Changes between Initial Version and Version 1 of OpenVPN_on_VBox

Timestamp:

Mar 15, 2007 8:54:41 AM (17 years ago)

Author:

Michael Thayer

Comment:

HOWTO on setting up OpenVPN on VBox

OpenVPN_on_VBox

@@ +1 @@
+= Setting up OpenVPN between VirtualBox guests and hosts =
+
+== Scenario ==
+
+You have a host (Debian Etch assumed below) where you're running
+multiple VBox VMs in NAT mode.  Let's call them debianvm and ubuntuvm.
+You can connect out of those virtual machines to your LAN and the internet
+using ssh, http etc, but you're disappointed that you can't connect into
+those boxes because the VBox NAT doesn't do port forwarding.
+
+(Note: as of version 1.3.8, VBox does support port forwarding)
+
+Your options are:
+ - Post a query to the vbox-users mailing list.
+   And get told, not unreasonably, that the NAT mode doesn't
+   support it.
+ - Read the documentation on "Host Interface Networking".
+   And run away in terror because it looks real complicated.
+ - Follow the instructions below to run OpenVPN clients
+   in those virtual machines, making them (almost) first
+   class citizens of your LAN and allowing you to connect in to them.
+
+So:
+
+On the host (192.168.7.3 assumed here) as root:
+
+First, enable packet forwarding
+(a one line uncomment edit in /etc/sysctl.conf).
+Then:
+
+  apt-get install openvpn
+  cd /etc/openvpn
+  cat<<EOF > debianvm.conf
+  dev tun
+  ifconfig 10.8.0.5 10.8.0.6
+  keepalive 10 60
+  port 1195
+  EOF
+  /etc/init.d/openvpn start
+
+On the debianvm guest, as root:
+
+  apt-get install ssh openvpn
+  cd /etc/openvpn
+  cat<<EOF > debianvm.conf
+  remote 192.168.7.3
+  dev tun
+  ifconfig 10.8.0.2 10.8.0.1
+  keepalive 10 60
+  redirect-gateway
+  EOF
+  /etc/init.d/openvpn start
+
+On the host:
+
+  ping 10.8.0.2
+
+should respond.  And
+
+  ssh -l root 10.8.0.2
+
+should get you a login.
+
+[There's nothing special about ssh; e.g a host-side xtightvncviewer
+connecting in to a tightvncserver running on the guest works fine too].
+
+This might be all you need, in which case skip the next section.
+
+== Multiple VMs ==
+
+Now we'll set up our ubuntuvm too.
+We'll simply run another openvpn on the host; it'll need to listen
+on a different port number (but that's easier than setting up OpenVPN's
+server mode IMHO).  We need to add +4 to get to the the next usable IP
+addresses (debianvm's link used .1 and .2 for the endpoints, and .0 and .3
+for net and broadcast addresses; ubuntuvm will use .4 through .7, with
+.5 and .6 being the endpoints).
+
+On the host (still as root in /etc/openvpn):
+
+  cat<<EOF > ubuntuvm.conf
+  dev tun
+  ifconfig 10.8.0.5 10.8.0.6
+  keepalive 10 60
+  port 1195
+  EOF
+  /etc/init.d/openvpn restart
+
+On the guest:
+
+  # NB First you'll need to enable the "universe" and apt-get update
+  
+  apt-get install ssh openvpn
+
+  cat<<EOF > ubuntuvm.conf
+  remote 192.168.7.3 1195
+  dev tun
+  ifconfig 10.8.0.6 10.8.0.5
+  keepalive 10 60
+  redirect-gateway
+  EOF
+  /etc/init.d/openvpn restart
+
+On the host:
+ 
+  ping 10.8.0.6
+
+should respond.  And
+
+  ssh -l username 10.8.0.6
+
+should log you into ubuntuvm (don't forget:
+ubuntu doesn't allow root logins).
+
+You should also find you can ssh (or whatever)
+directly from debianvm to ubuntuvm and vice-versa.
+
+== Tidying up ==
+
+On Debian, the openvpn init scripts run openvpn for any
+config files in /etc/openvpn on boot, so there should be
+no need to redo any of the above setup again; the VPN
+tunnels should just appear automatically.
+
+Make sure all your machines have 
+  10.8.0.2 debianvm
+  10.8.0.6 ubuntuvm
+in their /etc/hosts (or whatever you use for hostname resolution).
+
+Make sure your LAN is set up to route the 10.8.0.0/255.255.255.0
+net via the gateway at 192.168.7.3.
+
+You should now be able to connect to debianvm and ubuntuvm
+just the same as if they were any other machines on your LAN.
+
+== Disclaimer ==
+
+- The above doesn't include encryption.  Just wanted to point
+  this out in case anyone assumed OpenVPN did some by default. 
+  See the openvpn docs; using static keys adds 4 lines per VM
+  to the above total (generate key, scp it to client, add one
+  line to .conf files).
+
+- OpenVPN doesn't support broadcast.
+  Maybe that breaks some Windows things.
+
+- The redirect-gateway in the client config reroutes all traffic
+  through the VPN tunnel.  Suspect this could somehow break
+  DHCP interactions with the NAT-mode VirtualBox built-in DHCP
+  server, but it's worked fine for me so far.