OpenVPN bonus

This post will mostly be technical material for the casual linux user and adventurous home user.
Disclaimer: I take no responsibility for anything breaking in your device. Please be careful!

Lets get the details of my server and how to discover them for yourself.

First, log into your synology through SSH as root. If you are using a windows computer, I recommend using PUTTY.  Next lets find out what version of OpenVPN you are using, type in openvpn --version  and you should get an output like below

OpenVPN 2.1.4  armle-unknown-linux [SSL] [LZO2] [EPOLL] built on Mar 9 2013
Originally developed by James Yonan

Next, you can find out what version of linux you are running by typing in: cat /proc/version From that we can find out it's linux 2.6.32.12  gcc version 4.2.1

One security feature that (should) already be in the configuration files is proto udp. OpenVPN can run using either TCP or UDP protocol, however, UDP will generally provide better protection against DoS attacks and port scanning than TCP.

Now, there are some advanced things you can do to your OpenVPN, the first is to increase the symmetric keys. By default OpenVPN uses Blowfish, a 128-bit symmetrical cipher. While Blowfish is relatively secure at 128-bit, we can change it to 256-bit AES cipher, Cipher-Block Chain.  One reason why I like this instead of Blowfish is that 256-bit is good enough for TOP-SECRET for the government.  To implement it you'll need to add the following to both server and client configuration files:

cipher AES-256-CBC

The server file can be found at this pathway:
cd /usr/syno/etc/packages/VPNCenter/openvpn

Also, there is a way to implement Google Two Factor Authorization on Synology.  Likewise, while there are some forums out there discussing how to get this service implemented from Synology to OpenVPN, it has yet to be successfully shown.  However, I might experiment with it and try to get it working on my own server.  If I do, I'll be sure to show you how to do it as well!  :-)


Check out Part 1 of 3
Check out Part 2 of 3
Check out Part 3 of 3
Check out the bonus stuff!

Cyber Monday - Setting up an VPN with Synology on your Android & iPhone Part 3 of 3

Setting up a VPN on your Android or iPhone device is just as easy as setting it up on your computer. To begin, you'll want to download the configuration files from the synology server, or if you've already done that, you can use the same ones you installed on your computer for your phone.

Android:
To set up the android, you'll want to navigate to the Android Play store and either download this version if you have a newer device (4.0 and higher) or this version for older devices (1.5 and up).  It's very possible that if you are installing the older version (and possibly the newer, I'm not sure), that you'll have to install TUN.ko Installer. TUN helps establish the virtual point-to-point IP link. If you have this problem you'll be notified like shown on the picture to the left and it will likely even open another page of details (like the picture below) giving you a link to install it. If it is installed, then you'll just open the program and load the drivers and all will be well again.  This does happen to me every now and then because the drivers aren't loaded.

However, before you run into those problems, you'll need to connect your device to your computer and transfer your ca.crt and your openvpn.ovpn into the necessary folders.  For me, it was under the /mnt/sdcard/Openvpn folder.  From there you can start up the vpn client and you should be good to go now that you know how to trouble shoot any potential problem.

Now that you're connected you can check out the data transfers in the status bar of the phone.  :-)








iPhone:
Currently the official OpenVPN (1.0.1 build 88) software is too buggy for it to be easily compatible with iOS 6.1.3 (10B329). When I attempted, I ran into many errors. The files worked on my desktop OVPN connection, however they failed when trying to work with the iPhone version.  If/when the next release of OpenVPN is out there, I believe they will be fixing many of these issues and I will attempt an easy guide at that point.  However, currently you would need to log into the server, run several commands modifying several files and start and stop some services then play with it on the iPhone as well, all far too dependent upon what version of Synology/openVPN you are running and iOS version.  No elegant solution is possible currently.  Sorry guys!  :-(

Check out Part 1 of 3
Check out Part 2 of 3
Check out Part 3 of 3
Check out the bonus stuff!

Cyber Monday - Setting up an VPN with Synology on your computer Part 2 of 3

To begin setting up the VPN on your windows computer, you'll want to first go to OpenVPN's website and download the latest version: here.  As of this writing it's version 2.3.2 released on June 6, 2013 (2013.06.03). Once installed it'll create a nice icon on the start menu like so:

Now the easy part: Log into your synology server and go to the VPN section as described in Part 1 of this series (find the link below).  From there you should open the downloaded zip configuration files.  Unzip these files and navigate to C:\Program Files\OpenVPN\config.  Place the ca.crt and openvpn.ovpn files inside of the folder. 

Lastly, open openvpn.ovpn with your text editor, I like notepad personally, and on the third line it will say: remote YOUR_SERVER_IP 1194

This is where IP can be typed in; it can be found easily by going to whatsmyip.org or going to your router and see what IP address it has been issued.

To use the VPN, open up the program and you should be prompted for a username and password.

In this prompt you'll type in the synology username and password that has access and hopefully you'll connect right away. If you can't connect try closing your web browser and other things that access the internet and connect again.

Note: For mac users, you can use Tunnelblick to vpn as well.

Check out Part 1 of 3
Check out Part 2 of 3
Check out Part 3 of 3
Check out the bonus stuff!

Cyber Monday - Setting up an VPN with Synology Part 1 of 3

So recently, I was traveling abroad and wanted access to my files at home and wanted to make sure to have (more) secure access to the internet for the future. In doing so, I found out several things:

1.  PPTP is NOT secure due to its MS-CHAP v2,  PPTP's authentication protocol. Currently there are ways to penetrate them easily. (Side note: even its creator, Microsoft, has abandoned it!)
2.  OpenVPN is secure (at least for now), fast, reliable, and diverse (described below).
3.  There are a ton of ways to setup a VPN server and OpenVPN is available for apple products, android, and windows.

The two most interesting ways I found to setup OpenVPN was using Untangle. I really like Untangle for the reason that they can filter all of your internet traffic BEFORE it goes to your system, it can filter viruses out, install a secure firewall, intrusion detection system, spyware filter, phish filter, etc. It is absolutely amazing, free (or pay for premium), and easy on resources. I did install it on a spare laptop to see how exactly it runs and really enjoyed its ease of use and simplicity. However, you do need a dedicated system for it and it will slow your traffic down slightly.

At my home, I don't have the resources (i.e. a spare PC or laptop with 2+ nic cards) to run Untangle, so instead, I used my Synology server (DSM 4.2-3211) and opened a port on my router to the outside world for my VPN setup. So, lets get started!

Setting up the Server:

1. Log into your synology device and open up the Package Center and install the VPN Server

2. Once installed, it will create an icon on the dropdown menu.

3. Once open, select OpenVPN in the Settings Folder and enable it.  I chose to have a maximum of 3 simultaneous connections as I don't have many users in my home and feel safer limiting the number of instances possible. Likewise, I wanted the speed to be as fast as possible, so I enabled compression on the VPN link.  Next, you should go to the Privileges and choose who has access to the VPN. Under General Settings, you can also allow newly created users to automatically have access if you choose. Once set, export the configuration files and you're good to go.  

 

4. To be extra safe, you'll probably want to enable the AutoBlock under the General Settings as well. This will help prevent those nice people from China & Niagara from permanently gaining access to your server once they find it (Like they tried to do to a friend's synology server).  

5. Now you'll likely want to punch a hole into your router to allow for the server to have access to the outside world. If you're setting up a VPN you'll hopefully know how to do this, however, there are two ways, one would be to place your whole Synology server outside of the firewall using DMZ, sort of defeating the purpose of the work you just did, the other, which I HIGHLY recommend, is just port forwarding. Depending on your setup you'll type in the IP address of your synology server, and the port to forward (port 1194 & UDP only).

Congrats the OpenVPN server is now set up!  Next you'll need to setup the client side of it.  Check out how to setup the client for windows in Part 2, and for an android & apple iphone device in part 3.  Also a short bonus page of advanced things you can do to your synology with OpenVPN like IP forwarding.

Notes: Some great sources of information can be found here.


Check out Part 1 of 3
Check out Part 2 of 3
Check out Part 3 of 3
Check out the bonus stuff!