1

I am trying to use OpenVPN instead of PPTP for our VPN. In order to be able to do this, I need it to be "easy" to setup. Right now, I have to get people to rename the Tap-Win32 network interface to get the config to work properly.

Is there a way I can streamline client config of OpenVPN to reduce it to a Next-Next-Finish type of procedure?

1 Answer 1

2

I've mentioned this in a couple other OpenVPN questions but we used to roll our own nullsoft installer for OpenVPN. The starting point and instructions can be found here. The installer contained a well commented configuration file mostly pre-configured for the user. They were provided good instructions with a lot of pictures to guide them through the process of generating a certificate signing request using the MyCertificate Wizard that is part of that package. We prefilled in all the fields for the certificate request other than the employee's name and email address. They would then email us their csr which we would verify the information in the request, sign it, and email them back their certificate. Then their instructions included installing the certificate and modifying the configuration files to point to their new certificate and key files.

We were a small company though so it was easy to help out the couple of users who struggled with this process. In a bigger organization I think I would have moved the certificate requests and signing and auto generated configuration file to some sort of web based application.

Another thing you could look into is something like wpkg, another favorite project of mine. In it you could have a base xml file that belongs to a general profile to pushes out the openvpn package to all the computers in the organization. Then you could have per user profiles that contain an xml package file that pushes out the configuration for that user. But this may get a bit much to manage if you have a large number of users. It also takes a bit of time to figure out and implement wpkg so it may not be worth the effort. If you have a WSUS server available you may be able to do something similar with it.

2
  • OpenVPN really ought to simplify this out of the box. Oct 30, 2009 at 15:22
  • 1
    Well if you're willing to take the security risk and just deploy the VPN with a server certificate and then use user/password for authentication it simplifies things. But anytime you are dealing with a PKI (Public Key Infrastructure) the added security increases the complexity in deploying and adminstrating. Oct 30, 2009 at 16:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .