
All of the generated keys are inside the pki folder: we’ll find our public keys in pki/issued, and the private keys in pki/private. Now copy the generated keys to your permanent storage, I mounted mine in /mnt/keys:
[root@OpenVPN /usr/local/share/easy-rsa]# cp pki/private/* /mnt/keys
[root@OpenVPN /usr/local/share/easy-rsa]# cp pki/ca.crt /mnt/keys
[root@OpenVPN /usr/local/share/easy-rsa]# cp pki/dh.pem /mnt/keys
[root@OpenVPN /usr/local/share/easy-rsa]# cp ta.key /mnt/keys
[root@openvpn /usr/local/share/easy-rsa]# cd /mnt/keys
[root@OpenVPN /mnt/keys]# ls -lah
drwxr-xr-x 2 root wheel 8B Aug 15 21:06 .
drwxr-xr-x 3 root wheel 3B Sep 29 2015 ..
-rw——- 1 root wheel 1.1k Aug 15 21:06 ca.crt
-rw——- 1 root wheel 1.7k Aug 15 21:06 ca.key
-rw——- 1 root wheel 424B Aug 15 21:16 dh.pem
-rw——- 1 root wheel 4.3k Aug 15 21:05 john.appleseed.crt
-rw——- 1 root wheel 1.7k Aug 15 21:06 john.appleseed.key
-rw——- 1 root wheel 4.3k Aug 15 21:05 openvpn-server.crt
-rw——- 1 root wheel 1.7k Aug 15 21:06 openvpn-server.key
-rw——- 1 root wheel 636B Aug 15 21:17 ta.key
After listing your keys, you should see your CA, OpenVPN and user’s private and public keys (*.crt and *.key) and Diffie-Hellman file (dh.pem)
OpenVPN Server Configuration
Now we’ll place our OpenVPN configuration in /mnt/keys/openvpn.conf using nano
Insert the next configuration:
port 10011 proto udp dev tun ca ca.crt cert openvpn-server.crt #Server public key key openvpn-server.key #Server private key dh dh.pem #Diffie-Hellman parameters server 172.16.8.0 255.255.255.0 #Purple network ifconfig-pool-persist ipp.txt push "route 10.0.0.0 255.255.255.0" #Yellow network tls-auth ta.key 0 #crl-verify crl.pem keepalive 10 120 cipher AES-256-CBC auth SHA256 group nobody user nobody comp-lzo persist-key persist-tun verb 3
A couple of notes about this configuration:
- The port in which the OpenVPN service listens to is UDP 10011. That’s because my router maps OpenVPN Jail‘s IP port 10011 to the 443 WAN (internet) port for security reasons.
- Change the 10.0.0.0 address to your yellow network.
- The file ipp.txt will store the active connections and give you the same IP the last time you connected.
- Note how a static route is pushed to the client, which indicates that the yellow network can be accessed through this jail (OpenVPN Jail).
Exit and save this file (ctrl+x in nano). Now let’s configure NAT so we can create the purple network.
Server NAT Configuration
Next, we’ll create the firewall rules for the server:
This will create a new file in /usr/local/etc/ named ipfw.rules. Insert the next rules in that file:
#!/bin/sh EPAIR=$(/sbin/ifconfig -l | tr " " "\n" | /usr/bin/grep epair) ipfw -q -f flush ipfw -q nat 1 config if ${EPAIR} ipfw -q add nat 1 all from 172.16.8.0/24 to any out via ${EPAIR} ipfw -q add nat 1 all from any to any in via ${EPAIR} TUN=$(/sbin/ifconfig -l | tr " " "\n" | /usr/bin/grep tun) ifconfig ${TUN} name tun0
Important: Avoid copying and pasting any command from the internet. But if you have to do it, make sure that on ${EPAIR} there’s no space between the $ and the brackets.
A couple of notes about this configuration:
- After EPAIR, the first line flushes any previous configuration in the firewall
- The second one, creates the purple network.
- The third one, creates a rule saying that all traffic from the purple network should be translated and outputted through the epair0b interface (the one connected to the yellow network.
- The last one accepts any traffic coming from the yellow network (i.e. the one connected through epair0b interface) back into the jail.
- This configurations are the backbone of the translation between the yellow and purple networks.
Finally, let’s edit /etc/rc.conf so our configuration can be properly read:
Insert this after the last line:
openvpn_enable="YES" openvpn_if="tun" openvpn_configfile="/mnt/keys/openvpn.conf" openvpn_dir="/mnt/keys" cloned_interfaces="tun" gateway_enable="YES" firewall_enable="YES" firewall_script="/usr/local/etc/ipfw.rules"
Replace /mnt/keys/ for the path where you mounted your permanent storage. This enables the OpenVPN service, tells it where to find the configuration we saved and tells it where to find the NAT configuration.
Now go to your FreeNAS Web-gui and restart the jail.
Use jexec to get inside your jail again. Lets confirm the firewall is configured properly.
00100 nat 1 ip from 10.8.0.0/24 to any out via epair0b
00200 nat 1 ip from any to any in via epair0b
65535 allow ip from any to any
[root@openvpn /mnt/keys]#
To check that OpenVPN is listening in your configured port, run
USER COMMAND PID FD PROTO LOCAL ADDRESS FOREIGN ADDRESS
nobody openvpn 63758 6 udp4 *:10010 *:*
root syslogd 63726 7 udp4 *:514 *:*
[root@OpenVPN /]#
This means that OpenVPN is successfully listening on the configured port.
Client Configuration
For each client that was configured, we need to obtain their certificates and the CA root cert. Go to /mnt/keys and type:
We need to change the private key’s permissions so we can download them from the jail and insert it into our client configuration file. Do this for each client you created.
Using any SFTP program you like, copy the files in /mnt/keys: ca.crt, john.appleseed.key, john.appleseed.crt and ta.key to a folder in your desktop. In a text editor, type the next client configuration:
client dev tun proto udp remote myddnsdomain.com 443 resolv-retry infinite nobind persist-key persist-tun ca ca.crt cert john.appleseed.crt key john.appleseed.key remote-cert-tls server cipher AES-256-CBC tls-auth ta.key 1 #dhcp-option DNS 0.0.0.0 #redirect-gateway def1 comp-lzo verb 3
Replace myddnsdomain.com with your DDNS domain or with your static ip. If your router is configured to another port mapping, replace 443 with your custom UDP port.
Save that file as home-vpn.ovpn in the folder in your desktop where you saved your certificates.
Now use any OpenVPN client you like to import the OVPN file you just created. It will automatically detect your certificates and import them into configuration. Congratulations, you now have a working VPN!
Know this
This will only help you access clients in the yellow network. If you want to route all of your traffic (act as a default gateway), uncomment the lines dhcp-option and redirect-gateway.
Replace 0.0.0.0 with your local DNS server. This is almost always your gateway’s IP address, in this case, it’s my ISP’s modem in the Yellow Network.
Security Hardening
This section is completely optional and will help you protect your server from DoS and unauthorized intruders.
DoS mitigation
There’s an option called tls-auth that checks for a signature in each packet so unsigned ones can be dropped much easily, it helps to obfuscate your OpenVPN service and protects against DoS by creating a static pre-shared hash-based message authentication code (HMAC) key.
What this means is that if the someone doesn’t provide this key first, the OpenVPN server won’t even entertain the idea of authenticating any request from it.
This key is generated in the server and must be included in each client along with the other files (ca.crt, john.appleseed.crt and john.appleseed.key). It is included in the main instructions, so if you followed them correctly, this is already implemented.
Troubleshooting
Is it running?
[root@openvpn /]# ps aux
USER PID %CPU %MEM VSZ RSS TT STAT STARTED TIME COMMAND
nobody 4977 0.0 0.0 21704 3536 – SsJ 10:20PM 0:00.08 /usr/local/sbin/openvpn –cd /usr/local/
Here I can confirm that my OpenVPN server is running inside the jail as a service. If you don’t see your process, run OpenVPN manually (next step).
Check OpenVPN’s output
Stop the OpenVPN service (if running) and run it manually to see the output.
[root@openvpn /]# service openvpn stop
[root@openvpn /]# openvpn –config /mnt/keys/openvpn.conf
Reboot
Have you tried turning it on and off again? No seriously, FreeNAS seems to not update its routing tables properly using the newly created tunnel interface, but it seems that after a reboot, OpenVPN does connect properly.
Check the firewall rules
You can prompt the firewall to output its current rules, if after restarting your jail your output looks like this:
65535 allow ip from any to any
Then there’s something wrong with your firewall configuration. Check if /usr/local/etc/ipfw.rules contains the proper rules and that your paths are correct in /etc/rc.conf.
—
I hope this helps reduce the time it took me to originally figure out how to do everything without messing with static routes in the gateway router, firewall configurations and NAT issues.
If you find some mistake or have a suggestion or improvement, please don’t forget to comment!