mirror of
https://github.com/vyos/vyos-documentation.git
synced 2025-10-26 08:41:46 +01:00
96 lines
3.5 KiB
ReStructuredText
96 lines
3.5 KiB
ReStructuredText
.. _vpn-openconnect:
|
||
|
||
###########
|
||
OpenConnect
|
||
###########
|
||
|
||
OpenConnect-compatible server feature is available from this release.
|
||
Openconnect VPN supports SSL connection and offers full network access. SSL VPN
|
||
network extension connects the end-user system to the corporate network with
|
||
access controls based only on network layer information, such as destination IP
|
||
address and port number. So, it provides safe communication for all types of
|
||
device traffic across public networks and private networks, also encrypts the
|
||
traffic with SSL protocol.
|
||
|
||
The remote user will use the openconnect client to connect to the router and
|
||
will receive an IP address from a VPN pool, allowing full access to the network.
|
||
|
||
.. note:: All certificates should be stored on VyOS under /config/auth. If
|
||
certificates are not stored in the /config directory they will not be
|
||
migrated during a software update.
|
||
|
||
*************
|
||
Configuration
|
||
*************
|
||
|
||
SSL Certificates
|
||
================
|
||
|
||
We need to generate the certificate which authenticates users who attempt to
|
||
access the network resource through the SSL VPN tunnels. The following command
|
||
will create a self signed certificates and will be stored in the file path
|
||
`/config/auth`.
|
||
|
||
.. code-block:: none
|
||
|
||
openssl req -newkey rsa:4096 -new -nodes -x509 -days 3650 -keyout /config/auth/server.key -out /config/auth/server.crt
|
||
openssl req -new -x509 -key /config/auth/server.key -out /config/auth/ca.crt
|
||
|
||
We can also create the certificates using Cerbort which is an easy-to-use client
|
||
that fetches a certificate from Let's Encrypt an open certificate authority
|
||
launched by the EFF, Mozilla, and others and deploys it to a web server.
|
||
|
||
.. code-block:: none
|
||
|
||
sudo certbot certonly --standalone --preferred-challenges http -d <domain name>
|
||
|
||
Server Configuration
|
||
====================
|
||
|
||
.. code-block:: none
|
||
|
||
set vpn openconnect authentication local-users username <user> password <pass>
|
||
set vpn openconnect authentication mode <local|radius>
|
||
set vpn openconnect network-settings client-ip-settings subnet <subnet>
|
||
set vpn openconnect network-settings name-server <address>
|
||
set vpn openconnect network-settings name-server <address>
|
||
set vpn openconnect ssl ca-cert-file <file>
|
||
set vpn openconnect ssl cert-file <file>
|
||
set vpn openconnect ssl key-file <file>
|
||
|
||
|
||
*******
|
||
Example
|
||
*******
|
||
|
||
Use local user name "user4" with password "SecretPassword"
|
||
Client IP addresses will be provided from pool 100.64.0.0/24
|
||
The Gateway IP Address must be in one of the router´s interfaces.
|
||
|
||
.. code-block:: none
|
||
|
||
set vpn openconnect authentication local-users username user4 password 'SecretPassword'
|
||
set vpn openconnect authentication mode 'local'
|
||
set vpn openconnect network-settings client-ip-settings subnet '100.64.0.0/24'
|
||
set vpn openconnect network-settings name-server '10.1.1.1'
|
||
set vpn openconnect network-settings name-server '10.1.1.2'
|
||
set vpn openconnect ssl ca-cert-file '/config/auth/fullchain.pem'
|
||
set vpn openconnect ssl cert-file '/config/auth/cert.pem'
|
||
set vpn openconnect ssl key-file '/config/auth/privkey.pem'
|
||
|
||
|
||
************
|
||
Verification
|
||
************
|
||
|
||
.. code-block:: none
|
||
|
||
|
||
vyos@RTR1:~$ show openconnect-server sessions
|
||
|
||
interface username ip remote IP RX TX state uptime
|
||
----------- ---------- ------------ ------------- -------- -------- --------- --------
|
||
sslvpn0 user4 100.64.0.105 xx.xxx.49.253 127.3 KB 160.0 KB connected 12m:28s
|
||
|
||
.. note:: It is compatible with Cisco (R) AnyConnect (R) clients.
|