OpenVPN Configuration

Creating OpenVPN User and Configuration File for RediGate

Creating OpenVPN Configuration File for RediGate

1. Create a new user using the OpenVPN web interface. Enter a password in the Local Password field, and deploy the settings to the running server.
   
   
   

2. In this step, you will use the OpenVPN Connect client to connect once from your PC to the RediGate account, and in the process obtain the user credential file.

    

   1. Create a connection using OpenVPN Connect with the RediGate user credentials.
      For this demo, use the Server as vpn.mqtt.com (but in actual application, you will need to use your own server).
      
      
      

   2. The first time you connect to the server, you will receive an "UNTRUSTED SSL certificate" warning.
      You can leave the "Don't ask again" box checked for this step if you wish, and click Yes.
      
      
      
   3. But on the next dialog, with the "Allow VPN connection to vpn.mqtt.com UNVERIFIED profile?" warning, DO NOT leave the box checked next to "Don't ask again."
      UNCHECK the box, or else you will be prevented from using this dialog in the future to copy the credentials that you need.
      
      
      
   4. Click the "More details..." link to view the certificate information for this connection.
      
      
      
   5. Select all of the text inside the textbox except for the first line, which reads "OpenVPN configuration file:"
      
      
3. Open a text editor and paste the credentials copied from the "OpenVPN - Warning → UNVERIFIED profile" dialog (above).
   
   
   
4. Make the following edits to the text document:
   1. On approximately Line 58 of the the text document, edit the line with "auth-user-pass" so that the line reads "auth-user-pass /etc/openvpn/auth.txt"
      
   2. On approximately Lines 44 to 51, if you are using your own OpenVPN server, change "vpn.mqtt.com" to be the IP address or URL of your server.
      
5. Save the text file as "OpenVPN_CONF.txt" and load the text file onto the RediGate using one of the methods below. 
   1. Method 1 - Upload Additional Files using ACE
      
      1. Confirm that the name of the OpenVPN configuration file to be loaded onto the RediGate is less than 32 characters in length
      2. Open the ACE configuration to be loaded onto the RediGate, and select the "Upload Additional Files" checkbox
         
      3. Click "Upload" and browse to the OpenVPN_CONF.txt file you created in the previous steps
      4. Once the upload is complete, you should see the configuration file on the RediGate. The location of the configuration file will depend on the account used to upload the configuration/file:
         1. "user" account:  /home/director 
         2. "root" account: /home/director
         3. "Dirupld" account: /home/Dirupld
            
   2. Method 2 - You can use a different file transfer program to load the OpenVPN_CONF.txt file into the /home/director or /home/Dirupld folder on the RediGate.

Updating Settings and Starting VPN via MQTT and Ignition

Update VPN Settings via MQTT

1. Change the "AuthName" and "AuthPass" values to match those of the user whose configuration you uploaded 
   
   
   

2. Confirm all settings are correct, and send a "1" value to the the "VPN.Start" tag to initiate the connection. For examples on how to send MQTT values to non-Ignition systems, see OpenVPN MQTT API Reference
   

1. When the "Start" tag is toggled, the RediGate will check the following folders for the filename specified in the OpenVPN_CONF.txt tag (which was set in the previous step), and use that filename as the OpenVPN configuration with the username/password credentials specified in the AuthName and AuthPass tags:
   1. /home/director
   2. /home/Dirupld
2. The RediGate will then move the contents of that file into the file located in /etc/openvpn/openvpn2.conf for future use:
   
3. Confirm that the VPN has started by viewing the client list on the OpenVPN server configuration page
   
4. You may also confirm the VPN is established by viewing Diagnostics Menu option 2 ("Network Interfaces") and confirm that there is a "tun0" interface present. The VPN IP address of the RediGate will be shown under the "tun0" section.
   
   
5. After this, you may use a different VPN user account (with an address in the same subnet) to connect your PC to the OpenVPN server.
   Once connected, you should be able to Ping the RediGate and connect to its SSH port using PuTTY or TeraTerm, or transfer files from the PC using the SSH option in ACE.