OpenVPN and Wireguard Discussion and Installation

• 0:00:00 Introduction
• 0:00:45 iDempiere protection technologies
  • 0:00:45 Apache
  • 0:01:30 SSL encryption and apache login
  • 0:02:45 VPN
• 0:03:15 VPN simple Diagram (office direct - external openvpn user)
• 0:05:45 VPN typical diagram (office site-to-site vpn with external openpvn user)
• 0:06:15 Resources and Links (openvpn server, openvpn client, filezilla)
• 0:08:30 Openvpn Server installation
• 0:12:15 Download client file using filezilla
• 0:13:30 Copy client file to OpenVPN folder
• 0:14:00 OpenVPN launch and connect
• 0:15:45 Update OpenVPN server to allow for split tunneling (split-tunneling) and test

OpenVPN Client Connection

• sudo apt update
• sudo apt install openvpn
• sudo openvpn --config YourCertHere.ovpn
• Note: you can use tmux to hold the session will you are using a different terminal

Wireguard VPN

• 00:00 Introduction
• 00:42 Installation
• 01:20 Split tunneling
• 03:00 Usage scenario - simple
• 03:45 Usage scenario - routing
• 07:00 Getting started - use apache landing page
• what is not covered: aws internal dns routing

• Server side command line installer - works like a champ!
  • Installation Notes:
    • When prompted, use external IP (not internal IP) when configuring for AWS.
    • The script is prompt you with a random port, make sure both tcp and udp are open in your firewall for this port.
  • See this article for ufw firewall related commands if you are not using aws or a dedicated firewall. See github.com/chuboe/utils/reference
    • ufw status
    • ufw allow 22
    • ufw allow http
    • ufw allow https
    • sudo ufw allow from 19.85.226.34 to any port 5432 comment 'only allow app server to connect directly to the database'
      • # shows how to add a comment to the rule for future reference
    • ufw show added
      • # shows rules even when not active
      • # alternative way to see rules when UFW inactive:
        • sudo cat /etc/ufw/user.rules
    • ufw enable
• Managing connections when you have sudo abilities
  • sudo apt udpate
  • sudo apt install -y wireguard
  • Download your wireguard config from your admin
  • Rename your config file appropriately (name-config.conf)
    • Note you could have more than one config from more than one network. Naming is important in this case.
    • Be aware there is a config name length limit. The below start command will fail with a "file not found" error if the name is too long. TODO: add length here...
  • sudo mv name-config.conf /etc/wireguard/
  • sudo chown root:root /etc/wireguard/name-config.conf
  • sudo chmod 600 /etc/wireguard/name-config.conf
  • sudo wg-quick up name-config
  • sudo wg-quick down name-config
• Manage connection state from cli without sudo using nmcli
  • Create a local ~/wireguard directory
  • Download the wireguard configuration file to this local directory.
  • Rename the wireguard configuration file to something short and meaningful (ex: chuboe-wg.conf)
  • Import the connection
    • sudo nmcli connection import type wireguard file /home/your_user/wireguard/name_of_conf_file.conf
  • Note that the vpn connect will be active by default. It will also start upon boot by default. To disable autoconnect:
    • nmcli connection modify <name_of_con> connection.autoconnect no
  • lifecycle commands:
    • start:   nmcli connection up name_of_conf_file
    • end:   nmcli connection down name_of_conf_file
    • see all:   nmcli connection
    • drop:   sudo nmcli connection delete name_of_conf_file
• Manual Installation demonstration
• Longer and more detailed installation and demonstration
• Actively developed GUI
• Private Hosted Zone in AWS - use of dns instead of ip addresses
• Multi-region aws installation script - complicated