OpenVPN problems

[throughwalls]

I have been experimenting with an OpenVPN tunnel between ClientRouterA and ServerRouterB.

Good news is that I’ve gotten it to work (with some tweaks). Bad news is that there are some serious security and minor GUI problems.

Security problem

ClientRouterA is configured so that "All client traffic" goes through VPN. When ClientRouterA fails to establish a VPN tunnel (for whatever reason), traffic instead transparently exits the router using the local WAN.

client status.JPG (11.71 KiB) Viewed 4110 times

Put another way, the VPN client is not failing safely: When configured to use the VPN, ClientRouterA should ONLY route traffic through the VPN. This failure could be actively exploited (e.g. using a TCP SYN to terminate the VPN connection) to force the traffic to be routed in the clear.

My naive suggestion is to add firewall rules (when using "all client traffic" VPN mode) to allow communication only with the ServerRouterB on the specified port and transport (UDP/TCP). I guess an initial non-VPN DNS lookup may also be required for establishing the VPN connection.

Poor visibility of the state of the VPN connection

There is also no way for a normally skilled user to know that their traffic is not protected by the VPN. I only realized by accident that there was a problem. I would suggest providing status notifications on the gargoyle router status pages. VPN status should be highlighted when a connection is or can not be established. It might make sense to add this also to the login spash screen, just as notification of “You are at 100% of your quota” are shown.


GUI

Encryption selection: I am using Blowfish 256. My client shows that I am using 128 bit in the drop down list. I think there may be an initialization problem in the screen menus.

cypher.JPG (16.62 KiB) Viewed 4110 times

[Eric]

Thank you for this detailed feedback -- you make very good points. I will look into all of these issues right away.

[throughwalls]

Another gargoyle VPN feature might be helpful.

Allow keys to be regenerated

Once the keys are generated, there seems to be no way from the GUI to force a regeneration. I can disable the server, and then turn it back on again, but this does not get me back to the key generation options.

Overwrite keys if they are no longer active.

It would also be nice if they old keying information would be overwritten when either VPN config is "cleaned" or a new replacement key is generated. Even if this was a simple one pass overwrite with random numbers, it would likely be better than leaving the keying information available on the file system.

[throughwalls]

I do not have 1.6.1 running yet, but I have a question about the firewall blocking of non-VPN traffic when running OpenVPN.

Is it possible to SSH into the router from the WAN when the VPN is enabled?

Is it possible to do port forwarding from the WAN to a LAN machine while the VPN is enabled?