Connecting to a VPN from a public Wi-Fi access point is much safer. This guide will walkthrough how to set up a Mac and iOS client to connect to a VPN server running on a Raspberry Pi.
Materials
- Local network
- Mac or PC
- Raspberry Pi running Raspbian “wheezy” with an OpenVPN server setup
- HDMI Cable (*optional)
- Keyboard (*optional)
- Mouse (*optional)
- Monitor with HDMI input (*optional)
*If the Raspberry Pi is set up as a headless machine, you will not need a monitor, keyboard, or mouse–just another computer, which would be used to access it remotely over the network via SSH.
Downloads
- Tunneblick (OS X)
Knowledge, Skills, and Abilities
Tunnelblick is a free, open source graphic user interface for OpenVPN on OS X. X cite chiki chika. It provides easy control of OpenVPN client and/or server connections. It comes as a ready-to-use application with all necessary binaries and drivers (including OpenVPN, easy-rsa, and tun/tap drivers). Alter config.json on each provider to have the name of the cert setup in Tunnelblick; Start openvpn server on STF server; Start coordinator/provider on each provider machine; Handling video not working. Run./viewlog proc iosvideopull to check for errors fetching h264 data from the IOS device. See full list on tunnelblick.net.
- Ability to naviagate throughout a computer OS
- Knowledge of basic computer terminology
- Ability and confidence to enter commands in the Terminal, adjusting them to suit your enviornment, if necessary
- Familiarity with core networking concepts
- Basic understanding of Public Key Infrastructure
A Tunnelblick VPN Configuration contains all of the information Tunnelblick needs to connect to one or more VPNs. A Tunnelblick VPN Configuration contains one or more OpenVPN configuration files, and may contain key, certificate, and script files. Everything needed is contained within the Tunnelblick VPN Configuration.
This how-to sets is a direct continuation of my OpenVPN server how-to. The server should be set up and ready.
Setup A Client Config File
Copy A Sample Config File
Make a copy of the example config file and then edit that.
cd /etc/openvpn sudo cp /usr/share/doc/openvpn/examples/sample-config-files/client.conf /etc/openvpn sudo cp /etc/openvpn/client.conf /etc/openvpn/client1.conf
Edit the Client Config File
vi /etc/openvpn/client1.conf
You can use the following commands to view the settings without all of the comments:
cat client1.conf | grep -v '#' | tr -s 'n' cat client1.conf | grep -v '#' | grep -v ';' | tr -s 'n'
There are only three changes (in bold) to make in this file. The first is the line that readsremote my-server-1 1194 . It needs to be changed to the RPi’s IP address or domain name if using a Dynamic DNS service. After the change, your file should like this:
remote myhomenetwork.net 1194
The second change is to comment out the lines referring to the location of the keys
# ca ca.crt # cert client.crt # key client.key
Finally, we are going to use inline references to the keys and certificates as opposed to packaging them up together. Copy and paste each in the appropriate area:
<ca> -----BEGIN CERTIFICATE----- # insert base64 blob from ca.crt -----END CERTIFICATE----- </ca> <cert> -----BEGIN CERTIFICATE----- # insert base64 blob from client1.crt -----END CERTIFICATE----- </cert> <key> -----BEGIN PRIVATE KEY----- # insert base64 blob from client1.key -----END PRIVATE KEY----- </key>
The Client File Should Look Similar to This When The Changes Are Complete
client dev tun proto udp remote myhomenetwork.net 1194 resolv-retry infinite nobind persist-key persist-tun ns-cert-type server # ca ca.crt # cert client1.crt # key client1.key comp-lzo verb 3 <ca> -----BEGIN CERTIFICATE----- KJhdiuhJOkjNJKNNoiNIENJNSDFWEnSDNFSNDFonkjNSDfonSDOFnOnfOoiNDnSKLNfSNDflkNSDfgSDfnSLDKfnSndfsdnfLSNDflNFLSNFSNDkjsDNfNSFNSDFkjnsDFnSPVJOSNFoNoSNoNonLDNlOIOIJoiOJOIJfknkjnelspivnounewuoinybvytonirngonwoinNFOINWFOWENFNWEOFNWEIFNDOINSKJDCNOIWENIOFGSDFISBFJSHDBFLSDBFIUWBFISBFHBFKJSDBFKSDBFKSDBFKJNFKJSDBFKJSDBNFKJSDNFKSNVOINIDNFOIFIJWNFKJSDBFGKJSDBFKSJDBFKJSDKSDJBFKJSBFKJSDBFKJSBDFKJSBDFKJSDNONVO= -----END CERTIFICATE----- <ca> <cert> -----BEGIN CERTIFICATE----- KJhdiuhJOkjNJKNNoiNIENJNSDFWEnSDNFSNDFonkjNSDfonSDOFnOnfOoiNDnSKLNfSNDflkNSDfgSDfnSLDKfnSndfsdnfLSNDflNFLSNFSNDkjsDNfNSFNSDFkjnsDFnSPVJOSNFoNoSNoNonLDNlOIOIJoiOJOIJfknkjnelspivnounewuoinybvytonirngonwoinNFOINWFOWENFNWEOFNWEIFNDOINSKJDCNOIWENIOFGSDFISBFJSHDBFLSDBFIUWBFISBFHBFKJSDBFKSDBFKSDBFKJNFKJSDBFKJSDBNFKJSDNFKSNVOINIDNFOIFIJWNFKJSDBFGKJSDBFKSJDBFKJSDKSDJBFKJSBFKJSDBFKJSBDFKJSBDFKJSDNONVO= -----END CERTIFICATE----- </cert> <key> -----BEGIN PRIVATE KEY----- KJhdiuhJOkjNJKNNoiNIENJNSDFWEnSDNFSNDFonkjNSDfonSDOFnOnfOoiNDnSKLNfSNDflkNSDfgSDfnSLDKfnSndfsdnfLSNDflNFLSNFSNDkjsDNfNSFNSDFkjnsDFnSPVJOSNFoNoSNoNonLDNlOIOIJoiOJOIJfknkjnelspivnounewuoinybvytonirngonwoinNFOINWFOWENFNWEOFNWEIFNDOINSKJDCNOIWENIOFGSDFISBFJSHDBFLSDBFIUWBFISBFHBFKJSDBFKSDBFKSDBFKJNFKJSDBFKJSDBNFKJSDNFKSNVOINIDNFOIFIJWNFKJSDBFGKJSDBFKSJDBFKJSDKSDJBFKJSBFKJSDBFKJSBDFKJSBDFKJSDNONVO= -----END PRIVATE KEY----- </key>
Install the Config File to an iOS Device
Download the OpenVPN app
In order to use OpenVPN, the app needs to be downloaded to an iOS device.
Rename the Config File’s File Extension
Rename the file to client1.conf to client1.ovpn
Vpn Tunnelblick Ios
mv client1.conf client1.ovpn
Email the Config File to Yourself, or Use Dropbox/Google Drive, etc.
In order to setup the OpenVPN connection on the iOS device, the configuration file needs to be accessible from iOS. Any of the file sharing/syncing apps should work, or you can simply email the file to yourself. Once it is on the device, just touch it and choose to open it using OpenVPN.
Setup A Client Config File
Follow the steps above to make a new config file, but stop at the step where the certificate/keys are commented out. Instead, provide the path to those keys. The config file should look like this.
client dev tun proto udp remote myhomenetwork.net 1194 resolv-retry infinite nobind persist-key persist-tun ns-cert-type server ca ca.crt cert client1.crt key client1.key comp-lzo verb 3
Ios Tunnelblick Pc
Copy the four files required by OS X and Tunnelblick to another computer:
/etc/openvpn/easy-rsa/keys/client1.conf /etc/openvpn/easy-rsa/keys/ca.crt /etc/openvpn/easy-rsa/keys/client1.cert /etc/openvpn/easy-rsa/keys/client1.key
Below are the commands for doing it via SCP.
scp /etc/openvpn/easy-rsa/keys/client1.conf <usename>@<remotehost>:/Users/Shared scp /etc/openvpn/easy-rsa/keys/cca.crt <usename>@<remotehost>:/Users/Shared scp /etc/openvpn/easy-rsa/keys/client1.cert <usename>@<remotehost>:/Users/Shared scp /etc/openvpn/easy-rsa/keys/client1.key <usename>@<remotehost>:/Users/Shared
Reference this great chart from openvpn.net to see what files need to go where:
FilenameNeeded ByPurposeSecretca.crtserver + all clientsRoot CA certificateNOca.keykey signing machine onlyRoot CA keyYESdh{n}.pemserver onlyDiffie Hellman parametersNOserver.crtserver onlyServer CertificateNOserver.keyserver onlyServer KeyYESclient1.crtclient1 onlyClient1 CertificateNOclient1.keyclient1 onlyClient1 KeyYESclient2.crtclient2 onlyClient2 CertificateNOclient2.keyclient2 onlyClient2 KeyYESclient3.crtclient3 onlyClient3 CertificateNOclient3.keyclient3 onlyClient3 KeyYES
Bundle the OpenVPN Files Together To Make Them Compatible With Tunnelblick
Copy all four of the required file onto the Desktop or some other convenient folder.
Create a new folder called client1
.
Move the four files into the new folder.
Rename the folder to client1.tblk
Confirm the usage of the .tblk
file extension.
The folder is converted into a single file, which can be double-clicked and will open in Tunnelblick.
Simply use to menubar item for Tunnelblick to connect to the VPN.
Ios Tunnelblick Download
Tunnelblick helps you control OpenVPN® VPNs on macOS. It is Free Software that puts its users first. There are no ads, no affiliate marketers, no tracking — we don't even keep logs of your IP address or other information. We just supply open technology for fast, easy, private, and secure control of VPNs. Tunnelblick comes as a ready-to-use application with all necessary binaries and drivers (including OpenVPN, easy-rsa, and tun/tap drivers). No additional installation is necessary — just add your OpenVPN configuration and encryption information. To use Tunnelblick you need access to a VPN server: your computer is one end of the tunnel and the VPN server is the other end. For more information, see Getting VPN Service. Tunnelblick is licensed under the GNU General Public License, version 2 and may be distributed only in accordance with the terms of that license. OpenVPN is a registered trademark of OpenVPN Inc. |