#Opendns updater edgerouter lite password#
#Opendns updater edgerouter lite free#

Set interfaces openvpn vtun0 openvpn-option '-tls-auth /config/auth/ta.key 0' Tell the OpenVPN server to use the –tls-auth option.Copy the key to “/config/auth” on the ERL.First you need to generate the pre-shared key as a super user. This makes it so that someone doing a port scan of your public IP address will not see that the OpenVPN port is accepting connections. The TLS auth option makes it so that the OpenVPN server will not respond to packets unless those packets have a valid signature from a pre-shared key.Set service dns forwarding listen-on vtun0 We need to tell DNS to listen for requests on the new vtun0 interface.Set firewall name WAN_LOCAL rule 50 protocol udp Set firewall name WAN_LOCAL rule 50 log enable Set firewall name WAN_LOCAL rule 50 destination port 11194 Set firewall name WAN_LOCAL rule 50 description 'OpenVPN' Set firewall name WAN_LOCAL rule 50 action accept If you’re not using the standard port for openVPN (1194), change it appropriately. We’ll need to open a port in the firewall for OpenVPN.Set tls key-file /config/auth/server-nopass.key Set tls cert-file /config/auth/server.pem Set tls ca-cert-file /config/auth/cacert.pem Server subnet: This can be radically different from your own LAN subnet as it is only used to traverse the VPN tunnel.You can add as many routes here as you want if you have a more complex setup. I’m using this to access my home internet connection. Server push-route: For my setup I had no need to access anything on my home network so I assigned a different subnet from what I use there.Change ports, hash, encryption, and IP addresses as needed for your individual setup.Technically this part can be done in the webUI but we’ll do it in the CLI so you can copy and paste.Repeat this as necessary for each client.Openssl rsa -in /config/auth/client1.key -out /config/auth/client1-nopass.key Openssl rsa -in /config/auth/server.key -out /config/auth/server-nopass.key

#Opendns updater edgerouter lite password#

Now remove the password from the host and client(s) keys so that OpenVPN can run in interactive mode.

Openssl dhparam -out /config/auth/dhp.pem -2 1024

#Opendns updater edgerouter lite free#

Feel free to change the key length to 2048 or even 4096 but be aware that while it offers greater security it will also slow the whole VPN process down.Expect this to take 10 minutes with one CPU at 100% for 1024 or about 2 hours for 2048. Now we need to generate our Diffie-Hellman (DH) parameters to ensure Perfect Forward Secrecy (PFS).I made two so my wife could use it on her phone too. Repeat this step for each client device you plan on having.Move the new files while renaming them.The CN of your user certificate should be something unique. You will create one of these for each device you plan on connecting with OpenVPN. Next, generate a request and sign it for a new user certificate.Mv /usr/lib/ssl/misc/newkey.pem /config/auth/server.key Mv /usr/lib/ssl/misc/newcert.pem /config/auth/server.pem In addition to moving the files, we’ll also rename them.Ĭp /usr/lib/ssl/misc/demoCA/cacert.pem /config/auth/Ĭp /usr/lib/ssl/misc/demoCA/private/cakey.pem /config/auth/ We need to move the files to a directory where they won’t be wiped out during a firmware upgrade.

newcert.pem – This is the public key for your OpenVPN server.You’ll have one more file, shown below.newreq.pem – This is the unsigned public key of the server (this needs to be signed by your Root CA).newkey.pem – This is the private key for your OpenVPN server (keep this secret).Once this completes, you’ll have two new files, as follows:.The CN (Common Name) of your server certificate should be something unique. Follow the prompts and enter as much info as possible.Now we’ll generate a public/private key for the OpenVPN server.

Create the server certificate for your OpenVPN server.

cacert.pem – This the public key for your CA (you’ll be giving this out to your clients).

/private/cakey.pem – This is the private key for your CA (keep this secret).

The two most important files in here are as follows:

Once this completes, you’ll have a new directory called demoCA.

Go to the following directory to run the commands.

Setup the Root CA (Certificate Authority).