Openvpn client on embedded devices

As a kind of proof of concept I setup a Linksys router running the Openwrt firmware as a portable hardware openvpn client to connect to the AlwaysVPN service. I used the router as a wireless client, meaning I did not connect to a wired network to gain internet access. The final test was to connect a SIP IP phone to one of the LAN ports of the router and then place a phone call.

The following is a very basic overview of what needs to be done to duplicate this kind of setup.

1. Flash a router with the latest Openwrt firmware (I used Kamikaze 8.09)
2. Install the openvpn, empty and ntpclient packages
3. Configure the router as a wireless client, adding a wifi interface with DHCP.
4. Add a VPN interface using tap0 as the phisical interface (I used openvpn with tap not tun)
5. configure the firewall rules to allow traffic on the VPN interface and add MASQ to enable NAT.
6. using SCP/SSH create a /etc/openvpn directory and add your config files.
7. Create a /etc/init.d/openvpn-client file with the following (edit as needed):
   
#!/bin/sh /etc/rc.common
START=95
start () {
logger -t "openvpn" "starting openvpn-client"
empty -f -i in -o out openvpn --daemon --config /etc/openvpn/VPN_config_file.conf
empty -w -i out -o in "Username:" "username\n"
empty -w -i out -o in "assword:" "password\n"
}
stop () {
logger -t "openvpn" "stopping openvpn-client"
killall openvpn
killall empty
sleep 3
}
8. Do a chmod a+x /etc/init.d/openvpn-client and enable it
9. Make sure the NTP client is working
10. Disable DHCP server on VPN and WIFI interfaces
11. Add DHCP option 6 with dns servers of your vpn provider on the LAN interface. Otherwise dns requests will pass through the router to your ISPs DNS servers.
12. apply settings and reboot

Some additional notes:

empty was used to pass the username and password to openvpn without having to recompile openvpn with save-password support. If your server only uses key authentication this is not required.

This writeup was done from memory so some details may be missing. I’ve had bad experiences with using SIP over wifi in the passed so I was very surprised at how well the voip call worked over the openvpn wifi tunnel.