As @Dexter_Kane said if this is to connect to your home network from the outside this is good.
But if you're trying to use this from internally to the outside there's very little reason as your traffic will only be encrypted from your PC to this ubuntu server, decrypted, and forwarded out to wherever you were originally trying tor reach. I suppose it'd be useful if you want to obfuscate which device on your network is making outside connections it'd be alright
I'm trying to make it so I can remotely connect to my LAN outside of my house. Firstly, my plan is VPN into the network and then SSH into my servers (also other VMs) from somewhere else. Also, I guess it would be nice to have a secure connection when using public networks. Lastly, it's a feather in my hat project.
If I understand correctly, all traffic going to the LAN will be encrypted but outbound traffic won't.
Does this mean that if I use my VPN to connect to my LAN, and then SSH into one of my servers that all traffic from the server back to my outside computer will be vulnerable? Or, if I pull a file off my file server to my remote laptop, will that traffic be vulnerable? Or is the connection between my remote computer and the server secure, but all other outbound connections (ie to website) not air tight?
Ah I see that makes more sense, especially if you make some firewall rules to only allow LAN SSH as that'd be nice and secure
Correct, so say you are at a coffee shop and you connect to your home ubuntu VPN server your traffic TO the server from your PC will be encrypted which is excellent, then once going FROM your server outward to the traffic destination depending on what it is (say HTTP) it will be be unencrypted traffic
In your final example you gave with the remote connection and server being secure but outbound traffic to a website is not secure is true. VPN to your network, then SSH to the server is secure there is no leaks in that example so don't worry about an insecure connection leaking your files
I hope I explained that in an understandable way, please ask for clarification if not
All of the traffic between your remote computer and the server will be secure because of SSH no matter what you do. But to answer your question a little better, all the traffic between your remote computer and the VPN server will go though the VPN tunnel, not just the inbound traffic. So traffic from your remote computer to the LAN goes over the tunnel and traffic from the LAN to the remote computer also goes over the tunnel. But any traffic from your remote computer to the internet will only be encrypted between you and the server, from there it goes out your gateway like normal. So yeah, that will protect you on public networks.
Alright, so far so good. So in addition to the VPN set up as listed above:
Say there is a separate file server VM on the network. On that FS I can install openssh server. I can configure the FS UFW to allow SSH connections on port whatever from the LAN. In turn, the VPN server (an independent VM) allows me to connect from a remote computer at the coffee shop to my LAN. Now I have a local IP address on my LAN. Since I'll have Ubuntu Desktop on my laptop and a local IP I can just use the SSH command to access the VM FS?
Just make sure to have the ports open for machines in your ufw, and then first test SSH while you're on your LAN (no VPN), see how that works and if successful try connecting to your VPN to see if traffic is still routing properly and you have access. That's what I'd do anyway
Making some progress with this. Got the keys generated and setting up the server.conf files now. Lastly, I'll port forward default gateway. @100557662 tested the SSH while on the LAN... it's working. Hurah!
Only thing is I need to copy the ca.crt, the client.crt, and client.key files from my VPN to my client computer. Problem is I'm using Ubuntu Server, so I can't simply copy them to usb, so I'm not really sure how to copy those files off the VPN server and onto my laptop. I do have a SSH set up on the VPN server. Is there a way I can do a FTP via SSH?
from my experience with Ubuntu 14.04.2 LTS on virtual-box 256mb of ram will not be enough, you will get memory leak errors. 384mb is the least I was ever comfortable with but all my servers run on 512mb with no issues.
So the first part is like an SSH command with the absolute path to the crt and key files and the second part is where ever you want to copy those files to. You may have to run this command as root depending on your permissions.
I get this same error if I SSH into my server and try to cd into the keys directory using my username. However, I can access it as root.
So, it appears the keys directory can only be accessed by root right now. When I ls -l /keys, he directory with the keys, it returns they are all owned by root. So, I think if I change the permissions (or ownership) of the file I should be able to scp the directory over to my laptop.
Can I use chown username /keys, and then when I scp the directory as my username on the server, have access to the keys?
sudo [email protected]_address /directory/address/keys /Downloads Both prompt me for root's password, which I enter. Response Permission denied, try again (x3) Error thrown: Permission denied (public key, password).
chown -R username:username /directory/for/keys //I'm a little confused on the synatax... does username:username mean change owner from username to username? //Should it be root:username - like change ownership from root to username?
The syntax is owner:group so if you use user:user it changes the owner to the user and the group to the user's group. I'm not sure if it works with just user and no group but that's how I've always used it.