OpenVPN: Connect to multiple VPNs on Windows

Hi,

on Windows OpenVPN by default installs one TAP network interface. If you want to connect to multiple VPNs simultaneously you need an interface for each VPN.

You can add a additional adapter by a batch file provided by the TAP driver. Open a command prompt with administrative rights and change to the TAP install folder.

c:\> cd "C:\Program Files\TAP-Windows\bin"

and call
More »

Advertisment to support michlstechblog.info

OpenVPN: Read certificate passphrase from file

Hello,

when you establish a OpenVPN connection with a password protected ceritificate you have enter the passphrase each time when OpenVPN starts.

This isn’t nice if you want to connect at system startup without an user interaction.
More »

Windows: Set permissions on a service

Hi,

when it is necessary that normal user needs the ability to do some operations on a service, such as starting or stopping, multiple ways exists to grant these permissions. Windows has no GUI or (easy to use) command line tool on board to set these access rights. I will show you 3 ways to set them.

  • Sysinternals Process Explorer
  • sc.exe (Service controller)
  • subinacl.exe (The security swiss knife)

For the following examples I will use the OpenVPN Service with its Service Name openvpnservice and assign the start and stop permissions to a user or group. But its the same procedure for all other services.

The easiest way is to use the sysinternals Process Explorer. It provides a graphical user interface but  has the dependency that the service must be in the running state before process explorer is started. If you already have a valid openvpn configuration start the service:

sc start openvpnservice

Then start the process explorer as administrator and locate the openvpn service process openvpnserv.exe.

Openvpn Process

Openvpn Process


More »

OpenVPN: Set a static IP Address for a client

Hi,

sometimes you have to set a static IP Address for some VPN Clients. Because they provide some server services which always must be reached at the same IP Address.

The client configuration do not provide any option to do that, set a static IP Address on the adapter itself is also always being overwritten when the client establish a connection to the OpenVPN server.

Solution: Define a client specific script at the server.

In this example the openvpn server’s OS is linux (tap Interface IP 10.1.134.62), the client runs at Windows (static IP 10.1.134.1).

Define a directory where the client scripts should be stored , e.g. /etc/openvpn/staticclients and create the directory

mkdir /etc/openvpn/staticclients

Add this directory as option to your openvpn configfile at the server:

client-config-dir /etc/openvpn/staticclients

For each client you have to create a file. The filename must match the “common name” attribute that was specified at the X509 certificate of the client.This command gets the CN from the computers certificate:

root@devdeb~ > openssl x509 -in /etc/openvpn/yourClientCertificate.cer -noout -subject | sed -e 's/.*CN=\(.*\)\/.*/\1/'

TESTCLIENT

This example pushs the IP Address 10.1.134.1/255.255.255.192 to the Client with the common name TESTCLIENT and also pushes a additional route for subnet 10.1.135.0.

cat /etc/openvpn/staticclients/TESTCLIENT

ifconfig-push 10.1.134.1 255.255.255.192
push "route 10.1.135.0 255.255.255.0 10.1.134.62"
# push "dhcp-option WINS addr"
# push "dhcp-option DNS addr"

Michael

OpenVPN: Generate a random MAC Address for TAP Interfaces on Windows

Hi,

if you use some image based technology to deploy your Windows installation, for example SCCM, MDT, Acronis and/or sysprep based, and OpenVPM is already included, the MAC Address of the TAP LAN interface isn’t changed by that way. But a unique MAC Address is requiered if the clients conntects to the same OpenVPN server. If multiple clients have the same MAC Address ping from VPN Clients sometimes fails with error “TTL expired in transit” and the VPN connection is unstable.

This powershellscript sets a MAC Address for each OpenVPN TAP adapter. In detail:

  • Creating a Eventlog TAPsetMAC
  • Get all instances for TAP Adapters by reading HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\MatchingDeviceID == “tap0901”
  • Generate a random MAC Address. Starting with Prefix defined in $sMACPrefix.
  • Writing the MAC to each Adapter
  • Log the result to the EventLog
########################################################
# Generate a random MAC for all OpenVPN tap LAN interfaces
#  Michael Albert
#  05.04.2013
# License: GPLv2
########################################################
# HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}
# MatchingDeviceID tap0901
# REG_SZ MAC=00-FF-8F-E3-A1-AE
$oRandom=New-Object System.random
function fGetRandomMAC([string]$sMACStart){
     if($sMACStart.length -ge 0 -and $sMACStart.length -le 11){
          for($iLoop=$sMACStart.length; $iLoop -le 11; $iLoop++){
               $iChar=$oRandom.Next(16)
               $sMACStart+=[String]::Format("{0:x}", $iChar).ToUpper()
          }
          return($sMACStart)
     }
     else{
          return $false
     }
}
function fConvert2MAC16([string]$sMAC12){
     [string]$sMAC16=""
     if($sMAC12.length -eq 12){
          for($iLoop=0;$iLoop -le 11;$iLoop++){
               $sMAC16+=$sMAC12.SubString($iLoop,1)
               if((($iLoop+1) % 2) -eq 0 -and ($iLoop+1) -lt 12){
                    $sMAC16+="-"
               }
          }
          return $sMAC16
     }
     else{
          return $false
     }
}
###############################################################################
# Currently not used but defined :-)
function fValidMAC([system.string]$sMAC){
          $RegExIP=new-object System.Text.RegularExpressions.Regex("^([0-9a-fA-F]{2}\-){5}([0-9a-fA-F]{2})$")
          return($RegExIP.IsMatch($sMAC))
}
###############################################################################
## MAIN
###############################################################################
$sMACPrefix="00FF8F"
if(! [System.Diagnostics.EventLog]::SourceExists("TAPsetMAC")){
     New-EventLog -Source TAPsetMAC -Log Application
}
$aTAPAdapter=Get-ChildItem "registry::HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}" -ErrorAction SilentlyContinue |where-object{$_.GetValue("MatchingDeviceID") -eq "tap0901"}
foreach($rTAPAdapter in $aTAPAdapter){
     # Get-ItemProperty -Path "registry::HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}"
     if(! ($rTAPAdapter.GetValue("MAC"))){
          #$rTAPAdapter
          #$rTAPAdapter.Name
          # Get-ItemProperty -Path ("registry::"+$rTAPAdapter.Name)
          $sMAC=fGetRandomMAC $sMACPrefix
          if($sMAC16=fConvert2MAC16 $sMAC){
               Write-Host -NoNewline  "Set MAC of TAP Adaper to" $sMAC16 "..."
               $Error.Clear()
               New-ItemProperty -Path ("registry::"+$rTAPAdapter.Name) -Force -Name MAC -PropertyType String -Value $sMAC16|Out-Null
               if(! $Error){
                    Write-Host "ok"
                    Write-EventLog -LogName Application -Source TAPsetMAC -EntryType Information -EventID 666 -Message ("TAP LAN Adapter: Altered MAC Address to "+$sMAC16)
               }
               else{
                    Write-EventLog -LogName Application -Source TAPsetMAC -EntryType Warning -EventID 666 -Message ("TAP LAN Adapter: Failed to altered MAC Address to "+$sMAC16)
               }
          }
     }
}

Michael

Original Theme by Schiy · Powered by WordPress