OpenVZ node to be used as OpenVPN server

In the past I’ve owned VPS instances so that they can be used as proxies to setup in-country applications. For instance, some country Ministry of IT don’t like their servers managed from another country. So, the quick solution is to buy a cheap OpenVZ node from a provider advertising at lowendbox.com or ask a local IT guy to give me SSH access into his machine and setup OpenVPN server. Someone else wanted to setup the same thing that I do, so I thought I’d write this blog entry.

Server Side

The instructions are for Debian or Ubuntu or Linux Mint or similar based distros

1. Install OpenVPN

# apt-get install openvpn

2. Prepare key generation

# mkdir /etc/openvpn/easy-rsa
# cp /usr/share/doc/openvpn/examples/easy-rsa/2.0/* /etc/openvpn/easy-rsa

3. Editing vars

# cd /etc/openvpn/easy-rsa
# nano vars

Change the variables with whatever info you'd like to create the user info (KEY_SIZE is for the encryption complexity, using 2048 should be more than fine)
KEY_SIZE=2048
KEY_COUNTRY="NO"
KEY_PROVINCE="NO"
KEY_CITY="Oslo"
KEY_ORG="UiO"
KEY_EMAIL="saptarsp@test.in"

# source ./vars

4. Generating the Certificate Authority (CA)

# ./clean-all
# ./build-ca

5. Generating the Server keys - (with server name as dhisServer)

# ./build-key-server dhisServer

6. Generate the Diffie Hellman Key Exchange parameters

# ./build-dh

7. Create a client key (with client name as sunny)

# ./build-key sunny

8. Generate the HMAC code (so, that we can use TLS/SSL login without passwords)

# openvpn --genkey --secret /root/easy-rsa/keys/ta.key

9. Copy the generated keys into a keys folder

# mkdir -p /etc/openvpn/keys
# cp -pv /root/easy-rsa/keys/{ca.{crt,key},dhisServer.{crt,key},ta.key,dh2048.pem} /etc/openvpn/keys/

10. Edit the OpenVPN server configuration. Remove everything and add the following (or make changes)

# nano /etc/openvpn/server.conf
port 1194
proto udp
dev tun

ca keys/ca.crt
cert keys/server.crt
key keys/server.key  # This file should be kept secret 
dh keys/dh2048.pem

server 10.8.0.0 255.255.255.0

ifconfig-pool-persist ipp.txt

push "redirect-gateway def1 bypass-dhcp"  #all clients to redirect their default network gateway through the VPN
push "dhcp-option DNS 208.67.222.222"     #OpenDNS servers
push "dhcp-option DNS 208.67.220.220"

keepalive 10 120

tls-auth keys/ta.key 0 # This file is secret

comp-lzo

user nobody
group nogroup

persist-key
persist-tun

status openvpn-status.log
log /var/log/openvpn.log
verb 3

11. Enable IP forwarding on the server

# echo 1 > /proc/sys/net/ipv4/ip_forward

12. Forward all network traffic through NAT masquerade (Change this to eth0 to venet0 for OpenVZ or VPS nodes)

# iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

13. Restart OpenVPN service

# service openvpn restart

Client Side

On the client side, you don’t have to do much. If you want your entire office to access through this VPN, then you should install ddwrt or another router firmware (Asus N56U Padavan’s) which has an OpenVPN client. Below is a screenshot of Padavan’s firmware OpenVPN client. Note the important extended configuration – redirect-private def1 (All outgoing IP traffic with be redirected through VPN)

If you are using Windows and want to connect, try the OpenVPN-GUI. A pretty simple, but useful client to connect to OpenVPN servers. Remember to down the one with TAP driver, so you can seamlessly get all traffic to flow through the VPN connection. After the installation is done, copy the ca.crt, sunny.crt, sunny.key and ta.key files that were generated on the server in C:\Program Files\OpenVPN\config . You can email or use WinSCP to transfer the files to the client machine. Then create a sunny.ovpn file in the same folder with the following content

# C:\Program Files\OpenVPN\config\sunny.ovpn
client
remote xxx.xxx.xxx.xxx (replace this with your server IP)
port 1194
proto udp
dev tun
dev-type tun
ns-cert-type server
reneg-sec 86400
tls-auth ta.key 1
auth-retry interact
comp-lzo yes
verb 3
ca ca.crt
cert sunny.crt
key sunny.key
management 127.0.0.1 1194
management-hold
management-query-passwords
auth-retry interact

That should be all that is required. Once you start the OpenVPN GUI, you will see a system tray icon with right-click displaying connect or if you have multiple .ovpn files then choice on which one to connect to.

You Aint Virtualized Till You’ve Used Archipel

I’ve setup a few virtualized environments starting from the good old Xen in 2004. Good web-based, remote management of the VMs has been a sore point for me, since you needed to have some Gtk or Qt app to do all the VM management stuff. Not that the desktop virtual machine management isn’t robust, but its just that when you are travelling and you just want to restart the VM quickly, a web interface does the work quickly.

Another thing about VM management is being able to look at resources in real-time use. There are people out there who love the command-line stuff, but I like a GUI for real-time resource management. Are there too many simultaneous users, high-latency requests, reporting occupying too much CPU? So SSH into a server through the command-line just doesn’t cut it for me.

I recently discovered the Archipel project, when trying to setup a virtualized environment for an NGO without system admin, who don’t need to know qemu, libvirt etc. The goal is that in a few clicks you’d have a virtual machine ready to be used. Another click to restart a VM. Another click to clone an existing VM. Increase or decrease VM memory or CPU cores etc. by moving some sliders. Isn’t that what linode or Amazon EC2 offers you ask?… But I have my own server in a local datacenter, which turns out to be much more ROI-effective and performance effective than those providers in the long-term.

Archipel does all of the above and much more. It is an excellent XMPP-based VM orchestration tool:

Archipel is a solution to manage and supervise virtual machines. No matter if you have a few locally on your computer or thousands through data centers, Archipel is a central solution to manage them all. You can perform all basic virtualization commands and many other things like live migration, VMCasts, packages, etc.

All you have to do is setup eJabberd-based XMPP server, make some configuration like the qemu host and it will find all the VMs from your list. You can even manage multiple hosts with multiple VMs from one eJabberd server. That’s not all. Most of the commands are like chatting to a bot and then it runs commands on libvirt. How cool is that?!? Being able to chat with your Hypervisor!!

On the client-side, you have to install a set of webpages on Apache and this can be on the same host as eJabberd or separate. The pages on this client-side app uses websockets or BOSH and has a nice looking UI. This allows real-time view of the virtual machines and the hosts. I also some the built-in VNC client that uses only JavaScript. So you do not have to install any client on the local machine. It all runs from the web browser. There is some lag, but if you’ve got a good machine and a browser with good internet connection, it works quite well.

There are some bugs in the client app that keep showing up, but all in all this is an excellent system. Virtual machine management cannot be easier than this… This is indeed the future of virtual machine orchestration.

VMWare Releases Stage Manager 1.0 Beta

The leader in virtualization software and solutions, VMWare has released a new product called Stage Manager as beta. Stage Manager as the name suggest is used to manage the virtual stage of operating systems and is helpful to deploy applications on these virtual environment. Stage Manager is actually a useful GUI which allows easy management of virtual environments similar to Sun Microsystems Sun xVM Ops Center that ships with Sun's virtualization product xVM Server.

Some of the key features of Stage Manager as mentioned on VMWare's product website are:

Key Features

• Rapidly create new multi-server software configurations (services)
• Monitor resource usage on a per-service, per-stage and per-instance basis
• Easily perform operations on a complete service (e.g. cloning, deploying, archiving, etc.)
• Marshall changes across the service lifecycle, interacting with external process management/workflow system to ensure compliance with service transition policies
• Maintain an archive of past service configurations supporting compliance and recovery operations
• Maintain an auditable history of software configuration changes
• Manage storage behavior on a per-stage basis to maximize storage efficiency
• Control access to services on a per-service, per-stage and per-instance basis
• Inherit then deploy services to resource pools created within VMware VirtualCenter

 

You can also look at the feature tour below:

You can read more on VMware's Stage Manager Product Page

Sun Virtualization With xVM Server

Update: Sun xVM Server gets a discussion from Jonathan Schwartz

A friend attending Oracle Open World told me about xVM, Sun's Virtualization platform. I have to say, I hadn't heard of it before, so I went on to look for some resources and this post is what I've found about xVM Server.

Sun has a new virtualization server based on Xen hypervisor. It currently supports virtualization of operating systems like Linux, Windows and Solaris. I have been using Xen with openSuSE which is bundled on the DVD of openSuSE 10.3 and I think its one of the better virtualization software available. So I asked what was different about Sun xVM and is it just plain packaging that Sun will be doing. Going to their website, I found that xVM server has a few scoring points to it.

1.) It brings Sun's very efficient and cool ZFS filesystem with the xVM Server.

2.) Sun will provide xVM for free but would provide support (at some cost) for the xVM server.

3.) DTrace and Self Healing (FMA) will be available with xVM

4.) Another Sun open-source, Crossbow for network virtualization will also be bundled with xVM

SunxVM server is opensource and is working through a few different communities. All of those can be found at http://www.openxvm.org . VmWare which is the market leader for virtualization products only has 9% of the market share. This just goes to show how much the virtualization market is scattered and everyone wants a pie of the market. Sun's product is openSource and is bundled with some nice tools and good administration GUI as well.

Prof. Ian Pratt of Cambridge who originally developed the Xen hypervisor, must be quite happy with the development that Xen has gone through. The success of xVM Server largely depends on how much the market believes in the value proposition that Sun has bundled with Xen!!

Free Virtualization: VmWare Server 2.0 Beta

Guest Blogger: Steven Parker
13th Nov, New York

I have been a big fan of virtualization. Microsoft just yesterday announced that their Hyper-V server would be sold at $28 as an add-on to Windows Server 2008. This came as a surprise to me. Microsoft is entering into this market pretty late and with free alternatives from major players already existing, giving it free would have been the best strategy for widespread adoption. But may be Microsoft wouldn't be Microsoft if it started giving anything for free!!

VmWare which sells its flagship ESX-Server, also gives away free a smaller brother of ESX. They called it GSX and now its called VmWare Server. VmWare released just few hours ago, the VmWare Server 2.0 beta on their servers. This is downloadable for free and has lots of new features built into it.

What's New

New features and enhancements in the VMware Server Beta 1 release:

• Web-based management interface: A new Web-based user interface provides a simple, flexible, intuitive and productive way for you to manage your virtual machines.
• Expanded operating system support: VMware Server now supports Windows Vista Business Edition and Ultimate Edition (guest only), Windows Server 2008 (Longhorn Server Beta 3), Red Hat Enterprise Linux 5 and Ubuntu 7.1, among others.
• Greater scalability: Take full advantage of high-end hardware with support for up to 8GB of RAM per virtual machine, up to two virtual SMP (vSMP) processors and up to 64 virtual machines per host.
• 64-bit guest operating system support: Run high-performance operating systems in virtual machines with support for Intel EM64T VT-enabled processors and AMD64 processors with segmentation support.
• Support for VIX API 1.2: This feature provides a programming interface for automating virtual machine and guest operations.
• Support for Virtual Machine Interface (VMI): This feature enables transparent paravirtualization, in which a single binary version of the operating system can run either on native hardware or in paravirtualized mode.
• Support for USB 2.0 devices: Transfer data at faster data rates from USB 2.0 devices.

 

I have just downloaded and installed Ubuntu on it. Doesn't seem like its running on a VM and is pretty stable being in beta. I have yet to play and tweak a few things, but the first impression is pretty neat!! I'm going to install Vista and try quick switching between them... If you want to play with it as well, then you can download it from here. Leave comments about your experience ==>

Microsoft branding: 8 Versions Of Windows Server 2008

Guest Blogger: Steven Parker
12th Nov, New York

Steve Jobs recently said at the launch of Leopard OSX, "And everyone gets the 'Ultimate' version", just to take a swing at the different versions of Vista. If that was not enough, Microsoft is prepared to give the world many more versions of its server operating system. Actually, when Windows Server 2008 will be released it'll come in 8 different flavors!!

Microsoft has figured it out that marketing different versions of the same thing is profitable. They understand that packaging stuff with different set of features makes people want more. Microsoft seems to understand that the entire culture of marketing now-a-days is about tempting the customer to buy the bigger box, more that what he actually requires!! ;-)

Windows Server 2008 is special because of its thin-hypervisor called Hyper-V, which enables virtualization out of the box! Windows Server 2008 will come in Standard, Enterprise and Datacenter versions with and without the Hyper-V. And each of these would come in 64-bit and 32-bit versions. CALs (Client-Access License) means the number of clients that are allowed to access the server.

Version	Price	CALs
Standard (with Hyper-V)	$999	5
Standard (without Hyper-V)	$971	5
Enterprise (with Hyper-V)	$3999	25
Enterprise (without Hyper-V)	$3971	25
Datacenter (with Hyper-V)	$2999	per processor
Datacenter (without Hyper-V)	$2971	per processor
Web Server 2008 (without Hyper-V)	$469
Server 2008 for Itanuim (without Hyper-V)	$2999	per processor

The funny part of it is that "When Windows Server 2008 ships next February, those versions that have Hyper-V will include the beta bits for that, and those will be updated to the final version when that ships within 180 days". This means that you'll may for a beta product initially. When Microsoft releases the final product, which will be a standalone, you get the final as well...

Let's see how it all looks when Microsoft will release the product in all its glory in Feb 2008. I have heard good things about it from Sunny, who's been beta testing the Home Server and Server 2008 from it's early days. I seriously expected Vista to come with 32-bit and 64-bit versions on the same DVD, but that was not the case. Hope they have that for Windows Server atleast!

Run Windows Programs Without Booting Windows

Just found at Wired.com, about this new virtualization tool called "HyperSpace". Its a new hypervisor much like VmWare's ESX Server which is a layer just above the BIOS and can boot multiple OS. HyperSpace is something similar but not entirely an independent virtual machine. Instead it currently allows only Windows applications to run above it.

HyperSpace is developed by Pheonix Technologies, which is famous for developing BIOS for a host of motherboards. Pheonix Technologies says that this product has been developed considering that the boot times for Windows has increased so much that people need 5mins just to login to their computers to check emails. Also, Pheonix provides an argument that Windows has become bloated and people who want to use only simple applications, don't want to load that bloat...

Although all of the above arguments from Pheonix may be true, it doesn't make much sense to me. With quick sleep and hibernate available in Windows today, it really takes 4-5 secs to start using windows after you wake up from sleep. Even with hibernate, it takes less than a minute and in that time you just stretch your arms to start typing!!

I think virtualization should be directed at multiple testing environments and servers with different applications. Virtualization should ideally allow you to switch between operating systems by the click of a button. To me, this approach of virtualization is not very useful and does not have a large market. May be some people will use it, but Quick Sleep and Hibernate are for the general masses!!

Virtualization rocks!!

With the VMworld 2007 at San Fransisco just started, I wanted to tell you about how the VmWare ESX Server 3 is working and what's in store for the future. I am a big fan of Virtualization Technology and we all know that VmWare is leading brand in the virtualization business. You can read about the new features in ESX 3.1 here. Interesting to note are the technologies like AMD's Rapid Virtualization Technology (using nested paging tables - NPT) which is part of AMD's Barcelona CPU, Site Recovery Manager (for easier automated disaster recovery) and new security features.

ESX 3i which was announced just today by Diane Greene will be available for download in a few weeks at vmware.com. This comes as a surprise since most people thought that it'll be released only by OEMs. I have heard a lot of people wanting to use virtualization but don't understand the technicalities in such implementations. They get confused between VmWare workstation and ESX. So here's some input from someone whose used virtualization products from Vmware, Microsoft and participated at XenSource for more than 4 years.

There are basically 3 ways in which virtualization can be done on today's hardware.

1.) Running one/many OS simultaneously on another OS. The OS on which the other OS runs is called the Host and the other OS is called the guest. VmWare workstation is one such product, although there are a host of other products. Suppose you have Windows XP installed and you want to check your application on Windows 2000, Windows Vista and Windows 2003, then you can install VmWare Workstation on XP and install Win2000, Vista and Win2003 as the guest OS. This will allow you to run the guest OS in a window inside XP. You can share your internet connection of your host with the guest OS using NAT or bridge. All this can be done without any reboots or partitioning. The guest OS only creates a file on the host OS and inside the guest OS, you see this as a partition. This product works on CPUs that do not support Virtualization (VT/AMD-V)

2.) Running one/many OS on a emulator/hypervisor server. This product does not require a pre-installed operating system. It is a Linux-like kernel called the vmkernel and is a proprietary product. On this, you can installed different OS and play with them simultaneously. The ESX has enhanced performance as the guest OS do not have to go through the host's file system, resources or drivers. The ESX also emulates hardware separately for each guest OS, which means that they can be virtualized to be different platforms on the same hardware. The ESX Server is more robust and secure as the guest OS do not crash together even if the one guest OS fails. This requires CPU to support VT/AMD-V for optimal performance

3.) Virtualization appliances: Just like you have washing machines and microwaves, you can have guest OS on separate standalone devices. Generally rack mounted, these are thin servers that can be added to support different guest OS as and when required. These are specialized hardware and give the best performance. These can also be shared by thin-clients or diskless machines, where the OS is located inside the appliance and the monitor on the client machine is remotely using the OS. VmWare Server (GSX Server earlier) is one example of such a product.

Virtualization will play a very vital role in the future as more and more cores get built into the CPU. Many operating systems need to be used at a time for development and testing purposes and having separate hardware for each, is a cost. Virtualization thus not only saves cost, but also makes optimal use of available hardware.

PS: Funny that my firefox spell checker could find virtualize or virtualization in its dictionary!!