Thinking of Setting Up an OpenVPN Server with 1-Port Capability for External Connections

I was thinking back to the 1-Port router idea and now I am thinking of adding an OpenVPN to the mix.  I could have an encryption key on both sides of the connection to give my setup a little extra protection.  So that would mean: (1) have an RPi running an OpenVPN server (allowing connection from the outside); (2) have a second RPi running an OpenVPN client/OpenWRT; and (3) let a connection go through the second RPi to my WorkNet Guest wireless to my home network.

I could have most of the ideas that I have come up with resident in this setup.  In addition, I would still like to have a selection switch that would give me some different options, like TOR, w/wo OpenVPN, etc.  The bubble chart would look like:

Still Having Issues with Netgear G54/N150 Micro Adapters

I hate to say it but I might have to move on with this development.  I have not been able to get a functioning 8188cus driver to run in the RPi despite trying just about every known driver setup program that is out there.  I don't know what is happening here.  It seems like the newest versions of the Raspbian OS are not able to take the 8188cus driver and allow it to run.  I keep having the rtl8192cu come up in its place and that one does not allow the iw utilities to run with it.

Out of all of the 802.11n based adapters, the Netgear G54/N150 Micro was the one that worked out of the box without any changes.  But it seems that the rtl8192cu driver does not allow the adapter to perform all of it's intended functions.

Loaded OpenWRT onto an SD card for test in Reverse Router Mode

I just followed the instructions here to get an SD card image for OpenWRT.  I am going to configure it much the same as what I have done with the dual wifi adapter setups.  Then I plan to finagle some way of pushing a DMZ to the ethernet port.  More later.

Configuration Files for Specialized Router for Work

I thought that I would record the configuration files that I used for the Specialized Router here, so that I would have something to reference in the future.  The setup here assumes that I have a common SSID that I connect to both at home and at work.  At home, I have a separate SSID that I have set up on my primary router and on the WAP that I have downstairs.  The channel number is not the same in both places, but the RPi software looks for the SSID and does the connection.  At work, I use a DIR-505L router which is set to wifi hotspot mode with the same SSID but is connected to the guest wifi SSID at work.  Assuming that hostapd and isc-dhcp-server are installed, the configuration files are as follows:

(1) /etc/wpa_supplicant/wpa_supplicant.conf

ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=netdev
update_config=1

network={
    ssid="CairParavelClone"
        psk="p19dsndgyxhrh$AM"
        proto=WPA
    key_mgmt=WPA-PSK
        pairwise=TKIP
    auth_alg=OPEN
}

(2) /etc/default/isc-dhcp-server

# Path to dhcpd's config file (default: /etc/dhcp/dhcpd.conf).
DHCPD_CONF=/etc/dhcp/dhcpd_test.conf

# Path to dhcpd's PID file (default: /var/run/dhcpd.pid).
DHCPD_PID=/var/run/dhcpd_test.pid

# Additional options to start dhcpd with.
#    Don't use options -cf or -pf here; use DHCPD_CONF/ DHCPD_PID instead
#OPTIONS=""

# On what interfaces should the DHCP server (dhcpd) serve DHCP requests?
#    Separate multiple interfaces with spaces, e.g. "eth0 eth1".
INTERFACES="wlan1"

(3) /etc/network/interfaces

auto lo

iface lo inet loopback
iface eth0 inet dhcp

allow-hotplug wlan0
iface wlan0 inet dhcp
wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf
#iface default inet dhcp

allow-hotplug wlan1
#auto wlan1
iface wlan1 inet static
   address 192.168.42.1
   netmask 255.255.255.0
   network 192.168.42.0

up iptables-restore < /etc/iptables.ipv4.nat

(4) /etc/hostapd/hostapd.conf

interface=wlan1
ssid=Pi_AP
hw_mode=g
channel=9
macaddr_acl=0
auth_algs=1
ignore_broadcast_ssid=0
wpa=2
wpa_passphrase=Raspberry
wpa_key_mgmt=WPA-PSK
wpa_pairwise=TKIP
rsn_pairwise=CCMP

(5) /etc/dhcp/dhcpd_test.conf

ddns-update-style none;

default-lease-time 600;
max-lease-time 7200;

authoritative;

subnet 192.168.42.0 netmask 255.255.255.0 {
range 192.168.42.100 192.168.42.120;
option broadcast-address 192.168.42.255;
option routers 192.168.42.1;
default-lease-time 600;
max-lease-time 7200;
option domain-name "local";
option domain-name-servers 8.8.8.8, 8.8.4.4;
}

(6) /etc/iptables.ipv4.nat

# Generated by iptables-save v1.4.14 on Sat Jan 24 16:37:01 2015
*nat
:PREROUTING ACCEPT [217:54744]
:INPUT ACCEPT [4:751]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -o wlan0 -j MASQUERADE
COMMIT
# Completed on Sat Jan 24 16:37:01 2015
# Generated by iptables-save v1.4.14 on Sat Jan 24 16:37:01 2015
*filter
:INPUT ACCEPT [256:19656]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [136:13904]
-A FORWARD -i wlan0 -o wlan1 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i wlan1 -o wlan0 -j ACCEPT
COMMIT
# Completed on Sat Jan 24 16:37:01 2015

That is about it for right now.  Updates to follow when I get the Netgear G54/N150 nano adapters to be more stable.

Setting Up a Specialized Wireless Hotspot/Bridge Combo for Work

Givens: So, where I work at has a number of separate networks.  There is a corporate network which has a number of security setups which need to be kept pristine.  There is also a guest network which uses a capture port wireless access.  I have a copy of Kali Linux on my work laptop which runs in a VM.  I want to keep this VM separate from the corporate network but still be able to use it in my job, which involves doing some checks against lab equipment.  I also like to bring my RPis into the office to work on during lunch.

Project:  What I want to do is use a Raspberry Pi to be the intermediary with two internal network connections at work with the following characteristics:

1. EXT - provide connection to the guest wireless through a wifi adapter on the RPi; have it automatically log into the guest wireless capture page and obtain an IP; this should provide a semi-permanent connection for both internal networks.
2. NET1 - provide a bridge to the Kali Linux VM through a USB to Ethernet adapter connected to the Ethernet port on the RPi and then to a USB port on the work laptop; have it provide the EXT IP directly to the Kali Linux VM.
3. NET2 - provide a NAT firewall (opt. packet inspection) between the EXT and another wifi adapter which provides a DHCP server/Wireless Access Port with an SSID which is common to the home network.  I might split this up into 3 separate SSIDs.
4. TUN1 - provide an opt. ssh tunnel through the EXT from NET2 to the home network for vpn connection giving an external WAP connection to my home network.

I already have the makings of this project by having a wifi hotspot configuration.  This configuration uses a D-Link DIR-505L router connected to the guest network.  It however, occurred to me that maybe I should do this with one single RPi and just keep the RPi at work.  I could power this up via a USB cable plugged into my laptop dock (A to micro USB cable).

I think I might dub this one Reverse Router, because I can think of a couple of other things that I might do with it under the area of penetration testing.

Update (2015-01-25): I had problems getting the DHCP server to work correctly and consistently with the TP-Link adapters that I was using, they kept dropping out.  I finally got a sufficiently consistent connection once I switched over to the Netgear adapters. I may end up having to buy additional adapters for other tests.

Update (2015-01-27):  I changed the channel addresses so that the two Netgear wifi adapters would not be tromping on each other; for stability reasons.  I found a website that tells me how to set up multiple SSIDs on the same interface using hostapd (Multiple_SSIDs_with_hostapd). Also finally got the basic wireless access point to work with a wireless connection to my DIR-505L router.  So now I have a wireless coming in to a NAT firewall to a WAP with DHCP going out.  Right now I am copying the microSD to put onto a different microSD so that I can implement multiple SSIDs.  What I want to do there is to have three SSIDs: one accessing the house (house SSID and cert), one for guest access, and one for secure test access (TBD).  Each of these SSIDs will be set up to appear if certain files have been touched.  I have not fully determined if the Netgear G54/N150 can handle multiple SSIDs or not.  I know that hostapd can.

Update (2015-01-28):  Well I discovered that there are some issues with changing the mac address of a wifi adapter on the fly.  I did the first part of the setup from the Multiple SSIDs with hostapd article and borked the connection.  What I will probably find when I look into it is that the wifi mac address was stored somewhere and it's keeping the dhcp server from running on the WAP.

Update (2015-01-29): Nope, the Netgear G54/N150 is not capable of changing the wifi MAC address; at least from my experiments that is the case.  I wish that were not true, maybe I will try the previous wifi adapters (based on the rtl8188cu chipset).

Update (2015-01-30):  After reading a couple of things online, maybe what I have here is a driver problem for the Netgear G54/N150 nano adapters.  What seems to give it away is the problems that I have when I try to use the "iw list" command, which always comes back with an error.  In addition, the setup does not appear stable between reboots; sometimes the dhcp server comes up and sometimes it doesn't.

Setting up Shorewall and VLANs on the 1-Port Router

In putting together a 1-Port router, it seems that I have kind of lost a purpose here.  What I would like to do is have the router allow just the Mac Mini to access 3 other VLANs than what it is connected to.  In addition, I don't want anything from the Pers VLAN with the exception of the Mac Mini to be able to connect to these three VLANs.  I don't want any cross-talk between the VLANs.  The diagram of what I want to do is shown below.



 In order to accomplish this task I am turning to an old friend in the firewall world, Shorewall (http://www.shorewall.net/).  So I want to load Shorewall onto my 1-port router, add the additional VLANs, and add Webmin to manage the Shorewall setup and other things on this platform.  Installing Shorewall and Webmin is pretty easy:

sudo apt-get update
sudo apt-get install shorewall
sudo apt-get install -y perl libnet-ssleay-perl openssl libauthen-pam-perl libpam-runtime libio-pty-perl apt-show-versions python
wget http://prdownloads.sourceforge.net/webadmin/webmin_1.690_all.deb
sudo dpkg --install webmin_1.690_all.deb