VPN on Linux

Die deutsche Version finden Sie auf der Seite VPN unter Linux

⚠ If you receive an error message like Decoding PKCS12 failed. Probably wrong password or unsupported/legacy encryption or similar when connecting:
Do not change your OpenSSL configuration! Instead, create a new certificate in Version 2 (AES-256 container). Details below. Adjusting the OpenSSL configuration can lead to security risks.

VPN (Virtual Private Network) is needed if you want to use your computer from outside the university to access services that are only accessible within the university network. VPN guarantees secure access to the university network through other networks (dial-up via other providers, external company or university networks).

This guide is based on Ubuntu 22.04.2 LTS. Other distributions may work similarly. We cannot provide a guide for every distribution.

What needs to be done?[Bearbeiten | Quelltext bearbeiten]

Download personal network certificate.
Download configuration file:

Store network certificate and configuration file in a folder. Don't change the path later.
Rename the certificate.
Setup VPN

Step-by-step instructions[Bearbeiten | Quelltext bearbeiten]

Create certificate[Bearbeiten | Quelltext bearbeiten]

You need a network certificate for the VPN connection. If you already have a certificate for Eduroam, you can use that too and skip this step.
Open the service portal and log in with your university account.

http://sp.upb.de

Go to User Management and then Network Settings.

Click Create New Certificate.

Give the certificate a unique name (Ex: Laptop VPN)
Select Version 2 as the file format.
Then click on Send new certificate.

A new network certificate has been created for you.
First copy the Import Password to the clipboard.
Now click on Download Network Certificate.

Configure VPN on Linux[Bearbeiten | Quelltext bearbeiten]

Download the configuration file, select the VPN you want to connect to and click Download. Normally "Uni-VPN (Standard)" should be the right choice, but if you have problems with the connection, try "Uni-VPN-TCP" again.
Note: You can click on "Download" here and download your configuration file. This is not a screenshot ;-)

Direct all internet traffic through the tunnel?

Accessing online resources may require that you route all network traffic through the tunnel.
You do not need this option for pure access to network drives.

Create folder[Bearbeiten | Quelltext bearbeiten]

Create a folder and put the network certificate and configuration file there.
Choose the storage location carefully - you must not move or rename the folder later.
Rename the network certificate to Network_Certificate.p12

This is what the contents of the folder should look like.

Set up VPN[Bearbeiten | Quelltext bearbeiten]

Click on the "network icon".
Then click on Settings.

In the VPN section, click the + to add.

Select "Import from file...".

Open the folder we just created.
Select the configuration file.
Then click "Open".

The VPN settings were taken from the configuration file.
Enter the "import password"' for the network certificate. (1)
Then click Add. (2)

With one click on the switch you can connect to the VPN.

Connect VPN[Bearbeiten | Quelltext bearbeiten]

Or connect via the network menu.

Disconnect VPN[Bearbeiten | Quelltext bearbeiten]

You can disconnect the VPN connection from the network menu.

Check VPN[Bearbeiten | Quelltext bearbeiten]

You can check the functionality of the VPN by calling:

https://go.upb.de/ip

Your IP will be displayed there and whether you are on the university network.

For advanced users[Bearbeiten | Quelltext bearbeiten]

At least version OpenVPN 2.4 is required.

There is also the option to set up the connection via Ubuntu's network manager.

To use the network manager, the previously created network certificate must be unpacked:

$ openssl pkcs12 -in Network_Certificate.p12 -out Network_Certificate_OPVPN.crt.pem -clcerts -nokeys

$ openssl pkcs12 -in Network_Certificate.p12 -out Network_Certificate_OPVPN.key.pem -nocerts -nodes

The two new files are copied to a safe location in the user directory with the network certificate.

According to user reports, an additional parameter -legacy may be necessary under OpenSSL 3.0.2.

If this doesn't work, it may be necessary (e.g. with Arch) to install the package "openssl-1.1" and call the top two commands with "openssl-1.1" instead of "openssl".

To do this, you must first install the necessary packages using the terminal:

# sudo apt-get install openvpn network-manager-openvpn network-manager-openvpn-gnome