SSL VPN application method and system based on OPENVPN

Abstract

The invention relates to the technical field of communication, in particular to an SSL VPN application method and system based on an OPENVPN, and the method comprises the steps: creating an SSL VPN gateway in a virtual private cloud VPC, configuring an encryption algorithm and a compression algorithm of an OpenVPN, configuring the encryption algorithm and the compression algorithm of the OpenVPN, carrying out the certificate authentication setting through employing an eay-rsa module, and configuring an iptables rule; the SSL VPN application method and system based on the OPENVPN have the beneficial effects that compared with an IPSecVPN (Internet Protocol Section Virtual Private Network), the SSL VPN encrypts application data and provides more accurate access control; and meanwhile, the configuration is relatively simple and flexible, and for a client to site scene, the configuration deployment is simpler, and the maintenance cost is lower.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to an SSL VPN application method and system based on OPENVPN. Background Art

[0002] With the advancement of globalization and the popularization of the Internet, more and more people have the need to securely access internal resources in the enterprise or cloud, such as file servers, applications, and databases, from external networks.

[0003] Traditional VPN technologies, such as IPSec and L2TP, can support remote access, but their networking is not flexible enough. Mobile office users need to install specified client software, which makes network deployment and maintenance more troublesome, and it is impossible to perform fine-grained control over the access rights of mobile office users. Summary of the invention

[0004] The purpose of the present invention is to provide an SSL VPN application method and system based on OPENVPN to solve the problems raised in the above background technology.

[0005] To achieve the above object, the present invention provides the following technical solution: an SSL VPN application method based on OPENVPN, the method comprising the following steps:

[0006] Create an SSL VPN gateway in the virtual private cloud (VPC) and bind it to a public IP address.

[0007] Install and start the OpenVPN service on the SSL VPN gateway, configure the address pool for assigning IP addresses to clients after they connect, and push routing information to clients to allow them to access other private subnets within the VPC.

[0008] Configure the encryption and compression algorithms of OpenVPN, including but not limited to AES-256-CBC encryption algorithm and lz4-v2 compression algorithm;

[0009] Use the easy-rsa module to set up certificate authentication, including issuing CA certificates and server certificates, to ensure secure SSLVPN connections;

[0010] Configure iptables rules so that the decapsulated data packets can be correctly forwarded to the VMs in the VPC.

[0011] Preferably, the step of pushing routing information includes:

[0012] Set the push "route <private subnet address> <subnet mask>" instruction in the OpenVPN configuration file to allow clients to access the specified private subnet inside the VPC through VPN.

[0013] Preferably, the certificate authentication setting step further includes:

[0014] Initialize the PKI environment and generate necessary keys and certificate requests;

[0015] Issue CA certificates as the trust root of all certificates;

[0016] Generate a server certificate request and issue a server certificate for identity authentication of the SSL VPN gateway;

[0017] Generate a DH parameter file to enhance the security of key exchange.

[0018] Preferably, the iptables rule configuration steps include:

[0019] Add rules to the POSTROUTING chain of the NAT table to perform the MASQUERADE operation on packets from the OpenVPN client address pool to hide the real IP address of the VPN client and ensure that the packets can be correctly routed to the VPC internal network.

[0020] Preferably, the step of connecting the client to the SSL VPN gateway is also included, and the step includes:

[0021] Configure the OpenVPN client software on the client and import the configuration file including the CA certificate and server certificate;

[0022] The client establishes a connection with the SSL VPN gateway and, after identity authentication, receives and applies the routing information pushed by the SSL VPN gateway.

[0023] The data packets sent by the client application are encrypted and transmitted to the SSL VPN gateway through the VPN tunnel, and then forwarded by the gateway to the VPC internal network for secure access.

[0024] An SSL VPN application system based on OPENVPN, the system includes the following modules:

[0025] SSL VPN gateway module: deployed inside the VPC virtual private cloud, with a public IP address, used to establish an encrypted VPN connection with the remote client;

[0026] OpenVPN service module: installed and started on the SSL VPN gateway, configured with a specific IP address pool and routing information, used to assign virtual IP addresses to connected clients and push intranet routing information to allow clients to access other private subnets within the VPC;

[0027] Certificate authentication module: Use the easy-rsa tool set to issue CA certificates, server certificates, and client certificates for identity authentication and encrypted communication of SSL VPN connections;

[0028] iptables configuration module: Set NAT rules to ensure that decapsulated data packets can be correctly forwarded to the virtual machines in the VPC.

[0029] Preferably, the specific configuration of the OpenVPN service module includes:

[0030] Set the IP address pool to be assigned after the client connects;

[0031] Push routing information to the client, allowing the client to access a specific private subnet within the VPC;

[0032] Configure encryption algorithm;

[0033] Enable the new compression algorithm to improve data transmission efficiency.

[0034] Preferably, the operation steps of the certificate authentication module include:

[0035] Initialize the PKI infrastructure;

[0036] Issue CA certificates;

[0037] Generate a server certificate request and issue a server certificate;

[0038] Optionally, generate DH parameters to enhance the security of the key exchange.

[0039] Preferably, it also includes a client connection module for configuring and connecting to a remote client, and the specific steps include:

[0040] Import the CA certificate and client certificate issued by the SSL VPN gateway;

[0041] Configure the client's OpenVPN connection parameters, such as gateway address, encryption algorithm, and compression algorithm;

[0042] After the client successfully connects, a virtual network interface is automatically created to receive routing information from the VPN gateway and to send and receive encrypted data packets through the interface.

[0043] Preferably, the method further includes a data packet processing flow, specifically:

[0044] After the application is encapsulated, it reaches the virtual network interface through routing selection;

[0045] The data packets are sent to the VPN program through the virtual network interface for encryption;

[0046] The encrypted data packets are sent to the SSL VPN gateway via the public network;

[0047] The SSL VPN gateway receives and decrypts the data packet, performs address translation, and forwards it to the target virtual machine within the VPC.

[0048] After the target virtual machine processes the data packet, it returns the response data to the client through the packet return process.

[0049] Compared with the prior art, the present invention has the following beneficial effects:

[0050] The SSL VPN application method and system based on OPENVPN proposed in the present invention, compared with IPSecVPN, SSLVPN encrypts application data and provides more accurate access control; at the same time, the configuration is relatively simple and flexible, and for the client to site scenario, the configuration deployment is simpler and the maintenance cost is lower. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 is a flow chart of the method of the present invention;

[0052] Figure 2 This is a flow chart of sending data packets of the present invention;

[0053] Figure 3 This is a flow chart of receiving data packets of the present invention;

[0054] Figure 4 This is an IP header information diagram of the data packet of the present invention after being encrypted by VPN;

[0055] Figure 5 This is a schematic diagram of the SSLVPN gateway network topology of the present invention. DETAILED DESCRIPTION

[0056] In order to make the purpose and technical solution of the present invention clearly and completely described, and the advantages more clearly understood, the embodiments of the present invention are further described in detail with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are part of the embodiments of the present invention, rather than all of the embodiments, and are only used to explain the embodiments of the present invention, and are not used to limit the embodiments of the present invention. All other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0057] For example, see Figures 1 to 5The present invention provides a technical solution: an SSLVPN application method based on OPENVPN, the method comprising the following steps:

[0058] Access private resources in the cloud through SSL VPN connection. Local traffic is routed to the SSL VPN gateway through the tap virtual device. The SSL VPN gateway decrypts the data in the cloud and sends it to the actual cloud terminal, realizing secure access from outside the cloud to the cloud. It is mainly divided into two parts:

[0059] Server: This invention mainly involves the relevant settings of the server, which are divided into the following parts:

[0060] (1) SSL VPN gateway settings: The client needs to route the data packet to the SSL VPN gateway, which encrypts and decrypts the data packet to ensure the security of application data on and off the cloud;

[0061] (2) Gateway routing settings: OPENVPN can customize the network for communication between the server and the client. By configuring routing at the gateway, it can avoid the communication network between the VPN client and the VPN server from overlapping with the cloud network.

[0062] (3) Communication encryption settings: To ensure the security of cloud resources, a connection is established through SSLVPN. The client and server negotiate to determine the encryption algorithm, encrypt and re-encapsulate the application data, and complete secure access to the data.

[0063] (4) Double identity authentication setting: In addition to username and password authentication, certificate authentication is also provided for each client, strengthening access restrictions based on data encryption;

[0064] (5) Iptables rule settings: SNAT needs to be performed on the data packets at the VPN gateway. The source IP of the decapsulated application data packets is replaced with the intranet IP of the SSLVPN gateway through SNAT and sent to the correct intranet virtual machine.

[0065] Client: The choice of client is relatively flexible, as long as the correct configuration is connected to the correct server:

[0066] (1) Setting up the connected server (i.e., SSL VPN gateway), setting the correct server address and port to ensure connectivity between the client and the server;

[0067] (2) Configuration consistency: the encryption and compression algorithms of the client and server are consistent; the server may support multiple algorithms, whichever is supported by the client;

[0068] (3) Correct import of the certificate. Only by using the authenticated certificate issued by the server can identity authentication be passed and identity access restrictions be overcome.

[0069] The specific implementation is as follows:

[0070] First, set up the SSLVPN gateway. Create a new SSLVPN gateway in the VPC and bind it to a public IP address. The topology diagram is as follows: Figure 4 Install and start the OPENVPN service on SSLVPN, and customize the relevant configuration items. Some important configurations are as follows, which can be modified according to actual conditions:

[0071] #Specify the address pool of the IP allocated after the client connects. The server will occupy the first IP as the gateway by default. server 10.8.0.0 255.255.255.0

[0072] #Push routing information to the client to allow the client to connect to other private subnets behind the server

[0073] push"route 172.16.1.0 255.255.255.0"

[0074] #Encryption algorithm

[0075] cipher AES-256-CBC

[0076] #Enable the new version of openvpn compression algorithm

[0077] compress lz4-v2

[0078] After the SSLVPN gateway is configured, perform certificate authentication related settings, install the easy-rsa module for certificate authentication, and complete the issuance of the server certificate of the SSLVPN gateway. First perform general settings for the certificate (validity period, etc.), issue the CA certificate first, and then issue the server certificate.

[0079] . / easyrsa init-pki

[0080] . / easyrsa build-ca nopass

[0081] openssl x509-in pki / ca.crt-noout–text

[0082] ##Create a server certificate request

[0083] . / easyrsa gen-req server nopass

[0084] ##Issuing server certificate

[0085] . / easyrsa sign server server(server certificate name)

[0086] ##Issuing the certificate key is equivalent to encrypting the certificate again

[0087] . / easyrsa gen-dh

[0088] After the certificate is set up, use iptables to set the final conversion rules so that the decapsulated data packets can be correctly forwarded to the virtual machines inside the VPC:

[0089] iptables-t nat-A POSTROUTING-s 10.8.0.0 / 24-j MASQUERADE

[0090] The above settings at the SSLVPN gateway are automatically completed through an automated script after it is successfully created, without the need for manual settings.

[0091] After the SSLVPN gateway is started normally, the client can connect. Import the configuration file on the client. The main configuration items that need to be determined are the gateway address (the public network address of the gateway, i.e. 10.28.149.20), encryption algorithm, compression algorithm, certificate file (import the CA certificate issued at the SSLVPN gateway and the client certificate (the same as the server certificate issuance process)), etc. Confirm that the configuration information is correct and connect.

[0092] After the client connects to the SSL VPN gateway, a virtual device (tap / tun) is generated, and the gateway sends the network segment route to the client. The application sends a data packet with the destination IP as the intranet IP, which reaches the virtual network card through routing selection, transfers to the character device file, and is read by the VPN process. After the packet is encrypted, it is routed to the network card through the protocol stack and finally sent out through the public network card.

[0093] The following is combined with the illustrations Figure 1 as well as Figure 2 Detailed communication process description:

[0094] SSL VPN gateway: eth0-10.28.149.20 (public network), eth1-172.31.16.100 (VPC network), tun0-10.8.0.10

[0095] Client: eth0-10.28.148.34 (public network), tun0-10.8.0.21

[0096] 1) Application Package( Figure 3 The blue part in the IP header, the destination IP is the VPC intranet service IP)

[0097] Go through the protocol stack and search the routing table to find the exit;

[0098] 2) After the client and the SSL VPN gateway pass identity authentication, a virtual machine device tun0 is created and the routing information pushed from the SSL VPN is received: 172.31.16.0 / 24 (destination)

[0099] 10.8.0.10 (nexthop);

[0100] 3) The route 172.31.16.0 / 24 (destination) 10.8.0.10 (nexthop) is matched, and the data packet sealed by the application is sent from the virtual network card tun0;

[0101] 4) The data packet reaches the VPN program through the virtual network card, completes the application data encryption according to the negotiated encryption algorithm, and enters the protocol stack again for the packet process;

[0102] 5) The VPN program encapsulates the destination IP packet according to the configured server address, searches the routing table for the entry, and sends the packet from the client's public network card;

[0103] 6) The VPN process monitors the public IP+port. The data packet passes through the network card to the protocol stack and then to the VPN process.

[0104] 7) The VPN process performs unpacking and decryption operations. The VPN process strips off the outer IP header, decrypts the data, and leaks the inner IP packet;

[0105] 8) The SSL VPN gateway performs snat address translation for the communication network from the tun0 tunnel.

[0106] Match the iptables rules that have been issued;

[0107] The decrypted and unpacked IP data packet is sent to the virtual machine in the VPC network through the intranet network card of the SSL VPN gateway, and the normal unpacking process is then performed in the virtual machine to complete the access.

[0108] Embodiment 2, based on embodiment 1, proposes an SSL VPN application system based on OPENVPN, the system includes the following modules:

[0109] SSL VPN gateway module: deployed inside the VPC virtual private cloud, with a public IP address, used to establish an encrypted VPN connection with the remote client;

[0110] OpenVPN service module: installed and started on the SSL VPN gateway, configured with a specific IP address pool and routing information, used to assign virtual IP addresses to connected clients and push intranet routing information to allow clients to access other private subnets within the VPC; the specific configuration of the OpenVPN service module includes:

[0111] Set the IP address pool to be assigned after the client connects;

[0112] Push routing information to the client, allowing the client to access a specific private subnet within the VPC;

[0113] Configure encryption algorithm;

[0114] Enable the new compression algorithm to improve data transmission efficiency.

[0115] Certificate authentication module: Use the easy-rsa tool set to issue CA certificates, server certificates, and client certificates for identity authentication and encrypted communication of SSL VPN connections; the steps of the certificate authentication module include:

[0116] Initialize the PKI infrastructure;

[0117] Issue CA certificates;

[0118] Generate a server certificate request and issue a server certificate;

[0119] Optionally, generate DH parameters to enhance the security of the key exchange.

[0120] iptables configuration module: Set NAT rules to ensure that decapsulated data packets can be correctly forwarded to the virtual machines in the VPC.

[0121] It also includes a client connection module for configuring and connecting to remote clients. The specific steps include:

[0122] Import the CA certificate and client certificate issued by the SSL VPN gateway;

[0123] Configure the client's OpenVPN connection parameters, such as gateway address, encryption algorithm, and compression algorithm;

[0124] After the client successfully connects, a virtual network interface is automatically created to receive routing information from the VPN gateway and to send and receive encrypted data packets through the interface.

[0125] It also includes the data packet processing flow, specifically:

[0126] After the application is encapsulated, it reaches the virtual network interface through routing selection;

[0127] The data packets are sent to the VPN program through the virtual network interface for encryption;

[0128] The encrypted data packets are sent to the SSL VPN gateway via the public network;

[0129] The SSL VPN gateway receives and decrypts the data packet, performs address translation, and forwards it to the target virtual machine within the VPC.

[0130] After the target virtual machine processes the data packet, it returns the response data to the client through the packet return process.

[0131] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. An SSL VPN application method based on OPENVPN, characterized in that: The method comprises the following steps: Create an SSL VPN gateway in the virtual private cloud (VPC) and bind it to a public IP address. Install and start the OpenVPN service on the SSL VPN gateway, configure the address pool for assigning IP addresses to clients after they connect, and push routing information to clients to allow them to access other private subnets within the VPC. Configure the encryption and compression algorithms of OpenVPN, including but not limited to AES-256-CBC encryption algorithm and lz4-v2 compression algorithm; Use the easy-rsa module to set up certificate authentication, including issuing CA certificates and server certificates, to ensure secure connections for SSL VPN; Configure iptables rules so that the decapsulated data packets can be correctly forwarded to the VMs in the VPC.

2. The SSL VPN application method based on OPENVPN according to claim 1, characterized in that: The steps to push routing information include: Set the push "route <private subnet address> <subnet mask>" instruction in the OpenVPN configuration file to allow clients to access the specified private subnet inside the VPC through VPN.

3. The SSL VPN application method based on OPENVPN according to claim 1, characterized in that: The certificate authentication setup steps further include: Initialize the PKI environment and generate necessary keys and certificate requests; Issue CA certificates as the trust root of all certificates; Generate a server certificate request and issue a server certificate for identity authentication of the SSL VPN gateway; Generate a DH parameter file to enhance the security of key exchange.

4. The SSL VPN application method based on OPENVPN according to claim 1, characterized in that: The steps to configure iptables rules include: Add rules to the POSTROUTING chain of the NAT table to perform the MASQUERADE operation on packets from the OpenVPN client address pool to hide the real IP address of the VPN client and ensure that the packets can be correctly routed to the VPC internal network.

5. The SSL VPN application method based on OPENVPN according to claim 1, characterized in that: The step of connecting the client to the SSL VPN gateway also includes: Configure the OpenVPN client software on the client and import the configuration file including the CA certificate and server certificate; The client establishes a connection with the SSL VPN gateway and, after identity authentication, receives and applies the routing information pushed by the SSL VPN gateway. The data packets sent by the client application are encrypted and transmitted to the SSL VPN gateway through the VPN tunnel, and then forwarded by the gateway to the VPC internal network for secure access.

6. An SSL VPN application system based on OPENVPN and an SSL VPN application method based on OPENVPN according to any one of claims 1 to 5, characterized in that: The system includes the following modules: SSL VPN gateway module: deployed inside the VPC virtual private cloud, with a public IP address, used to establish an encrypted VPN connection with the remote client; OpenVPN service module: installed and started on the SSL VPN gateway, configured with a specific IP address pool and routing information, used to assign virtual IP addresses to connected clients and push intranet routing information to allow clients to access other private subnets within the VPC; Certificate authentication module: Use the easy-rsa tool set to issue CA certificates, server certificates, and client certificates for identity authentication and encrypted communication of SSL VPN connections; iptables configuration module: Set NAT rules to ensure that decapsulated data packets can be correctly forwarded to the virtual machines in the VPC.

7. The SSL VPN application system based on OPENVPN according to claim 6, characterized in that: The specific configuration of the OpenVPN service module includes: Set the IP address pool to be assigned after the client connects; Push routing information to the client, allowing the client to access a specific private subnet within the VPC; Configure encryption algorithm; Enable the new compression algorithm to improve data transmission efficiency.

8. The SSL VPN application system based on OPENVPN according to claim 6, characterized in that: The operation steps of the certificate authentication module include: Initialize the PKI infrastructure; Issue CA certificates; Generate a server certificate request and issue a server certificate; Optionally, generate DH parameters to enhance the security of the key exchange.

9. The SSL VPN application system based on OPENVPN according to claim 6, characterized in that: It also includes a client connection module for configuring and connecting to remote clients. The specific steps include: Import the CA certificate and client certificate issued by the SSL VPN gateway; Configure the client's OpenVPN connection parameters, such as gateway address, encryption algorithm, and compression algorithm; After the client successfully connects, a virtual network interface is automatically created to receive routing information from the VPN gateway and to send and receive encrypted data packets through the interface.

10. The SSL VPN application system based on OPENVPN according to claim 6, characterized in that: It also includes the data packet processing flow, specifically: After the application is encapsulated, it reaches the virtual network interface through routing selection; The data packets are sent to the VPN program through the virtual network interface for encryption; The encrypted data packets are sent to the SSL VPN gateway via the public network; The SSL VPN gateway receives and decrypts the data packet, performs address translation, and forwards it to the target virtual machine within the VPC. After the target virtual machine processes the data packet, it returns the response data to the client through the packet return process.

Images