Requisitos:
Firmware 5.5.2
Cable de consola modelo: AT-VT-KIT3
Memoria USB o Tarjeta SD
Version GUI de OpenVPN para Windows link aqui
Tunnelblick OpenVPN para macOS link aqui
awplus#enable
awplus#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
awplus(config)#radius-server host 127.0.0.1 key awplus-local-radius-server
awplus(config)#aaa authentication openvpn default group radius
awplus(config)#radius-server local
awplus(config-radsrv)#server enable
awplus(config-radsrv)#nas 127.0.0.1 key awplus-local-radius-server
//Crear configuración de red para usuario1
awplus(config-radsrv)#group client-1
awplus(config-radsrv-group)#attribute Framed-IP-Address 192.168.100.1
awplus(config-radsrv-group)#attribute Framed-IP-Netmask 255.255.255.0
awplus(config-radsrv-group)#attribute repeated Framed-Route "192.168.10.0/24 192.168.100.254"
awplus(config-radsrv-group)#exit
//Crear usuario1 y asignarlo a su grupo para obtener la configuración de red
awplus(config-radsrv)#user userOpenVPN password very-secret group client-1
awplus(config-radsrv)#exit
//Crear la interface Gateway para los clientes VPN
awplus(config)#interface tunnel1
awplus(config-if)#tunnel mode openvpn tun
awplus(config-if)#tunnel openvpn cipher aes256
awplus(config-if)#tunnel openvpn authentication SHA256
awplus(config-if)#ip address 192.168.100.254/24
awplus(config-if)#exit
//Crear el certificado
awplus(config)#crypto pki trustpoint local
awplus(ca-trustpoint)#exit
awplus(config)#exit
awplus#crypto pki export local pem cacert.pem
Copying...
Successful operation
awplus#dir
1257 -rw- Nov 24 2022 15:10:44 cacert.pem
1361 -rw- Nov 24 2022 15:07:22 default.cfg
4096 drwx Nov 24 2022 15:03:03 gui-userdata/
52710731 -rw- Nov 17 2022 14:12:27 AR4050S-5.5.1-2.6.rel
//Extraer el certificado a un medio externo:
Ejemplo usando Memoria USB
awplus#copy flash:/cacert.pem usb:/cacert.pem
Copying...
Successful operation
awplus#
Ejemplo de usar Tarjeta SD
awplus#copy flash:/cacert.pem card:/cacert.pem
Copying...
Successful operation
awplus#
//Salvar la configuración
awplus#wr
Building configuration...
[OK]
awplus#
SI tenemos configurado el Firewall
hay que permitir las conexiones del puerto de OpenVPN
awplus>enable
awplus#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
awplus(config)#zone Public
awplus(config-zone)#network Internet
awplus(config-network)#host WAN
awplus(config-host)#ip address 172.31.1.1
awplus(config-host)#exit
awplus(config-network)#exit
awplus(config-zone)#exit
awplus(config)#firewall
awplus(config-firewall)#rule permit openvpn from Public to Public.Internet.WAN
awplus(config-firewall)#exit
awplus(config)#
hay que agregar la subred VPN a la Zona Privada:
awplus(config)#zone Private
awplus(config-zone)#network VPN
awplus(config-network)#ip subnet 192.168.100.0/24
awplus(config-network)#exit
awplus(config-zone)#exit
awplus(config)#exit
awplus#wr
Building configuration...
[OK]
awplus#
Crear archivo de conexión OpenVPN
client.ovpn
client
remote "ip_publica" 1194 udp
dev tun
#
tls-client
tls-cipher TLS-DHE-RSA-WITH-AES-256-CBC-SHA:TLS-RSA-WITH-AES-256-CBC-SHA:TLS-DHE-RSA-WITH-AES-128-CBC-SHA:TLS-RSA-WITH-AES-128-CBC-SHA
tls-ciphersuites TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256
#
data-ciphers-fallback AES-256-CBC
data-ciphers AES-256-CBC
auth SHA256
#
auth-user-pass
#
topology subnet
pull
#
verb 2
#
port 1194
<ca>
-----BEGIN CERTIFICATE-----
Copy-Paste cadena del archivo cacert.pem
-----END CERTIFICATE-----
</ca>