NetComm Wireless NTC-6908 Installation instructions

OpenVPN
Technical Support Guide

2
OpenVPN Technical Support Guide
www.netcommwireless.com
v1.0
Copyright
Copyright© 2015 NetComm Wireless Limited. All rights reserved.
The information contained herein is proprietary to NetComm Wireless. No part of this document may be translated, transcribed,
reproduced, in any form, or by any means without prior written consent of NetComm Wireless.
Trademarks and registered trademarks are the property of NetComm Wireless Limited or their respective owners. Specifications are
subject to change without notice. Images shown may vary slightly from the actual product.
Please note: This document is subject to change without notice.
DOCUMENT VERSION
DATE
1.0 - Initial document release
7 December, 2015
Table 1 - Document Revision History

3
OpenVPN Technical Support Guide
www.netcommwireless.com
v1.0
Table of Contents
Applicable devices ........................................................................................................................................................................4
Introduction....................................................................................................................................................................................4
OpenVPN Server Mode .................................................................................................................................................................5
Configuring an OpenVPN Server..............................................................................................................................................................6
Verifying the OpenVPN Connection Status .............................................................................................................................................11
OpenVPN Client Mode.................................................................................................................................................................12
Certificate Files......................................................................................................................................................................................12
Configuring an OpenVPN Client.............................................................................................................................................................13
Verifying the OpenVPN Connection Status............................................................................................................................................. 16
OpenVPN Peer-To-Peer Mode....................................................................................................................................................17
Configuring an OpenVPN Peer-To-Peer Connection...............................................................................................................................18
OpenVPN Peer-To-Peer Example..........................................................................................................................................................19
Verifying the OpenVPN Peer-To-Peer Connection Status........................................................................................................................21

4
OpenVPN Technical Support Guide
www.netcommwireless.com
v1.0
Applicable devices
This document is applicable to the following NetComm Wireless devices:
NTC-6908
NTC-6908-02
NTC-6520
NTC-6200
NTC-30WV
NTC-30WV-02
NTC-40WV
NTC-140W
NWL-11
NWL-15
NWL-25
Introduction
A VPN (Virtual private network) is a secure connection between two or more endpoints. It can also be seen as an extension to a
private network.
There are two key types of VPN scenarios:
Site to Site VPN
Remote Access VPN
In a site to site VPN, data is encrypted from one VPN gateway to the other, providing a secure link between two sites over a third
party insecure network like the Internet.
In a remote access VPN scenario, a secure connection would be made from an individual computer to a VPN gateway. This would
enable a user to access their e-mail, files and other resources at work from wherever they may be, providing they have an Internet
connection.
NetComm Wireless M2M routers support three types of Virtual Private Network (VPN) technologies:
Point-to-Point Tunnelling Protocol (PPTP) VPN
Internet Protocol Security (IPsec) VPN
OpenVPN
OpenVPN is an open source virtual private network (VPN) program for creating point-to-point or server-to-multi-client encrypted
tunnels between host computers. NetComm Wireless M2M routers support three different OpenVPN modes:
OpenVPN Server
OpenVPN Client
OpenVPN Peer-to-Peer VPN connection.
This document describes how to configure the different OpenVPN types on NetComm Wireless M2M routers.
Important notes about OpenVPN on NetComm Wireless M2M Routers
When using two NetComm Wireless M2M routers in a Server-Client scenario, you should change the LAN IP Address
of the devices so that they are on different subnets, otherwise you may find it impossible to access the web-interface
of one of the routers when an OpenVPN connection is established.
A NetComm Wireless M2M router acting as a Server must be connected to an APN that provides a publicly routable IP
address.

5
OpenVPN Technical Support Guide
www.netcommwireless.com
v1.0
OpenVPN Certificates and Secret Keys are dependent on the time on each router being in synchronisation. If the time
is not correct on the router due to NTP not working or for any other reason, the certificate or secret key timestamp
may be considered expired and hence will not be useable.
If both the OpenVPN Server and OpenVPN Client are in a private network, please ensure that the server is routable to
the client and vice-versa before establishing the VPN connection.
OpenVPN Server Mode
In OpenVPN Server Mode, a NetComm Wireless M2M Series Router acts as a host allowing M2M Routers in client mode or
Windows/Linux software clients to establish a virtual private network connection. In order to establish a secure communications
channel, a cryptographic key is exchanged between the server and the client using the Diffie-Hellman method of key exchange.
Once a shared secret is established, certificates identifying each client node are issued which can be used as a means of
authentication.
OpenVPN authentication is achieved through first establishing a public key infrastructure. The public key infrastructure includes:
1. A public and private key for the server and each client
2. A master Certificate Authority (CA) certificate and the key used to sign each of the server and client certificates.
This authentication method results in several benefits:
The server only needs its own certificate and key. It does not need to have every certificate of every client that may
connect to it.
The server will only accept clients with certificates that were signed by the master certificate authority.
If the security of a client certificate is compromised, that individual certificate can be revoked without requiring a new
public key infrastructure to be generated.
The server can enforce access rights for specific clients based on the certificate fields.
While certificate authentication is the more secure and desirable means of authentication, it is also possible to use a username and
password for authentication. Username and password authentication is not used in conjunction with certificates.
An OpenVPN Server allows for one or many client routers to establish secure communication tunnels as illustrated below:
Figure 1 - OpenVPN Server Mode Diagram

6
OpenVPN Technical Support Guide
www.netcommwireless.com
v1.0
Configuring an OpenVPN Server
1. Log in to your NetComm Wireless M2M router using the “root” account. Refer to your device’s User Guide for further
details performing this.
2. Click on Networking, VPN, then OpenVPN. The OpenVPN List is displayed.
Figure 2 - OpenVPN List
3. Next to OpenVPN server list, click the +Add button. If you have not yet generated a server certificate, the following
message is displayed:
Figure 3 - Server certificate prompt
Click the OK button. If you have already generated a server certificate, you may skip to step 7.
4. Next to Diffie-Hellman parameters, click the Generate button. The following dialog is displayed.
Click the OK button. The Diffie-Hellman parameters are generated. When complete the bottom section of the screen
shows the following.

7
OpenVPN Technical Support Guide
www.netcommwireless.com
v1.0
5. Enter the details in the fields provided to create a certificate for this router then click the Generate button at the bottom of
the screen.
The router displays a warning that the keys will take a few minutes to generate. Click the OK button.
When it is complete, a certificate serial number and expiry date appear above the certificate fields.
6. Navigate to the OpenVPN page again (Networking -> VPN -> OpenVPN)
7. Under OpenVPN server, click on the Add button. The OpenVPN server edit page is displayed.

8
OpenVPN Technical Support Guide
www.netcommwireless.com
v1.0
Figure 4 - OpenVPN Server configuration page

9
OpenVPN Technical Support Guide
www.netcommwireless.com
v1.0
8. In the Profile name field, type a name for the OpenVPN Server profile you are creating.
9. From the Type drop down list, select whether to use TUN (tunnel) or TAP (virtual TAP interface). A TAP interface can be
bridged with an Ethernet connection.
10. Select a port number and packet type to use for your OpenVPN Server. The default OpenVPN port is 1194 and default
packet type is UDP.
11. In the VPN Network Address and VPN Network Mask fields, enter the IP address and network mask to assign to your
VPN. This is ideally an internal IP address which differs from your existing address scheme.
12. HMAC or Hash-based Message Authentication Code is a means of calculating a message authentication code through the
use of a cryptographic hash function and a cryptographic key. If you wish to use the HMAC signature as an additional key
and level of security, under the SSL/TLS handshake section, click the Use HMAC Signature toggle key so that it is in the
ON position, then click the Generate button so that the router can randomly generate the key. The Server key timestamp
field is updated with the time that the key was generated. Click the Download button to download the key file so that it can
be uploaded on the client.
13. Select the Authentication Type that you would like to use for the OpenVPN Server.
Certificate Authentication
a) In the Certificate Management section, enter the required details to create a client certificate. All fields are required. When
you have finished entering the details, click the Generate button. The certificate should only take a moment to generate.
Figure 5 - OpenVPN Server - Certificate Management section
b) When it is done, you can click the Download P12 or Download TGZ buttons to save the certificate file. You may select the
format required by the remote router. NetComm Wireless routers support both formats. If for some reason the integrity of
your network has been compromised, you can return to this screen and use the Certificate drop down list to select the
certificate and then press the Revoke button to disable it.
c) To inform the OpenVPN Server of the network address scheme of the currently selected certificate, enter the Network
Address and Network Mask in the respective fields. If you do not enter the remote subnet here, any packet requests from
the server to the client will not be received by the client network because it is not aware of the remote client’s subnet.

10
OpenVPN Technical Support Guide
www.netcommwireless.com
v1.0
Username / Password Authentication
a) In the username/password section, enter the username and password you would like to use for authentication on the
OpenVPN Server. Click the Download CA certificate or Download CA TGZ button to save the certificate. Choose the
format supported by your client router. NetComm Wireless routers support both formats.
Note: If you wish to have more than one client connect to this OpenVPN Server, you must use Certificate Authentication
mode as Username/Password only allows for a single client connection.
Figure 6 - OpenVPN Server - Username/Password section
b) To inform the OpenVPN Server of the network address scheme of the currently selected certificate, enter the Network
Address and Network Mask in the respective fields. If you do not enter the remote subnet here, any packet requests from
the server to the client will not be received by the client network because it is not aware of the remote client’s subnet.
14. When you have finished entering all the required information, click Save to finish configuring the OpenVPN Server.

11
OpenVPN Technical Support Guide
www.netcommwireless.com
v1.0
Verifying the OpenVPN Connection Status
Open a command prompt and ping a remote client IP address. See the screenshot below for an example.
Figure 7 - OpenVPN Server connection verification

12
OpenVPN Technical Support Guide
www.netcommwireless.com
v1.0
OpenVPN Client Mode
NetComm M2M Series Routers may be configured to operate as an OpenVPN Client and connect to an OpenVPN Server running
on another NetComm Wireless M2M Series Router or a software OpenVPN Server on a computer.
Figure 8 - OpenVPN Client Diagram
Certificate Files
When using two NetComm Wireless M2M Routers to establish an OpenVPN connection, the certificate generated by the server will
be recognised by the client and will not require modification.
In situations where you are using another third-party OpenVPN Server to generate certificates, the NetComm Wireless M2M Router
will expect a tar archive compressed using GZip. There are three files that the OpenVPN client in a NetComm Wireless router will
expect to see within a .tgz file:
The master Certificate Authority (CA) certificate file named ca.crt
Client certificate file (e.g., OpenVPN Test Client.crt)
Client key file (e.g., OpenVPN Test Client.key)
If you have used a third-party OpenVPN Server to generate certificates and keys, you will need to archive these three files in a .tgz
file to provide the OpenVPN Client on your NetComm Wireless M2M Router.
You can perform this in Linux by using the command:
tar –zcvf netcommclient.tgz netcommclient.crt netcommclient.key ca.crt
For more information on creating .tgz files, please refer to http://www.cs.duke.edu/~ola/courses/programming/tar.html

13
OpenVPN Technical Support Guide
www.netcommwireless.com
v1.0
Configuring an OpenVPN Client
1. Login to your NetComm Wireless M2M Series Router using the “root” account.
2. Click on Networking, VPN, then OpenVPN. The OpenVPN List is displayed.
Figure 9 - OpenVPN List
3. Next to OpenVPN client list, click the +Add button. The configuration window is displayed.

14
OpenVPN Technical Support Guide
www.netcommwireless.com
v1.0
Figure 9 - OpenVPN Client - Configuration page

15
OpenVPN Technical Support Guide
www.netcommwireless.com
v1.0
4. Set OpenVPN profile to Enable.
5. Type a name for the OpenVPN Client profile you are creating.
6. In the Server IP address field, type the WAN IP address of the OpenVPN Server.
7. From the Type drop down list, select TUN or TAP. TAP is used with Ethernet bridging. In this example, we have selected
TUN.
8. Enter the Server Port and packet type to use for the connection.
9. If the “Default gateway” option is applied on the OpenVPN Client page, the OpenVPN Server will enable connections to be
made to other client networks connected to it. If it is not selected, the OpenVPN connection allows for secure
communication links between the remote office and the head office only.
10. Select the Authentication Type that you would like to use for the OpenVPN Client.
Certificate Authentication
a) In the Certificate subject information section at the bottom of the screen, click the Choose a file / Browse button and
locate the certificate file you downloaded when you configured the OpenVPN Server. This may be either the P12 or TGZ
file. When it has been selected, click the Upload button to send it to the router.
Figure 10 - OpenVPN Client - Certificate Authentication section

16
OpenVPN Technical Support Guide
www.netcommwireless.com
v1.0
Username / Password Authentication
a) Enter the username and password to authenticate with the OpenVPN Server.
Figure 11 - OpenVPN Client - Username/Password section
b) Use the Choose a file/Browse button to locate the CA certificate file you saved from the OpenVPN Server and then press
the Upload button to send it to the router.
11. Click the Save button to complete the OpenVPN Client configuration.
Verifying the OpenVPN Connection Status
Open a command prompt and ping a computer on the remote network. See the screenshot below for an example.
Figure 12 - OpenVPN Client verification of connection

17
OpenVPN Technical Support Guide
www.netcommwireless.com
v1.0
OpenVPN Peer-To-Peer Mode
OpenVPN Peer-To-Peer Mode is the quickest and easiest way to establish a secure connection between two points. In Peer-To-
Peer Mode one node acts as a master and accepts a single connection from a slave.
In OpenVPN Peer-To-Peer mode, both the master and the slave generate a secret key which is then passed on to the other for
authentication. This is the only form of authentication available in Peer-To-Peer mode.
Figure 13 - OpenVPN Peer-To-Peer Mode Diagram

18
OpenVPN Technical Support Guide
www.netcommwireless.com
v1.0
Configuring an OpenVPN Peer-To-Peer Connection
Perform the following steps on two NetComm Wireless M2M Series Routers:
1. Login to your NetComm Wireless M2M Series Routers using the “root” account.
2. Click on Networking, VPN, then OpenVPN. The OpenVPN List is displayed.
Figure 14 - OpenVPN List
3. Next to OpenVPN P2P list, click the +Add button. The configuration window is displayed.
Figure 9 - OpenVPN Peer-To-Peer Mode

19
OpenVPN Technical Support Guide
www.netcommwireless.com
v1.0
4. Set OpenVPN profile to Enable.
5. In the Profile name field, type a name for the OpenVPN Peer-To-Peer profile you are creating.
6. On the router designated as the master, leave the Server IP address field empty. On the router designated as the slave,
enter the WAN IP Address of the master.
7. Enter the Server Port and packet type to use for the connection.
8. Enter the Local IP address and Remote IP address to use for the OpenVPN tunnel. The slave should have the reverse
settings of the master.
9. Under the Remote network section, enter the Network address and Subnet mask. The Network address and Subnet
mask fields inform the Master node of the LAN address scheme of the Slave.
10. Under the Server secret key section, press the Generate button to create a secret key to be shared with the slave. When
the timestamp appears, you can click the Download button to save the file to exchange with the other router.
11. When you have saved the secret key file on each router, use the Browse button to locate the secret key file for the master
and then press the Upload button to send it to the slave. Perform the same for the other router, uploading the slave’s
secret key file to master.
12. When they are uploaded click the Save button to complete the Peer-To-Peer OpenVPN configuration.
OpenVPN Peer-To-Peer Example
OpenVPN Peer-To-Peer Master
Figure 15 - OpenVPN Peer-To-Peer Master Example

20
OpenVPN Technical Support Guide
www.netcommwireless.com
v1.0
OpenVPN Peer-To-Peer Slave
Figure 16 - OpenVPN Peer-To-Peer Slave Example