forked from pool/ocserv
9b957043e0
OBS-URL: https://build.opensuse.org/request/show/361424 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=5
119 lines
3.3 KiB
Plaintext
119 lines
3.3 KiB
Plaintext
## Setup AnyConnect VPN w/ ocserv
|
|
|
|
### What is Cisco Anyconnect? What is ocserv?
|
|
|
|
Cisco Anyconnect is an enterprise VPN first launched by Cisco.
|
|
|
|
The open source technology behind is OpenConnect.
|
|
|
|
It uses UDP DTLS (Datagram Transport Layer Security) to encrypt traffic
|
|
during regular times, and uses TCP TLS for reconnect when offline.
|
|
|
|
So it's more stable then other types of VPN, and massively used by big multinational companys which make it unlikely to be overkilled. With its rare scale among individuals, it's less likely to attract blockage.
|
|
|
|
### Initialization
|
|
|
|
After getting ocserv installed through zypper/YaST, you need to edit
|
|
/etc/ocserv/certificates/server.tmpl.
|
|
|
|
Change:
|
|
|
|
cn = "Your hostname or IP"
|
|
|
|
to the real one. You can /sbin/ifconfig -a to check yours.
|
|
|
|
#### Generate Certificates
|
|
|
|
cd /etc/ocserv/certificates
|
|
sudo certtool --generate-privkey --outfile ca-key.pem
|
|
sudo certtool --generate-self-signed --load-privkey ca-key.pem --template ca.tmpl --outfile ca-cert.pem
|
|
sudo certtool --generate-privkey --outfile server-key.pem
|
|
sudo certtool --generate-certificate --load-privkey server-key.pem --load-ca-certificate ca-cert.pem --load-ca-privkey ca-key.pem --template server.tmpl --outfile server-cert.pem
|
|
|
|
#### Generate passwd file
|
|
|
|
sudo ocpasswd -c /etc/ocserv/ocpasswd your_username_wanted
|
|
|
|
The later "your_username_wanted" is left for you.
|
|
|
|
Then log your chosen passwords twice.
|
|
|
|
#### Shutdown SUSEFirewall2 through YaST
|
|
|
|
Because I don't know how to convert iptables rules to SUSEFirewall2 ones.
|
|
If you can help me, please fork this package and submit back.
|
|
|
|
#### Set iptables rules
|
|
|
|
sudo /sbin/iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o eth0 -j MASQUERADE
|
|
sudo /sbin/iptables -A FORWARD -s 192.168.1.0/24 -j ACCEPT
|
|
|
|
The 9000/9001 ports, IP range 192.168.1.0/24 are default ones,
|
|
you can change them in /etc/ocserv/ocserv.conf
|
|
|
|
Warning: Your eth0 may not exist, you can ifconfig -a to find yours.
|
|
|
|
#### Test
|
|
|
|
sudo /sbin/ocserv -f -d 1
|
|
|
|
#### Enable systemd services
|
|
|
|
sudo systemctl enable ocserv.service
|
|
sudo systemctl start ocserv.service
|
|
|
|
### Client Cert Login
|
|
|
|
sudo certtool --generate-privkey --outfile user-key.pem
|
|
sudo certtool --generate-certificate --load-privkey user-key.pem --load-ca-certificate ca-cert.pem --load-ca-privkey ca-key.pem --template user.tmpl --outfile user-cert.pem
|
|
|
|
#### Change ocserv.conf
|
|
|
|
Change:
|
|
|
|
#auth = "certificate"
|
|
auth = "plain[/etc/ocserv/ocpasswd]"
|
|
|
|
To:
|
|
|
|
auth = "certificate"
|
|
#auth = "plain[/etc/ocserv/ocpasswd]"
|
|
|
|
And comment:
|
|
|
|
#listen-clear-file = /var/run/ocserv-conn.socket
|
|
|
|
And uncomment:
|
|
|
|
ca-cert = /etc/ocserv/certificates/ca-cert.pem
|
|
|
|
Restart service:
|
|
|
|
sudo systemctl restart ocserv.service
|
|
|
|
#### Generate pk12 file for iOS
|
|
|
|
openssl pkcs12 -export -inkey user-key.pem -in user-cert.pem -certfile ca-cert.pem -out user.p12
|
|
|
|
### Client Connection
|
|
|
|
Remember to set the server address to xxx.xxx.xxx.xxx:your_port,
|
|
eg: opensuse.org:9000
|
|
|
|
#### iOS
|
|
|
|
Search "anyconnect" in App Store.
|
|
|
|
Either type username/password manually or import the pk12 file
|
|
(You can put the later on your download server)
|
|
|
|
#### Linux
|
|
|
|
Install NetworkManager-openconnect, also plasma-nm-openconnect if you're under KDE. Support certificate login only.
|
|
|
|
You need your ca-cert.pem, user-cert.pem and user-key.pem.
|
|
|
|
#### Android
|
|
|
|
Search "AnyConnect", "SmoothConnect" or "OpenConnect" in Google Play.
|