SuperPC behind OpenWrt and Multiple Users Access

Installing and Using OpenWrt
1

Hello, I have this super computer for Eng simulations (Win :/). The Uni can't open RDP port, which is the one needed for dumb users.

I need to fix it.
Proposal 1:
SSH Tunnel -> OpenWRT is a single user mode OS. I don't know if it is a good idea to create multiple users just for that.

Propostal 2:
OpenVPN Server -> Ok. I admit it. I've built a lot of VPN servers in LXC machines or ubuntu server only copy and paste howto over the internet. I can find a descent for OpenWRT. Most of them are for client side.

With one configuration including ca I can share and let them install the client and open the .opvn file.

Suggestions are welcome and good reading and objective suggestions as well.

2

These days I wouldn't bother about tunneling other protocols over ssh anymore, full VPN solutions are easy enough and much more convenient. IPsec, wireguard and OpenVPN (among others) are at your disposal and can be set up on OpenWrt (all offering the option to run as gateway server on OpenWrt, to allow your clients to dial in).

4 Likes
3

https://openwrt.org/docs/guide-user/services/vpn/openvpn/basic

2 Likes
4

It worked very well, however I have a question. The script always create the same client file. I suppose that I need to create one for each user, correct? How do I do that?

5

https://openwrt.org/docs/guide-user/services/vpn/openvpn/extras#multi-client

1 Like
6

I've successfully implemented a OpenVPN server on a TP-Link. I've tried again in a ZyXEL NBG6817. However, the connection always drop cause it is calculating for days. I've sent the calc to background. Still calculating after 72 hours. I'm confused! My TP-Link that has a horrible hadrware, did that in a few hours. Now the ZyXEL is taking days? Need some help.

7

What does calculating mean in this context?

8

When I try to generate the key, running bellow commands:

opkg update
opkg install openvpn-easy-rsa
 
# Configuration parameters
export EASYRSA_PKI="/etc/easy-rsa/pki"
export EASYRSA_REQ_CN="ovpnca"
 
# Remove and re-initialize the PKI directory
easyrsa --batch init-pki
 
# Generate DH parameters
easyrsa --batch gen-dh

I get...

...+....+....+..............................................................................

Dots are eternal.

9

This one is the longest especially on the low performance devices, so you can generate it on your PC and then move to the router.

1 Like
10

This was my last output after a day of calc:

........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................Segmentation fault

If I decide to run in my computer, what should I move to the router?

11

Try to transfer only the dh.pem after you initialize the PKI directory.
The other commands should be much faster, so even a low performance device should be able to run them successfully.
Otherwise, you can perform the whole PKI section on your PC and transfer the EASYRSA_PKI directory.

1 Like
12

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.