Search My Blog

Saturday, July 31, 2010

Setting Up OpenVPN on a DD-WRT Router, Part 1 — ServerWatch.com

Setting Up OpenVPN on a DD-WRT Router, Part 1

July 14, 2010
By Eric Geier

VPN connections let you remotely access file or connect remote offices together via secure tunnels over the Internet. They can even come in handy to secure connections on public Internet ports or Wi-Fi hotspots, hiding Internet traffic from local eavesdroppers.

If you aren't going to have more than two-dozen VPN users, you might consider setting up your own VPN server using the DD-WRT router firmware. If you have a compatible wireless router, you can load the firmware on it. This gives you an OpenVPN server and client, and many more cool features. You can then set it up for remote access connections or site-to-site connections to connect offices together.

DD-WRT supports two different VPN protocols: Point-to-Point Tunneling Protocol (PPTP), which is very popular but has vulnerabilities, and OpenVPN, which uses Secure Sockets Layer (SSL) and Transport Layer Security (TLS) for a much more secure solution. In this two-part tutorial, we will set up and use OpenVPN.

In this first of two articles, we will explain how to flash the router with the DD-WRT firmware, change the router's IP and subnet for compatibly reasons, and create the SSL certificates. In the second installment, we will step through configuring the OpenVPN server, creating startup and firewall scripts, configuring the clients, and testing it out.

For the record, this tutorial was based off using the VPN variant of DD-WRT v24-SP2. It's the build 13064, dated 10/10/09. For creating SSL certificates and for the clients, we used OpenVPN 2.1.1, released on 12/11/09. The steps for using other versions of the firmware or OpenVPN may vary.

Flash Router With the VPN Version of DD-WRT

First, make sure you're using a wireless router that's compatible with DD-WRT and has enough NVRAM storage space. You'll want to follow the directions to flash or upload the VPN version of DD-WRT to your router.

To check the available NVRAM, you must use Telnet or SSH to get to the router. You can download and use PuTTY. Select Telnet as the Connection Type and enter the router's IP address (192.168.1.1). Then, for the DD-WRT Login, enter "root." If you've created a password via the Web-based control panel, use it; otherwise, the default is "admin".

Once logged in via Telnet, enter the following command:

If you have more than 5,200 bytes left, you're good to go.