OpenVPN/Stunnel - Revision history

Admin: /* Configure Stunnel Client */

2017-04-30T19:47:15Z

Configure Stunnel Client

← Older revision		Revision as of 19:47, 30 April 2017
Line 58:		Line 58:

	===Configure Stunnel Client===		===Configure Stunnel Client===

			{{Main\|Stunnel/Client}}

	Now we will edit <code>stunnel.conf</code> on the client. This configuration assumes [[OpenVPN]] is running on the client on port 9999 as well:		Now we will edit <code>stunnel.conf</code> on the client. This configuration assumes [[OpenVPN]] is running on the client on port 9999 as well:

2017-04-30T19:46:23Z

Flags

2017-04-30T19:46:12Z

References

← Older revision		Revision as of 19:46, 30 April 2017
Line 75:		Line 75:
	==References==		==References==

	Useful ~~link~~: http://home.arcor.de/lightsky/docs/stunnel_openssl_synergy.pdf		Useful links:
			* http://home.arcor.de/lightsky/docs/stunnel_openssl_synergy.pdf
	~~Another useful link:~~ http://kyl191.net/2012/12/tunneling-openvpn-through-stunnel/		* http://kyl191.net/2012/12/tunneling-openvpn-through-stunnel/

	=Flags=		=Flags=

2017-04-30T19:33:37Z

Configure Stunnel

← Older revision		Revision as of 19:33, 30 April 2017
Line 57:		Line 57:
	</pre>		</pre>

	===Configure Stunnel===		===Configure Stunnel Client===

	Now we will edit <code>stunnel.conf</code> ~~(ignore~~ the .~~cnf file). Edit this file to include~~ the ~~following 4 lines~~:		Now we will edit <code>stunnel.conf</code> on the client. This configuration assumes [[OpenVPN]] is running on the client on port 9999 as well:

	<pre>		<pre>
			...

			client = yes

	[openvpn]		[openvpn]
	~~client = yes~~		accept = 127.0.0.1:9999
	accept = 127.0.0.1:~~31337~~		connect = A.B.C.D:443
	connect = ip.~~add~~.re.ss:~~9999~~
	</pre>		</pre>

	~~OpenVPN needs to be configured to use this port 9999.~~ This ~~means~~ you ~~can replace connection profiles with ports with "remote localhost 31337"~~. (~~Assumes TCP not~~ UDP.) ~~<-- ?~~		This assumes you are using TCP for OpenVPN. (If you use OpenVPN in UDP mode, I don't know what will happen.)

	==References==		==References==

2017-04-30T19:31:55Z

Run Stunnel on Boot

← Older revision		Revision as of 19:31, 30 April 2017
Line 55:		Line 55:
	<pre>		<pre>
	iptables -A INPUT -p tcp --dport 443 -j ACCEPT		iptables -A INPUT -p tcp --dport 443 -j ACCEPT
	~~</pre>~~

	~~===Run Stunnel on Boot===~~

	~~Make stunnel run on boot by editing crontab <code>crontab -e</code> and adding:~~

	~~<pre>~~
	~~@reboot stunnel /etc/stunnel/stunnel.conf~~
	</pre>		</pre>

2017-04-30T19:31:48Z

Configure Stunnel Server for OpenVPN

← Older revision		Revision as of 19:31, 30 April 2017
Line 22:		Line 22:

	===Configure Stunnel Server for OpenVPN===		===Configure Stunnel Server for OpenVPN===

			{{Main\|Stunnel/Server}}

	The stunnel server will listen for external, encrypted traffic on port 443. It will decrypt any traffic it receives, and forward it on to OpenVPN at local port 9999. Here is the stunnel configuration file to accomplish this:		The stunnel server will listen for external, encrypted traffic on port 443. It will decrypt any traffic it receives, and forward it on to OpenVPN at local port 9999. Here is the stunnel configuration file to accomplish this:

2017-04-30T19:31:39Z

Open Hole in Firewall

← Older revision		Revision as of 19:31, 30 April 2017
Line 46:		Line 46:

	===Open Hole in Firewall===		===Open Hole in Firewall===

			{{Main\|Stunnel/Server}}

	Now use iptables to open up the firewall. Assuming you're using port 443:		Now use iptables to open up the firewall. Assuming you're using port 443:

2017-04-30T19:31:29Z

Open Hole in Firewall

← Older revision		Revision as of 19:31, 30 April 2017
Line 47:		Line 47:
	===Open Hole in Firewall===		===Open Hole in Firewall===

	Now use iptables to open up the firewall. Assuming you're using port ~~9999~~:		Now use iptables to open up the firewall. Assuming you're using port 443:

	<pre>		<pre>
	iptables -A INPUT -p tcp --dport ~~9999~~ -j ACCEPT		iptables -A INPUT -p tcp --dport 443 -j ACCEPT
	</pre>		</pre>

2017-04-30T19:31:11Z

Verify OpenVPN Running

← Older revision		Revision as of 19:31, 30 April 2017
Line 33:		Line 33:
	Here, port 9999 is a local port only, and is closed to the rest of the world. Stunnel listens on port 443 for OpenVPN traffic, and when it hears anything, it encrypts it and forwards it on to local port 9999 (where OpenVPN is listening).		Here, port 9999 is a local port only, and is closed to the rest of the world. Stunnel listens on port 443 for OpenVPN traffic, and when it hears anything, it encrypts it and forwards it on to local port 9999 (where OpenVPN is listening).

	===Verify OpenVPN Running===		===Verify OpenVPN Running on Server===

	Verify OpenVPN process is up and listening:		{{Main\|OpenVPN}}

			Verify [[OpenVPN]] process is up and listening:

	<pre>		<pre>

2017-04-30T19:30:24Z

Configure Stunnel Server for OpenVPN

← Older revision		Revision as of 19:30, 30 April 2017
Line 23:		Line 23:
	===Configure Stunnel Server for OpenVPN===		===Configure Stunnel Server for OpenVPN===

	Here is the stunnel configuration file ~~section that specifies how stunnel should run OpenVPN through stunnel~~:		The stunnel server will listen for external, encrypted traffic on port 443. It will decrypt any traffic it receives, and forward it on to OpenVPN at local port 9999. Here is the stunnel configuration file to accomplish this:

	<pre>		<pre>
	[openvpn]		[openvpn]
	accept = ~~9999~~		accept = 443
	connect = A.B.C.D:~~443~~		connect = 127.0.0.1:9999
	</pre>		</pre>

	Here, port 9999 is a local port only, and is closed to the rest of the world. Stunnel listens on port ~~9999~~ for OpenVPN traffic, and when it hears anything, it encrypts it ~~and forwards it on to external IP address A.B.C.D via port 443 (which is externally bound). Also, vice-versa: stunnel listens on the external port for incoming traffic through port 443, decrypts it,~~ and forwards it on to local port 9999, where OpenVPN is listening.		Here, port 9999 is a local port only, and is closed to the rest of the world. Stunnel listens on port 443 for OpenVPN traffic, and when it hears anything, it encrypts it and forwards it on to local port 9999 (where OpenVPN is listening).

	===Verify OpenVPN Running===		===Verify OpenVPN Running===