org-howto/articles/2024/09/setup-virtual-private-network.org

[21sep2024] setting up VPN for ny/chicago

• Project
• Strategy
• Solution

#

#

#

#

#

#

Project

Want to setup VPN between NY and Chicago households.

EDIT 25dec2024: Nothing wrong with these instructions, but wound up using Tailscale instead. Two major advantage of tailscale for vpn:

1. vpn network topology is a mesh instead of a star.

This means hosts communicate using the same pathways they would use if not using a vpn, so network is more scalable and efficient. See https://www.tailscale.com

1. uses wireguard on each node for encryption. Code for wireguard is two orders of magnitude smaller than openvpn, so accordingly less likely to have security vulnerabilities.

Strategy

Both locations using a Unifi router with dynamic IP address from internet provider.

Will be following openvpn setup instructions here https://openvpn.net/community-resources/how-to/#openvpn-quickstart

1. create digital ocean droplet, to get host with a static IP address

   host	vpn1
   datacenter	NYC3
   ipv4	159.203.164.149
   cost	$8/mo
   provider website	www.digitalocean.com

2. put ssh keys on vpn1

     ssh-copy-id root@159.203.164.149

3. Install openvpn and easy-rsa2 on vpn1

     ssh root@159.203.164.149
     apt-get install openvpn    # version 2.6.9 on 22sep2024
     atp-get install easy-rsa

   Also do the same on roly-desktop-23

     apt-get install openvpn    # version 2.5.9 on 22sep2024
     atp-get install easy-rsa   # version 3.0.8-1ubuntu1

   On roly-desktop-23 looks like easy-rsa in /usr/sharee/doc/easy-rsa

Next create public key infrastruture (PKI) openvpn instructions for using easy-rsa seem to be outdated. Following instructions at https://easy-rsa.readthedocs.io/en/latest

1. create easyrsa working directory

     mkdir -p path/to/secrets && cd path/to/secrets
     make-cadir vpn-ca

2. setup pki directory

     cd path/to/secrets
     ./easyrsa init-pki

   pki/private :: private keys generated on this host pki/reqs :: certificate requests generated on this host

   Will be creating files:

   ca.crt - our own certificate authority's certificate (public proof-of-authority) index.txt - master database of all certificates issued by us serial - serial number, increment-only private/ca.key (private proof-of-authority – SECURITY CRITICAL) certs_by_serial - all our signed certificates issued - issued certificates by commonName

3. build a master certificate authority

     cd path/to/secrets
     ./easyrsa build-ca

   Responding to prompts:

   passphrase	*
   common name	conybeare

   Resulting tree

     cd path/to/secrets/vpn-ca/pki && tree
     .
     ├── ca.crt
     ├── certs_by_serial
     ├── index.txt
     ├── index.txt.attr
     ├── issued
     ├── openssl-easyrsa.cnf
     ├── private
     │   └── ca.key
     ├── renewed
     │   ├── certs_by_serial
     │   ├── private_by_serial
     │   └── reqs_by_serial
     ├── reqs
     ├── revoked
     │   ├── certs_by_serial
     │   ├── private_by_serial
     │   └── reqs_by_serial
     ├── safessl-easyrsa.cnf
     └── serial
   
     13 directories, 7 files
   

4. request a certificate

     cd path/to/secrets
     ./easyrsa gen-req vpn1

   passphrase	*
   common name	vpn1

5. sign certificate

     cd path/to/secrets
     ./easyrsa sign-req server vpn1

   output

   vpn-ca/pki/issued/vpn1.crt

COPYPASTA BELOW ==============================================================

Solution

• stumbled on this stack overflow question https://stackoverflow.com/questions/28939652/how-to-detect-sse-sse2-avx-avx2-avx-512-avx-128-fma-kcvi-availability-at-compile

• turns out to be an easy one-liner

    gcc -dM -E - < /dev/null | sort

  with output like

    #define _FORTIFY_SOURCE 3
    #define _LP64 1
    #define _STDC_PREDEF_H 1
    #define __ATOMIC_ACQUIRE 2
    #define __ATOMIC_ACQ_REL 4
    ...
  

  Here:

  • -E tells compiler to emit preprocessor output
  • -dM tells compiler to produce defines instead of preprocesed source code
  • - as last argument tells compiler to compile input from stdin.

• to look at say SSE/AVX related instructions:

  (using gcc 13.2 here)

    gcc -dM -E - < /dev/null | egrep "SSE|AVX" | sort

    #define __MMX_WITH_SSE__ 1
    #define __SSE2_MATH__ 1
    #define __SSE2__ 1
    #define __SSE_MATH__ 1
    #define __SSE__ 1
  

  but with -mavx512f:

    gcc -mavx512f -dM -E - < /dev/null | egrep "SSE|AVX" | sort

  with output:

    #define __AVX2__ 1
    #define __AVX512F__ 1
    #define __AVX__ 1
    #define __MMX_WITH_SSE__ 1
    #define __SSE2_MATH__ 1
    #define __SSE2__ 1
    #define __SSE3__ 1
    #define __SSE4_1__ 1
    #define __SSE4_2__ 1
    #define __SSE_MATH__ 1
    #define __SSE__ 1
    #define __SSSE3__ 1