Client Server

These scenarios show how to configure an OpenVPN tunnel using a client/server topology.

Basic Tunnel

Description

A simple client/server tunnel is created between two devices

Scenario

Step 1: Set the following configuration in DUT0:

set interfaces ethernet eth0 address 192.168.100.1/24
set interfaces openvpn ovpn1 local-endpoint 10.0.0.0/29
set interfaces openvpn ovpn1 mode server tls-profile TLS
set vpn openvpn tls-profile TLS ca running://ca.crt
set vpn openvpn tls-profile TLS certificate running://server.crt
set vpn openvpn tls-profile TLS private-key running://server.priv.pem
set vpn openvpn tls-profile TLS dhparam running://dh.pem

Step 2: Set the following configuration in DUT1:

set interfaces ethernet eth0 address 192.168.100.2/24
set interfaces openvpn ovpn1 peer 1 address 192.168.100.1
set interfaces openvpn ovpn1 mode client tls-profile TLS
set vpn openvpn tls-profile TLS ca running://ca.crt
set vpn openvpn tls-profile TLS certificate running://client.crt
set vpn openvpn tls-profile TLS private-key running://client.priv.pem

Step 3: Ping IP address 192.168.100.2 from DUT0:

admin@DUT0$ ping 192.168.100.2 count 1 size 56 timeout 1
Show output
PING 192.168.100.2 (192.168.100.2) 56(84) bytes of data.
64 bytes from 192.168.100.2: icmp_seq=1 ttl=64 time=0.525 ms

--- 192.168.100.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.525/0.525/0.525/0.000 ms

Step 4: Run command interfaces openvpn ovpn1 status at DUT1 and check if output contains the following tokens:

CONNECTED
Show output
OpenVPN interface ovpn1
State: CONNECTED (SUCCESS)
Local endpoint: 10.0.0.6:1194
Remote: 192.168.100.1

Step 5: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 1 size 56 timeout 1
Show output
PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data.
64 bytes from 10.0.0.1: icmp_seq=1 ttl=64 time=0.525 ms

--- 10.0.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.525/0.525/0.525/0.000 ms

Step 6: Run command interfaces openvpn ovpn1 clients at DUT0 and check if output contains the following tokens:

Client
Show output
-----------------------------------------------------------------------------------
Common Name       Address        Endpoint    Connected since         Last seen
-----------------------------------------------------------------------------------
Client       192.168.100.2:1194  10.0.0.6  2024-04-23 17:33:09  2024-04-23 17:33:10

Client Static IP

Description

A client is given a static IP address based on their common name

Scenario

Step 1: Set the following configuration in DUT0:

set interfaces ethernet eth0 address 192.168.100.1/24
set interfaces openvpn ovpn1 local-endpoint 10.0.0.0/29
set interfaces openvpn ovpn1 mode server tls-profile TLS
set vpn openvpn tls-profile TLS ca running://ca.crt
set vpn openvpn tls-profile TLS certificate running://server.crt
set vpn openvpn tls-profile TLS private-key running://server.priv.pem
set vpn openvpn tls-profile TLS dhparam running://dh.pem
set interfaces openvpn ovpn1 mode server server-profile SRV
set vpn openvpn server-profile SRV client Client address 10.0.0.2

Step 2: Set the following configuration in DUT1:

set interfaces ethernet eth0 address 192.168.100.2/24
set interfaces openvpn ovpn1 peer 1 address 192.168.100.1
set interfaces openvpn ovpn1 mode client tls-profile TLS
set vpn openvpn tls-profile TLS ca running://ca.crt
set vpn openvpn tls-profile TLS certificate running://client.crt
set vpn openvpn tls-profile TLS private-key running://client.priv.pem

Step 3: Ping IP address 192.168.100.2 from DUT0:

admin@DUT0$ ping 192.168.100.2 count 1 size 56 timeout 1
Show output
PING 192.168.100.2 (192.168.100.2) 56(84) bytes of data.
64 bytes from 192.168.100.2: icmp_seq=1 ttl=64 time=0.303 ms

--- 192.168.100.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.303/0.303/0.303/0.000 ms

Step 4: Run command interfaces openvpn ovpn1 status at DUT1 and check if output contains the following tokens:

CONNECTED
Show output
OpenVPN interface ovpn1
State: CONNECTED (SUCCESS)
Local endpoint: 10.0.0.2:1194
Remote: 192.168.100.1

Step 5: Ping IP address 10.0.0.2 from DUT0:

admin@DUT0$ ping 10.0.0.2 count 1 size 56 timeout 1
Show output
PING 10.0.0.2 (10.0.0.2) 56(84) bytes of data.
64 bytes from 10.0.0.2: icmp_seq=1 ttl=64 time=0.812 ms

--- 10.0.0.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.812/0.812/0.812/0.000 ms

Disconnect By Common Name

Description

A client is forcefully disconnected by the server by the client’s common name

Scenario

Step 1: Set the following configuration in DUT0:

set interfaces ethernet eth0 address 192.168.100.1/24
set interfaces openvpn ovpn1 local-endpoint 10.0.0.0/29
set interfaces openvpn ovpn1 mode server tls-profile TLS
set vpn openvpn tls-profile TLS ca running://ca.crt
set vpn openvpn tls-profile TLS certificate running://server.crt
set vpn openvpn tls-profile TLS private-key running://server.priv.pem
set vpn openvpn tls-profile TLS dhparam running://dh.pem

Step 2: Set the following configuration in DUT1:

set interfaces ethernet eth0 address 192.168.100.2/24
set interfaces openvpn ovpn1 peer 1 address 192.168.100.1
set interfaces openvpn ovpn1 mode client tls-profile TLS
set vpn openvpn tls-profile TLS ca running://ca.crt
set vpn openvpn tls-profile TLS certificate running://client.crt
set vpn openvpn tls-profile TLS private-key running://client.priv.pem

Step 3: Ping IP address 192.168.100.2 from DUT0:

admin@DUT0$ ping 192.168.100.2 count 1 size 56 timeout 1
Show output
PING 192.168.100.2 (192.168.100.2) 56(84) bytes of data.
64 bytes from 192.168.100.2: icmp_seq=1 ttl=64 time=0.197 ms

--- 192.168.100.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.197/0.197/0.197/0.000 ms

Step 4: Run command interfaces openvpn ovpn1 status at DUT1 and check if output contains the following tokens:

CONNECTED
Show output
OpenVPN interface ovpn1
State: CONNECTED (SUCCESS)
Local endpoint: 10.0.0.6:1194
Remote: 192.168.100.1

Step 5: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 1 size 56 timeout 1
Show output
PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data.
64 bytes from 10.0.0.1: icmp_seq=1 ttl=64 time=0.363 ms

--- 10.0.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.363/0.363/0.363/0.000 ms

Step 6: Run command interfaces openvpn ovpn1 disconnect common-name Client at DUT0 and expect this output:

Show output
common name 'Client' found, 1 client(s) killed

Step 7: Expect a failure in the following command: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 1 size 56 timeout 1
Show output
PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data.

--- 10.0.0.1 ping statistics ---
1 packets transmitted, 0 received, 100% packet loss, time 0ms

Disconnect By Address

Description

A client is forcefully disconnected by the server by the client’s address

Scenario

Step 1: Set the following configuration in DUT0:

set interfaces ethernet eth0 address 192.168.100.1/24
set interfaces openvpn ovpn1 local-endpoint 10.0.0.0/29
set interfaces openvpn ovpn1 mode server tls-profile TLS
set vpn openvpn tls-profile TLS ca running://ca.crt
set vpn openvpn tls-profile TLS certificate running://server.crt
set vpn openvpn tls-profile TLS private-key running://server.priv.pem
set vpn openvpn tls-profile TLS dhparam running://dh.pem

Step 2: Set the following configuration in DUT1:

set interfaces ethernet eth0 address 192.168.100.2/24
set interfaces openvpn ovpn1 peer 1 address 192.168.100.1
set interfaces openvpn ovpn1 mode client tls-profile TLS
set vpn openvpn tls-profile TLS ca running://ca.crt
set vpn openvpn tls-profile TLS certificate running://client.crt
set vpn openvpn tls-profile TLS private-key running://client.priv.pem

Step 3: Ping IP address 192.168.100.2 from DUT0:

admin@DUT0$ ping 192.168.100.2 count 1 size 56 timeout 1
Show output
PING 192.168.100.2 (192.168.100.2) 56(84) bytes of data.
64 bytes from 192.168.100.2: icmp_seq=1 ttl=64 time=0.367 ms

--- 192.168.100.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.367/0.367/0.367/0.000 ms

Step 4: Run command interfaces openvpn ovpn1 status at DUT1 and check if output contains the following tokens:

CONNECTED
Show output
OpenVPN interface ovpn1
State: CONNECTED (SUCCESS)
Local endpoint: 10.0.0.6:1194
Remote: 192.168.100.1

Step 5: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 1 size 56 timeout 1
Show output
PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data.
64 bytes from 10.0.0.1: icmp_seq=1 ttl=64 time=0.591 ms

--- 10.0.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.591/0.591/0.591/0.000 ms

Step 6: Run command interfaces openvpn ovpn1 disconnect address 192.168.100.2 1194 at DUT0 and expect this output:

Show output
1 client(s) at address 192.168.100.2

Step 7: Expect a failure in the following command: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 1 size 56 timeout 1
Show output
PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data.

--- 10.0.0.1 ping statistics ---
1 packets transmitted, 0 received, 100% packet loss, time 0ms