Versions Compared

Old Version 45

changes.mady.by.user Former user

Saved on

compared with

New Version Current

changes.mady.by.user Former user

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

In this tutorial, we will be demonstrating connectivity from a RediGate 120C to an OpenVPN server.

Pre-Requisites

  1. A RediGate 120X RediGate 100 or 400 series device with internet connectivity
  2. Completion of the Getting Started Guide for your respective RediGate device
    1. RediGate 100 Series Getting Started Guide
    2. RediGate 400 Series Getting Started Guide
  3. Successful completion of one of our IIoT Platform Quick Starts. In this example, we will be showing screenshots from the RediGate to Inductive Automation Ignition (--MQ-RBE) quick start.
  4. An OpenVPN server that is accessible to the RediGate device . In this example, we will be using the OpenVPN AMI that is available on AWS(see Setting up AWS OpenVPN Server for an example of setting up an OpenVPN AMI on Amazon Web Services).

Setting up Your RediGate

Install OpenVPN on your RediGate

...

  1. Download the "RediGate-to-OpenVPN-V2.zip" file from the http://redigate.elecsyscorp.com/examples website
    1. This .zip contains an example RediGate-to-OpenVPN-V2.xml ACE configuration and a couple of example OpenVPN configurations for your reference
  2. Copy and paste the "VPN_Configuration_Ch14" object from the RediGate-to-OpenVPN-V2.xml configuration into your configuration
  3. If your RediGate has access to the public internet, copy and paste the "NTP Client" from the RediGate-to-OpenVPN-V2 configuration into your configuration. If not, you will need to manually set the date/time of the RediGate in order for the timestamps on the generated certificates to work

  4. Copy and paste the "Firewall" object  from the RediGate-to-OpenVPN configuration into your configuration:


    Info
    titleDelete or Edit Existing Firewall

    Each configuration can only have 1 firewall, so if you already have a firewall object, you will need to delete the existing one or edit the "Port Management" and "Custom IPTABLES" objects to match that of the RediGate-to-OpenVPN firewall configuration

  5. Upload configuration and confirm that the VPN tags are being published to your broker. The example below shows a screenshot of the tags published to Inductive Automation's Ignition SCADA:

Setting up Your OpenVPN Server

Set the server hostname

Login through the web UI and change the hostname to the domain name of the server. Also update the interface so it allows all connections (if not already set)

Image Removed

Don't Route Internet Traffic Through VPN

Image Removed

Creating Self-Signed Certificates (https://openvpn.net/index.php/open-source/documentation/howto.html#pki)

 

 

Generate the master Certificate Authority (CA) certificate & key

NOTE: MAKE SURE YOU RUN THE COMMAND LINE AS ADMINISTRATOR

In this section we will generate a master CA certificate/key, a server certificate/key, and certificates/keys for 3 separate clients.

For PKI management, we will use easy-rsa, a set of scripts which is bundled with OpenVPN 2.2.x and earlier. If you're using OpenVPN 2.3.x, you need to download easy-rsa separately from here.

If you are using Linux, BSD, or a unix-like OS, open a shell and cd to the easy-rsa subdirectory. If you installed OpenVPN from an RPM or DEB file, the easy-rsa directory can usually be found in /usr/share/doc/packages/openvpn or /usr/share/doc/openvpn (it's best to copy this directory to another location such as /etc/openvpn, before any edits, so that future OpenVPN package upgrades won't overwrite your modifications). If you installed from a .tar.gz file, the easy-rsa directory will be in the top level directory of the expanded source tree.

If you are using Windows, open up a Command Prompt window and cd to \Program Files\OpenVPN\easy-rsa. Run the following batch file to copy configuration files into place (this will overwrite any preexisting vars.bat and openssl.cnf files):

init-config

Now edit the vars file (called vars.bat on Windows) and set the KEY_COUNTRY, KEY_PROVINCE, KEY_CITY, KEY_ORG, and KEY_EMAIL parameters. Don't leave any of these parameters blank.

Next, initialize the PKI. On Linux/BSD/Unix:

. ./vars
./clean-all
./build-ca

On Windows:

vars
clean-all
build-ca

The final command (build-ca) will build the certificate authority (CA) certificate and key by invoking the interactive openssl command:

ai:easy-rsa # ./build-ca
Generating a 1024 bit RSA private key
............++++++
...........++++++
writing new private key to 'ca.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [KG]:
State or Province Name (full name) [NA]:
Locality Name (eg, city) [BISHKEK]:
Organization Name (eg, company) [OpenVPN-TEST]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:OpenVPN-CA
Email Address [me@myhost.mydomain]:

 

Note that in the above sequence, most queried parameters were defaulted to the values set in the vars or vars.bat files. The only parameter which must be explicitly entered is the Common Name. In the example above, I used "OpenVPN-CA".

Generate certificate & key for server

Next, we will generate a certificate and private key for the server. On Linux/BSD/Unix:

./build-key-server server

On Windows:

build-key-server server

 

For "server", make sure you put the IP address of the server as indicated by the default certificate:

Image Removed

 

CA files will be found here: C:\Program Files\OpenVPN\easy-rsa\keys

Image Removed

Upload them to the certificates section on the server

Image Removed

View Successful Match

Image Removed

Creating OpenVPN User and Configuration File for RediGate

Creating OpenVPN Configuration File for RediGate

  • Create a new user using the OpenVPN web interface
    Image Removed
  • Create a connection with those user's credentials using your PC's "VPN Connect App", however BE CAREFUL. You do not want to click through all the options because the next step requires copying and saving the text from one of the dialog boxes.
    Image Removed
  • Copy and paste the credentials generated by the "OpenVPN - Warning" into a text document, omitting the top line that reads "OpenVPN configuration file:"
    Image Removed
    • Edit ~Line 58 of the the text document with the following so that the text

    Creating OpenVPN User and Configuration File for RediGate

    Creating OpenVPN Configuration File for RediGate

    1. Create a new user using the OpenVPN web interface. Enter a password in the Local Password field, and deploy the settings to the running server.
      Image Added

    2. In this step, you will use the OpenVPN Connect client to connect once from your PC to the RediGate account, and in the process obtain the user credential file.

      Note

      Be careful to follow the instructions below exactly, to make sure you retain the ability to copy/paste the text as expected.

       

      1. Create a connection using OpenVPN Connect with the RediGate user credentials.
        For this demo, use the Server as vpn.mqtt.com (but in actual application, you will need to use your own server).
        Image Added

      2. The first time you connect to the server, you will receive an "UNTRUSTED SSL certificate" warning.
        You can leave the "Don't ask again" box checked for this step if you wish, and click Yes.
        Image Added

      3. But on the next dialog, with the "Allow VPN connection to vpn.mqtt.com UNVERIFIED profile?" warning, DO NOT leave the box checked next to "Don't ask again."
        UNCHECK the box, or else you will be prevented from using this dialog in the future to copy the credentials that you need.
        Image Added

      4. Click the "More details..." link to view the certificate information for this connection.
        Image Added

      5. Select all of the text inside the textbox except for the first line, which reads "OpenVPN configuration file:"

    3. Open a text editor and paste the credentials copied from the "OpenVPN - Warning → UNVERIFIED profile" dialog (above).
      Image Added

    4. Make the following edits to the text document:
      1. On approximately Line 58 of the the text document, edit the line with "auth-user-pass" so that the line reads "auth-user-pass /etc/openvpn/auth.txt"
      Image Removed
      1. Image Added
      2. NOTE: On approximately Lines 44 to 51 of your file should not contain , if you are using your own OpenVPN server, change "vpn.mqtt.com" – they should read  to be the IP address or server name URL of your OpenVPN server.
        Image Added
    5. Save the file text file as "OpenVPN_CONF.txt" and load the text file onto the RediGate using one of the methods below. 
      1. Method 1 - Upload Additional Files using ACE
        1. Confirm tha tthe that the name of the OpenVPN configuration file to be loaded onto the RediGate is less than 32 characters in length
        2. Open the ACE configuration to be loaded onto the RediGate, and select the "Upload Additional Files" checkbox
        3. Click "Upload" and browse to the OpenVPN_CONF.txt file you created in the previous steps
        4. Once the upload is complete, you should see the configuration file on the RediGate. The location of the configuration file will depend on the account used to upload the configuration/file:
          1. "user" account:  /home/director 
          2. "root" account: /home/director
          3. "Dirupld" account: /home/Dirupld
      2. Method 2 - You can use a different file transfer program to load the OpenVPN_CONF.txt file into the /home/director or /home/Dirupld folder on the RediGate.

    Updating Settings and Starting VPN via MQTT and Ignition

    Update VPN Settings via MQTT

    1. Change the "AuthName" and "AuthPass" values to match those of the user whose configuration you uploaded 


    2. Confirm all settings are correct, and send a "1" value to the the "VPN.Start" tag to initiate the connection. For examples on how to send MQTT values to non-Ignition systems, see OpenVPN MQTT API Reference

      Info
      titleEdit Default MQTT Values

      You can edit the default values for the AuthName, AuthPass, and OpenVPN_CONF.txt by changing the PreInitRTDB values under the "VirtualUnit3-VPN-NAT-Tags":

       

      1. When the "Start" tag is toggled, the RediGate will check the following folders for the filename specified in the OpenVPN_CONF.txt tag (which was set in the previous step), and use that filename as the OpenVPN configuration with the username/password credentials specified in the AuthName and AuthPass tags:
        1. /home/director
        2. /home/Dirupld
      2. The RediGate will then move the contents of that file into the file located in /etc/openvpn/openvpn2.conf for future use:
        Image Modified
    3. Confirm that the VPN has started by viewing the client list on the OpenVPN server configuration page
    4. You may also confirm the VPN is established by viewing Diagnostics Menu option 2 ("Network Interfaces") and confirm that there is a "tun0" interface present. The VPN IP address of the RediGate will be shown under the "tun0" section.

    5. After this, you may use a different VPN user account (with an address in the same subnet) to connect your PC to the OpenVPN server.
      Once connected, you should be able to Ping the RediGate and connect to its SSH port using PuTTY or TeraTerm, or transfer files from the PC using the SSH option in ACE.