OpenVpn Notes and example

Linux VPN using ssl for encryption, with clients for Android and Windows.
Using more than one CA, stacked in same file https://community.openvpn.net/openvpn/wiki/Using_Certificate_Chains
2018 - Using PSK(pre-shared keys) only a point to point link can be established, for a server with multiple clients use CA and certs.
2018 Python script to gen self-signed certs and client certs https://github.com/diepes/openvpn-inline-config-generator
- idea is to create them, throw away cakey, deploy config. When adding re-gen or stack server CA

Routing

Using TUN(L3) the routing is messy if there are subnets at both ends, have to fiddle with ccd files per client, inserting iroute custom OpenVPN junk.
- Would have been perfect if we could create a new tun-x interface per connecting client, allowing the full power of Linux routing, and firewalling.
Using TAP(L2) very similar, but now mac's (and broadcasts) traverse the vpn.
- Allows running of routing protocols, e.g. ospf, and adding static routes to client IP's on the server. (fix ip's with ifconfig-pool-persist ipp.txt)
- The compression should reduce the impact of the ethernet headers.

Errors

2019-OpenVPN tunnel restarts with log
```
Wed Jan  9 20:04:24 2019 [vpn01] Inactivity timeout (--ping-restart), restarting
Wed Jan  9 20:04:24 2019 SIGUSR1[soft,ping-restart] received, process restarting
Wed Jan  9 20:04:24 2019 Restart pause, 2 second(s)
```
- keepalive ping going missing ?
- Problem tracked to 2 clients using same cert, kicking each other off.
- Solved by allowing multiple clients with same cert add to config: "duplicate-cn"

2018-OpenVPN dies with errors in log

NOTE: Pulled options changed on restart, will need to close and reopen TUN/TAP device.
: ERROR: Linux route delete command failed: external program exited with error status: 2
: Linux ip addr del failed: external program exited with error status: 2
ROUTE_GATEWAY 10.x.y.z/255.255.255.224 IFACE=eth0 HWADDR=06:bb:33:11:55:14

Try to fix by adding to config
```
       ifconfig-pool-persist
```
On Ubunt 16.04 edit vim /lib/systemd/system/openvpn@.service , add
```
[Service]
Restart=always
RestartSec=30
```

VERIFY ERROR: depth=1, error=unhandled critical extension: CN=
- and OpenSSL: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed
  - verify with
```
$ openssl verify -CAfile ca.pem server.pem 
CN = test_ca_20180712_20h31
error 34 at 1 depth lookup: unhandled critical extension
error server.pem: verification failed
```
    - X509v3 Subject Key Identifier: critical
openvpn: VERIFY ERROR: depth=0, could not extract X509 subject string from certificate
- Caused by not adding a CN to the certificate when created.
openvpn[...]: TLS Error: Unroutable control packet received from [AF_INET] ... (si=3 op=P_CONTROL_V1)
- Add client to config in addition to tls-client to allow client to accept ip from server
- remove topology mode setting from client.'

...

CategoryVpnTunnel