DSM-G600, DNS-3xx and NSA-220 Hack Forum

Hi Audrey,

Glad you got it working and thanks for confirmation that the echo command works - still haven't got around to testing that myself!

Haydn.

Unfortunately I have no time do compile all the Beta's as well as releases unless there is a specific reason for doing so (i.e: something broken in last release). Hopefully I'll have more time soon.

Haydn.

Here are some basic config files to get you started. Note that you'd need to generate appropriate server and client keys in order to get this to work.

server.conf

local <your DNS-323 IP>
port <your DNS-323 port>  #forward this port on your router
proto udp

;dev tap
dev tun0

tls-server
tls-auth ta.key 0        # server

# root certificates
ca etc/ca.crt
dh etc/dh1024.pem

# server certificates
cert etc/dns323.crt
key etc/dns323.key       # server

server 10.10.0.0 255.255.255.0

push "route 10.0.0.0 255.255.255.0"
push "dhcp-option DNS 10.0.0.1"

# direct all traffic through VPN
;push "redirect-gateway"

;ifconfig-pool-persist ip.lst

# allow clients to be able to "see" each other.
client-to-client
# allow multiple clients to connect
duplicate-cn

keepalive 10 120

# extra security

;cipher BF-CBC        # Blowfish
;cipher AES-128-CBC   # AES
;cipher DES-EDE3-CBC  # Triple-DES

# enable compression on the VPN link.
comp-lzo

max-clients 10
persist-key
persist-tun

;verb 3
;status openvpn-status.log

client.ovpn

remote <DNS-323 IP or ddns address> <port #>

dev tun
;dev tap

proto udp

resolv-retry infinite

nobind

persist-key
persist-tun

# server security
tls-client
tls-auth ta.key 1

# mute repated wireless packets
mute-replay-warnings

# connection keys
ca keys/ca.crt

# unique client keys
cert keys/client.crt
key keys/client.key

# ensure connection to a server
ns-cert-type server


# cryptographic cipher.
;cipher AES-128-CBC

# enable compression
comp-lzo

;verb 3

Last edited by andrey (2008-06-18 20:14:09)

lu,

You're correct, HaydnH doesn't contain necessary files to compile certificate keys. I would suggest installing "etch" debian for that. However, I'm not sure how efficient VPN will without any security so to speak.

If you'd like to eliminate certificates, simply comment them out from configuration that I posted earlier.

you shouldn't have "secret static.key" option enabled since you haven't compiled the keys, comment it out.

Sinobato,

To generate keys you would need to install debian "etch" (see my post above or Wiki), install OpenVPN there using 'apt get install openvpn', generate keys that way and copy them into your working OpenVPN folder. Perhaps that's not the simplest way, but it works.

-- Andrey

about the keys - I have generated the key by
./openvpn --genkey --secret static.key
(as per openvpn documentation)
then copied the key to both the client & server, so afaik the entry to the key in the config is ok, but then that still leaves the problem of the  "server 10.10.0.0 255.255.255.0" line.
thanks
lu

maybe useful:
openvpn portable
http://sourceforge.net/projects/ovpnp

I have built openvpn but it did not build the kernel module.
Do I have to recompile the kernel and upgrade the one in my dns-313?
I hawe no clue how to config the kernel on it it's not a PC.
or is the kernel config extractable from the old kernel?
(I tried downloading the package here but it tells me invalid module format)

Last edited by eak (2008-11-05 18:55:59)

Hey all,

I've been trying to get this working on my DNS-321 all day but to no avail.  After downloading and extracting the tarball, I simply cannot run openvpn: I always get the error message

./openvpn: ./openvpn: cannot execute binary file

"file ./openvpn" shows me:

./openvpn: ELF 32-bit LSB executable, ARM, version 1, dynamically linked (uses shared libs), stripped

Any ideas why I can't get this to execute?

I've thus far successfully setup Transmission, Subversion, vsftpd, lighttpd...this is the only one i can't seem to crack...

Last edited by metal450 (2009-05-02 05:28:41)

>>it could be that it won't work on the 321 having been compiled for the 323.

Hmm, I'd thought of that, but seems somehow unlikely as every other binary i've tried that was compiled for the 323 worked perfectly...

>>It may be a library issue...

I'd think this is the most likely issue, although I'm not really experienced enough in Linux to figure out the issue - I haven't programmed on linux since college, 10 years ago...  Do you (or anyone) by chance know of any way i could determine this, i.e. get more specific error message, etc?

>>You could try compiling it yourself on the 321.

I'd thought of that also, and tried to figure out if i could "easily" compile just by installing gcc and make, but the following thread scared me a little bit: seems like getting a build environment setup on this thing is damn complex.  Am i wrong? (http://dns323.kood.org/howto:crosscompile)

metal450 wrote:

I'd think this is the most likely issue, although I'm not really experienced enough in Linux to figure out the issue - I haven't programmed on linux since college, 10 years ago...  Do you (or anyone) by chance know of any way i could determine this, i.e. get more specific error message, etc?

strace ./openvpn
?

metal450 wrote:

>>You could try compiling it yourself on the 321.

I'd thought of that also, and tried to figure out if i could "easily" compile just by installing gcc and make, but the following thread scared me a little bit: seems like getting a build environment setup on
this thing is damn complex.  Am i wrong? (http://dns323.kood.org/howto:crosscompile)

The page you refer to is about *cross* compiling - i.e. compiling on one platform to execute on another platform - e.g. compile source on an x86 machine (PC) to produce an executable that will run on the arm (321) architecture.  What you can do as an alternative, is compile natively - i.e. compile on the machine that you want to run the software on (321)
You would need to install more than gcc and make, but I think it is straigthforward enough - search the forums to deturmine what you need.  I haven't done it myself, but I think Fonz provides all of the packages that you need for native compilation (you need to download them and install them under ffp).

Last edited by luusac (2009-05-03 05:41:51)

Got it to compile!  Thanx for the tip...it was way simpler than I expected

Basically, all I had to do was install the required packages (http://www.shadowandy.net/2008/08/addin … ns-323.htm), run ./configure, and make!