View source for OpenVPN

[[Category:Applications]]
<span style="display:none" class="helpSource openvpn">OpenVPN</span>
<span style="display:none" class="helpSource openvpn_status">OpenVPN#Status</span>
<span style="display:none" class="helpSource openvpn_server">OpenVPN#Server</span>
<span style="display:none" class="helpSource openvpn_client">OpenVPN#Client</span>
<span style="display:none" class="helpSource openvpn_advanced">OpenVPN#Advanced</span>
<span style="display:none" class="helpSource openvpn_event_log">OpenVPN#Event_Log</span>

{| width='100%'
|-
| align="center" | [[Image:OpenVPN_128x128.png]] &nbsp; &nbsp; '''OpenVPN'''
| align="center" |
{|
|-
| Other Links:
|-
|[http://www.untangle.com/store/openvpn.html OpenVPN Description Page]
|-
|[http://www.untangle.com/store/openvpn.html OpenVPN Screenshots]
|-
|[http://forums.untangle.com/openvpn/ OpenVPN Forums]
|-
|[[OpenVPN Reports]]
|-
|[[OpenVPN FAQs]]
|}
|}
<br/>
----


== About OpenVPN ==

OpenVPN enables you to create an [http://en.wikipedia.org/wiki/Transport_Layer_Security SSL]-based [http://en.wikipedia.org/wiki/VPN VPN] (virtual private network) that supports both site-to-site and client-to-site tunnels. This allows your ''road warrior'' users to connect to local resources as if they were in the office, or connect the networks of several geographically distant offices together - all with the added security of encryption protecting your data. OpenVPN supports any operating system with an OpenVPN-compatible VPN client (which is almost every OS), even smartphones!

The OpenVPN application can run as a server allowing for remote client to connect to the Untangle server, and the OpenVPN application can connect to other remote Untangle servers as a client. 

== Settings ==

This section reviews the different settings and configuration options available for OpenVPN.


----


=== Status ===

The '''Status''' tab shows you a list of open connections, the time the tunnels were created and transmit statistics.

==== Connected Remote Clients ====

This grid shows the currently connected remote clients that are connected to this OpenVPN (if server is enabled.)

{| border="1" cellpadding="2" width="85%" align="center"
|+
! Name !! Description
|-
|width="10%"|'''Address'''
|width="70%"|The IP of the remote client.
|-
|'''Client'''
|The OpenVPN client name.
|-
|'''Start Time'''
|The time that the client connected.
|-
|'''Rx Data'''
|The amount of data received from this client in this session.
|-
|'''Tx Data'''
|The amount of data sent to this client in this session.
|}

==== Remote Server Status ====

This grid shows the remote servers this OpenVPN is connecting to as a client.

{| border="1" cellpadding="2" width="85%" align="center"
|+
! Name !! Description
|-
|width="10%"|'''Name'''
|width="70%"|The name of the remote server.
|-
|'''Connected'''
|The current connection status
|-
|'''Rx Data'''
|The amount of data received from this client in this session.
|-
|'''Tx Data'''
|The amount of data sent to this client in this session.
|}


----


=== Server ===

The Server tab includes all the configuration for OpenVPN's server functionality.

''Site Name'' is the name of the this OpenVPN site. A random name is chosen so that it is unique. A new name can be given, but it should be unique across all Untangle sites in the organization. For example, if the company name is "MyCompany" then "mycompany" is a bad site name if you have multiple Untangles deployed as it might be used elsewhere. The ''Site Name'' '''must''' be unique.

''Site URL'' shows the URL that remote clients will use to connect to this server. This is just for reference. Verify that this address will resolve and be publicly reachable from remote networks. This URL can be configured in [[Config]] > [[Network]] > [[Hostname]].

If ''Server Enabled'' is checked, the OpenVPN server will run and accept connections from configured ''Remote Clients''. If unchecked the OpenVPN server will not run and not server services will be provided.

''Address Space'' defines an IP network/space for the VPN to use internally. The ''Address Space'' '''must''' be unique and separate from all existing networks and other address spaces on other OpenVPNs. A default will be chosen that does not conflict with the existing configuration.

''NAT OpenVPN Traffic'' will NAT all traffic from remote networks to local networks to a local address. This helps solve routing and host-based firewall issues. The default and recommended value is enabled. 

==== Remote Clients ====

The Remote Clients sub-tab configures all the ''Remote Clients'' that can connect to this OpenVPN server. A ''Remote Client'' is any entity that connects to this OpenVPN server as a client. This includes both remote desktops, laptops, devices, road warriors, etc. This also includes remote OpenVPNs and remote Untangle networks.

Initially there are no clients that are allowed to connect and an unique entry must be created for each remote client you wish to allow to connect to this server.

To add a new ''Remote Client'' click on the Add and provide the following information:

* ''Enabled'' - If checked, this client is enabled. If unchecked, this client is disabled and can not connect.
* ''Client Name'' - A unique name for the client. (alphanumerics only)
* ''Group'' - The ''group'' for this client. More information below.
* ''Type'' - The type of this client. ''Individual Client'' for a single host like a remote desktop or laptop. ''Network'' for an entire remote network that the server should also be able to reach.
* ''Remote Networks'' - The remote network in CIDR notation if this remote client is of type ''Network''. For example: 192.168.1.0/24 means that the 192.168.1.* network lives behind the remote client and should be reachable from the server. If there are multiple networks reachable through this remote client, a comma separated list of CIDR networks can be used. These networks are automatically ''exported'' such that hosts on the main network and other remote clients can reach these networks. 

After configuring this information save the new ''Remote Client'' by clicking ''OK'' then ''Apply.'' After saving settings, click on the ''Download Client'' button in the ''Remote Clients'' table on the row for the new client.
This will provide 3 links to various distributions that can be installed on the remote client.

* ''Click here to download this client's Windows setup.exe file.'' provides an .exe file that can be run on the remote client if the remote client is a standard Windows machine. Just download the file and email it or give it to the remote client via some other means. This .exe file will install the OpenVPN client software and configure it to connect to this OpenVPN server with the proper certificate information.
* ''Click here to download this client's configuration zip file for other OSs (Apple/Linux/etc).'' provides a zip file with the OpenVPN client configuration files. This file can be used to configure various OpenVPN clients for various OSs, like linux, apple, and even some phones/tables/devices.
* ''Click here to download this client's configuration file for remote Untangle OpenVPN clients.'' provides a zip file with the OpenVPN client configuration for setting up a remote OpenVPN application on Untangle to connect as a client to this server. For more information about how to install this on the remote client read the [[OpenVPN#Client]] documentation below.
* ''Click here to download this client's configuration onc file for Chromebook.'' provides a onc file that can be used to configure your Chromebook as a client to connect to the Untangle OpenVPN server. On the target device, browse to chrome://net-internals and use Import ONC file.

After installing the software on the remote client, the remote client should be able to connect to the OpenVPN server.

'''Note:''' A client can only be connected once. If you install the same client on multiple remote devices they will kick each other off when a new one logs in. In most cases you need to setup a client for each remote device.

==== Groups ====

''Groups'' are convenience feature to "group" clients together and apply some settings to that entire group.
By default there will be a ''Default Group.'' Each group has the following settings:

* ''Full Tunnel'' - If checked, remote clients will send ALL traffic bound to the internet through the VPN. This allows for Untangle to filter ALL internet traffic for connected clients by "proxying" it through the VPN and then out through Untangle's internet connection. This will have no effect on remote Untangle OpenVPN clients. If unchecked, then only traffic destined to the local network are subject to filtering.
* ''Push DNS'' - If enable, OpenVPN will "push" some DNS configuration to the remote clients when they connect. This is useful if you wish for some local names and services to properly resolve via DNS that would not publicly resolve.
* ''Push DNS Server'' - If set to ''OpenVPN Server'' then the IP of the Untangle server itself will be pushed to the remote clients and all remote clients will use Untangle for all DNS lookups. If ''Custom'' is selected then one or two DNS entries can be specified that will be used for DNS resolution.
* ''Push DNS Custom 1'' - If ''Push DNS Server'' is set to custom, this IP will be pushed to remote clients to use for DNS resolution. It is important to export this address if that traffic should travel through the VPN tunnel. If this value is blank nothing will be pushed.
* ''Push DNS Custom 2'' - Just like ''Push DNS Custom 1'' except this sets the secondary DNS value. If blank, no secondary DNS will be pushed.
* ''Push DNS Domain'' - If set this domain will be pushed to remote clients to extend their domain search path during DNS resolution.

These settings will apply to all clients belonging to that group. Many sites will only have one group because all clients need the same settings. However, some clients have some ''Full Tunnel'' remote clients and some ''Split Tunnel'' remote clients. In this case, you need two groups where each client belongs to the appropriate group.


==== Exported Networks ====

''Exported Networks'' is a list of networks that are reachable through the OpenVPN server for remote clients. ''Exported Networks'' are routes that are pushed to remote clients when they connect effectively telling remote clients to reach the specified network through the OpenVPN server.

For example, exporting ''1.2.3.4/24'' will result in all ''1.2.3.* ''traffic going through the OpenVPN server. 

The ''Exported Networks'' grid is pre-populated on installation with the IP/netmask of each static non-WAN interface.

* If ''Enabled'' is checked this network will be exported/pushed to connecting remote clients.
* ''Export Name'' is a name, purely used for documentation purposes.
* ''Network'' is the network, in CIDR notation.


----


=== Client ===

The '''Client''' tab is configures which remote servers this OpenVPN will connect to as a client.


==== Remote Servers ====

The ''Remote Servers'' grid lists the currently configured remote servers that OpenVPN is configured to connect to. 

To configure a new server to connect to, first login to the remote server and configure a new client as described above and click on  the ''Download Client'' as described above in the [[OpenVPN#Remote_Clients]] section. After you have downloaded the distribution zip file return to this OpenVPN and click on the ''Browse'' button below the ''Remote Servers'' grid. Select the zip file downloaded from the OpenVPN server and then press  OK. Next press the ''Submit'' button to upload the zip file to OpenVPN which will add a new entry into the ''Remote Servers'' grid based on the configuration in the submitted zip file.

Once connected to a remote server, you will be able to reach their exported networks. They will also be able to reach the networks on this server specified as the ''Remote Network'' in the [[OpenVPN#Remote_Clients]]  configuration.

* ''Note:'' Site to Site connections are not full-tunnel even if selected in the Group for the site to site.  Internet traffic on the remote site will exit through its local gateway.


----


=== Advanced ===

The ''Advanced'' tab is provided for advanced users who have a detailed knowledge and understanding of OpenVPN, and need very specific configuration changes to address unique or unusual situations. It is entirely possible to completely break your OpenVPN configuration with a single wrong character, misplaced space, or by changing a configuration option that probably shouldn't be changed. Changes you make on this page can possibly compromise the security and proper operation of your sever, and are not officially supported.

==== Common Settings ====

At the top of the ''Advanced'' page are the Protocol, Port, and Cipher options. These must be the same on both the client and server for connections to work. Since they are the options most frequently modified, they can be easily configured here and will apply to both the client and server.

The Client to Client Allowed checkbox is used to enable or disable traffic passing between OpenVPN clients. When enable, all clients will have full network access to each other when connected. If disabled, traffic will not be allowed to flow between connected clients.

==== Server Configuration and Client Configuration ====

If you require changes to other low level parameters, the Server Configuration and Client Configuration grids allow you to effectively have total control of the OpenVPN configuration file that is generated. Both grids work the same way, with each configuration applied to the corresponding server or client openvpn.conf file respectively.

By default, all items in both configuration grids are read only. This represents





== Reports ==

{{:OpenVPN Reports}}


== Related Topics ==

[http://en.wikipedia.org/wiki/OpenVPN OpenVPN]

[[IPsec VPN]]


== OpenVPN FAQs ==

{{:OpenVPN FAQs}}