For private use I only want to use a simple peer-to-peer openVPN connection without maintaining a complete Public Key Infrastructure. I have heard it can be simplified by using static keys, but how can I set this up using Raspberry Pi?
You can generate static secret keys and just preshare them to the devices using openVPN. Then this keys are used for authentication. There is no need to generate private/public keys and maintain them in an infrastructure with a certification authority.
For reference I use Raspbian Stretch Lite 2019-04-08 updated with
sudo update && sudo full-upgrade && sudo reboot on 2019-05-01.
Example for this setup:
10.8.0.1 10.8.0.2 / vpn tunnel ┌──────────┐ \ peer1 ╔════════════════╗ ╔=═══════════════════════════════════ peer2 RPi(eth0) <-----------> router <-------------> │ INTERNET │ \ wired / \ wan │ │ 192.168.4.2 192.168.4.1 22.214.171.124 └──────────┘ (public ip)
I assume you have a working internet connection.
On the openvpn peer1 install openvpn:
rpi ~$ sudo -Es rpi ~# apt update rpi ~# apt full-upgrade rpi ~# apt install openvpn rpi ~# systemctl disable openvpn.service
If you use systemd-networkd then install also
rpi ~# apt install openvpn-systemd-resolved
Then generate a static secret key:
rpi ~# openvpn --genkey --secret /etc/openvpn/static.key
Create a peer1 config file:
rpi ~# cat > /etc/openvpn/peer1.conf <<EOF dev tun ifconfig 10.8.0.1 10.8.0.2 secret static.key cipher AES-256-CBC EOF
Start the openvpn peer1:
rpi ~# systemctl enable email@example.com rpi ~# systemctl start firstname.lastname@example.org rpi ~# exit rpi ~$
On the openvpn peer2 also install openvpn as shown above with that 5 or 6 commands. Don't generate a new static key, instead copy that one you have made on the openvpn peer1 to
/etc/openvpn/ with same permission (
sudo chmod 600 /etc/openvpn/static.key). Create a peer2 config file:
mngmt ~# cat > /etc/openvpn/peer2.conf <<EOF remote 192.168.4.3 dev tun ifconfig 10.8.0.2 10.8.0.1 secret static.key cipher AES-256-CBC EOF
This config file is made to test the vpn tunnel on your local network first. Now start the peer2 with:
mngmt ~# exit mngmt ~$ sudo systemctl start email@example.com
Now you should be able to ping the peer1:
mngmt ~$ ping 10.8.0.1
If it works we can test to connect from the internet. To be sure not conflicting with local setup we have to use a complete different path to connect to the internet. For this I use my android cell phone with USB tethering to the management computer where I have disabled wifi on the phone to be sure only using 4G data uplink. I also disabled wifi on the management computer and pulled out its ethernet cord. The default port of openvpn is
1194 so you have to forward this port on your router to the local openvpn peer1 192.168.4.2 port 1194 (192.168.4.2:1194). It is important to use protocol udp not tcp. Look at the router what it's current public ip address is, in my example 126.96.36.199. Then change the line
remote 192.168.4.3 in
remote 188.8.131.52 and
Then enable USB tethering on your mobile phone and start peer2. You can check if port forwarding is set on the remote router with:
mngmt ~$ sudo nmap -Pn -sU -p1194 184.108.40.206 Starting Nmap 7.70 ( https://nmap.org ) at 2019-08-03 16:20 BST Nmap scan report for p57A8602E.dip0.t-ipconnect.de (220.127.116.11) Host is up. PORT STATE SERVICE 1194/udp open|filtered openvpn Nmap done: 1 IP address (1 host up) scanned in 2.31 seconds
This only checks if the port forwarding is active on the router. It does not check if the openvpn peer behind is active. This you can finally check with ping:
mngmt ~$ sudo systemctl start firstname.lastname@example.org mngmt ~$ ping 10.8.0.1 PING 10.8.0.1 (10.8.0.1) 56(84) bytes of data. 64 bytes from 10.8.0.1: icmp_seq=1 ttl=64 time=743 ms 64 bytes from 10.8.0.1: icmp_seq=2 ttl=64 time=504 ms 64 bytes from 10.8.0.1: icmp_seq=3 ttl=64 time=403 ms
If this works then you have a running vpn tunnel through the internet to your local RasPi. If you want to connect in the other direction then just comment
remote <ip address> in
/etc/openvpn/peer2.conf and set it in
With this simple setup with a pre shared secret key you can ensure that the environment is working (port forwarding, routing etc.). Now you can improve the setup of openvpn step by step with all its nice features like TLS public key authentication, connecting whole subnets, not only one RasPi, using tap interfaces instead of tun interfaces to remotely play games that need broadcasts and so on. But this isn't subject of this site.
 openvpn - Static Key Mini-HOWTO
 man openvpn