thomaswaldmann / vpngw Goto Github PK

in vpngw, ipv6 was disabled for security reasons:

• some vpn providers do not provide ipv6
• if there is no ipv6 vpn support, there is some danger that ipv6 packets do not go over the vpn, potentially triggering issues that vpngw was designed to avoid
• iirc, there currently is no ipv6 configuration at all on vpngw (routing, iptables/ferm)

to enable v6:

• get clear about how to do it securely, adapt configuration
• how to still support v4-only vpn providers?

in /etc/network/interfaced.d/wan, add:

allow-hotplug eth1

TODO: add to docs

otherwise you can cheat by assigning yourself a static ip addr of another range.

cyberghost started pushing v4 and v6 today (previously: only v4).

this breaks openvpn 2.3 if v6 is disabled on all interfaces.
it exits with an error if it can not configure v6 on an interface.
there is no way in openvpn 2.3 to avoid this.

https://community.openvpn.net/openvpn/ticket/849

the gateway should shutdown automatically after some delay after AC power loss.

some minutes after a AC power loss is likely best (running a long time on battery might be pointless as the rest of the network infrastructure is not working without AC anyway).

unifi controller:

https://www.kobelnet.ch/2019/12/06/setup-unifi-controller-on-debian-10-buster

FritzBoxes like the 6591 have a internal iperf server that can be enabled for testing.

On the vpngw, use these commandlines:

iperf -c fritzbox-ip -p 4711 -u -t 60 -i 10 -b 1000M  # expected:  UDP ~1000Mbit/s
iperf -c fritzbox-ip -p 4711    -t 60 -i 10 -b 1000M  # expected:  TCP ~930Mbit/s

Client: thinkpad x270, i7-6600u, usb3 lan interface rtl8153, debian 10

ferm + openvpn up script

Currently, vpngw is based on Debian 8 "Jessie", but long term it would be good to upgrade it to Debian 9 "Stretch".

I tried it once, but due to some obstacles I kept jessie in the end for now:

• interface names are like enp0s25 by default in stretch
• that is an annoyance because it depends on the hardware setup
• there is a kernel option (grub) to get back "old style" eth0/eth1 interface names, but at the same time it is deprecated, so future looks not good for them
• I tried using the new stuff and adding alias names like "wan", "lan", ... - but ran into troubles with vlan not working with that.

So the main open issue is how to set up networking with stretch so that the setup does not depend on hardware-dependant interface names. We don't want to change interface names in a lot of config files when moving to other hardware.

https://dnsleaktest.com/