Ideas for securing OpenVPN on an OpenWrt router

Question

I put an OpenVPN server on port 1194 on an OpenWrt 10.03 router:

echo "nameserver 8.8.8.8" > /etc/resolv.conf; opkg update; opkg install luci-app-openvpn openvpn openssl-util openssh-sftp-server ntpd
vim /etc/ssl/openssl.cnf # modify a few lines
[ CA_default ]
dir             = /etc/openvpn
new_certs_dir   = $dir/certs
certificate = $dir/ca.crt
private_key = $dir/ca.key

touch /etc/openvpn/index.txt; touch /etc/openvpn/serial; echo 01 > /etc/openvpn/serial
openssl req -nodes -new -x509 -keyout /etc/openvpn/ca.key -out /etc/openvpn/ca.crt -days 3650 # give a common name, like: vpnserver
openvpn --genkey --secret /etc/openvpn/ta.key
openssl req -nodes -new -keyout /etc/openvpn/server.key -out /etc/openvpn/server.csr # give a common name, like: vpnserver
mkdir -p /etc/openvpn/certs; mkdir -p /etc/openvpn/private
openssl ca -out /etc/openvpn/server.crt -in /etc/openvpn/server.csr
time openssl dhparam -out /etc/openvpn/dh1024.pem 1024 # it could take 10 minutes!

# generate certs for clients [X = client number]
openssl req -nodes -new -keyout /etc/openvpn/clientX.key -out /etc/openvpn/clientX.csr # give a common name! it will be the user name
openssl ca -out /etc/openvpn/clientX.crt -in /etc/openvpn/clientX.csr
# e.g.: 
openssl req -nodes -new -keyout /etc/openvpn/client1.key -out /etc/openvpn/client1.csr # give a common name! it will be the user name
openssl ca -out /etc/openvpn/client1.crt -in /etc/openvpn/client1.csr

vim /etc/config/openvpn
config 'openvpn' 'openvpn_server'
    option 'enable' '1'
    option 'port' '1194'
    option 'proto' 'udp'
    option 'dev' 'tap'
    option 'ca' '/etc/openvpn/ca.crt'
    option 'cert' '/etc/openvpn/server.crt'
    option 'key' '/etc/openvpn/server.key'
    option 'tls_auth' '/etc/openvpn/ta.key 0' # server: 0
    option 'dh' '/etc/openvpn/dh1024.pem'
    option 'comp_lzo' '1'
    option 'server' '10.20.30.0 255.255.255.0'
    option 'keepalive' '10 120'
    option 'persist_key' '1'
    option 'persist_tun' '1'
    option 'mute' '20'
    option 'verb' '3'
    option 'client_to_client' '1'
    list 'push' 'dhcp-option DNS 10.20.30.1'
/etc/init.d/openvpn enable
/etc/init.d/openvpn start
ifconfig -a | less
ping 10.20.30.1

# here comes the firewall part
vim /etc/config/firewall # modify it
config 'include'
    option 'path' '/etc/firewall.user'

config 'redirect'
    option 'src' 'wan'
    option 'proto' 'udp'
    option 'src_dport' '1194'
    option 'dest_port' '1194'
    option '_name' 'OpenVPN'

vim /etc/firewall.user # modify it
iptables -t nat -A prerouting_rule -i $WAN -p udp --dport 1194 -j ACCEPT
iptables -A input_rule -i $WAN -p udp --dport 1194 -j ACCEPT
iptables -A forwarding_rule -i tap+ -o br-lan -j ACCEPT
iptables -A forwarding_rule -i br-lan -o tap+ -j ACCEPT
iptables -A input_rule -i tap+ -j ACCEPT
iptables -A output_rule -o tap -j ACCEPT

/etc/init.d/firewall restart

# tar the files that goes to the client1
mkdir -p /root/client1
cp /etc/openvpn/ca.crt /root/client1/; cp /etc/openvpn/client1.crt /root/client1/; cp /etc/openvpn/client1.key /root/client1/; cp /etc/openvpn/ta.key /root/client1/
cd /root/; tar -cf client1.tar client1

# configure the client
# extract the client1.tar's content to "~/.cert" on the clients pc
# if you're using e.g.: Fedora/SELinux, then
restorecon -Rv ~/.cert*
# then: 
# ca.crt: the ca certificate
# client1.crt: the users certificate
# client1.key: the users private key
# ta.key: tls authentication [1]

What could I do (on the server side) to increase security regarding this OpenVPN server? Here are some of my ideas:

1. I sed 's/1194/50000/' the port number to a higher one to make it harder for port scanners to find
2. iptables? I should only allow IP ranges [on the input chain] that I will use in reality? +Only allow my laptop's MAC address
   
3. If I don't use my router (e.g.: when I'm sleeping) I just turn it off.

Is there anything I'm missing? From the ps command I can see that OpenVPN is run by root, which is unsafe. What else should I do to increase security?

Answer 1

OpenVPN is designed to be secure. It will only allow clients who have the keys signed by you. The most important thing is keeping the private keys secure. Always encrypt them on the clients and check the permissions on the key file on the server. Don't keep the CA private keys on the server it doesn't need them. Encrypt it put it on a pendrive and protect it.

Port scanners will have no trouble finding the server on any port but they won't be able to use it. If you know that you will only use it from a limited set of IP addresses then by all means disable everything else with iptables. However most people tend to use it from varying locations for example with a laptop. You could automatically ban IPs that try invalid keys but bruteforcing RSA keys like this is infeasible anyway.

If the keys are safe then the biggest risk is some bug in the OpenVPN implementation which makes it vulnerable to attacks. If that happens an attacker can run arbitrary code with the privileges of the OpenVPN server process. You can decrease the effect of this kind of attack by not running the server as root. Add this to your server config:

user nobody
group nobody

Your config file seems to use a different syntax then mine but something like this should be supported. You can try the grsecurity patch for the kernel but I'm not sure it works on embedded systems and it would be really bad if you made it unbootable by accident. It makes arbitrary code execution bugs harder to exploit.

You can also increase key sizes. 1024 bit keys may become breakable in the near future if not already. Be sure not to generate them with Debian's OpenSSL. :)

It's my personal opinion that MAC address filtering is absolutely useless. It's easy to fake and valid ones can be found easily. Use WPA2 CCMP with a 63 byte long random key and you should be OK. Don't let people plug in random cables.

I know there are not much resources available in routers but you can try logging. I'm almost sure there won't be enough space on the router so log to an other host. Syslog-ng can do this easily I don't know how easy it is to install it on a router.