OpenVPN on Windows notes
------------------------

This is a BETA release.

As of 2003.07.18, OpenVPN only builds/runs on Win XP.
Ports to other versions of windows should
be forthcoming.

Install from Binaries
---------------------

Download and Unzip the most recent OpenVPN-Win32 beta
which can be found in:

http://prdownloads.sourceforge.net/openvpn/

Choose the most recent distribution with a .zip extension.

The .zip version is basically identical to the .tar.gz
version except it also contains a .\win32-binaries directory.

Within win32-binaries, the bin directory has the
OpenVPN exe and the OpenSSL DLLs.  Either copy all
files in bin to a directory on your PATH, or add
the location of the bin directory to your PATH.

Build from source
-----------------

You can skip this section if you installed
from binaries as described above.

You will need the following:

(1) MinGW/MSYS environment
    http://mingw.sourceforge.net/

(2) OpenSSL library
    http://www.openssl.org/

(3) LZO library
    http://www.oberhumer.com/opensource/lzo/

(4) Windows DDK (available only from Microsoft)
    http://www.microsoft.com/whdc/ddk/winddk.mspx

First build the usermode component of OpenVPN
from the top-level directory of the OpenVPN
source distribution:

Edit makefile.32 with the location of
your OpenSSL and LZO distributions.  Note that
it is only necessary to build these distributions,
not to install them.

Note that the makefile accepts a 'dynamic'
or 'static' target, depending on the way
you want to link with the OpenSSL library.

By default the makefile will attempt to
dynamically link with OpenSSL.

Type:
  make -f makefile.w32

This will build the user mode component of OpenVPN.

Now build the TAP-Win32 kernel driver:

Go to Start -> All Programs -> Development Kits -> Windows DDK
  -> Build Environments -> Win Free Build Environment

Use the Checked Build Environment if you want a debugging version.

A command prompt window will open.  Go to the tap-win32 directory
of the OpenVPN distribution.

Type:
  build -cef

This will build the kernel driver in the i386 directory.

At this point you will have built:

.\openvpn.exe -- openvpn daemon
.\tap-win32\i386\tapdrvr.sys -- TAP-Win32 kernel driver

Copy openvpn.exe to a directory in your path.
If you build dynamically with OpenSSL, copy the OpenSSL
DLLs to a directory in your path.

See instructions below for installing the kernel driver.

Install the TAP-Win32 kernel driver
-----------------------------------

I have only tested this on Win XP so far.

Go to Start -> Control Panel -> Add Hardware

Click on Next

Check "Yes, I have already connected the hardware"

Select "Add a new hardware device" from the bottom of the list.

Check "Install the hardware that I manually select from a list"

Select Network Adapters from the list.

Click on Have Disk.

Select the OemWin2k.inf file.  If you built from source,
it will be in .\tap-win32\i386 -- If you are installing
from binaries, it will be in .\win32-binaries\driver

Select "TAP VPN Adapter" and click on Next.

You will get a warning that the driver has not passed
Logo testing.  While it is true that a buggy driver has
a greater ability to crash your system than a buggy
application, I have personally built, installed, and
uninstalled this driver multiple times on my WinXP
laptop without any problems.  If you want more information
on the kernel driver, you should check out the Cipe-Win32
list on sourceforge, where its development and usage
is discussed.

Assuming you are comfortable installing a non-Microsoft
approved driver, click on Continue Anyway.

This action should install the driver and display
a success or failure dialog on completion.

Configure the TAP VPN adapter
-----------------------------

Go to Start -> Control Panel -> Network Connections

You should see a "TAP VPN Adapter" with a name like
"Local Area Connection 1".  Right click and rename
this to something shorter such as "my-tap".

Now right click again and select properties.

Select Internet Protocol (TCP/IP) from the list
and click on Properties.

Set the IP address and subnet mask of your
new TAP device.  For the example below we
will use an IP of 10.3.0.1 and a subnet mask
of 255.255.255.0.  Other fields can be left
as they are.

Check that OpenVPN sees the adapter
-----------------------------------

Type:
  openvpn --show-adapters

You should see a list that looks like this:

Fri Jul 18 14:17:09 2003 0: Available TAP-Win32 devices:
Fri Jul 18 14:17:09 2003 1: [1] 'my-tap'

You can list all network interfaces with the
Windows "ipconfig" command, and all TAP-Win32
interfaces should be included among them.

Windows and TAP device naming
-----------------------------

One major change in usage between running on Windows vs.
the Posix world is the lack of an "ifconfig" command on
Windows.  Basically what happens when you install the
TAP-Win32 driver is that you get a new network adapter
that shows up in your network control panel.  You right
click on the TAP adapter and set the TCP/IP properties,
i.e. IP address and netmask.  Then you rename the TAP
adapter icon to something like "my-tap" and reference
it using the --dev-node option in OpenVPN.

Example running a VPN between Windows and Linux
-----------------------------------------------

First generate a static key:

  openvpn --genkey --secret key

Copy this key to your linux system via a secure medium.

Now generate config files for the windows
and linux sides:

on windows create a file openvpn-config :

remote [my-linux-box]
dev tap
dev-node my-tap
tun-mtu 1500
tun-mtu-extra 64
secret key
verb 3

on linux create a file openvpn-config :

remote [my-windows-box]
dev tap
up ./tap.up
tun-mtu 1500
tun-mtu-extra 64
secret key
verb 3

on linux also create a file tap.up and do a chmod +x on it:

#!/bin/bash
ifconfig $1 10.3.0.2 netmask 255.255.255.0 mtu $2

Make sure that both boxes can talk to each other
over UDP port 5000.  Also make sure that the linux
side has a firewall rule like this to let IP traffic
come in from the TAP adapter:

iptables -A INPUT -i tap+ -j ACCEPT

Now the moment of truth... Type:

 openvpn --config openvpn-config

On both windows and linux boxes.

If everything worked correctly you will now have a
point-to-point VPN connecting the two boxes.

On Windows, you can ping the Linux box through
the VPN with:

  ping 10.3.0.2

On Linux, you can ping the Windows box through
the VPN with:

  ping 10.3.0.1

Uninstall the Tap-Win32 driver
------------------------------

Go to Start -> Control Panel -> System -> Hardware

Click on Device Manager

Go down the list to Network Adapters.

You should see one or more "TAP VPN" adapters.

Right click and select Uninstall.

Upgrade the Tap-Win32 driver
----------------------------

I found that I need to uninstall the driver,
reboot my system, and reinstall the new
driver.

Notes -- ARP/MAC Issues with the TAP-Win32 driver
-------------------------------------------------

Most TAP drivers allocate a random MAC to their virtual NIC.
If OpenVPN running on Windows disconnects and reconnects to
a remote peer, it is possible that that peer will reinitialize
its TAP device and generate a new random MAC, causing Windows to
temporarily lose access to the IP addresses exported by that
remote peer.  This is because Windows doesn't know that a given
IP address on the virtual TAP network now is associated with a
new MAC, so it tries to send packets to the old MAC, causing
them to be dropped.

Luckily, there is an easy solution to this problem.
Create a batch file with one or more of the following commands:

  arp -d [ip-address]

Where ip-address is a remote IP address at the other end of the
virtual TAP network whose access was lost due to an OpenVPN
restart.  The arp -d command will cause Windows
to "forget" the MAC address which it previously associated with
the given IP address.  Next time that IP address is used,
Windows will actively query the remote peer
(with an "arp who-has" message) to get the new MAC address.

You can use the --up option in OpenVPN to automatically run a
given batch file immediately after TAP device initialization --
such a batch file can contain arp commands as described above.

Performance
-----------

Using the configuration above, I FTPed a
33 MB file compressed file over the VPN
in both directions.

The speed is limited by the encryption
efficiency of the Linux box
which is a Pentium II 266Mhz.

****************

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

c:\>sh
sh-2.04$ cd /tmp
sh-2.04$ ftp
ftp> open 10.3.0.2
Connected to 10.3.0.2.
220 ProFTPD 1.2.8 Server (boulder.yonan.net) [localhost]
User (10.3.0.2:(none)): jim
331 Password required for jim.
Password:
230 User jim logged in.
ftp> cd /tmp
250 CWD command successful.
ftp> binary
200 Type set to I
ftp> get test.dat
200 PORT command successful
150 Opening BINARY mode data connection for test.dat (33259135 bytes)
226 Transfer complete.
ftp: 33259135 bytes received in 19.84Seconds 1676.54Kbytes/sec.
ftp> send test.dat
200 PORT command successful
150 Opening BINARY mode data connection for test.dat
226 Transfer complete.
ftp: 33259135 bytes sent in 28.75Seconds 1156.80Kbytes/sec.
ftp> quit
221 Goodbye.
sh-2.04$
