• • Configure the local network on its router – set DHCP IP reservation for OpenVPN server virtual machine (based on MAC address of virtual machine's ethernet port). DHCP server will always assign the same IP address.
    
    
  • Configure port forwarding if needed - forward public port to port 443 TCP on IP address assigned by DHCP for OpenVPN server.
    
    
  • Choose public port number above 1024 TCP to avoid using privileged ports.

2N OpenVPN server installation

All examples shown in this article are for Debian 10 and require to be run with elevated rights, either login as root or use proper command to gain required rights.

• On the Linux machine, deploy stunnel4, openvpn, bridge-utils and lshw via command in the command line.
  
  

  apt-get install -y stunnel4 openvpn bridge-utils lshw >/dev/null

  
  
  
• Create certificates for OpenVPN. You need server certificate, server key, ca and intercom certificate with intercom key. Then you need to put those certificates to correct folders for stunnel, openvpn and intercoms.
  
  You can do it manually or use the script below. This script will generate unique certificates each time it is run and put them in /tmp/certs folder. Then it moves all required certificates to appropriate folders. It also generates client certificates for IP Intercoms / Access Units and place them to folder /root/certs from where you can download them.
  
  To make script run, you need to save it in EOL conversion to UNIX and encoding UTF-8 format as .sh file, then upload it and apply chmod a+x to make script executable.
  
  In the script example, the intercom.key password is set to Test1234, but due to security we recommend to create your own certificates with own password and settings, use this example as a reference only. 2N TELEKOMUNIKACE a.s. does not hold any responsibility if example certificates will not be secure enough.
  
  

  #!/bin/bash ################################################################################ # Settings # ################################################################################ # Certificates C_C="" # Country Name (2 letter code) C_ST="" # State or Province Name C_L="" # Locality Name C_O="" # Organization Name C_OU="" # Organizational Unit Name C_CN="" # Common Name ################################################################################ VERSION=1.0 ################################################################################ print_step() { echo -n "${1} ... " } print_ok() { echo "[ OK ]" } check_error() { if [ $1 -ne 0 ]; then echo echo echo echo "Error: $2" echo exit $1 fi } print_step "Generating certificates" TMP_CERTS=/tmp/certs EC=prime256v1 EC_PARAMS=ec-${EC}-params.crt PASS=Test1234 rm -rf ${TMP_CERTS} mkdir ${TMP_CERTS} check_error $? "can't generate certificates" touch ${TMP_CERTS}/index.txt ${TMP_CERTS}/index.txt.attr check_error $? "can't generate certificates" echo "01" > ${TMP_CERTS}/serial.txt check_error $? "can't generate certificates" cat <<EOF >${TMP_CERTS}/openssl.cnf [ ca ] default_ca = CA_default [ CA_default ] database = ${TMP_CERTS}/index.txt serial = ${TMP_CERTS}/serial.txt policy = policy_default [ policy_default ] commonName = supplied EOF check_error $? "can't generate certificates" openssl ecparam -name ${EC} -out ${TMP_CERTS}/${EC_PARAMS} &>/dev/null check_error $? "can't generate certificates" subj="/C=${C_C}/ST=${C_ST}/L=${C_L}/O=${C_O}/OU=${C_OU}/CN=${C_CN:-Certificate Authority}" openssl req -subj "${subj}" \ -passout pass:${PASS} \ -new -x509 -newkey ec:${TMP_CERTS}/${EC_PARAMS} \ -days 3650 -sha256 \ -keyout ${TMP_CERTS}/ca.key -out ${TMP_CERTS}/ca.crt \ &>/dev/null check_error $? "can't generate certificates" subj="/C=${C_C}/ST=${C_ST}/L=${C_L}/O=${C_O}/OU=${C_OU}/CN=${C_CN:-Server Certificate}" openssl req -subj "${subj}" \ -new -nodes -newkey ec:${TMP_CERTS}/${EC_PARAMS} \ -keyout ${TMP_CERTS}/server.key -out ${TMP_CERTS}/server.csr \ &>/dev/null check_error $? "can't generate certificates" subj="/C=${C_C}/ST=${C_ST}/L=${C_L}/O=${C_O}/OU=${C_OU}/CN=${C_CN:-Intercom Certificate}" openssl req -subj "${subj}" \ -new -nodes -newkey ec:${TMP_CERTS}/${EC_PARAMS} \ -keyout ${TMP_CERTS}/intercom.key -out ${TMP_CERTS}/intercom.csr \ &>/dev/null check_error $? "can't generate certificates" openssl ca -config ${TMP_CERTS}/openssl.cnf \ -passin pass:${PASS} \ -cert ${TMP_CERTS}/ca.crt -keyfile ${TMP_CERTS}/ca.key \ -outdir ${TMP_CERTS} -days 3650 -md sha256 -batch \ -in ${TMP_CERTS}/server.csr -out ${TMP_CERTS}/server.crt \ &>/dev/null check_error $? "can't generate certificates" openssl ca -config ${TMP_CERTS}/openssl.cnf \ -passin pass:${PASS} \ -cert ${TMP_CERTS}/ca.crt -keyfile ${TMP_CERTS}/ca.key \ -outdir ${TMP_CERTS} -days 3650 -md sha256 -batch \ -in ${TMP_CERTS}/intercom.csr -out ${TMP_CERTS}/intercom.crt \ &>/dev/null check_error $? "can't generate certificates" print_ok ################################################################################ rm -rf /etc/stunnel/keys mkdir /etc/stunnel/keys cp ${TMP_CERTS}/ca.crt /etc/stunnel/keys/ca.crt check_error $? "can't set stunnel service" cat ${TMP_CERTS}/server.crt >/etc/stunnel/keys/server.pem check_error $? "can't set stunnel service" cat ${TMP_CERTS}/server.key >>/etc/stunnel/keys/server.pem check_error $? "can't set stunnel service" rm -rf /etc/openvpn/server/keys mkdir /etc/openvpn/server/keys cp ${TMP_CERTS}/ca.crt /etc/openvpn/server/keys/ca.crt check_error $? "can't set openvpn service" cp ${TMP_CERTS}/server.crt /etc/openvpn/server/keys/server.crt check_error $? "can't set openvpn service" cp ${TMP_CERTS}/server.key /etc/openvpn/server/keys/server.key check_error $? "can't set openvpn service" rm -rf /root/certs mkdir /root/certs cp ${TMP_CERTS}/ca.crt /root/certs check_error $? "can't copy intercom certificates" cp ${TMP_CERTS}/intercom.key /root/certs check_error $? "can't copy intercom certificates" cp ${TMP_CERTS}/intercom.crt /root/certs check_error $? "can't copy intercom certificates"

Connect 2N device to 2N OpenVPN server

• Go to 2N device (you want to connect to 2N OpenVPN server over Internet) web interface, section System - Certificates,
  Upload ca.crt file to CA Certificates, upload intercom.crt and intercom.key files to User Certificates.
  
  

• Go to section System - Network - OpenVPN,
  enable it, set the following and save.
  
  
  • Default Interface: No
    
    Set to Yes if 2N device connected via VPN is supposed to communicate outside local network connected over VPN.
    Otherwise, 2N device will route such traffic via its own connection and will not route it to VPN.
    
    
  • Server Address: Public IP (which belongs to router where 2N OpenVPN server is)
    
    
  • Server Port: Public Port (port used for forwarding on router where 2N OpenVPN server is - for example 1443)
    
    
  • Trusted Certificate: Select the uploaded certificate
    
    
  • Client Certificate: Select the uploaded certificate