TeleBoss 850 2.06.280_STD User Manual
Page 81
Instead, you specify settings via the unit's Setting Keys, and then the unit generates the configuration file from the
Setting Keys.
Some keys are specific: they specify the VPN protcol and VPN port, or the certificate to use. The previous
answers in this section have discussed how to configure such things on the unit. Other Setting Keys on the unit
are generic: they merely specify text where you can enter an OpenVPN configuration option. Once you have your
client configuration in mind, you can see what configuration items it requires on the server, and then supply any
further configuration items that you require on the unit, minus any configuration items that the unit handles
automatically for you. First, let's go over what a generic key is.
A generic key is of this form:
net.vpn[x].ssl.conf[y]
, where y is a number between 1 and 16. For example,
by default, the cipher is "BF-CBC" (128-bit Blowfish CBC). You can change this to be stronger with, say, AES-256-
CBC (256-bit AES CBC), with the following setting:
net.vpn[1].ssl.conf[7]
="cipher AES-256-CBC"
"cipher AES-256-CBC" is the OpenVPN configuration item, 1 is VPN slot 1 (which could also be slot 2), and 7 is
an arbitrary number between 1 and 16 that is unique among any other "ssl.conf" Setting Keys. In other words, 7 is
just an index used to denote your multiple configuration items. You can configure multiple settings, and the 'y' in
net.vpn[x].ssl.conf[y]
can be in any order and not necessarily adjacent. For example:
net.vpn[x].ssl.conf[7]
="cipher AES-256-CBC"
net.vpn[x].ssl.conf[3]
="comp-lzo"
net.vpn[x].ssl.conf[9]
="persist-key"
Some values of OpenVPN configuration items cannot be specified in a generic key. For example, the "ca"
OpenVPN configuration item is required. But you cannot specify the "ca" OpenVPN configuration item because
the unit already configures that item from the data you provide via the SSLC command.
The generic key has been identified, now examine the example below to see how to make the unit cooperate.
Example
Here is an example OpenVPN client configuration. It discusses what it means for the client and what it means for
the unit. For a better understanding of OpenVPN configuration, consult the documenation at
client
remote 10.82.3.1
port 1194
proto udp
dev tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/myserver.crt
key /etc/openvpn/myserver.key
tls-auth /etc/openvpn/tlsauth.key
cipher AES-256-CBC
comp-lzo
ping 15
ping-restart 60
verb 3
daemon
The "client" item specifies that the server will operate in the mode secured by SSL/TLS. This the only mode the
unit supports, so if the server does not use tls-server mode then the unit is incompatible with it. This item also
specifies that the client will allow the server to configure addressing information for it. This implies that on the unit,
there must be a "server" configuration option that specifies the virtual network. E.g., "server 10.8.0.0
255.255.255.0" means the server will hand out and address to the client in the 10.8.0.0/24 network. The unit
keeps the ".1" address in the virtual network for itself; e.g., the unit would have address 10.8.0.1 in this example.
The "remote" item specifies the address the address to connect to. The only impact this has on the unit is that the
unit must listen on the address that the connection ultimately arrives at. Use a generic key to specify this address
(e.g., net.vpn[x].ssl.conf="local 10.82.3.1"). Also, if firewalls separate the unit and the server, you should be aware
of the firewall configuration, so that the firewall routes traffic to the address on which the unit is listening.
Содержание Teleboss 850
Страница 6: ......
