645M-4 OpenVPN Bridged LAN to LAN communication

The following application note demonstrates the configuration of the ELPRO 645M-4 cellular modem in a Bridged (Flat Network) OpenVPN Server and Client configuration.  OpenVPN is an open sourced commercial software that implements a Virtual Private Network (VPN) to create a secure Point to Point link, either Bridged or Routed between two locations. It can be used with a wide variety of network layer protocols and is capable of traversing network address translators (NATs) and firewalls.  It can be used with a Private Fixed IP system or a Public Dynamic Cellular network, OpenVPN authenticates with each peer by using pre-shared secret keys, certificates and/or username/password.  

Certificate generation 

Modem Generation

OpenVPN certificate can be generated in the modem by running some scripts via a Telnet session however it is recommended that the certificates generation be done using a computer as some of the key generations requires a large amount of processing and can take some time when generated in the modem and it is far better and a lot quicker if it can be generated using a PC. If you wish to Generate the certificates internally, please contact support@elpro.com.au for instructions.

OpenVPN Generation

Download from the following web address and locate the appropriate installer for your operating system.

https://openvpn.net/community-downloads/

Run the installer and make sure to install the “EasyRSA2 Certificate Management Scripts”.

Initialisation

When complete, open a Command Prompt window and change directory to \Program Files\OpenVPN\easy-rsa. 

Run the following batch file’s to configure and copy the configuration files into place.

• init-config.bat
  
• Edit the vars.bat file using Window Notepad and set the KEY_COUNTRY, KEY_PROVINCE, KEY_CITY, KEY_ORG, and KEY_EMAIL parameters. Don’t leave any of these parameters blank, save and close file.
  
• Vars.bat
  
• clean-all.bat
  
• build-ca.bat
  

The final command (build-ca) will build the “Certificate Authority” (CA) certificate’s and key files.

You will be asked to enter information that will be incorporated into your certificates.

For some fields there will be a default value that you configured when you edited the “vars.bat” file above, just step through the process, if you enter '.', the field will be left blank.

Country Name (2 letter code) [AU]:

State or Province Name (full name) [QLD]:

Locality Name (eg, city) [Brisbane]:

Organization Name (eg, company) [Elpro]:

Organizational Unit Name (eg, section) []: (Can leave this blank)

Common Name (eg, your name or your server's hostname) [ELPROServer]

Email Address [support@elpro.com.au]:

Note that in the above sequence, most queried parameters were defaulted to the values set in the vars.bat file. The only parameter which must be explicitly entered is the Common Name (Must not be Blank). In the example above, I used “ELPROServer”.

Generate certificate & key for server

Next, we will generate a certificate and private key for the server. 

Type the following:

• build-key-server <YourServerName>
  

As in the previous step, most parameters can be defaulted. When the Common Name is queried, enter “Server”. Two other queries require “yes” responses, “Sign the certificate? [y/n]” and “1 out of 1 certificate requests certified, commit? [y/n]”.

Generate certificates & keys for 3 clients

Generating client certificates is very similar to the previous step. 

Type the command for each Client to create certificates and keys:

• build-key client1 
  
• build-key client2
  
• build-key client3
  

Remember that for each client, make sure to type the appropriate Common Name when prompted, i.e. “Client1”, “Client2”, or “Client3”. Always use a unique common name for each client. If more than 3 x Clients are required, then you will need to generate files for each Client.

Generate Diffie Hellman parameters

Diffie Hellman parameters must be generated for the OpenVPN server. 

Type the Following:

build-dh

This process can take some time (possibly 30-120 Minutes) to create the key, depending on the key size generation parameters.

Key Files

Now we will find our newly generated keys and certificates in the key’s subdirectory. Below is an explanation of the files:

The final step in the key generation process is to copy all files to the machines which need them, taking care to copy secret files over a secure channel and save them to a secure location as you will need these files during the configuration of the Server and any Client modems.

Bridged Application Example – Master – Slave

Central 645M-4 #1 Master to Slave Remote

Dynamic DNS

The use of Dynamic DNS assigns a DNS name to the modem which then allows the modem to be accessed regardless of the assigned PPP IP address.  There are several providers that offer Dynamic DNS "DDNS" services for example, a free service provided by “No-IP" allows users to setup between one to three host names on a domain name provided by No-IP.  

In this example we are using a dynamic public IP address provided by “No-IP” and we have setup a Dynamic DNS address on the Server and each Client cellular IP Address.

To configure the Dynamic DNS, navigate to Services – DDNS on the left-hand menu system and “Add” a DDNS instance.

Enable the DDNS and select a provider, in this example we are using NoIP.com. Enter the DDNS domain name that you have configured with your DDNS provider and the Login details for the account and “Save and Apply”.

Remember to press the “Start” button to enable the process.

OpenVPN Bridged (tap) Server Configuration

In order to create an Open VPN flat connection between the two ELPRO 645M-4 modems, we first need to define a Server in one of the units. The network diagram illustrated at the start of this section shows an ELPRO 645M-4 modem that needs to communicate to another 645M-4 modem and to be able to pass data freely between the PC’s and /or Ethernet I/O devices connected to the modems, i.e. requires a flat LAN to LAN connection.

In this case, the OpenVPN Server will be configured in the Base Modem and an OpenVPN Client will be configured in the remote 645M-4 modem.

Note: The following LAN IP addresses are assigned to each 645M-4 Modem,

• 645M-4 Server – 192.168.1.1
  
• 645M-4 Client #1 – 192.168.1.2
  

Navigate to the “Services” / “VPN” on the left navigation bar, and then select “OpenVPN” from the menu tabs. 

This is where you configure the OpenVPN Server instance. 

Type in the name you wish to call the instance, selecting the type (Server Configuration for an Ethernet Bridge (VPN)) from the selection list then press the “Add” button.

After creating the Open VPN Server instance, you will need to select “Switch to Advanced Configuration” this will bring up the advanced configuration parameters.

Then configure the following.

Select “Enable” then press the “Save & Apply” button

Next select “Cryptography”

Click “Additional Fields” and add the first field from the table below then press the “Add” button, select” Choose File” and locate the associated file that was created during the previous certificate generation phase. When found, select the “Save & Apply” button and repeat for the other Additional fields in the table.

We need the VPN clients to connect and feel as if they are physically on the same Ethernet network, i.e. using IP addresses in the 192.168.1.0/24 range. So we need to configure a “virtual tap interface” that the OpenVPN uses to bridge the Ethernet LAN interface, and the OpenVPN's tap interface. 

We implement this in the configuration of the “server_bridge” with a Server IP Address, Subnet Mask and a virtual IP range that gets reserved for connecting Clients. Care must be taken when configuring this as the IP range cannot be already assigned to other devices on the Network.

Also it is best to keep the range limited to the number of Clients that will be connecting.

e.g. If you only have the one Client you could assign the range to be in the high end of the subnet so that it is away from any general addressing and to also make the range only one or two addresses slots, see example below.

Server_bridge = 192.168.1.1 255.255.255.0 192.168.1.252 192.168.1.254

Green is the Server IP address, Blue is the Subnet Mask and Red is the Client IP range.

Ticking “Duplicate_cn” will allow multiple Clients to connect using the same certificates. If unticked each Client will need to have its own certificate generated.

The rest of the configuration should be stock standard.

Navigate back to the main “OpenVPN” page, where you will see the OpenVPN instance you just created. 

Make sure the “Start/Stop” button shows “Stop” if it shows “Start” then press the button. 

You should then see the Server has “Enabled” and “Started” by the indication “Yes” & “Yes (XXXXX)”.

.

OpenVPN Bridged Client Configuration

Connect to the LAN IP of the remote modem, in our example this is on 192.168.1.2. 

Navigate to the “Services” / “VPN” on the left-hand menu, and then select “OpenVPN” from the menu tabs and configure a Client instance.  

The Sample instances shown are only for routed networks, so we need to configure a new “bridged” instance.

Type in the name you wish to call the instance, selecting the type (Client Configuration for an Ethernet Bridge (VPN)) from the selection list then press the “Add” button.

Edit the instance then select “Switch to Advanced Configuration”, tick “enabled” and press the “Save and Activate” button.

Select “Cryptography”

Click “Additional Fields” and add the first field from the table below, press the “Add” button then select” Choose File” and locate the associated file that was created during the previous certificate generation phase. When found, select the “Save & Apply” button and repeat for the other Additional fields in the table below.

Here you need to enter the Server Cellular IP Address and the Port “1194” into the “remote” field, or if you are using Dynamic DNS as we are in this example, you will need to enter the Dynamic DNS name without the Port number, also make sure the “client” is enabled.

When complete press the “Save and Apply” button.

It will change to “Stop” and you will see a “yes (XXXX)” under “Started” process.

Bridge Interfaces

Server

Navigate to the “Network/Interface” page and you should see the OpenVPN Server status which should indicate some data packets have been transmitted and received, this means the tunnel between the modems is passing data. 

Select the “edit” button on the LAN, select the “Physical Settings” tab and now need to make sure the OpenVPN interface is “Bridged” with the “Wired LAN” and “radio.network1” interfaces.

Client

Client Network/Interface overview will show a similar Open VPN status which will show the virtual Tunnel IP address and that TX & RX packet have been passed.

LAN2LAN Communication tests: 

The tunnel between server and client should now be setup successfully and the client and server should be able to be pinged via the Network/Diagnostic” page

You should now be able to communicate from the LAN connection on the Server to the LAN connection on the Client.

You can test the Tunnel communication using the “Diagnostics” menu in the modem shown above, but a more comprehensive test is to open a command window on the PC connected to the Server and ping another Device (PC or other Ethernet Device) on the Client LAN and get responses.

Note: You should get 4 x responses.

You will notice the times will reflect the “over the air” connection time i.e. it will not be like a <1msec LAN connection time

Check lists

Server 

• Dynamic DNS and Start the process.
  
• Server Cryptography files, i.e. Load ca.crt, dh2048.pem, Server.crt & Server.key files
  
• Configure the “Server_bridge” on the “VPN” Tab.
  
• Start the Server.
  
• Bridge LAN to OpenVPN Server instance
  
• Allow “Ping from WAN to LAN” on Network/Firewall/Security tab
  
• Enable “HTTP ACCESS over WAN” if over the air Web access is required.
  

Client Checklist

• Configure New OpenVPN instance
  
• Load Client Cryptography files, i.e. ca.crt, ClientX.crt & ClientX.key files
  
• Add and configure the Server IP Address on the “OpenVPN Client” instance under the “Advanced config/VPN” tab.
  
• Start the Client.
  
• Bridge LAN to OpenVPN Client instance
  
• Allow “Ping from WAN to LAN” on Network/Firewall/Security tab
  

Common problems that can prevent data transfer beyond the modems Ethernet ports.

• As it’s a flat network you do not necessarily need a Default Gateway unless you have more than one network adaptor or Wi-Fi enabled on your PC.  If needed configure the default Gateway IP address to point to the 645M-4 modems LAN IP address, in this case the Server PC’s Gateway IP address will need to be 192.168.1.1.
  

• The Connected Ethernet device could be blocking the incoming ICMP (Ping) commands (i.e. if a PC), this can be resolved via Windows firewall by adding an Inbound Rule.
  

1. Check the 645M-Network/Firewall/Security – “Ping from WAN to LAN” is set to “Allow” on both the Server and Client.
   

Note: if you also wish to have access to the Web page configuration over the Cellular network you will also need to enable the “HTTP Access” on the same security page.

This can be set to any IP, a specific Subnet or IP Address.