1,723
edits
Difference between revisions of "Linksys AC Series Router Configuration Tips for OpenWRT"
Linksys AC Series Router Configuration Tips for OpenWRT (view source)
Revision as of 16:42, 25 September 2020
, 16:42, 25 September 2020→POPTOP / PPTPD
m (→POPTOP / PPTPD) |
|||
| Line 2,359: | Line 2,359: | ||
===POPTOP / PPTPD=== | ===POPTOP / PPTPD=== | ||
First a warning so no one gets frustrated. Right out of the box, the configuration for PPTPD from OpenWRT is broken. The hint was found here: https://forum.openwrt.org/t/default-config-file-for-pptpd-lacks-logwtmp-option/4795 And as of 8.2020 it is still busted. How to fix it? Well, follow the below directions. | First a warning so no one gets frustrated. Right out of the box, the configuration for PPTPD from OpenWRT is broken. The hint for correcting it was found here: https://forum.openwrt.org/t/default-config-file-for-pptpd-lacks-logwtmp-option/4795 And as of 8.2020 it is still busted. How to fix it? Well, follow the below directions. Hint, this is the key setting in the /etc/config/pptpd file to get it functional (see below for more information): option 'logwtmp' '0' | ||
option 'logwtmp' '0' | |||
====Installation==== | ====Installation==== | ||
opkg install pptpd ppp (dependencies will automatically be installed if just pptpd is installed) | opkg install pptpd ppp (dependencies will automatically be installed if just pptpd is installed) | ||
There is no LuCI GUI available | There is no LuCI GUI available. Oddly, given there is no LuCI GUI, OpenWRT configuration of PPTPD is done through an /etc/config/ppptd file (usually this is only reserved for services that have a companion LuCI GUI available) | ||
====Configuration and other PPTPD Related File Locations==== | ====Configuration and other PPTPD Related File Locations==== | ||
* OpenWRT PPTPD Configuration File: /etc/config/pptpd | |||
* PPTPD Configuration File: /etc/pptpd.conf* (BIG Asterisk here, see below) (as part of the /etc/init.d/pptpd startup script, this file is copied to /var/etc/pptpd.conf. This could be changed in the startup script, but to keep things withing the OpenWRT configuration paradigm things can be left as they are, but just know this is going on behind the scenes.) | |||
* PPP Configuration Files: /etc/ppp | |||
** /etc/ppp/chap-secrets (AKA User Names and Passwords for PPTPD): /etc/ppp/chap-secrets (the /etc/ppp/chap-secrets is actually "located" here /tmp/etc/chap-secrets and is dynamically generated by the /etc/init.d/pptpd startup script. When PPTPD is started a symbolic link is created as /etc/ppp/chapt-secrets which is pointed to /tmp/etc/chap-secrets. It should also be noted the pptpd package contains an /etc/ppp/chap-secrets file that is empty except for some commented out column headings. This might lead one to believe that this is the file where user names and passwords are created for PPTPD. This is not the case. The user names and passwords are dynamicaly generated as previously noted and the information used when it is generated is derived from the /etc/config/ppptp file. So make sure user names and passwords are created in the /etc/config/pptpd file in the format noted in the example below) | |||
** /etc/ppp/filter (OpenWRT PPTPD doesn't seem to utilize the settings in this file, even though it is included, so probably relegated to PPP only stuff. Research indicates it seems to be related to "allowed" outbound protocols) | |||
** /etc/ppp/options (This file contains the ppp (Point to Point Protocol) configuration and can be left with default settings. Do not confuse it with the options.pptpd file which is used for PPTPD PPP settings. IE, PPP is used for more than PPTPD and the plain options file is just for PPP) | |||
** /etc/ppp/options.pptpd (this file is copied to /var/etc/options.pptpd in the /etc/init.d/pptpd startup script) | |||
** /etc/ppp/resolv.conf (this file isn't necessary for PPTPD to function, but can be used for DNS name resolution.) (The /etc/ppp/resolv.conf file is also a symbolic link pointing to /tmp/resolv.conf.ppp, which is created by other OpenWRT services.) | |||
====Configuring PPTPD==== | ====Configuring PPTPD==== | ||
| Line 2,398: | Line 2,392: | ||
option 'username' 'AnotherUserNameETC' | option 'username' 'AnotherUserNameETC' | ||
option 'password' 'AnotherPaswordETC' | option 'password' 'AnotherPaswordETC' | ||
</syntaxhighlight>Notice the ''option 'logwtmp' '0'<nowiki/>'' line. It MUST be included for the service to start (or the startup script has to be modified). And of course substitute the W.X.Y.Z and ABC with your own IP Address range. | </syntaxhighlight>Notice the ''option 'logwtmp' '0'<nowiki/>'' line. It MUST be included for the service to start (or the startup script in /etc/init.d/pptpd has to be modified). And of course substitute the W.X.Y.Z and ABC with your own IP Address range. | ||
The above noted "logwtmp" setting is NOT included in the default pptpd file. That | The above noted "logwtmp" setting is NOT included in the default pptpd file. That is very, very odd, because the /etc/init.d/pptpd startup script explicilty checks for the existence of that setting and will show an "sh: out of range" error message if it is not included. So why would the default startup script requre a setting that isn't included in the default configuration file? Additionally the main OpenWRT [https://openwrt.org/docs/guide-user/services/vpn/pptp/basic documentation page for PPTPD] does not mention it at all. It's almost like the nice people at OpenWRT don't want PPTPD to be used. It is a somewhat "old & busted" VPN protocol (Google it), so using a more modern alternative like OpenVPN would be a good choice. But sometimes it is necessary to support older protocols such as this. | ||
From there everything gets better. The following files can be manually configured and the PPTPD startup script copies them to the /var/etc directory for the service to use when it starts up; | From there everything gets better. The following files can be manually configured and the PPTPD startup script copies them to the /var/etc directory for the service to use when it starts up; | ||
*/etc/pptpd.conf (see below for a working version of this file, slightly different than the default OpenWRT version) | */etc/pptpd.conf (see below for a working version of this file, slightly different than the default OpenWRT version) | ||
*/etc/ppp/options | */etc/ppp/options (this can be left with default OpenWRT settings) | ||
*/etc/ppp/options.pptpd (see below for a working version of this file, slightly different than the default OpenWRT version) | */etc/ppp/options.pptpd (see below for a working version of this file, slightly different than the default OpenWRT version) | ||
| Line 2,502: | Line 2,496: | ||
====Additional Information==== | ====Additional Information==== | ||
The [https://openwrt.org/docs/guide-user/services/vpn/pptp/basic information on the OpenWRT site on PPTP] is a bit misleading, because as noted above /etc/pptpd.conf is not the true configuration file. It is actually generated dynamically as many OpenWRT services are. | The [https://openwrt.org/docs/guide-user/services/vpn/pptp/basic information on the OpenWRT site on PPTP] is a bit misleading (possibly just outdated), because as noted above /etc/pptpd.conf is not the true configuration file. It is actually generated dynamically as many OpenWRT services are. The article also references an issue with the /etc/init.d/pptpd startup script that no longer seems to exist. | ||
This option for the /etc/ppp/options.pptpd is NOT supported by the OpenWRT PPTPD service: require-mppe-128 (an In file /var/etc/options.pptpd: unrecognized option 'require-mppe-128' error will occur if it is included). It should also be noted that the mppe-128 is built into the OpenWRT /usr/sbin/pptpd binary / executable file, thus making the setting unneccessary as it is enabled by default (pptp-server.log if enabled shows this: MPPE 128-bit stateless compression enabled). | This option for the /etc/ppp/options.pptpd is NOT supported by the OpenWRT PPTPD service: require-mppe-128 (an error message of: In file /var/etc/options.pptpd: unrecognized option 'require-mppe-128' error will occur if it is included). It should also be noted that the mppe-128 is built into the OpenWRT /usr/sbin/pptpd binary / executable file, thus making the setting unneccessary as it is enabled by default (pptp-server.log if enabled shows this: MPPE 128-bit stateless compression enabled). So do not include require-mppe-128 in the /etc/ppp/options.pptpd. | ||
===OpenVPN=== | ===OpenVPN=== | ||
| Line 2,571: | Line 2,565: | ||
*Watch out when clicking the "Keys list" link as it is very close to the Remove link. If the Remove link is clicked, there is no confirmation about deleting the entire Certificate infrastructure. | *Watch out when clicking the "Keys list" link as it is very close to the Remove link. If the Remove link is clicked, there is no confirmation about deleting the entire Certificate infrastructure. | ||
====== Configuring a Certificate Authority Infrastructure (Certificate Authority, Server Certificate, Client Certificate(s) ====== | ======Configuring a Certificate Authority Infrastructure (Certificate Authority, Server Certificate, Client Certificate(s)====== | ||
For some odd reason (possibly troubleshooting), it is possible to create an OpenVPN infrastructure that transmits information ''without'' encryption. That's a bit too "open". In order to encrypt communication one must create a "Certificate Infrastructure". This includes first, a Certificate Authority (CA), then a certificate for a Server, then certificate(s) for clients. | For some odd reason (possibly troubleshooting), it is possible to create an OpenVPN infrastructure that transmits information ''without'' encryption. That's a bit too "open". In order to encrypt communication one must create a "Certificate Infrastructure". This includes first, a Certificate Authority (CA), then a certificate for a Server, then certificate(s) for clients. | ||
| Line 2,578: | Line 2,572: | ||
If the Webmin module is configured as noted below, the entire certificate infrastructure (minus OpenSSL settings) will be stored in /etc/openvpn/keys | If the Webmin module is configured as noted below, the entire certificate infrastructure (minus OpenSSL settings) will be stored in /etc/openvpn/keys | ||
* Create a Certificate Authority | *Create a Certificate Authority | ||
==== Webmin for OpenVPN and Certificate Management ==== | ====Webmin for OpenVPN and Certificate Management==== | ||
Only some features of the Webmin Module are useful. First and foremost is the Certificate management. Works great. As noted above, watch out when clicking the "Keys list" link as it is very close to the Remove link. If the Remove link is clicked, there is no confirmation about deleting the entire Certificate infrastructure. Bad design, oh, well. | Only some features of the Webmin Module are useful. First and foremost is the Certificate management. Works great. As noted above, watch out when clicking the "Keys list" link as it is very close to the Remove link. If the Remove link is clicked, there is no confirmation about deleting the entire Certificate infrastructure. Bad design, oh, well. | ||
| Line 2,591: | Line 2,585: | ||
The Webmin module for OpenVPN & Certificate management is not a "standard module". | The Webmin module for OpenVPN & Certificate management is not a "standard module". | ||
* Install in the Webmin interface: Webmin, Webmin Configuration, Webmin Modules, Install from Local File, Select File, Install Module. | *Install in the Webmin interface: Webmin, Webmin Configuration, Webmin Modules, Install from Local File, Select File, Install Module. | ||
** Download the module if the Webmin interface doesn't populate with available modules | **Download the module if the Webmin interface doesn't populate with available modules | ||
*** wget https://www.webmin.com/cgi-bin/search_third.cgi?modules=1 | ***wget https://www.webmin.com/cgi-bin/search_third.cgi?modules=1 | ||
**** If wget displays an error, make sure the full version of wget is installed (not the one built into BusyBox): opkg install wget | ****If wget displays an error, make sure the full version of wget is installed (not the one built into BusyBox): opkg install wget | ||
**** If a certificate error occurs, add this to the end of the wget line: --no-check-certificate | ****If a certificate error occurs, add this to the end of the wget line: --no-check-certificate | ||
*** Site: https://www.webmin.com/cgi-bin/search_third.cgi?modules=1 | ***Site: https://www.webmin.com/cgi-bin/search_third.cgi?modules=1 | ||
*** OpenVPN & Certificate Management Module Link (version 3.2): http://www.openit.it/downloads/OpenVPNadmin/openvpn-3.2.wbm.gz | ***OpenVPN & Certificate Management Module Link (version 3.2): http://www.openit.it/downloads/OpenVPNadmin/openvpn-3.2.wbm.gz | ||
*** Sometimes the interface seems to work, sometimes it doesn't. Possibly due to Wemin site issues or Perl issues on a local machine. | ***Sometimes the interface seems to work, sometimes it doesn't. Possibly due to Wemin site issues or Perl issues on a local machine. | ||
* By default, the OpenVPN... Module is located in Servers. Given that it deals with Networking and an equivalent Module (PPTP) is located in Networking, it makes sense to relocate the Module to Networking | *By default, the OpenVPN... Module is located in Servers. Given that it deals with Networking and an equivalent Module (PPTP) is located in Networking, it makes sense to relocate the Module to Networking | ||
** Webmin, Webmin Configuration, Reassign Modules, OpenVPN..., Networking, Save | **Webmin, Webmin Configuration, Reassign Modules, OpenVPN..., Networking, Save | ||
Below is a working configuration file for the OpenVPN & Certificate Authority Module (/etc/webmin/openvpn)<syntaxhighlight lang="text"> | Below is a working configuration file for the OpenVPN & Certificate Authority Module (/etc/webmin/openvpn)<syntaxhighlight lang="text"> | ||