{"id":1,"date":"2021-03-16T15:38:03","date_gmt":"2021-03-16T15:38:03","guid":{"rendered":"https:\/\/honest-magic.ch\/?p=1"},"modified":"2021-08-08T16:30:06","modified_gmt":"2021-08-08T15:30:06","slug":"site-to-site-vpn-usg-ubuntu","status":"publish","type":"post","link":"https:\/\/honest-magic.ch\/index.php\/2021\/03\/16\/site-to-site-vpn-usg-ubuntu\/","title":{"rendered":"Tutorial: Setup Site-To-Site VPN with OpenVPN, Unifi Security Gateway and Ubuntu"},"content":{"rendered":"\n

Here is some experience around the setup of an OpenVPN site-to-site connection from Ubuntu 20.04.2 LTS to UniFi Security Gateway (USG) written down.<\/p>\n\n\n\n

Preparation<\/h2>\n\n\n\n

UniFi Security Gateway<\/h5>\n\n\n\n
Public IP address<\/td>1.1.1.1<\/td><\/tr>
Local subnet<\/td>192.168.1.0\/24<\/td><\/tr>
Local IP address<\/td>192.168.1.1<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
Ubuntu 20.4.2 LTS<\/h5>\n\n\n\n
Public IP address<\/td>4.4.4.4<\/td><\/tr>
Local subnet <\/td>192.168.4.0\/24<\/td><\/tr>
Local IP address<\/td>192.168.4.1<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

To setup an OpenVPN site-to-site VPN on the UniFi Security Gateway access is needed to the UniFi Network Controller 6.0.45 console. To generate the needed preshared key you need access to the USG using SSH. These steps are based on the UniFi Network Controller 6.0.45 and the Classic UI.<\/p>\n\n\n\n

Preshared Key<\/h3>\n\n\n\n
  1. Connect to the USG using SSH, e.g.
    $ ssh <\/code>user@192.168.1.1<\/li>
  2. Generate the OpenVPN preshared key
    $ <\/code>generate vpn openvpn-key \/tmp\/ovpn
    \"\"<\/li>
  3. Copy the key between
    —–BEGIN OpenVPN Static key V1—–
    and
    —–END OpenVPN Static key V1—–
    and remove the newlines for the USG configuration.<\/li>
  4. Save the whole \/tmp\/ovpn file content for the Ubuntu configuration.<\/li><\/ol>\n\n\n\n

    UniFi Security Gateway Configuration<\/h3>\n\n\n\n
    1. Login to the UniFi Network Controller and open the Settings in the Classic UI
      \"\"<\/li>
    2. Open “Networks” and press
      \"\"<\/li>
    3. Select “Site to Site VPN” as purpose and choose OpenVPN as type. Fill in the form as showed in the picture<\/a> below. The preshared key we generated in the last section can now be entered here.<\/li>
    4. Save the network<\/li><\/ol>\n\n\n\n
      \"\"
      USG configuration<\/figcaption><\/figure>\n\n\n\n

      Ubuntu 20.04.2 LTS Configuration<\/h3>\n\n\n\n

      Access the Linux on a shell. You will need sudo permissions.Install OpenVPN<\/p>\n\n\n\n

      Install OpenVPN<\/h4>\n\n\n\n
      $ sudo apt install openvpn<\/code><\/pre>\n\n\n\n
      Enable IP Forwarding<\/h4>\n\n\n\n
      $ sudo cat >> \/etc\/sysctl.conf << EOF\nnet.ipv4.ip_forward = 1\nnet.ipv6.conf.all.forwarding = 1\nnet.ipv4.conf.all.accept_redirects = 0\nnet.ipv4.conf.all.send_redirects = 0\nEOF\n\n$ sudo sysctl -p<\/code><\/pre>\n\n\n\n
      Configure Firewall<\/h4>\n\n\n\n
      Add the following text at the beginning of the file \/etc\/ufw\/before.rules<\/strong> before everything else:<\/p>\n\n\n\n
      *nat\n:POSTROUTING ACCEPT [0:0]\n\n-A POSTROUTING -s 192.168.1.0\/24 -d 192.168.4.0\/24 -j MASQUERADE\n\nCOMMIT<\/code><\/pre>\n\n\n\n
      $ sudo ufw disable\n$ sudo ufw enable<\/code><\/pre>\n\n\n\n
      OpenVPN Configuration File<\/h4>\n\n\n\n
      Create the configuration file \/etc\/openvpn\/server\/demo-vpn.conf<\/strong> with the following content:<\/p>\n\n\n\n
      #\n# Sample OpenVPN configuration file for\n# office using a pre-shared static key.\n#\n# '#' or ';' may be used to delimit comments.\n\n# Use a dynamic tun device.\n# For Linux 2.2 or non-Linux OSes,\n# you may want to use an explicit\n# unit number such as \"tun1\".\n# OpenVPN also supports virtual\n# ethernet \"tap\" devices.\ndev tun42\n\nremote 1.1.1.1\n\n\nifconfig 10.1.0.2 10.1.0.1\n\nscript-security 3\n\n# Our up script will establish routes\n# once the VPN is alive.\nup .\/demo-configure-routes.up\n\n# Our pre-shared static key\nsecret demo-preshared.key\n\n# OpenVPN 2.0 uses UDP port 1194 by default\n# (official port assignment by iana.org 11\/04).\n# OpenVPN 1.x uses UDP port 5000 by default.\n# Each OpenVPN tunnel must use\n# a different port number.\n# lport or rport can be used\n# to denote different ports\n# for local and remote.\n;port 1194\n\n# Downgrade UID and GID to\n# \"nobody\" after initialization\n# for extra security.\n; user nobody\n; group nobody\n\n# If you built OpenVPN with\n# LZO compression, uncomment\n# out the following line.\n; comp-lzo\n\n# Send a UDP ping to remote once\n# every 15 seconds to keep\n# stateful firewall connection\n# alive.  Uncomment this\n# out if you are using a stateful\n# firewall.\n; ping 15\n\n# Uncomment this section for a more reliable detection when a system\n# loses its connection.  For example, dial-ups or laptops that\n# travel to other locations.\nping 15\nping-restart 45\nping-timer-rem\npersist-tun\npersist-key\n\n# Verbosity level.\n# 0 -- quiet except for fatal errors.\n# 1 -- mostly quiet, but display non-fatal network errors.\n# 3 -- medium output, good for normal operation.\n# 9 -- verbose, good for troubleshooting\nverb 3<\/code><\/pre>\n\n\n\n
      Save the content of the generated OpenVPN key (\/tmp\/ovpn on USG) to the file \/etc\/openvpn\/server\/demo-preshared.key<\/strong><\/p>\n\n\n\n
      Create the file \/etc\/openvpn\/server\/demo-configure-routes.up<\/strong> with the following content:<\/p>\n\n\n\n
      #!\/bin\/sh\nroute add -net 192.168.1.0 netmask 255.255.255.0 gw $5<\/code><\/pre>\n\n\n\n
      and make it executable <\/p>\n\n\n\n
      $ sudo chmod +x \/etc\/openvpn\/server\/demo-configure-routes.up<\/code><\/pre>\n\n\n\n
      Finishing up<\/h4>\n\n\n\n
      Start the VPN with<\/p>\n\n\n\n
      $ sudo systemctl start openvpn-server@demo-vpn<\/strong>.service<\/code><\/pre>\n\n\n\n
      To inspect the status call:<\/p>\n\n\n\n
      $ sudo systemctl status openvpn-server@demo-vpn<\/strong>.service<\/code><\/pre>\n\n\n\n
      To start the site-to-site VPN at boot:<\/p>\n\n\n\n
      $ sudo systemctl enable openvpn-server@demo-vpn<\/strong>.service<\/code><\/pre>\n\n\n\n
      Test the VPN<\/h2>\n\n\n\n
      Try ping the USG through the tunnel:<\/p>\n\n\n\n
      $ ping 10.1.0.1<\/code><\/pre>\n\n\n\n
      References<\/h2>\n\n\n\n
      \n
      Site-to-site VPN routing explained in detail<\/a><\/blockquote>