18

I want to route all my network traffic through my home's ISP connection when I'm out in Internet cafes so I can't be eavesdropped/firesheeped.

I have an HTC G2 with CyanogenMod 7, which has OpenVPN client support built-in:

enter image description here

At home, I have a router with TomatoVPN on it, which includes an OpenVPN server:

enter image description here

Now, how do I get the phone client to connect to the router server? I can Google and find a set of seemingly relevant instructions, but they aren't very helpful:

You need to pack your cert and keys and put it in SD card

Where do I get those?

Copy client.p12 to sdcard root directory

Where do I get that?

add your certificates, and set the interface type and the protocol accordingly.

How, specifically? Which settings should be what? Using settings that don't protect me is worse than no protection at all due to the false sense of security.

I'm looking for step-by-step instructions for a "roadwarrior" setup that routes all traffic through the VPN.

Where do I get keys? Do I need to use additional username/password authentication? What DNS search domains? What settings should I use in CM7's OpenVPN Advanced menu? "Redirect gateway" needs to be set to route all traffic, for instance, right? Which settings for Basic and Advanced in TomatoVPN? "Direct clients to redirect Internet traffic"? "Respond to DNS"?

Update:

I've given it yet another try on my own, and was again unsuccessful. I don't think there's any way to generate keys on either the router or the phone, so I tried to generate them in Ubuntu. I tried to follow these directions to generate keys, but they aren't correct. (The folder is /usr/share/doc/openvpn/examples/easy-rsa/2.0 instead of /usr/share/doc/openvpn-2.0/easy-rsa, for instance, and there's a vars, but no init-config script.) I found these directions, which are more helpful, and generated a number of files:

  • 01.pem
  • 02.pem
  • ca.crt
  • ca.key
  • dh1024.pem
  • htc_g2.crt
  • htc_g2.csr
  • htc_g2.key
  • server.crt
  • server.csr
  • server.key
  • ta.key

The files I copied to the router are

  • ca.crt
  • server.crt
  • server.key
  • dh1024.pem

first stripping everything before -----BEGIN, according to these instructions. The router server starts now and says

Name Value Max bcast/mcast queue length 0

under Status. So I guess the server is working?

Then I copied these files to the phone:

  • ca.crt
  • htc_g2.crt
  • htc_g2.key
  • server.crt
  • ta.key

Different directions disagree on which files to copy. Then I went to Settings → Location & security → Install from SD card, and was able to install the CA certificate, added a password, etc. Trying to add the htc_g2 or server certificates did not work, saying "no certificate to install". I edited the files and removed everything before -----BEGIN, and then they installed. In "Add OpenVPN VPN", I selected the "ca" certificate for "Set CA certificate", and the htc_g2 certificate for "Set user certificate". When I try to connect, it says "Unable to connect to network". Same if I try the server certificate for the user certificate.

Improve this question
9
  • What operating system(s) are you running on your home computer(s)?
    – newuser
    Mar 27, 2011 at 20:41
  • @JonnyP: Home computer is Ubuntu but I'd rather use the router than the computer.
    – endolith
    Oct 10, 2011 at 16:02
  • 1
    At this stage I'd recommend that you try to get the OpenVPN setup working with a regular OpenVPN desktop client first, and then copy the same setup to your phone.
    – onik
    Oct 24, 2011 at 9:14
  • I can't believe that no one knows how to do this. Why does the option exist if no one has ever used it?
    – endolith
    Oct 25, 2011 at 16:35
  • I have a friend that set it up...on CM 6. He had to re-issue all VPN certs after he found that the CM client required certain fields to be set. I'll see if I can get more info out of him.
    – Broam
    Nov 23, 2011 at 16:19

2 Answers 2

Reset to default
1

First of all, check the Keys tab in TomatoVPN to see if you already have some default keys defined. If not, check out the OpenVPN HOWTO for info on how to generate the keys. Next, copy the first two keys (CA and Server certificate) from the text areas to a text editor and save them with .cer suffix and transfer them to your phone. CM7 should be able to import .cer certificates directly but older versions may need to use .p12 files (see this link for info on how to convert .crt -> .pem ->.p12). After this, go to Settings -> Security -> Install from SD Card to load the certificates to the phone.

Improve this answer
4
  • That link has 14,000 words. Can you point me directly to the relevant parts? Is the key generation different if I want to connect other computers to my router besides the phone? I added more details to the question.
    – endolith
    Oct 10, 2011 at 15:59
  • 1
    The same keys are used on normal clients as well.I have no experience of TomatoVPN, but you should be able to set at least a couple of different client keys. Also, it could be possible to use the same keys simultaneously on different devices, but this depends on the OpenVPN setup. The key creation is described under the title "Setting up your own Certificate Authority (CA) and generating certificates and keys for an OpenVPN server and multiple clients". If you use keys and keep them safe no user/pass authentication is necessary under usual circumstances. Redirect gateway`should be the only...
    – onik
    Oct 10, 2011 at 22:15
  • ...one you need to change in CM7 settings.
    – onik
    Oct 10, 2011 at 22:15
  • Reason for downvote?
    – onik
    Oct 23, 2011 at 10:28
1

OK, so let's clarify the problem.

Can you please explain which file is for? For example, what is the "ta.key" for?

Normally, there's the file list on Server's side:

  1. server.conf (the configuration of server, seemed you haven't got this file?)
  2. ca.crt
  3. ca.key
  4. dh1024.pem

and the server should also contain a set of client keys.

For the client side, it should have:

  1. client.crt
  2. client.key
  3. ca.crt
  4. client.ovpn(or client.conf)

I cannot see why you have ta.key?

for how to create the p12 files, here's the instruction:

Open a Linux terminal(NOTE: you should have OpenSSL pre-installed), enter

openssl pkcs12 -export -in [PathToClientCert] -inkey [PathToClientKey] -certfile [PathToCACert] -name [FriendlyName] -out certs.p12

(you should replace the contents of square brackets with yours and no need to keep any square brackets.)

then the p12 file named certs.p12 will be generated.

Hope it will helps.

Improve this answer
5
  • I don't know what ta.key is. The server seems to be running ok. I just don't know how to connect to it. /tmp/etc/openvpn/server1 has these files in it: ca.crt config.ovpn dh.pem server.crt server.key status. Maybe config.ovpn is the same as server.conf?
    – endolith
    Dec 3, 2011 at 21:46
  • @endolith yes, config.ovpn is the same as sever.conf. You may need to edit config.ovpn before start the OpenVPN.
    – dumbfingers
    Dec 5, 2011 at 7:43
  • @endolith do you want to connect to OpenVPN from a CM7 android phone or somewhere else?
    – dumbfingers
    Dec 5, 2011 at 7:44
  • The router is running an OpenVPN server and I want to connect to it with my CM7 phone, yes.
    – endolith
    Dec 5, 2011 at 13:19
  • @endolith First, use the command I provided to generate the p12 file, copy it to your phone's SD card. Follow this on Phone's menu: Settings-Wireless & Networks-VPN Settings-Add VPN, then choose OpenVPNAdd VPN, and fill in the options: [VPN name] any as you like [Set VPN server] fill the IP address, as same as the "remote" in client.ovpn [User authentication] if you use user/password, fill it. [Set CA certificate] touch & import the ca cert [Set user certificate] touch & import the user cert(client.crt) You may need to check advanced options. That's all.
    – dumbfingers
    Dec 5, 2011 at 13:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .