OpenVPN
This article explains how to configure your vpn client, so that you can access the network at NIKHEF.
Configuration Files
The following configuration files need to be copy to $HOME/Library/Application Support/Tunnelblick/Configurations/; the owner:group of the files are root:wheel and the permissions are rw-r--r--. The two CA crt files (salado-ca.crt & nikhef-ca.crt) need to be place in $HOME/.globus
You can use Sloot as the primary vpn server and Boswachter as an alternative. Remote is for the remote location. Tunnel is to Schrepel and to put all your traffic over the line. Openvpn is to Schrepel and normal use. Wipkip-tunnel is handy if you want to encrypt all your traffic but don't want to use TCP for it.
NOTE: change the names between '<' & '>' by either the hostname or the location of the CRTs/PEMs.
openvpn.conf
client comp-lzo comp-noadapt proto udp remote <SCHREPEL> port 1194 dev tun tun-mtu 1500 nobind persist-key persist-tun # security/certificate stuff: ns-cert-type server ca <NIKHEF-CA.CRT> cert <USERCERT.PEM> key <USERKEY.PEM>
boswachter.conf
client comp-lzo comp-noadapt proto udp remote <BOSWACHTER> port 1194 dev tun tun-mtu 1500 nobind persist-key persist-tun # security/certificate stuff: ns-cert-type server ca <NIKHEF-CA.CRT> cert <USERCERT.PEM> key <USERKEY.PEM>
remote.conf
client comp-lzo comp-noadapt proto udp #remote salado.nikhef.nl remote <KONIJN> remote <CAVIA> remote-random port 1194 dev tap tun-mtu 1500 nobind persist-key persist-tun # security/certificate stuff: ns-cert-type server ca <SALADO-CA.CRT> cert <USERCERT.PEM> key <USERKEY.PEM>
sloot.conf
client comp-lzo comp-noadapt proto udp remote <SLOOT> port 1194 dev tun tun-mtu 1500 nobind persist-key persist-tun # security/certificate stuff: ns-cert-type server ca <NIKHEF-CA.CRT> cert <USERCERT.PEM> key <USERKEY.PEM>
tunnel.conf
client comp-lzo comp-noadapt proto tcp remote 194.171.97.13 #remote boswachter.nikhef.nl port 443 dev tun tun-mtu 1500 nobind persist-key persist-tun # security/certificate stuff: ns-cert-type server ca <NIKHEF-CA.CRT> cert <USERCERT.PEM> key <USERKEY.PEM>
wipkip-tunnel.conf
client comp-lzo comp-noadapt proto udp remote 194.171.96.49 port 1195 dev tun tun-mtu 1500 nobind persist-key persist-tun # security/certificate stuff: ns-cert-type server ca <SALADO-CA.CRT> cert <USERCERT.PEM> key <USERKEY.PEM>
