VPN on Linux

Die deutsche Version finden Sie auf der Seite VPN unter Linux

⚠ If you receive an error message such as Decoding PKCS12 failed. Probably wrong password or unsupported/legacy encryption or similar when connecting:
Do not adjust your OpenSSL configuration! Instead, create a new certificate in version 2 (AES-256 container). Details below. Adjusting the OpenSSL configuration can create security risks.

You need a VPN (Virtual Private Network) if you want to use services from your computer at home that are only accessible within the university network. VPN ensures secure access to the university network from external networks (dial-up via other providers, external company or university networks).

These instructions are based on Ubuntu 22.04.2 LTS. Other distributions may work in a similar way. We cannot offer instructions for every distribution.

Simultaneous connections[Bearbeiten | Quelltext bearbeiten]

🛈
Do you want to connect your laptop and your mobile phone to the VPN in addition to your PC? You can set up VPN connections on multiple devices. However, each person can only establish one connection per VPN at the same time.

What does that mean?

Uni-VPN

If you use the Uni-VPN, you can only establish one connection at a time.
You cannot establish a connection to the Uni-VPN on another device at the same time.
You must disconnect the existing connection first.

Group VPN

If you use a group VPN, you cannot establish a second VPN connection to this group VPN on another device at the same time.
You must disconnect the existing connection first.

However, you can connect to the Uni VPN or another group VPN on another device at the same time.

What do I need to do?[Bearbeiten | Quelltext bearbeiten]

Download personal network certificate.
Download configuration file:

Save network certificate and configuration file in a fixed folder.
Rename network certificate.
Set up VPN.

Step-by-step instructions[Bearbeiten | Quelltext bearbeiten]

Create certificate[Bearbeiten | Quelltext bearbeiten]

You need a network certificate for the VPN connection. If you already have a certificate for Eduroam, you can use that and skip this step.
Open the service portal and log in with your university account.

http://sp.upb.de

Go to User management and then to Network settings.

Click on "Create new certificate".

Give the certificate a unique name (e.g. Laptop VPN)
Select Version 2 as the file format.
Then click on "Send new certificate".

A new network certificate has been created for you.
First copy the import password to the clipboard.
Now click on "Download network certificate".

Configuring VPN under Linux[Bearbeiten | Quelltext bearbeiten]

Download the configuration file, select the VPN you want to connect to and click on Download. Normally, "Uni-VPN (Standard)" should be the right choice, but if you have problems with the connection, try "Uni-VPN-TCP" again.
Note: You can click on "Download" here and download your configuration file. This is not a screenshot ;-)

Route all Internet traffic through the tunnel?

Accessing online resources may require that you route all network traffic through the tunnel.
You do not need this option for pure access to network drives.

Create folder[Bearbeiten | Quelltext bearbeiten]

Create a folder and place the network certificate and configuration file there.
- On distributions that use SELinux (e.g. RedHad, Fedora, CentOS etc.) you need to make sure that the location has the correct labels
- These can be checked with ls -laZ PATH and need a label in the form of unconfined_u:object_r:home_cert_t:s0
- By default the directory ~/.cert/ should have the correct labels for the network certificate
- Debian/Ubuntu based distributions normally do not use SELinux and should therefore not be affected by this
Choose the location carefully - you must not move or rename the folder later.
Rename the network certificate to Network_Certificate.p12

This is what the contents of the folder should look like.

Set up VPN[Bearbeiten | Quelltext bearbeiten]

Click on the "Network symbol".
Then click on "Settings".

In the VPN area, click on the + to add.

Select "Import from file...".

Open the folder we just created.
Select the "Configuration file".
Then click "Open".

The VPN settings have been imported from the configuration file.
Enter the "Import password" for the network certificate. (1)
Then click on "Add". (2)

You can connect to the VPN by clicking on the switch.

Connect VPN[Bearbeiten | Quelltext bearbeiten]

Or establish the connection via the network menu.

Disconnect VPN[Bearbeiten | Quelltext bearbeiten]

You can disconnect the VPN connection via the network menu.

Unpack container[Bearbeiten | Quelltext bearbeiten]

If there are problems using the certificate in its container format with the export password provided, it may help to unpack the container into certificate and key.
These problems occur, for example, with the old container format under distributions that use OpenSSL 3 or newer. Here you can either unpack the previous container (in order to reference the key and certificate directly) or request a new certificate with the new container format in the service portal.

The OpenSSL version can be checked as follows:

$ openssl version

The container can be unpacked as follows:

$ openssl pkcs12 -in Network_Certificate.p12 -out Network_Certificate_cert.pem -clcerts -nokeys
$ openssl pkcs12 -in Network_Certificate.p12 -out Network_Certificate_key.pem -nocerts -nodes

The two new files are copied to a safe location in the user directory with the network certificate. When unpacking the old container format, an additional parameter -legacy is required under OpenSSL 3, otherwise this will be refused.

Edit configuration[Bearbeiten | Quelltext bearbeiten]

If you do not select the certificates via the GUI, but use the configuration file via the command line, you must ensure that the files are named appropriately for the configuration file. If you have unpacked the container, you must adjust the configuration file accordingly.

Configuration file without changes

#### Betriebssystemanpassungen für Linux ####################

pkcs12 Network_Certificate.p12
resolv-retry 5
auth-nocache
# oder getrennt:
# cert Network_Certificate_cert.pem
# key Network_Certificate_key.pem

If you have unpacked the container in certificate and key:

#### Betriebssystemanpassungen für Linux ####################

# pkcs12 Network_Certificate.p12
resolv-retry 5
auth-nocache
# oder getrennt:
cert Network_Certificate_cert.pem
key Network_Certificate_key.pem