OpenVPN

OpenVPN

‎
Original author(s)	James Yonan
Developer(s)	OpenVPN project / OpenVPN Technologies, Inc.
Initial release	1.1.0 / April 10, 2002; 9 years ago (2002-04-10) [1]
Stable release	2.2.1  (July 6, 2011; 4 months ago (2011-07-06)) 855 [+/−]
Preview release	2.x (Git HEAD)  (Every Sunday 05:00 GMT -5 Main Mirror) [+/−]
Platform	Cross-platform
Type	VPN
License	GNU GPL
Website	http://openvpn.net/index.php/open-source.html

OpenVPN is a free and open source software application that implements virtual private network (VPN) techniques for creating secure point-to-point or site-to-site connections in routed or bridged configurations and remote access facilities. It uses a custom security protocol^[2] that utilizes SSL/TLS for key exchange. It is capable of traversing network address translators (NATs) and firewalls. It was written by James Yonan and is published under the GNU General Public License (GPL).^[3]

OpenVPN allows peers to authenticate each other using a pre-shared secret key, certificates, or username/password. When used in a multiclient-server configuration, it allows the server to release an authentication certificate for every client, using signature and Certificate authority. It uses the OpenSSL encryption library extensively, as well as the SSLv3/TLSv1 protocol, and contains many security and control features.

Architecture

Encryption

OpenVPN uses the OpenSSL library to provide encryption of both the data and control channels. It lets OpenSSL do all the encryption and authentication work, allowing OpenVPN to use all the ciphers available in the OpenSSL package. It can also use the HMAC packet authentication feature to add an additional layer of security to the connection (referred to as an "HMAC Firewall" by the creator). It can also use hardware acceleration to get better encryption performance.^[4][5] Support for PolarSSL is planned in version 2.3

Authentication

OpenVPN has several ways to authenticate peers to each another. OpenVPN offers pre-shared secret key, certificate-based, and username/password-based authentication. Preshared secret key is the easiest, with certificate based being the most robust and feature-rich. In version 2.0 username/password authentications can be enabled, both with or without certificates. However to make use of username/password authentications, OpenVPN depends on third-party modules. See the Extensibility paragraph for more info.

Networking

OpenVPN can run over User Datagram Protocol (UDP) or Transmission Control Protocol (TCP) transports, multiplexing created IPsec ESP tunnels on a single TCP/UDP port^{[citation needed]} (RFC 3948 for UDP).^[6] It has the ability to work through most proxy servers (including HTTP) and is good at working through Network address translation (NAT) and getting out through firewalls. The server configuration has the ability to "push" certain network configuration options to the clients. These include IP addresses, routing commands, and a few connection options. OpenVPN offers two types of interfaces for networking via the Universal TUN/TAP driver. It can create either a layer-3 based IP tunnel (TUN), or a layer-2 based Ethernet TAP that can carry any type of Ethernet traffic. OpenVPN can optionally use the LZO compression library to compress the data stream. Port 1194 is the official IANA assigned port number for OpenVPN. Newer versions of the program now default to that port. A feature in the 2.0 version allows for one process to manage several simultaneous tunnels, as opposed to the original "one tunnel per process" restriction on the 1.x series.

OpenVPN's use of common network protocols (TCP and UDP) makes it a desirable alternative to IPsec in situations where an ISP may block specific VPN protocols in order to force users to subscribe to a higher-priced, "business grade," service tier.

Security

OpenVPN offers several internal security features. It runs in userspace, instead of requiring IP stack (and therefore kernel) operation. OpenVPN has the ability to drop root privileges, use mlockall to prevent swapping sensitive data to disk, enter a chroot jail after initialization and apply a SELinux context after initialization.

OpenVPN runs a custom security protocol based on SSL and TLS^[2]. OpenVPN offers support of smart cards via PKCS#11 based cryptographic tokens.

Extensibility

OpenVPN can be extended with third-party plug-ins or scripts which can be called at defined entry points.^[7][8] The purpose of this is often to extend OpenVPN with more advanced logging, enhanced authentication with username and passwords, dynamic firewall updates, RADIUS integration and so on. The plug-ins are dynamically loadable modules, usually written in C, while the scripts interface can execute any scripts or binaries available to OpenVPN. In the OpenVPN source code ^[9] there are some examples of such plug-ins, including a PAM authentication plug-in.

Platforms

It is available on Solaris, Linux, OpenBSD, FreeBSD, NetBSD, QNX, Mac OS X, and Windows 2000/XP/Vista/7. While most mobile phone OSes (iOS, Palm OS, etc) do not support OpenVPN, it is available for Maemo,^[10] Windows Mobile 6.5 and below,^[11] and Android devices which have had the Cyanogenmod aftermarket firmware flashed^[12] or have the correct kernel module installed.^[13] It is not a "web-based" VPN, meaning that it is not shown as a web page such as Citrix or TS Web access - the program is installed independently and configured by editing text files manually, rather than through a GUI-based wizard. OpenVPN is not compatible with IPsec or any other VPN package. The entire package consists of one binary for both client and server connections, an optional configuration file, and one or more key files depending on the authentication method used.

Firmware implementations

OpenVPN has been integrated into routing firmware packages such as Vyatta, pfSense, DD-WRT,^[14][15] OpenWrt^[16] and Tomato (firmware),^[17][18] allowing users to run OpenVPN in client or server mode from their network routers. A router running OpenVPN in client mode, for example, facilitates users within that network to access their VPN without having to install OpenVPN on each computer on that network.

Third-party client software

Client	Operating System	Cost	Developer	Latest release	Link	Notes
OpenVPN Client	Cross-platform	Free	OpenVPN Technologies, Inc.	1.7.2 / April 11, 2011; 7 months ago (2011-04-11)	openvpn.net, Commercial version download	Commercial version, Requires .NET Framework 3.5 SP1 for Desktop Client. Installs TAP-Win32 Adapter OAS.
OpenVPN Portable	Microsoft Windows	Free	Lukas Landis	1.6.6 / February 9, 2010; 20 months ago (2010-02-09)	sourceforge.net/projects/ovpnp	Installs TAP-Win32 Adapter V9 at startup and uninstalls adapter after shutdown.
OpenVPN Manager	Microsoft Windows	Free	Jochen Wierum	0.0.3.1 / March 31, 2009; 2 years ago (2009-03-31)	openvpn.jowisoftware.de/, sourceforge.net/projects/openvpnmngr
SecurepointSSLVPN	Microsoft Windows	Free	Securepoint GmbH	RC3 / November 22, 2010; 11 months ago (2010-11-22)	sourceforge.net/projects/securepoint	Uses TAP-Win32 Adapter V9.
OpenVPN MI GUI	Microsoft Windows	Free	Boris Wesslowski	20110902 / September 2, 2011; 2 months ago (2011-09-02)	openvpn-mi-gui.inside-security.de	Alternative to the shipped Windows GUI that overcomes some of its problems
Viscosity	Mac OS X & Microsoft Windows	Paid	SparkLabs	1.3.4 / August 2, 2011; 3 months ago (2011-08-02)	thesparklabs.com/viscosity	Available for both Mac OS X & Windows
Tunnelblick	Mac OS X	Free	Tunnelblick	3.1.7 / April 3, 2011; 7 months ago (2011-04-03)	code.google.com/p/tunnelblick	Can act as client or server. Beta versions with advanced features also available.
Shimo	Mac OS X	Paid	ChungwaSoft	2.2.3 / June 3, 2010; 17 months ago (2010-06-03)	shimoapp.com
OpenVPN	DD-WRT	Free	NewMedia-NET GmbH	v24 SP1 (Build10020) / July 27, 2008; 3 years ago (2008-07-27)	dd-wrt.com
TomatoVPN	Tomato (firmware)	Free	Keith Moyer	1.27vpn3.6 / January 27, 2010; 21 months ago (2010-01-27)	tomatovpn.keithmoyer.com
TunnelDroid	Android	Free	TunnelDroid	December 12, 2009; 22 months ago (2009-12-12)	sourceforge.net/projects/tunneldroid, Market Download	Merged with OpenVPN Settings.
OpenVPN Settings	Android	Free	android-openvpn-settings	0.4.7 / October 11, 2010; 13 months ago (2010-10-11)	code.google.com/p/android-openvpn-settings
LiliVPN	Cross-platform	Free	Rens Sparrius	0.4 Alpha June 11, 2010; 17 months ago (2010-06-11)	lilivpn.com
OAST	Cross-platform	Free	Chlen Nigera, Karthik Upadhyayula	2.4.2.0 / July 18, 2009; 2 years ago (2009-07-18)	sourceforge.net/projects/oast/	Requires: Java, portable version is bundled with Java.
Guizmovpn	iPhone/iPad/iOS	Paid	Guizmo	1.1.0 / May 30, 2011; 5 months ago (2011-05-30)	GuizmOVPN.com	Only on JailBroken IOS devices on the cydia store due to interference with DNS and routing.[19]

There's a more thorough list of projects related to OpenVPN in the OpenVPN wiki.

Community

A circa 2005 version of the OpenVPN community logo.

There are many support options for OpenVPN. The primary method for community support is through the OpenVPN mailing lists. Other sources of support, not directly affiliated with OpenVPN include:

Support Source	Description
OpenVPN Documentation	2.0 Manual 2.1 Manual 2.2 Manual
IRC	#openvpn on irc.freenode.net
Forum	Official OpenVPN forums
Community	Official OpenVPN wiki/bug tracker OpenVPN e.V. community Secure Computing Networks OpenVPN Wiki

See also

	Free software portal
	Cryptography portal

• OpenSSH, which also implements a level-2/3 "tun"-based VPN
• stunnel encrypt any TCP connection (single port service) over SSL
• UDP hole punching, a technique for establishing UDP "connections" between firewalled/NATed network nodes
• Virtual private network (VPN)
• Point-to-Point Tunneling Protocol (PPTP) Microsoft method for implementing VPN

References

1. ^ SourceForge.net - OpenVPN: openvpn-announce
2. ^ ^{a b} "OpenVPN Security Overview". http://openvpn.net/index.php/open-source/documentation/security-overview.html. Retrieved 28 September 2011. 
3. ^ LinuxSecurity.com - OpenVPN: An Introduction and Interview with Founder, James Yonan
4. ^ Network security hacks By Andrew Lockhart - Hack #104 - Create a Cross-platform VPN
5. ^ IPv6 Deployment Guide By 6net - Chapter 5 - Integration and Transition
6. ^ User Centric Media: First International Conference, UCMedia 2009, Venice, Italy, December 9–11, 2009, Revised Selected Papers By Patros Daras, Oscar Mayora Ibarra - Scalable IPTV Delivery to Home via VPN - Proposed Scheme
7. ^ OpenVPN script entry points
8. ^ OpenVPN plug-in entry points for C based modules
9. ^ OpenVPN example plug-ins
10. ^ OpenVPN Maemo package
11. ^ [1]
12. ^ cyanogen (7 July 2010). "CHANGELOG at eclair from CyanogenMod's android_vendor_cyanogen". Github. http://github.com/CyanogenMod/android_vendor_cyanogen/blob/eclair/CHANGELOG. Retrieved 28 October 2010. Nexus One Cyanogenmod changelog
13. ^ [2]
14. ^ dd-wrt.com - OpenVPN
15. ^ Geek-Pages.com - OpenVPN server and client on DD-WRT
16. ^ http://wiki.openwrt.org/doc/howto/vpn.openvpn
17. ^ TomatoVPN
18. ^ LinksysInfo.org – VPN build with Web GUI
19. ^ GuizmOVPN.com - Why is it released only under Cydia ?

External links

• OpenVPN project homepage
• OpenVPN presentation and demonstration video Hampshire Linux User Group. Archive.org. details.