OpenVPN - Revision history

Bittner: Add network-manager integration

2025-09-25T21:47:12Z

Add network-manager integration

@@ Line 37: / Line 37: @@
+}
 </syntaxHighlight>
 === Mounting filesystems via a VPN ===

Klinger: Category:VPN added

2025-03-20T17:08:14Z

Category:VPN added

← Older revision		Revision as of 17:08, 20 March 2025
Line 148:		Line 148:

	[[Category:Networking]]		[[Category:Networking]]
	[[Category:~~Applications~~]]		[[Category:VPN]]

Mic92: imported from old wiki

2024-06-07T13:49:52Z

imported from old wiki

← Older revision		Revision as of 13:49, 7 June 2024
Line 63:		Line 63:

	If you want to run OpenVPN clients in NixOS declarative containers, you will need to set the {{nixos:option\|enableTun}} container option.		If you want to run OpenVPN clients in NixOS declarative containers, you will need to set the {{nixos:option\|enableTun}} container option.

			=== Supporting legacy cipher providers ===
			If you need to connect to servers with legacy ciphers (e.g. '''BF-CBC'''), one way is to override OpenVPN to use '''openssl_legacy''' package (which is [https://github.com/NixOS/nixpkgs/blob/nixos-unstable/pkgs/development/libraries/openssl/3.0/legacy.cnf configured to enable legacy providers]), for example via an overlay:

			<syntaxHighlight lang="nix">
			final: prev: {
			openvpn = prev.openvpn.override {
			openssl = prev.openssl_legacy;
			};
			}
			</syntaxHighlight>

	== VPN Server ==		== VPN Server ==

Klinger: Category:Networking Category:Applications

2024-04-19T20:01:06Z

Category:Networking Category:Applications

← Older revision		Revision as of 20:01, 19 April 2024
Line 136:		Line 136:
	</syntaxHighlight>		</syntaxHighlight>

	[[Category:~~Configuration~~]]		[[Category:Networking]]
			[[Category:Applications]]

imported>MatthiasvB: Added line that potentially fixes DNS issues

2023-12-21T20:25:18Z

Added line that potentially fixes DNS issues

@@ Line 21: / Line 21: @@
 <syntaxHighlight>
 systemctl start openvpn-officeVPN.service
 </syntaxHighlight>

imported>Zarkone: Small instruction on how to start/stop created VPN services.

2020-10-21T10:48:51Z

Small instruction on how to start/stop created VPN services.

← Older revision		Revision as of 10:48, 21 October 2020
Line 17:		Line 17:

	Ensure you use absolute paths for any files such as certificates and keys referenced from the configuration files.		Ensure you use absolute paths for any files such as certificates and keys referenced from the configuration files.

			Use <em>systemctl</em> to start/stop VPN service. Each generated service will have a prefix `openvpn-`:
			<syntaxHighlight>
			systemctl start openvpn-officeVPN.service
			</syntaxHighlight>

	=== Mounting filesystems via a VPN ===		=== Mounting filesystems via a VPN ===

imported>Samueldr: fixes heading levels

2018-05-16T01:31:51Z

fixes heading levels

← Older revision		Revision as of 01:31, 16 May 2018
Line 1:		Line 1:
	=VPN Client=		== VPN Client==
	OpenVPN can be configured for automatic startup by enabling it in <tt>/etc/nixos/configuration.nix</tt>:		OpenVPN can be configured for automatic startup by enabling it in <tt>/etc/nixos/configuration.nix</tt>:

Line 18:		Line 18:
	Ensure you use absolute paths for any files such as certificates and keys referenced from the configuration files.		Ensure you use absolute paths for any files such as certificates and keys referenced from the configuration files.

	==Mounting filesystems via a VPN==		=== Mounting filesystems via a VPN ===

	If you mount filesystems through the VPN, the filesystem will not be unmounted properly because the VPN connection will be shut down prior to unmounting the filesystem. However, newer systemd versions allow you to set mount options to unmount the mount before closing the VPN connection via the mount option <tt>x-systemd.requires=openvpn-<em>vpnname</em>.service</tt>.		If you mount filesystems through the VPN, the filesystem will not be unmounted properly because the VPN connection will be shut down prior to unmounting the filesystem. However, newer systemd versions allow you to set mount options to unmount the mount before closing the VPN connection via the mount option <tt>x-systemd.requires=openvpn-<em>vpnname</em>.service</tt>.
Line 44:		Line 44:
	If you want to run OpenVPN clients in NixOS declarative containers, you will need to set the {{nixos:option\|enableTun}} container option.		If you want to run OpenVPN clients in NixOS declarative containers, you will need to set the {{nixos:option\|enableTun}} container option.

	=VPN Server=		== VPN Server ==
	==Simple one-client VPN gateway server==		=== Simple one-client VPN gateway server ===
	The following is an example of a VPN server configuration which supports a single known client.		The following is an example of a VPN server configuration which supports a single known client.

imported>Gnidorah at 12:00, 21 February 2018

2018-02-21T12:00:52Z

← Older revision		Revision as of 12:00, 21 February 2018
Line 50:		Line 50:
	<syntaxHighlight lang="nix">		<syntaxHighlight lang="nix">
	let		let
	# generate via openvpn --genkey --secret ~~static~~.key		# generate via openvpn --genkey --secret openvpn-laptop.key
	client-key = "/root/openvpn-laptop.key";		client-key = "/root/openvpn-laptop.key";
	domain = "vpn.localhost.localdomain";		domain = "vpn.localhost.localdomain";
Line 56:		Line 56:
	port = 1194;		port = 1194;
	in {		in {
			# sudo systemctl start nat
	networking.nat = {		networking.nat = {
	enable = true;		enable = true;

imported>Gnidorah: fixes

2018-02-21T06:25:25Z

fixes

← Older revision		Revision as of 06:25, 21 February 2018
Line 56:		Line 56:
	port = 1194;		port = 1194;
	in {		in {
	~~boot.kernel.sysctl."net.ipv4.ip_forward" = 1;~~
	networking.nat = {		networking.nat = {
	enable = true;		enable = true;
	externalInterface = <your-server-out-~~itf~~>;		externalInterface = <your-server-out-if>;
	internalInterfaces = [ vpn-dev ];		internalInterfaces = [ vpn-dev ];
	};		};
Line 71:		Line 70:
	secret ${client-key}		secret ${client-key}
	port ${toString port}		port ${toString port}

	cipher AES-256-CBC		cipher AES-256-CBC
			auth-nocache

	comp-lzo		comp-lzo

	keepalive 10 60		keepalive 10 60
	ping-timer-rem		ping-timer-rem
Line 82:		Line 83:
	environment.etc."openvpn/smartphone-client.ovpn" = {		environment.etc."openvpn/smartphone-client.ovpn" = {
	text = ''		text = ''
	~~client~~
	dev tun		dev tun
	remote "${domain}"		remote "${domain}"
	ifconfig 10.8.0.1 10.8.0.2		ifconfig 10.8.0.2 10.8.0.1
	port ${toString port}		port ${toString port}
			redirect-gateway def1

	cipher AES-256-CBC		cipher AES-256-CBC
			auth-nocache

	comp-lzo		comp-lzo
	keepalive 10 60		keepalive 10 60
Line 98:		Line 101:

	'';		'';
	mode = "~~700~~";		mode = "600";
	};		};
	system.activationScripts.openvpn-addkey = ''		system.activationScripts.openvpn-addkey = ''

imported>HLandau at 22:01, 24 October 2017

2017-10-24T22:01:28Z

← Older revision		Revision as of 22:01, 24 October 2017
Line 111:		Line 111:
	}		}
	</syntaxHighlight>		</syntaxHighlight>

			[[Category:Configuration]]