Create a secure Linux-based wireless access point (Linux.com)

[Posted July 19, 2006 by ris]

Linux.com looks at WPA2. "Wi-Fi Protected Access version 2 (WPA2) is becoming the de facto standard for securing wireless networks, and a mandatory feature for all new Wi-Fi products certified by the Wi-Fi Alliance. We all know the security weaknesses of its predecessor, WEP; this time they got it right. Here's how to implement the WPA2 protocol on a Linux host and create a secure wireless access point (WAP) for your network."

Create a secure Linux-based wireless access point (Linux.com)

Posted Jul 19, 2006 21:33 UTC (Wed) by drag (guest, #31333) [Link]

I like the idea of just leaving the wifi network open and implimenting a VPN.

I've been playing around with OpenVPN add-on for Ipcop from Zerina and it seems to work pretty well and is easy to setup. Set it up for over the internet and over a 'orange' DMZ for the wifi.

Ya follow the directions on zerina's website. After you finished you download the client package zip file. In the zip file there will be a *.p12 file and a *.opvn file. The p12 file is in pkcs#12 format. It is a password protected file that contains you certificites and keys and such.

Now what to do with that confused me for a while. I tried the OpenVPN add-on for Network-manager from Gnome's CVS and I couldn't figure out how to make it work with that. Then I tried OpenVPN-Admin, which is a cool mono-based administration tool. I just realy wanted to have a icon or something that I could click on just to start and stop the connection. But neither of them supported the pksc#12 format. Then I learned that I could extract the certs and the keys out of it using openssl.

But I figured out eventually that all I had to do was copy the *opvn and *p12 file to /etc/openvpn (using Debian unstable, I suppose other distros may have it different) . Then I had to rename filename.opvn to filename.conf and simply restart openvpn service. It came up, asked for the password to the file and it was off.

Now I just have persistant connection to my home lan, which is great for me. Wifi or over the internet it doesn't realy matter.