Software:OpenVPN

From HandWiki
Short description: Free and open-source virtual private network software
OpenVPN
OpenVPN logo.svg
Original author(s)James Yonan
Developer(s)OpenVPN project / OpenVPN Inc.
Initial release13 May 2001; 23 years ago (2001-05-13)[1]
Stable release2.6.8[2] (17 November 2023; 7 months ago (2023-11-17)) [±]
Written inC
Platform
TypeVPN
LicenseGNU GPLv2[10]

OpenVPN is a virtual private network (VPN) system that implements techniques to create secure point-to-point or site-to-site connections in routed or bridged configurations and remote access facilities. It implements both client and server applications.

OpenVPN allows peers to authenticate each other using pre-shared secret keys, certificates or username/password. When used in a multiclient-server configuration, it allows the server to release an authentication certificate for every client, using signatures and certificate authority.

It uses the OpenSSL encryption library extensively, as well as the TLS protocol, and contains many security and control features. It uses a custom security protocol[11] that utilizes SSL/TLS for key exchange. It is capable of traversing network address translators (NATs) and firewalls.[citation needed]

OpenVPN has been ported and embedded to several systems. For example, DD-WRT has the OpenVPN server function. SoftEther VPN, a multi-protocol VPN server, also has an implementation of OpenVPN protocol.[citation needed]

It was written by James Yonan and is free software, released under the terms of the GNU General Public License version 2 (GPLv2).[12] Additionally, commercial licenses are available.[13]

Architecture

Encryption

OpenVPN uses the OpenSSL library to provide encryption of both the data and control channels. It lets OpenSSL do all the encryption and authentication work, allowing OpenVPN to use all the ciphers available in the OpenSSL package. It can also use the HMAC packet authentication feature to add an additional layer of security to the connection (referred to as an "HMAC Firewall" by the creator). It can also use hardware acceleration to get better encryption performance.[14][15] Support for mbed TLS is available starting from version 2.3.[16]

Authentication

OpenVPN has several ways to authenticate peers with each other. OpenVPN offers pre-shared keys, certificate-based, and username/password-based authentication. Preshared secret key is the easiest, and certificate-based is the most robust and feature-rich.[citation needed] In version 2.0 username/password authentications can be enabled, both with or without certificates. However, to make use of username/password authentications, OpenVPN depends on third-party modules.[citation needed]

Networking

OpenVPN can run over User Datagram Protocol (UDP) or Transmission Control Protocol (TCP) transports, multiplexing created SSL tunnels on a single TCP/UDP port[17] (RFC 3948 for UDP).[18]

From 2.3.x series on, OpenVPN fully supports IPv6 as protocol of the virtual network inside a tunnel and the OpenVPN applications can also establish connections via IPv6.[19] It has the ability to work through most proxy servers (including HTTP) and is good at working through network address translation (NAT) and getting out through firewalls. The server configuration has the ability to "push" certain network configuration options to the clients. These include IP addresses, routing commands, and a few connection options. OpenVPN offers two types of interfaces for networking via the Universal TUN/TAP driver. It can create either a layer-3 based IP tunnel (TUN), or a layer-2 based Ethernet TAP that can carry any type of Ethernet traffic. OpenVPN can optionally use the LZO compression library to compress the data stream. Port 1194 is the official IANA assigned port number for OpenVPN. Newer versions of the program now default to that port. A feature in the 2.0 version allows for one process to manage several simultaneous tunnels, as opposed to the original "one tunnel per process" restriction on the 1.x series.

OpenVPN's use of common network protocols (TCP and UDP) makes it a desirable alternative to IPsec in situations where an ISP may block specific VPN protocols in order to force users to subscribe to a higher-priced, "business grade" service tier. For example, Comcast previously declared that their @Home product was, and had always been, designated as a residential service and did not allow the use of commercial applications. Their argument was that conducting remote work via a VPN can adversely affect the network performance of their regular residential subscribers. They offered an alternative, @Home Professional, this would cost more than @Home product. So, anyone wishing to use VPN would have to subscribe to higher-priced, business-grade service tier.[20]

When OpenVPN uses Transmission Control Protocol (TCP) transports to establish a tunnel, performance will be acceptable only as long as there is sufficient excess bandwidth on the un-tunneled network link to guarantee that the tunneled TCP timers do not expire.[21] If this becomes untrue, performance falls off dramatically. This is known as the "TCP meltdown problem".[22][23]

Security

OpenVPN offers various internal security features. It has up to 256-bit encryption through the OpenSSL library, although some service providers may offer lower rates, effectively providing some of the fastest VPN available to consumers. It runs in userspace instead of requiring IP stack (therefore kernel) operation. OpenVPN has the ability to drop root privileges, use mlockall to prevent swapping sensitive data to disk, enter a chroot jail after initialization, and apply a SELinux context after initialization.

OpenVPN runs a custom security protocol based on SSL and TLS,[11] rather than supporting IKE, IPsec, L2TP or PPTP.

OpenVPN offers support of smart cards via PKCS#11-based cryptographic tokens.

Extensibility

OpenVPN can be extended with third-party plug-ins or scripts, which can be called at defined entry points.[24][25] The purpose of this is often to extend OpenVPN with more advanced logging, enhanced authentication with username and passwords, dynamic firewall updates, RADIUS integration and so on. The plug-ins are dynamically loadable modules, usually written in C, while the scripts interface can execute any scripts or binaries available to OpenVPN. In the OpenVPN source code[26] there are some examples of such plug-ins, including a PAM authentication plug-in. Several third-party plug-ins also exist to authenticate against LDAP or SQL databases such as SQLite and MySQL.[27]

Header

OpenVPN header format
Offsets Octet 0 1 2 3
Octet Bit 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
0 0 Opcode KeyID Session ID
4 32 Session ID
8 64 Session ID HMAC
12 96 HMAC
⋮ ⋮
24 192
28 224 HMAC Packet ID
32 256 Packet ID Net Time
36 288 Net Time Msg Array Len Message Packet ID #
⋮ ⋮

Platforms

It is available on Solaris, Linux, OpenBSD, FreeBSD, NetBSD, QNX, macOS and Windows XP and later.[28] OpenVPN is available for mobile operating systems including Maemo,[29] Windows Mobile 6.5 and below,[30] iOS 3GS+ devices,[31] jailbroken iOS 3.1.2+ devices,[32] Android 4.0+ devices, and Android devices that have had the Cyanogenmod aftermarket firmware flashed[33] or have the correct kernel module installed.[34] It is not compatible with some mobile phone OSes, including Palm OS. It is not a "web-based" VPN shown as a web page such as Citrix or Terminal Services Web access; the program is installed independently and configured by editing text files manually, rather than through a GUI-based wizard. OpenVPN is not compatible with VPN clients that use the IPsec over L2TP or PPTP protocols. The entire package consists of one binary for both client and server connections, an optional configuration file, and one or more key files depending on the authentication method used.

Firmware implementations

OpenVPN has been integrated into several router firmware packages allowing users to run OpenVPN in client or server mode from their network routers. A router running OpenVPN in client mode, for example, allows any device on a network to access a VPN without needing the capability to install OpenVPN.

Notable firmware packages with OpenVPN integration include:

Notable firmware packages with OpenVPN integration
Firmware package Cost Developer References
DD-WRT Free NewMedia-NET GmbH [35]
Gargoyle Free Eric Bishop [36]
OpenWrt Free Community driven development [37]
OPNsense Free Deciso BV [38]
pfSense Free Rubicon Communications, LLC (Netgate)
Tomato Free Keith Moyer [39][40]

OpenVPN has also been implemented in some manufacturer router firmware.

Software implementations

OpenVPN has been integrated into SoftEther VPN, an open-source multi-protocol VPN server, to allow users to connect to the VPN server from existing OpenVPN clients.

OpenVPN is also integrated into Vyos, an open-source routing operating system forked from the Vyatta software router.

Licensing

OpenVPN is available in two versions:

  • OpenVPN Community Edition, which is a free and open-source version
  • OpenVPN Access Server (OpenVPN-AS) is based on the Community Edition, but provides additional paid and proprietary features like LDAP integration, SMB server, Web UI management and provides a set of installation and configuration tools that are reported to simplify the rapid deployment of a VPN remote-access solution.[41][42] The Access Server edition relies heavily on iptables for load balancing and it has never been available on Windows for this reason. This version is also able to dynamically create client ("OpenVPN Connect") installers, which include a client profile for connecting to a particular Access Server instance.[43] However, the user does not need to have an Access Server client in order to connect to the Access Server instance; the client from the OpenVPN Community Edition can be used.[44]

See also

References

  1. ↑ OpenVPN Change Log - OpenVPN Release Notes
  2. ↑ "Community Downloads". https://openvpn.net/community-downloads/. 
  3. ↑ "Downloads". https://openvpn.net/index.php/open-source/downloads.html. 
  4. ↑ "Private Tunnel VPN - Android Apps on Google Play". https://play.google.com/store/apps/details?id=net.openvpn.privatetunnel. 
  5. ↑ "Private Tunnel VPN". App Store. 23 October 2014. https://itunes.apple.com/us/app/private-tunnel-vpn/id854725970. 
  6. ↑ "How to connect to Access Server from a Linux computer". https://openvpn.net/index.php/access-server/docs/admin-guides/182-how-to-connect-to-access-server-with-linux-clients.html. 
  7. ↑ "FreeBSD Ports Search". https://www.freebsd.org/cgi/ports.cgi?query=openvpn&stype=all. 
  8. ↑ "OpenBSD Ports". http://openports.se/net/openvpn. 
  9. ↑ "The NetBSD Packages Collection: net/openvpn". http://ftp.netbsd.org/pub/pkgsrc/current/pkgsrc/net/openvpn/README.html. 
  10. ↑ "openvpn_COPYING at master · OpenVPN_openvpn". 2019-07-30. https://github.com/OpenVPN/openvpn/blob/master/COPYING. 
  11. ↑ 11.0 11.1 "OpenVPN Security Overview". http://openvpn.net/index.php/open-source/documentation/security-overview.html. 
  12. ↑ LinuxSecurity.com - OpenVPN: An Introduction and Interview with Founder, James Yonan
  13. ↑ openvpn.net: Pricing, retrieved 12 December 2018
  14. ↑ Andrew Lockhart (2006). Network Security Hacks: Tips & Tools for Protecting Your Privacy. "O'Reilly Media, Inc.". p. 339. ISBN 978-0-596-55143-8. https://books.google.com/books?id=6weH75ATpbUC&pg=PA339. 
  15. ↑ 6net (2008). IPv6 Deployment Guide. Javvin Technologies Inc.. p. 109. ISBN 978-1-60267-005-1. https://books.google.com/books?id=logdYuisKWgC&pg=PA109. 
  16. ↑ Overview of changes in OpenVPN v2.3 - ChangesInOpenvpn23 - OpenVPN Community
  17. ↑ OpenVPN man page, section "TLS Mode Options"
  18. ↑ Petros Daras; Oscar Mayora (2013). User Centric Media: First International Conference, UCMedia 2009, Venice, Italy, December 9-11, 2009, Revised Selected Papers. Springer Science & Business Media. p. 239. ISBN 978-3-642-12629-1. https://books.google.com/books?id=ti8WoFmQHdoC&pg=PA239. 
  19. ↑ OpenVPN community wiki, IPv6 in OpenVPN - retrieved 8 December 2013
  20. ↑ "OpenVPN VPN Protocol" (in en). https://privacyhq.com/documentation/openvpn-vpn-protocol/. 
  21. ↑ Murray, Mike. "OPENVPN MTU: Finding The Correct Settings". https://www.thegeekpub.com/271035/openvpn-mtu-finding-the-correct-settings. 
  22. ↑ Titz, Olaf (23 April 2001). "Why TCP Over TCP Is A Bad Idea". http://sites.inka.de/bigred/devel/tcp-tcp.html. 
  23. ↑ Honda, Osamu; Ohsaki, Hiroyuki; Imase, Makoto; Ishizuka, Mika; Murayama, Junichi (October 2005). "Understanding TCP over TCP: effects of TCP tunneling on end-to-end throughput and latency". in Atiquzzaman, Mohammed; Balandin, Sergey I.. 6011. doi:10.1117/12.630496. Bibcode: 2005SPIE.6011..138H. 
  24. ↑ "OpenVPN script entry points". Openvpn.net. http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html#lbAQ. 
  25. ↑ OpenVPN plug-in entry points for C based modules.
  26. ↑ "OpenVPN example plug-ins". Openvpn.git.sourceforge.net. http://openvpn.git.sourceforge.net/git/gitweb.cgi?p=openvpn/openvpn.git;a=tree;h=HEAD. 
  27. ↑ OpenVPN Community Wiki - Related Projects
  28. ↑ "Downloads". OpenVPN. https://openvpn.net/index.php/open-source/downloads.html. 
  29. ↑ "OpenVPN Maemo package". Maemo.org. http://maemo.org/downloads/product/Maemo5/openvpn/. 
  30. ↑ "OpenVPN for PocketPC". Ovpnppc.ziggurat29.com. 1 April 2007. http://ovpnppc.ziggurat29.com/ovpnppc-main.htm. 
  31. ↑ "OpenVPN Connect". OpenVPN Technologies. 16 January 2013. https://itunes.apple.com/us/app/openvpn-connect/id590379981. 
  32. ↑ "GuizmOVPN - OpenVPN GUI for iPhone/iPad". guizmovpn.com. 30 September 2007. http://guizmovpn.com. 
  33. ↑ "CHANGELOG at eclair from CyanogenMod's android_vendor_cyanogen". GitHub. cyanogen. 7 July 2010. https://github.com/CyanogenMod/android_vendor_cyanogen/blob/eclair/CHANGELOG.  Nexus One Cyanogenmod changelog
  34. ↑ "How to setup and configure OpenVPN on Android rooted device | VPN blog is actual information about VPN". http://ww43.vpnblog.info/android-openvpn-strongvpn.html. 
  35. ↑ dd-wrt.com - OpenVPN
  36. ↑ Gargoyle Wiki - OpenVPN
  37. ↑ "OpenVPN - OpenWrt Wiki". openwrt.org. https://openwrt.org/docs/guide-user/services/vpn/openvpn/start. 
  38. ↑ "opnsense.org - OPNsense 17.1 Release Announcement". https://opnsense.org/opnsense-17-1-released/. 
  39. ↑ "TomatoVPN". Tomatovpn.keithmoyer.com. http://tomatovpn.keithmoyer.com. 
  40. ↑ LinksysInfo.org – VPN build with Web GUI
  41. ↑ "OpenVPN Product Comparison". https://openvpn.net/index.php/access-server/section-faq-openvpn-as/general/225-compare-openvpn-community-and-enterprise-editions.html. 
  42. ↑ "What is OpenVPN Access Server (OpenVPN-AS)?". https://openvpn.net/index.php/access-server/section-faq-openvpn-as/general/133-what-is-openvpn-access-server.html. 
  43. ↑ "Regarding chocolatey.org repository · Issue #2 · wget/chocolatey_package_openvpn". 2017-01-16. https://github.com/wget/chocolatey_package_openvpn/issues/2#issuecomment-272799486. 
  44. ↑ "Can I use a community OpenVPN client to connect to the Access Server?". https://openvpn.net/index.php/access-server/section-faq-openvpn-as/client-configuration/140-can-i-use-open-source-openvpn-client-gui-to-connect-to-the-access-server.html. 

External links



Retrieved from "https://handwiki.org/wiki/index.php?title=Software:OpenVPN&oldid=3467545"