ChaosVPN:OpenWRTHowto

Back

Note:
ChaosVPN is a VPN to connect Hackers and Hackerspaces - it does NOT provide anonymous internet access!
For this look at tor or other similar services.

It will also not help you to reach domains like .rdos, .lll, .clos or any other strange things supposed to be available on the "dark web".

Alternative: If you prefer BGP, you can also connect via https://dn42.net/, we are interconnected.

This is Howto for setting up an independent Box providing ChaosVPN

Introduction

A new package is in the developer branch of openwrt but not currently in the stable release (chaos_calmer/15.05).

Install on chaos calmer/15.05

You have to add an external repo to get chaosvpn installed.

• Connect with ssh to your router.
• At first install the package `openssl` by cli or gui. This is for connecting to the current https repository.
• Edit the file /etc/opkg.conf with your preferred editor and add the following line:

src/gz chaos_calmer_packages_chaosvpn https://www.o-g.at/downloads/openwrt

• Run the command:

echo "untrusted comment: Local build key
RWSzjbOxzqWG1o9Wm8RwCdXvXOPJS/dOUNA3ue0f+G2KkHjUADpV1WeZ" > /etc/opkg/keys/b38db3b1cea586d6

• run `opkg update` to update the package list

Now you can install chaosvpn from the package manager via gui or the cli tool.

WARNING:
this is not a official repository.
It will only stay online until the new openwrt version 16.x will be released.

If you have question you can ask `tuxcoder` on irc(hackint.org) at the #chaosvpn channel or via pm.

Fulfil Requirements

Buy Hardware form OpenWrt supported devices list where "Supported Current Release" is at least 15.05. Newer release is better.
You have to read the basic Howto precisely
generate your keys, choose nodename and subnet and send pubkey to ChaosVPN Team

Get your new node added to the central configuration

Devise a network-nick and a unique IP range you will be using

This network-nick or sometimes called nodename is the name of the network endpoint/gateway where the vpn software will be running,
not necessarily the name of the user, there may even be more than one gateway per user.

Used below where <nodename> is.

Please use only characters a-z, 0-9 and _ in it. Note that only lowercase letters are supported.

Second please select an unused IPv4 range out of IP Range, and write yourself down in that wiki page to mark your future range as in-use.
Please select from the correct ranges, 172.31.*.* for Europe, and 10.100.*.* for North America and elsewhere.

Repeat: Please do not forget to add yourself to the list at IP Range to mark your range as used.

Used below where <ipv4 subnet in the vpn> is.

The usage of IPv6 networks is also possible, but we do not have a central range for this (yet),
you may specify an IPv6 range you received from your (tunnel) provider to be reachable over the VPN,
or a private IPv6 ULA (Unique Local Address) network described in RFC4193.
For more info about ULA and a network-range generator please also see http://www.sixxs.net/tools/grh/ula/ .

Used below where <ipv6 subnet in the vpn> is.

Hostname

The gateway may have a DynDNS (or similar) hostname pointing to a dynamic IP, or a static hostname/fixed IP.

Better supply a hostname than a raw IP address even if it is static, so you can change it youself and do not need to contact us when needed. (Perhaps something like chaosvpn.yourdomain.example)

Used below where <clienthost> is.

Generate keys

Generate keys with tinc 1.1+

# tinc --net=chaos init <nodename>

Replace <nodename> with the name your new node should get.

**FIXME** need some way that "tinc init" puts the public key into the seperate files and not only into the generated hosts file, which our chaosvpn daemon overwrites.

generate public/private RSA and ECDSA keypairs with

# tinc --net=chaos generate-keys 2048

press Enter 4 times and backup the files /etc/tinc/chaos/ecdsa_key.priv, ecdsa_key.pub, rsa_key.priv and rsa_key.pub on an external device.

Generate keys with tinc 1.0.xx

create chaos config folder with

# mkdir /etc/tinc/chaos/

generate public/private keypairs with

# tincd --net=chaos --generate-keys=2048

press Enter 2 times and backup the files /etc/tinc/chaos/rsa_key.priv and rsa_key.pub on an external device.

Mail us your Infos

• send via email to chaosvpn-join@hamburg.ccc.de

We need the following info - but please be so kind and also add a short description of you/your space and your motivation to join chaosvpn - or at least make us laugh. :)

(Please remove all lines starting with # from the email, they are just descriptions)

[<nodename>]

sponsor=
# Name a person/nickname/nodename or organisation/hackerspace already on ChaosVPN that will
# vouch for you getting access.

gatewayhost=<clienthost>
# This should be the external hostname or ip address of the client host, not a VPN address.
# If the client is not reachable over the internet leave it out and set hidden=1 below.
# If possible supply a hostname (even dyndns) and not an ip address for easier changing
# from your side without touching the central config.

network=<ipv4 subnet in the vpn>
network6=<ipv6 subnet in the vpn>
# (mandatory, must include)
# this may be more than one, IPv4 or IPv6, network6 with  IPv6 is optional
#
# These subnets must be unique in our vpn,
# simply renumber your home network (or use something like NETMAP) with a network block that is still free.
#
# Please use the list of assigned networks on ChaosVPN:IPRanges, and add yourself there.

owner=
# (mandatory, must include)
# Admin of the VPN gateway, with email address - a way to contact the responsible
# person in case of problems with your network link.

port=4712
# (optional)
# if not specified tinc works on tcp+udp port 655
# it is better if everyone chooses a random port for this.
# either this specified port or port 655 should accept TCP and UDP traffic from internet.

hidden=0
# (optional)
# "I cannot accept inbound tunnel connections, I can only connect out."
# (e.g. behind a NAT)
silent=0
# (optional)
# "I cannot connect out, but you can connect to me."
# Only ONE of hidden=1 or silent=1 is possible. 

Ed25519PublicKey=<something>
# (optional)
# tinc 1.1pre11+ only, contents of your /etc/tinc/chaos/ed25519_key.pub

-----BEGIN RSA PUBLIC KEY-----
....
-----END RSA PUBLIC KEY-----
# (mandatory)
# rsa-public-key - contents of your /etc/tinc/chaos/rsa_key.pub

Awaiting Response, give us some days, your request is processed manually

Retry until $success or $reject - but do not spam us.

Preparations

so get ready. Read the full Howto befor you start!

1. Get Started

Unpack your Router and power on
Connect wired or wireless (use information provided with your router: manual/quick install guide)
Go directly to your routers Webinterface (192.168.1.1 or 192.168.178.1) and search for something like System -> Firmware Upgrade
(There is no need to change any of the configuration)

2. Install OpenWRT

Follow the install guide on the OpenWrt website

3. Start and Setup OpenWRT

Restart the network connection between PC <-> Router
Connect via telnet and change your root password

telnet 192.168.1.1 
passwd 

Connect the (WAN) port on your router to current infrastructure
Go to the Webinterface via Browser Network -> Interfaces and activate WAN Connection with DHCP or your custom internet configuration
Navigate to System -> Software and press Update Lists Press Available Software Search for ChaosVPN and press install
(I did also install screen at this point)

4. Prepare for launch

Connete with SSH to your device

ssh root@192.168.1.1 

telnet won't work anymore.

edit the chaosvpn.conf in /etc/tinc/

$my_peerid = <nodename>

$my_vpn_ip = 172.31.<your Subnet>.[1-255]

Copy over your public/private keypairs to your router /etc/tinc/chaos/

5. Lift off

start chaosvpn with:

/etc/init.d/chaosvpn start

Hope no error appears.

netstat -nr

You should see a hell of a lot of routes using the chaos_vpn interface. This is good.

Check /etc/tinc/chaos/hosts/ see if a whole bunch of node info has appeared.

Wait several minutes from first execution then test ping some of the "test ping" addresses as defined in the IP Ranges wiki page.
10.100.69.1 is the NYC Resistor fonera. See if you can ping it from the router.

If all went well you are now pinging.
Get someone to ping you back. Ask in the IRC Channel
You now have a functional node.

Configure a Moonlander

While building a ChaosVPN-only access node, use either Webclient or Console Backup continously

1. Add Interface for ChaosVPN

via LuCI

go to Network -> Interfaces
click Add new interface.. Button at the bottom of the page
enter ChaosVPN into name field
select Unmanaged
select Ethernet Adapter: "chaos_vpn"
save

via /etc/config/network

config 'interface' 'ChaosVPN'
        option 'proto' 'none'
        option 'ifname' 'chaos_vpn'

2. Add Zone for ChaosVPN via LuCI

go to Network -> Firewall
in the Zones Tab, klick Add
enter ChaosVPN into name field
for Covered Networks select ChaosVPN

3. Make WLAN an ChaosVPN only AP

The following is varies with your persional use case - please post your configuration with an short description if you like
The default WAN will be still reachable via wired network.
The wireless network will have no access to WAN - ChaosVPN only.
At any state you can use the IP 192.168.1.1 to reach your router.
Pressing save will only cache the setting - press apply to make sure settings are set

Setup via LuCI

go to Network -> Interfaces
click Add new interface
enter wlan into name field
select Static address
check Create a bridge if you like to bridge 2.4GhZ and 5GhZ
select (both) wlan devices

In the Edit mask

IPv4 Address: 172.31.<your subnet>.[1-255] //this have to not be the ip of chaosvpn device!
Netmask: 255.255.255.0

Add a DHCP Server to server some addresses in range 100-150
Advanced Settings to propagate internal nameservers

DHCP Options: 6,172.31.116.1,195.24.78.86,172.22.228.6

go to Network -> Firewall
in the Zones Tab, klick Add
enter wlan into name field
at Covered Networks select wlan device
check Allow forward to destination zones: ChaosVPN

ping irc.hackint.hack

tests your successful landing with stable communication uplink

... to be continued