OpenVZ node to be used as OpenVPN server

In the past I’ve owned VPS instances so that they can be used as proxies to setup in-country applications. For instance, some country Ministry of IT don’t like their servers managed from another country. So, the quick solution is to buy a cheap OpenVZ node from a provider advertising at lowendbox.com or ask a local IT guy to give me SSH access into his machine and setup OpenVPN server. Someone else wanted to setup the same thing that I do, so I thought I’d write this blog entry.

Server Side

The instructions are for Debian or Ubuntu or Linux Mint or similar based distros

1. Install OpenVPN

# apt-get install openvpn

2. Prepare key generation

# mkdir /etc/openvpn/easy-rsa
# cp /usr/share/doc/openvpn/examples/easy-rsa/2.0/* /etc/openvpn/easy-rsa

3. Editing vars

# cd /etc/openvpn/easy-rsa
# nano vars

Change the variables with whatever info you'd like to create the user info (KEY_SIZE is for the encryption complexity, using 2048 should be more than fine)
KEY_SIZE=2048
KEY_COUNTRY="NO"
KEY_PROVINCE="NO"
KEY_CITY="Oslo"
KEY_ORG="UiO"
KEY_EMAIL="saptarsp@test.in"

# source ./vars

4. Generating the Certificate Authority (CA)

# ./clean-all
# ./build-ca

5. Generating the Server keys - (with server name as dhisServer)

# ./build-key-server dhisServer

6. Generate the Diffie Hellman Key Exchange parameters

# ./build-dh

7. Create a client key (with client name as sunny)

# ./build-key sunny

8. Generate the HMAC code (so, that we can use TLS/SSL login without passwords)

# openvpn --genkey --secret /root/easy-rsa/keys/ta.key

9. Copy the generated keys into a keys folder

# mkdir -p /etc/openvpn/keys
# cp -pv /root/easy-rsa/keys/{ca.{crt,key},dhisServer.{crt,key},ta.key,dh2048.pem} /etc/openvpn/keys/

10. Edit the OpenVPN server configuration. Remove everything and add the following (or make changes)

# nano /etc/openvpn/server.conf
port 1194
proto udp
dev tun

ca keys/ca.crt
cert keys/server.crt
key keys/server.key  # This file should be kept secret 
dh keys/dh2048.pem

server 10.8.0.0 255.255.255.0

ifconfig-pool-persist ipp.txt

push "redirect-gateway def1 bypass-dhcp"  #all clients to redirect their default network gateway through the VPN
push "dhcp-option DNS 208.67.222.222"     #OpenDNS servers
push "dhcp-option DNS 208.67.220.220"

keepalive 10 120

tls-auth keys/ta.key 0 # This file is secret

comp-lzo

user nobody
group nogroup

persist-key
persist-tun

status openvpn-status.log
log /var/log/openvpn.log
verb 3

11. Enable IP forwarding on the server

# echo 1 > /proc/sys/net/ipv4/ip_forward

12. Forward all network traffic through NAT masquerade (Change this to eth0 to venet0 for OpenVZ or VPS nodes)

# iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

13. Restart OpenVPN service

# service openvpn restart

Client Side

On the client side, you don’t have to do much. If you want your entire office to access through this VPN, then you should install ddwrt or another router firmware (Asus N56U Padavan’s) which has an OpenVPN client. Below is a screenshot of Padavan’s firmware OpenVPN client. Note the important extended configuration – redirect-private def1 (All outgoing IP traffic with be redirected through VPN)

If you are using Windows and want to connect, try the OpenVPN-GUI. A pretty simple, but useful client to connect to OpenVPN servers. Remember to down the one with TAP driver, so you can seamlessly get all traffic to flow through the VPN connection. After the installation is done, copy the ca.crt, sunny.crt, sunny.key and ta.key files that were generated on the server in C:\Program Files\OpenVPN\config . You can email or use WinSCP to transfer the files to the client machine. Then create a sunny.ovpn file in the same folder with the following content

# C:\Program Files\OpenVPN\config\sunny.ovpn
client
remote xxx.xxx.xxx.xxx (replace this with your server IP)
port 1194
proto udp
dev tun
dev-type tun
ns-cert-type server
reneg-sec 86400
tls-auth ta.key 1
auth-retry interact
comp-lzo yes
verb 3
ca ca.crt
cert sunny.crt
key sunny.key
management 127.0.0.1 1194
management-hold
management-query-passwords
auth-retry interact

That should be all that is required. Once you start the OpenVPN GUI, you will see a system tray icon with right-click displaying connect or if you have multiple .ovpn files then choice on which one to connect to.

Excellent service for monitoring servers using Nagios - Monguru

I’ve been looking for ways to monitor servers for sometime. Most services charge way too much to automate monitoring multiple server. One could do it nicely with a second server running Nagios, and a shared Nagios could be used by many people. The guys at Monguru have just done that. If you are into running web servers, you should definitely have heard of Nagios.
The documentation is scant and the installation scripts are distributed across different wiki pages, blog posts etc. Basically to get this working, your server needs to run an SNMP agent that can be polled by Nagios and you have to register at Monguru. They provide you a login to their shared Nagios instance and you can add your server to that instance for free. The dashboard is simplistic and config files are uploaded through a very simple interface. Anyways, what you should do to get your server monitored, is to download the script

$ wget https://raw.github.com/monguru/configuration_scripts/master/add_new_server.sh
$ chmod +x add_new_server.sh
$ sudo ./add_new_server.sh

Then, follow the steps mentioned… like naming your server. The script downloads all the SNMP config files that are needed. It downloads python scripts that will create a username, password that you need to remember. It will create an instance in your monguru website as well that you can use for Twitter notifications or git integration of your config files… It is pretty simple, but cool stuff!!

You Aint Virtualized Till You’ve Used Archipel

I’ve setup a few virtualized environments starting from the good old Xen in 2004. Good web-based, remote management of the VMs has been a sore point for me, since you needed to have some Gtk or Qt app to do all the VM management stuff. Not that the desktop virtual machine management isn’t robust, but its just that when you are travelling and you just want to restart the VM quickly, a web interface does the work quickly.

Another thing about VM management is being able to look at resources in real-time use. There are people out there who love the command-line stuff, but I like a GUI for real-time resource management. Are there too many simultaneous users, high-latency requests, reporting occupying too much CPU? So SSH into a server through the command-line just doesn’t cut it for me.

I recently discovered the Archipel project, when trying to setup a virtualized environment for an NGO without system admin, who don’t need to know qemu, libvirt etc. The goal is that in a few clicks you’d have a virtual machine ready to be used. Another click to restart a VM. Another click to clone an existing VM. Increase or decrease VM memory or CPU cores etc. by moving some sliders. Isn’t that what linode or Amazon EC2 offers you ask?… But I have my own server in a local datacenter, which turns out to be much more ROI-effective and performance effective than those providers in the long-term.

Archipel does all of the above and much more. It is an excellent XMPP-based VM orchestration tool:

Archipel is a solution to manage and supervise virtual machines. No matter if you have a few locally on your computer or thousands through data centers, Archipel is a central solution to manage them all. You can perform all basic virtualization commands and many other things like live migration, VMCasts, packages, etc.

All you have to do is setup eJabberd-based XMPP server, make some configuration like the qemu host and it will find all the VMs from your list. You can even manage multiple hosts with multiple VMs from one eJabberd server. That’s not all. Most of the commands are like chatting to a bot and then it runs commands on libvirt. How cool is that?!? Being able to chat with your Hypervisor!!

On the client-side, you have to install a set of webpages on Apache and this can be on the same host as eJabberd or separate. The pages on this client-side app uses websockets or BOSH and has a nice looking UI. This allows real-time view of the virtual machines and the hosts. I also some the built-in VNC client that uses only JavaScript. So you do not have to install any client on the local machine. It all runs from the web browser. There is some lag, but if you’ve got a good machine and a browser with good internet connection, it works quite well.

There are some bugs in the client app that keep showing up, but all in all this is an excellent system. Virtual machine management cannot be easier than this… This is indeed the future of virtual machine orchestration.