[Howto] openVPN mit TUN/TAP

#!/bin/sh################################################################################################### autorun.sh to prepare qnap NAS (here tested with ts-110) to start different initial scripts# with additional security not to hang the system during tests using a USB-Stick to block# starting those scripts if necessary ;-)## There's absolutely no chance to get it going without the first section,  because the /opt # structure is completed by the system   a f t e r  finshed working on the autorun file. # Up to that point additional software started won't find it's libraries and won't work correctly.# Thanks to David (Terz) for these hints and ideas e.g.:# http://forum.qnapclub.de/ucp.php?i=pm&mode=view&f=0&p=6218&sid=2d8a4df616faa21558c54a4c90c3100d## If You link this scripts to autorun.sh file it can be edited without circumstances of doing# mount -t ext2 /dev/mtdblock5 /tmp/config   a n d# umount /tmp/config## c/o peter meins 2009################################################################################################### id of the block-stick -> adapt it to Yours ( use lsusb :)MNUSBStick="ID 090c:1000"# first section - delete old fragments of /optrm -rf /opt# and give a new link to /optln -sf /share/HDA_DATA/.qpkg/Optware /opt# search-paths </opt/bin>, </opt/sbin> to the profile, because# a pure export will only work on this task and its childrenecho "export PATH=$PATH:/opt/bin:/opt/sbin" >> /etc/profile# alias setup for midnight commander to bloom in blue# of course only if U use it . . .echo 'alias mc="mc -c"' >> /etc/profile# only execute if blocking USBstick is not plugged in to prevent hang-ups during test-phaseif (lsusb | grep "$MNUSBStick"); then	# message to admin in log	echo "no additional software gonna be started" > /share/HDA_DATA/.qpkg/Optware/etc/openvpn/log/boot.log	# no more excitement	exit 1else	# start environment for openvpn	/share/HDA_DATA/.qpkg/Optware/etc/openvpn/vpnstart.sh start &    # keep on going with what U want to edfi# that's itexit 0################################################################################################### eop start.sh/*This program is free software; you can redistribute it and/ormodify it under the terms of the GNU General Public Licenseas published by the Free Software Foundation; either version 2of the License, or (at your option) any later version.This program is distributed in the hope that it will be useful,but WITHOUT ANY WARRANTY; without even the implied warranty ofMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See theGNU General Public License for more details.You should have received a copy of the GNU General Public Licensealong with this program; if not, write to the Free SoftwareFoundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.*/

#!/bin/sh################################################################################################### autorun.sh to prepare qnap NAS (here tested with ts-110) to start different initial scripts# with additional security not to hang the system during tests using a USB-Stick to block# starting those scripts if necessary ;-)## There's absolutely no chance to get it going without the first section,  because the /opt# structure is completed by the system   a f t e r  finshed working on the autorun file.# Up to that point additional software started won't find it's libraries and won't work correctly.# Thanks to David (Terz) for these hints and ideas e.g.:# http://forum.qnapclub.de/ucp.php?i=pm&mode=view&f=0&p=6218&sid=2d8a4df616faa21558c54a4c90c3100d## If You link this scripts to autorun.sh file it can be edited without circumstances of doing# mount -t ext2 /dev/mtdblock5 /tmp/config   a n d# ln -sf /share/HDA_DATA/.qpkg/Optware/etc/openvpn/start.sh /tmp/config/autorun.sh# chmod +x /tmp/config/autorun.sh# umount /tmp/config## c/o peter meins 2009/2010################################################################################################### expence of lsusb w/o usb-stick -> adapt it to Yours ( use lsusb :)# and copy result to var <NoStick> right hereNoStick='Bus 001 Device 002: ID 05e3:0608 Genesys Logic, Inc.Bus 001 Device 001: ID 1d6b:0002'# take off new line and spacesNoStick=$(echo "$NoStick" | tr -d "\n" | tr -d ' ')# first section - delete old fragments of /optrm -rf /opt# and give a new link to /optln -sf /share/HDA_DATA/.qpkg/Optware /opt# search-paths </opt/bin>, </opt/sbin> to the profile, because# a pure export will only work on this task and its childrenecho "export PATH=$PATH:/opt/bin:/opt/sbin" >> /etc/profile# alias setup for midnight commander to bloom in blue# of course only if U use it . . .echo 'alias mc="mc -c"' >> /etc/profile# make file writeablechmod 2777 /share/HDA_DATA/Qmultimedia/# read the momentary situation and trim the resultRightNow=`lsusb | tr -d "\n" | tr -d ' '`if [ "$RightNow" == "$NoStick" ]; then    # no stick present    # start environment for openvpn    /share/HDA_DATA/.qpkg/Optware/etc/openvpn/vpnstart.sh start &    # keep on going with what U want to edelse    # a stick present -> no action    # message to admin in log    echo "no additional software gonna be started" > /share/HDA_DATA/.qpkg/Optware/etc/openvpn/log/boot.log    # no more excitement    exit 1fi# that's itexit 0################################################################################################### eop start.sh/*This program is free software; you can redistribute it and/ormodify it under the terms of the GNU General Public Licenseas published by the Free Software Foundation; either version 2of the License, or (at your option) any later version.This program is distributed in the hope that it will be useful,but WITHOUT ANY WARRANTY; without even the implied warranty ofMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See theGNU General Public License for more details.You should have received a copy of the GNU General Public Licensealong with this program; if not, write to the Free SoftwareFoundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.*/

#!/bin/sh########################################################################################## preparing start of openvpn-client on qnap NAS being called by autorun.sh.# It will connect to an openvpn server ( tested with gentoo :)# Location in /share/HDA_DATA/.qpkg/Optware/etc/openvpn/vpnstart.sh# depending on nas-type ( here tested: TS 110 )# This will create a tap-device and bridge it together with et0 to br0# The same subnet like on server-side is used. # Can be adapted in connection-variables-section.# # c/o peter meins 2009########################################################################################## parameter-declarations## search-pathsPS="/bin/ps"GREP="/bin/grep"MKDIR="/bin/mkdir"RM="/bin/rm"PING="/bin/ping"INSMOD="/sbin/insmod"LSMOD="/sbin/lsmod"IFCONFIG="/sbin/ifconfig"ROUTE="/sbin/route"OPENVPN="/share/HDA_DATA/.qpkg/Optware/sbin/openvpn"BRCTL="/opt/sbin/brctl"KILLALL="/usr/bin/killall"## connection-variablesbr="br0"eth="eth0"tap="tap0"eth_ip="10.1.1.101"eth_netmask="255.255.255.0"eth_gateway="10.1.1.200"MNLogDir="/share/HDA_DATA/.qpkg/Optware/etc/openvpn/log"MNLogFile=$MNLogDir"/boot.log"MNFlagFile="/mnt/HDA_ROOT/.config/uLinux.conf"MNTimeOut=0MNDebug=1       # 0 to mute########################################################################################## Routine zur Logbucherstellung beim Boot des NAS########################################################################################## Function log()log(){	local logtext="$1"    # ether no debug-message or debug-message and debug-flag set    if ( test $# -lt 2 ) || ( ( test $# -eq "2" )  && (($MNDebug)) ); then        # Protokollierung        if !(test $MNLogFile = ""); then            echo -n $(date +%c)' : ' >> $MNLogFile            if (test "$logtext" = ""); then                echo $0				 >> $MNLogFile            elif (test "$logtext" = "-"); then                echo "--------------------------------------------------" >> $MNLogFile            else                echo $logtext		 >> $MNLogFile            fi        fi        # all right to log-file        chmod 777 $MNLogFile    fi}# eoFunction#########################################################################################case "$1" in    start)        log "last vpn-check" -debug        # create log-dir        $MKDIR -p $MNLogDir        # und alte log-Datei löschen        $RM $MNLogFile        log "preparing boot of openvpn"        # wait for boot with timeout of 10 min.        log "waiting for boot to be finished" -debug        MNTimeOut=120        # the ts-110 has a sys-file with a Booting-flag-variable        # showing value 1 while babe is crawling        until ($GREP "Booting = 0" $MNFlagFile); do             sleep 5             ((MNTimeOut--))            if [ "$MNTimeOut" -le "0" ]; then                 log "Timeout: Boot not finished" -debug                        exit 1            fi        done         log "booting finished" -debug        # load modul for tun        $INSMOD /usr/local/modules/tun.ko > /dev/null 2>&1        if ($LSMOD | $GREP tun); then             log "found tun-modul" -debug        else            log "no tun-modul" -debug            exit 1            fi        # load modul for bridge        $INSMOD /usr/local/modules/bridge.ko > /dev/null 2>&1        if ($LSMOD | $GREP bridge); then            log "found bridge-modul" -debug        else            log "no bridge-modul" -debug            exit 1        fi        log "system ready all modules present" -debug        # waiting for bin-file to be ready with timeout of 5 min.        MNTimeOut=60        until [ -x $OPENVPN ]; do             sleep 5             ((MNTimeOut--))            if ( "$MNTimeOut" -le "0" ); then                 log "Timeout: Bin file not available" -debug                        exit 1            fi        done         log "bin file available to do the job" -debug        # create a tap-device if not present        if !($IFCONFIG -a | $GREP tap0); then            # we need a tap-device for a brigded system -> lets do it            $OPENVPN --mktun --dev tap0            # if something went wrong            if [ ! $? ] ; then                log "creating tap-device went wrong!" -debug                exit 1            fi            # check it with timeout of 5 min. before giving up            MNTimeOut=60            until ($IFCONFIG -a | $GREP tap0); do                 sleep 5                 ((MNTimeOut--))                if [ "$MNTimeOut" -le "0" ]; then                     log "Timeout: Tap-device not created" -debug                            exit 1                fi            done             log "tap0 device created" -debug        fi        # create the bridge if not present        if !($IFCONFIG -a | $GREP br0); then            # add a bridge            $BRCTL addbr $br            log "bridge $br created" -debug            # add eth in            $BRCTL addif $br $eth            log "eth-device $eth tied to the bridge" -debug            # add tap in            $BRCTL addif $br $tap            log "tap-device $tap tied to the bridge" -debug            # set them to promisc-mode            $IFCONFIG $tap 0.0.0.0 promisc up            $IFCONFIG $eth 0.0.0.0 promisc up            log "both devices set into the promisc-mode" -debug            # put the address back to the bridge            $IFCONFIG $br $eth_ip netmask $eth_netmask            log "given ethernet-ip $eth_ip to the bridge" -debug            # and give default gateway to the bridge            $ROUTE add default gw $eth_gateway $br            log "set default route $eth_gateway to bridge $br" -debug        fi         # here's a bridge so everything worked out        if ($IFCONFIG -a | $GREP br0); then            # starting OpenVPN            $OPENVPN --config /share/HDA_DATA/.qpkg/Optware/etc/openvpn/openvpn.conf --daemon            # check the whole thing            if ($PS ax | $GREP openvpn | $GREP -v grep > /dev/null 2>&1); then                log "openvpn ready to go" -debug            else                log "openvpn not started" -debug                exit 1            fi        else            # or damned not            log "no bridge $br available" -debug                        exit 1        fi        ;;    stop)        # nothing to do        if [ -n "`pidof openvpn`" ]; then            $KILLALL openvpn 2>/dev/null        fi        ;;    restart)        $0 stop        $0 start        ;;    *)        echo "Usage: /etc/init.d/vpnstart.sh {start|stop|restart}"        exit 1esacexit 0############################################ eof vpnstart.sh/*This program is free software; you can redistribute it and/ormodify it under the terms of the GNU General Public Licenseas published by the Free Software Foundation; either version 2of the License, or (at your option) any later version.This program is distributed in the hope that it will be useful,but WITHOUT ANY WARRANTY; without even the implied warranty ofMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See theGNU General Public License for more details.You should have received a copy of the GNU General Public Licensealong with this program; if not, write to the Free SoftwareFoundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.*/

#!/bin/sh######################################################################################################################################## preparing start of openvpn-client on qnap NAS being called by autorun.sh.# It will connect to an openvpn server ( tested with gentoo :)# Location in /share/HDA_DATA/.qpkg/Optware/etc/openvpn/vpnstart.sh# depending on nas-type ( here tested: TS 110 )# This will create a tap-device and bridge it together with et0 to br0# The same subnet like on server-side is used.# Can be adapted in connection-variables-section.## c/o peter meins 2009########################################################################################## parameter-declarations## search-pathsPS="/bin/ps"GREP="/bin/grep"MKDIR="/bin/mkdir"RM="/bin/rm"PING="/bin/ping"INSMOD="/sbin/insmod"LSMOD="/sbin/lsmod"IFCONFIG="/sbin/ifconfig"ROUTE="/sbin/route"OPENVPN="/share/HDA_DATA/.qpkg/Optware/sbin/openvpn"BRCTL="/opt/sbin/brctl"KILLALL="/usr/bin/killall"## connection-variablesbr="br0"eth="eth0"tap="tap0"eth_ip="10.1.1.105"eth_netmask="255.255.255.0"eth_gateway="10.1.1.205"MNLogDir="/share/HDA_DATA/.qpkg/Optware/etc/openvpn/log"MNLogFile=$MNLogDir"/boot.log"MNFlagFile="/mnt/HDA_ROOT/.config/uLinux.conf"MNTimeOut=0MNDebug=1       # 0 to mute########################################################################################## Routine zur Logbucherstellung beim Boot des NAS########################################################################################## Function log()log(){	local logtext="$1"    # ether no debug-message or debug-message and debug-flag set    if ( test $# -lt 2 ) || ( ( test $# -eq "2" )  && (($MNDebug)) ); then        # Protokollierung        if !(test $MNLogFile = ""); then            echo -n $(date +%c)' : ' >> $MNLogFile            if (test "$logtext" = ""); then                echo $0				 >> $MNLogFile            elif (test "$logtext" = "-"); then                echo "--------------------------------------------------" >> $MNLogFile            else                echo $logtext		 >> $MNLogFile            fi        fi        # all right to log-file        chmod 777 $MNLogFile    fi}# eoFunction#########################################################################################case "$1" in    start)        log "last vpn-check" -debug        # create log-dir        $MKDIR -p $MNLogDir        # und alte log-Datei löschen        $RM $MNLogFile        log "preparing boot of openvpn"        # wait for boot with timeout of 10 min.        log "waiting for boot to be finished" -debug        MNTimeOut=120        # the ts-110 has a sys-file with a Booting-flag-variable        # showing value 1 while babe is crawling        until ($GREP "Booting = 0" $MNFlagFile); do            sleep 5            ((MNTimeOut--))            if [ "$MNTimeOut" -le "0" ]; then                log "Timeout: Boot not finished" -debug                exit 1            fi        done        log "booting finished" -debug        # load modul for tun        $INSMOD /usr/local/modules/tun.ko > /dev/null 2>&1        if ($LSMOD | $GREP tun); then            log "found tun-modul" -debug        else            log "no tun-modul" -debug            exit 1        fi		# have a look at		# http://forum.qnapclub.de/viewtopic.php?f=33&t=7421&sid=0f1efd2ed6785297d39793fb4f04910f&start=10		# to verify that the stp-module has to be loaded        # load modul stp        $INSMOD /usr/local/modules/stp.ko > /dev/null 2>&1        if ($LSMOD | $GREP stp); then            log "found stp-module" -debug        else            log "no stp-module" -debug            exit 1        fi        # load modul bridge        $INSMOD /usr/local/modules/bridge.ko > /dev/null 2>&1        if ($LSMOD | $GREP bridge); then            log "found bridge-module" -debug        else            log "no bridge-module" -debug            exit 1        fi        log "system ready all modules present" -debug        # waiting for bin-file to be ready with timeout of 5 min.        MNTimeOut=60        until [ -x $OPENVPN ]; do            sleep 5            ((MNTimeOut--))            if ( "$MNTimeOut" -le "0" ); then                log "Timeout: Bin file not available" -debug                exit 1            fi        done        log "bin file available to do the job" -debug        # create the bridge if not present        if !($IFCONFIG -a | $GREP br0); then            # add a bridge            $BRCTL addbr $br            MNTimeOut=60            until ($IFCONFIG -a | $GREP $br); do                sleep 5                ((MNTimeOut--))                if ( "$MNTimeOut" -le "0" ); then                    log "Timeout: Bridge-device not available" -debug                    exit 1                fi            done            log "bridge $br created" -debug	     # add eth in            $BRCTL addif $br $eth            log "eth-device $eth tied to the bridge" -debug            # set it to promisc-mode            $IFCONFIG $eth 0.0.0.0 promisc up            log "tap-device set into the promisc-mode" -debug            # put the address back to the bridge            $IFCONFIG $br $eth_ip netmask $eth_netmask            log "given ethernet-ip $eth_ip to the bridge" -debug            # and give default gateway to the bridge            $ROUTE add default gw $eth_gateway $br            log "set default route $eth_gateway to bridge $br" -debug	     # internet available            MNTimeOut=10            until (ping -c 1 www.google.de); do                sleep 5                ((MNTimeOut--))                if ( "$MNTimeOut" -le "0" ); then                    log "the internet could'nt be reached" -debug                    exit 1                fi            done            log "Internet available" -debug			# going to call openvpn			log "going to call ovpn" -debug         # starting OpenVPN            $OPENVPN --config /share/HDA_DATA/.qpkg/Optware/etc/openvpn/openvpn.conf --daemon         # check the whole thing            if ($PS ax | $GREP openvpn | $GREP -v grep > /dev/null 2>&1); then                log "openvpn ready to go" -debug            else                log "openvpn not started" -debug                exit 1            fi        fi        # checkfor tap-device with timeout of 5 min. before giving up        MNTimeOut=60        until ($IFCONFIG -a | $GREP tap0); do            sleep 5            ((MNTimeOut--))            if [ "$MNTimeOut" -le "0" ]; then                log "Timeout: Tap-device not created" -debug                exit 1            fi        done        log "tap0 device created" -debug		# add tap in        $BRCTL addif $br $tap        log "tap-device $tap tied to the bridge" -debug        # set it to promisc-mode        $IFCONFIG $tap 0.0.0.0 promisc up        log "tap-device set into the promisc-mode" -debug        # ready 2 go        log "openvpn ready to go" -debug		;;    stop)        # nothing to do        if [ -n "`pidof openvpn`" ]; then            $KILLALL openvpn 2>/dev/null        fi        ;;    restart)        $0 stop        $0 start        ;;    *)        echo "Usage: /etc/init.d/vpnstart.sh {start|stop|restart}"        exit 1esacexit 0############################################ eof vpnstart.sh/*This program is free software; you can redistribute it and/ormodify it under the terms of the GNU General Public Licenseas published by the Free Software Foundation; either version 2of the License, or (at your option) any later version.This program is distributed in the hope that it will be useful,but WITHOUT ANY WARRANTY; without even the implied warranty ofMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See theGNU General Public License for more details.You should have received a copy of the GNU General Public Licensealong with this program; if not, write to the Free SoftwareFoundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.*/

clientdev tapproto udpfloatnobindremote servmin.homelinux.org 1194resolv-retry infinitepersist-keypersist-tunca /share/HDA_DATA/.qpkg/Optware/etc/openvpn/keys/ca.crtcert /share/HDA_DATA/.qpkg/Optware/etc/openvpn/keys/client2.crtkey /share/HDA_DATA/.qpkg/Optware/etc/openvpn/keys/client2.keycomp-lzolog /share/HDA_DATA/.qpkg/Optware/etc/openvpn/log/client.logverb 3status /share/HDA_DATA/.qpkg/Optware/etc/openvpn/log/client-status.logtls-auth /share/HDA_DATA/.qpkg/Optware/etc/openvpn/keys/ta.key 1tls-clientfragment 1300mssfix

[~] #  ls -l  /share/HDA_DATA/.qpkg/Optware/etc/openvpn/keys-rwxr-xr-x    1 admin    administ     1074 Sep 27  2007 ca.crt*-rwxr-xr-x    1 admin    administ     3613 Oct 14 00:57 client2.crt*-rwxr-xr-x    1 admin    administ      887 Oct 14 00:56 client2.key*-rwxr-xr-x    1 admin    administ      636 Mar  5  2008 ta.key*