Make OpenVPN more secure & Prevent "TLS handshaking timeout"

[alireza2n]

Hi!
First of all, Amahi was my first step into linux servers & networking which played out great! Thanks to all developers & contributors!

I just found a way to check verify integrity of SSL/TLS handshakes, this will add "HMAC signature" to packets so Any UDP packet not bearing the correct HMAC signature can be dropped.

I believe this will solve "SSL/TLS handshake timeout" problems.

I live in a place where some firewall is somehow corrupting these packets, regardless of their protocol (TCP/UDP) or port (I even tried port 80!), now after adding "HMAC signature" everything goes smoothly as expected and OpenVPN works flawlessly, plus it is even more secure.

Here is how:

-On server :
open "Terminal" or use ssh to login into server as root, enter these:

Code: Select all

cd / cd /etc/openvpn/amahi openvpn -–genkey -–secret ta.key

If using Terminal:

Code: Select all

gedit /etc/openvpn/amahi.conf

If using SSH:

Code: Select all

nano /etc/openvpn/amahi.conf

Now add these lines to the end of file:

Code: Select all

tls-auth /etc/openvpn/amahi/ta.key 0 cipher AES-256-CBC

Save the config file:
If using Terminal : Save the file
If using SSH: press Ctrl+x , then y ,then press Enter

Let's restart openvpn service:

Code: Select all

service openvpn restart

you'll get something like this after this command :

Code: Select all

Shutting down openvpn [OK] starting openvpn [OK]

OK, there is one more thing left on server, you need to copy "ta.key" to a shared folder, because you have to use it on VPN client. a simple way to do this is to enter this, it will copy "ta.key" to "Docs" share folder which is accessible via Windows Share:

Code: Select all

cp /etc/openvpn/amahi/ta.key /var/hda/files/docs

- On Client:
Open HomeHDA.ovpn via a text editor (i.e Notepad), add these lines to end of it:

Code: Select all

tls-auth ta.key 1 cipher AES-256-CBC

Then save it, now we need to copy "ta.key" to the folder where the "HomeHDA.ovpn" exists.
On windows it should be copied to "C:\Program files\HDAConnect\config" or "C:\Program Files (x86)\HDAConnect\config".

Everything is set, fire up HDAConnect (if on windows) and use your username/password to connect. (as you know you cannot make a vpn tunnel from yourself to yourself! so you have to test it from another network )

PS: Great thanks to writer of this article for giving me the clue :
http://www.techbabu.com/2009/12/openvpn ... -on-linux/

Please tell me if there are any mistakes in my commands, I'm not perfect.

[bigfoot65]

Great work. Can you please add a wiki page at http://wiki.amahi.org for this guidance. You can login and create a page using your amahi.org credentials.

That will provide a better place for users versus it getting buried in the forums.

[alireza2n]

Great work. Can you please add a wiki page at http://wiki.amahi.org for this guidance. You can login and create a page using your amahi.org credentials.

That will provide a better place for users versus it getting buried in the forums.

Sure!
By the way, I think adding this to next release will improve Amahi OpenVPN.
------
Edit:
Should I edit the "VPN Troubleshooting" page or just add a new page with this thread's title? (sorry I'm new to wiki editing)

[bigfoot65]

Please add a new page. You can add a link to it on the VPN Troubleshooting page. In order to identify this for a future release, please file a bug at http://bugs.amahi.org.

[cpg]

Great job indeed! Yeah, this is a good one for the wiki, very actionable!

[alireza2n]

I'm so sorry guys but I could not find any Add or Create a page in wiki, I only found Edit page...(account restriction maybe?).
PS: I also could not a feature request in bug tracker, can you tell me where is it?

[bigfoot65]

Hello,

In the wiki, once you log in...just add the page name after http://wiki.amahi.org/index.php/ and it will say not found....create new page.

As for the feature request, just enter it as a bug and we can change it to a feature request.

[alireza2n]

Hello,

In the wiki, once you log in...just add the page name after http://wiki.amahi.org/index.php/ and it will say not found....create new page.

As for the feature request, just enter it as a bug and we can change it to a feature request.

Thanks a lot for the help, both are done.
I also added edited Vpn Troubleshooting & VPN pages.