- 1 QUICK HOWTO FOR UBUNTU USER
- 1.1 Install Software
- 1.2 Install necessary helper programs
- 1.3 Install our ChaosVPN program
- 1.4 Create config directory
- 1.5 Get your new node added to the central configuration
- 1.6 Customize configfile
- 1.7 Enable Starting of ChaosVPN
- 1.8 script in /etc/ppp/ip-up to autostart, or to restart from time to time via cron
QUICK HOWTO FOR UBUNTU USER
Install necessary helper programs
needed to use the chaosvpn client:
# apt-get install tinc iproute
needed to compile the chaosvpn-client if not using a precreated debian package for it:
# apt-get install build-essential git bison flex libssl-dev zlib1g-dev debhelper devscripts
(see below for downloadable pre-created packages)
# apt-get install tinc
This should be at least tinc version 1.0.13, but may work with 1.0.10 or later.
Or visit http://tinc-vpn.org/, download and build yourself - at a minimum ./configure, specify the parameter --sysconfdir=/etc, and check the binary in the script
If the tinc installation gives the following error:
> ./MAKEDEV: don't know how to make device "tun"
Then create the device by hand:
# mkdir -p /dev/net # mknod /dev/net/tun c 10 200 # chown root:root /dev/net/tun # chmod 600 /dev/net/tun
Install our ChaosVPN program
The easiest way: Using Launchpad PPA
There are amd64 and i386 binary packages available for LTS release 12.04 ( precise ) There is also a source package
Add the following lines to your /etc/apt/sources.list:
For Ubuntu Precise:
deb http://ppa.launchpad.net/matt-nycresistor/chaosvpn/ubuntu precise main deb-src http://ppa.launchpad.net/matt-nycresistor/chaosvpn/ubuntu precise main
Make the Repository-Key known:
apt-get update sudo add-apt-repository ppa:matt-nycresistor/chaosvpn
Answer "y" to the warnings about whatever content.
Run apt-get update a second time:
Finally install the ChaosVPN software:
apt-get install chaosvpn
Install Done, proceed to next step some pages below.
PPS: The repositories are available for i386 (Intel+AMD x86 32bit) and amd64 (Intel+AMD x86 64bit) - users of other architectures will have to compile the chaosvpn client on their own.
Alternative: compile yourself from our git repository
Always needed to compile:
# git clone git://github.com/ryd/chaosvpn.git # cd chaosvpn
way 1: create a git snapshot debian package
# dch -i increment the version and set ubuntu specific info. # make deb perhaps it throws an error about missing build dependencies, install these and retry. # sudo dpkg -i ../chaosvpn_2.0*.deb install the generated package file, replace filename above with real name. it is also possible to copy the generated .deb package to a different machine of the same architecture and install it there - no need to have a full compile environment on your router/firewall.
way 2: create debian package and install this
# dch -i increment the version and set ubuntu specific info. # debuild -us -uc should give you packages in parent dir # sudo dpkg -i ../chaosvpn_2.0*.deb install the generated package file, replace filename above with real name.
way 3: just compile and install the raw binary
# make # sudo make install
Create config directory
# mkdir -p /etc/tinc/chaos
Get your new node added to the central configuration
Devise a network-nick and a unique IP range you will be using
This network-nick or sometimes called nodename is the name of the network endpoint/gateway where the vpn software will be running,
not necessarily the name of the user, there may even be more than one gateway per user.
Used below where <nodename> is.
Please use only characters a-z, 0-9 and _ in it. Note that only lowercase letters are supported.
Second please select an unused IPv4 range out of IP Range, and write yourself down in that wiki page to mark your future range as in-use.
Please select from the correct ranges, 172.31.*.* for Europe, and 10.100.*.* for North America and elsewhere.
Repeat: Please do not forget to add yourself to the list at IP Range to mark your range as used.
Used below where <ipv4 subnet in the vpn> is.
The usage of IPv6 networks is also possible, but we do not have a central range for this (yet),
you may specify an IPv6 range you received from your (tunnel) provider to be reachable over the VPN,
or a private IPv6 ULA (Unique Local Address) network described in RFC4193.
For more info about ULA and a network-range generator please also see http://www.sixxs.net/tools/grh/ula/ .
Used below where <ipv6 subnet in the vpn> is.
The gateway may have a DynDNS (or similar) hostname pointing to a dynamic IP, or a static hostname/fixed IP.
Better supply a hostname than a raw IP address even if it is static, so you can change it youself and do not need to contact us when needed. (Perhaps something like chaosvpn.yourdomain.example)
Used below where <clienthost> is.
Generate keys with tinc 1.1+
# tinc --net=chaos init <nodename>
Replace <nodename> with the name your new node should get.
**FIXME** need some way that "tinc init" puts the public key into the seperate files and not only into the generated hosts file, which our chaosvpn daemon overwrites.
generate public/private RSA and ECDSA keypairs with
# tinc --net=chaos generate-keys 2048
press Enter 4 times and backup the files /etc/tinc/chaos/ecdsa_key.priv, ecdsa_key.pub, rsa_key.priv and rsa_key.pub on an external device.
Generate keys with tinc 1.0.xx
create chaos config folder with
# mkdir /etc/tinc/chaos/
generate public/private keypairs with
# tincd --net=chaos --generate-keys=2048
press Enter 2 times and backup the files /etc/tinc/chaos/rsa_key.priv and rsa_key.pub on an external device.
Mail us your Infos
- send via email to email@example.com
We need the following info - but please be so kind and also add a short description of you/your space and your motivation to join chaosvpn - or at least make us laugh. :)
(Please remove all lines starting with # from the email, they are just descriptions)
[<nodename>] sponsor= # Name a person/nickname/nodename or organisation/hackerspace already on ChaosVPN that will # vouch for you getting access. gatewayhost=<clienthost> # This should be the external hostname or ip address of the client host, not a VPN address. # If the client is not reachable over the internet leave it out and set hidden=1 below. # If possible supply a hostname (even dyndns) and not an ip address for easier changing # from your side without touching the central config. network=<ipv4 subnet in the vpn> network6=<ipv6 subnet in the vpn> # (mandatory, must include) # this may be more than one, IPv4 or IPv6, network6 with IPv6 is optional # # These subnets must be unique in our vpn, # simply renumber your home network (or use something like NETMAP) with a network block that is still free. # # Please use the list of assigned networks on ChaosVPN:IPRanges, and add yourself there. owner= # (mandatory, must include) # Admin of the VPN gateway, with email address - a way to contact the responsible # person in case of problems with your network link. port=4712 # (optional) # if not specified tinc works on tcp+udp port 655 # it is better if everyone chooses a random port for this. # either this specified port or port 655 should accept TCP and UDP traffic from internet. hidden=0 # (optional) # "I cannot accept inbound tunnel connections, I can only connect out." # (e.g. behind a NAT) silent=0 # (optional) # "I cannot connect out, but you can connect to me." # Only ONE of hidden=1 or silent=1 is possible. Ed25519PublicKey=<something> # (optional) # tinc 1.1pre11+ only, contents of your /etc/tinc/chaos/ed25519_key.pub -----BEGIN RSA PUBLIC KEY----- .... -----END RSA PUBLIC KEY----- # (mandatory) # rsa-public-key - contents of your /etc/tinc/chaos/rsa_key.pub
Awaiting Response, give us some days, your request is processed manually
Retry until $success or $reject - but do not spam us.
FIXME to be expanded
In the top part are the variables.
$my_peerid to the network nick from step 4 $my_vpn_ip to an ip address in your network range, like 172.31.x.1
Enable Starting of ChaosVPN
If you installed ChaosVPN through our Debian packages it is not started by default.
To enable this edit the file /etc/default/chaosvpn and change the RUN= line to RUN="yes"
After all changes (re-)start the chaosvpn client:
# /etc/init.d/chaosvpn start
If you made everything correct there should now be a tinc daemon running, and the output of 'route -n' should show lots of routes pointing to the new 'chaos_vpn' network interface.
script in /etc/ppp/ip-up to autostart, or to restart from time to time via cron
if you built a debian package and installed it the cron and ip-up parts are already setup, if you installed it manually with make install you have to do it yourself.
and with luck, it will function beautifully! ;)
todo: tons ;) test in particular, and adjust docs for other linux distros, and perhaps even with *bsd