Hack Lab #2 - Adding an OpenVPN Connection into the HomeLab

Strangely enough, I have a lot of equipment that is not being utilized all the time.  One thing that I wanted to do was to have a VPN connection into the house that I could use when I am on travel.  I just so happened to have a GL-AR300M laying around.  I also have both a GL-USB150 and a GL-AR750S-EXT as travel routers that I take with me.  I pretty much use the GL-USB150 to connect into my companies BYOD network.  Since it is a simple usb device, and can do WiFi relay, I use it as the main router for side projects when I am at work.  The GL-AR750S-EXT is also connected to my companies BYOD network, but is my main travel router when I am away.  I decided to add an OpenVPN connection to my house.

The main instructions for doing this are located at https://docs.gl-inet.com/en/3/app/openvpn/ for the Server portion and https://docs.gl-inet.com/en/2/app/openvpn/ for the client.  My server is going to be the GL-AR300M, I will attach it to an isolated vlan known as LAN5, and my client will be on the GL-AR750S-EXT.  I first set up LAN5 vlan throughout the network to keep it separate from anything else.  The LAN side of my server was connected to LAN5 and the WAN side was connected to my ISP router.  Right now while I do testing, I will not have it on my ISPs Router DMZ.  In fact I might isolate that out anyway.  No need to expose any more ports than necessary.  So the process is:

1. set up the server router in the home network
2. generate a .ovpn file using the GUI
3. download the .ovpn file (which is for the client)
4. at work, set up the client router
5. install the .ovpn file using the GUI
6. test out the connection
7. download the OpenVPN client to the personal laptop
8. install the .ovpn file on the personal laptop's OpenVPN client
9. test out the connection

Pretty simple, and it worked out just fine.

TravelRouter#2 - Updated to Routed Client Mode using LuCI

I was pretty pleased with how easy it was to put the GL.iNet 6416a into a Routed Client Mode using LuCI (generic instructions are here).  The basic connection was through an Ethernet cable from my laptop to the router plugged into the LAN port.  The full-up connection is shown in the image:

In the expedience of time I will explain the process in the following paragraphs.

(1) connect the router via an Ethernet plugged into the LAN port and the other end placed into a USB to Ethernet adapter on the laptop.

(2) disconnect the laptop from all Ethernet connections except for the router connection.

(3) log into the router with credentials using your browser; select Network -> WiFi.

(4) click on the Scan button next to the "Generic MAC80211 802.11bgn (radio0)" line.  Select the WiFi network that you wish to join by clicking on the "Join Network" button.

(5) leave "Replace Wireless Configuration" checked, this will ensure that everything is replaced.  Enter the wpa2 passphrase.  Make sure that WAN is selected; this will ensure that the wireless setup is associated with the WAN connection on the router.  Select save.

(6) When the next screen comes up, make sure that WAN is selected.  Click on Save and Apply.

(7) At the next screen you should see the selected WiFi under the "Generic..." line.  Next, click on the Add button next to the "Generic..." line.  Select LAN to associate with this new WiFi SSID.  Change the name from"OpenWRT" if you desire a different SSID for your LAN network connection.

(8) select Wireless Security tab to setup the WPA2 data.  Select WPA2-PSK for encryption and "Force TKIP and CCMP (AES)" from the dropdown next to Cipher.  Add the passphrase as necessary.  Click on Save and Apply.  This will bring you back to the screen with the "Generic..." line.  You should see both the SSID of the WiFi you are connected to on the WAN side, and the SSID for the LAN side.  At this point you are set up.

That is pretty easy setup for OpenWRT.  Next, I got to figure out a couple of different setups including one with OpenVPN back to my house.

TravelRouter #1 - I Bought a GL-iNet 6426A Travel Router

After some looking around, I ended up buying a GL-iNet 6416A Travel Router from Amazon for $24.  What intrigued me about this router was the (1) OpenWRT based system and (2) the ability to reflash it with a new version of OpenWRT if I wanted.  So the first thing that I did after getting the router was to reflash it (instructions here) with the latest Chaos Calmer version.  This eliminated the tweeks that the company had placed on the router, but I wanted to customize my own.  BTW, the company provided a very nice suite of abilities for the novice.  This router was also the basis for the nefarious TOR routers that showed up on kickstarter a couple of years ago.  Those routers were tossed because they claimed original prototypes and manufacturing when in fact they were just repackaging the GL-iNet 6416A.  The following is an image of the router from rednerd.com (his site has a very good description of how to add TOR to this router).

I also immediately set the system to allow ssh connections on the LAN side.  The next tweek was to update the software listings and setup LuCI for web interface.  I did that through ssh (instructions here).  I next setup the router with my own SSID and WPA2 password (without enabling the wireless).  The interface allowed me to choose between putting the wireless on the LAN or the WAN side of things, I chose LAN.  After all that, it would appear that I have about 11.95 MB more space for software.  That means that I can do a lot with it.

My main thought is to setup some standard configurations with some kind of selection through the web interface to easily set the router to what I want.  That may take some doing.  More Later.