<div dir="ltr">Discussione rilevante a Ninux Firenze dalla lista OpenWISP.<br><br><div class="gmail_quote"><div dir="ltr">---------- Forwarded message ---------<br>From: Federico Capoano <<a href="mailto:federico.capoano@gmail.com">federico.capoano@gmail.com</a>><br>Date: Tue, Apr 18, 2017 at 5:18 PM<br>Subject: Re: [openwisp] Tinc template for openwisp<br>To: <<a href="mailto:openwisp@googlegroups.com">openwisp@googlegroups.com</a>><br></div><br><br><div dir="ltr">Hi Gabriel,<br><br><div class="gmail_quote"></div></div><div dir="ltr"><div class="gmail_quote"><div dir="ltr">On Tue, Apr 18, 2017 at 12:49 AM Gabriel <<a href="mailto:gabriel@autistici.org" target="_blank">gabriel@autistici.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hello, I made a template to automate the tinc configuration on<br>
OpenWRT/LEDE:<br>
This template configure a L2 "star" vpn with IPv4 on top.<br>
The central node (or Server) is used to authenticate the users and to<br>
perform NAT traversal, then all the traffic is P2P between the clients.<br></blockquote><div> </div></div></div><div dir="ltr"><div class="gmail_quote"><div>Great news and thanks for sharing.</div></div></div><div dir="ltr"><div class="gmail_quote"><div><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
The template and the configuration for a generic node are attached, you<br>
just need to substitute the uppercase stuff:<br>
<br>
The vpn must be identified with a unique name: NET_NAME<br>
<br>
There's one central node (server) identified by: SERVER_NAME<br>
This node must have a public address: SERVER_HOSTNAME<br>
It also needs a public rsa key: SERVER_RSA_PUB_KEY<br></blockquote><div> </div></div></div><div dir="ltr"><div class="gmail_quote"><div>All these variables are good candidates to be kept in a setting called <a href="https://github.com/openwisp/django-netjsonconfig#netjsonconfig-context" target="_blank">NETJSONCONFIG_CONTEXT</a>, which stores a python dictionary that is then passed to the <a href="http://netjsonconfig.openwisp.org/en/stable/general/basics.html#context-configuration-variables" target="_blank">context of netjsonconfig</a> (the underlying configuration engine library).</div><div><br></div><div>If you are using <a href="https://github.com/openwisp/ansible-openwisp2" target="_blank">ansible-openwisp2</a> to deploy and upgrade openwisp2, you can fill this setting by using the variable <b>openwisp2_context</b>, like in the following example:</div><div><font face="monospace"><br></font></div><div><div><font face="monospace">- hosts: yourhost</font></div><div><font face="monospace"> roles:</font></div><div><font face="monospace"> - openwisp.openwisp2</font></div><div><font face="monospace"> vars:</font></div><div><font face="monospace"> openwisp2_context:</font></div><div><font face="monospace"> tinc_net_name: <NET_NAME></font></div><div><font face="monospace"> tinc_server_name: <SERVER_NAME></font></div><div><font face="monospace"> tinc_server_hostname: <SERVER_HOSTNAME></font></div><div><font face="monospace"> tinc_server_pubkey: <SERVER_RSA_PUB_KEY></font></div></div><div><br></div><div>You can then reference these variables in the configuration by using {{ <span style="font-family:monospace;line-height:18px">tinc_net_name }}, {{ </span><span style="font-family:monospace;line-height:18px">tinc_server_name }} and so on.</span></div><div><br></div><div><span style="line-height:1.5">Doing this will make your life easier when you will have to change one of those values in the future.</span><br></div></div></div><div dir="ltr"><div class="gmail_quote"><div><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
The client must have a unique name: CLIENT_NAME<br>
and an address to communicate in the vpn: CLIENT_ADDRESS<br>
<br>
<br>
It was easy to create this template and it's working, however I have<br>
some doubts:<br>
<br>
1) I need to specify the CLIENT_NAME and the CLIENT_ADDRESS _manually_<br>
on each device using the configuration in "tinc_client.json".<br>
Is there a way to variabilize these values in the template ?<br></blockquote><div> </div></div></div><div dir="ltr"><div class="gmail_quote"><div>For CLIENT_NAME, you can use one of the variables available for each object, from <a href="https://github.com/openwisp/django-netjsonconfig#netjsonconfig-context" target="_blank">the docs</a>:</div><div><br></div></div><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div class="gmail_quote"><div><div><i>Each Config object gets the following attributes passed as configuration variables:</i></div></div></div></blockquote><div class="gmail_quote"><div><div><ul><ul><li><span style="line-height:1.5"><i>id</i></span></li><li><span style="line-height:1.5"><i>key</i></span></li><li><span style="line-height:1.5"><i>name</i></span></li><li><span style="line-height:1.5"><i>mac_address</i></span></li></ul></ul></div></div><div>There's also a video in which I show this feature: <span style="line-height:1.5"><a href="https://www.youtube.com/watch?v=IZEesG3UDio&feature=youtu.be&t=103" target="_blank">Some advanced features of OpenWISP2 (1:43)</a></span></div><div><br></div><div>For <span style="line-height:1.5">CLIENT_ADDRESS, I am afraid OpenWISP2 can't do this out of the box right now.</span></div><div><span style="line-height:1.5"><br></span></div><div><span style="line-height:1.5">It's possible to to write a python function that uses the django ORM to insert the ip address according to some rules that you can define.</span></div><div><span style="line-height:1.5">It is then possible to set up this python function to be called each time a new configuration is created.</span></div></div></div><div dir="ltr"><div class="gmail_quote"><div><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
2) The VPN is not fully automatic, the rsa public key is generated on<br>
when tinc get started for the first time, then it must be manually<br>
copied from the client to the server<br>
Any ideas on how automate it?<br></blockquote><div><br></div></div></div><div dir="ltr"><div class="gmail_quote"><div>I don't have a simple solution to suggest. </div><div><br></div><div>Is it not possible to tell tinc to accept clients which have public key signed by a specific Certification Authority like OpenVPN does?</div></div></div><div dir="ltr"><div class="gmail_quote"><div><span style="line-height:1.5"> </span></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">3) When the configuration is updated openwisp-config doesn't run<br>
"/etc/init.d/tinc restart" and it must be manually restarted. Is it ok?<br></blockquote><div><br></div></div></div><div dir="ltr"><div class="gmail_quote"><div>openwisp-config should run /etc/init.d/tinc reload, see this line:</div><div><a href="https://github.com/openwisp/openwisp-config/blob/master/openwisp-config/files/sbin/openwisp-reload-config#L21" target="_blank">https://github.com/openwisp/openwisp-config/blob/master/openwisp-config/files/sbin/openwisp-reload-config#L21</a></div><div><br></div><div>Try to deliberately change the configuration so that openwisp-config downloads it and applies it, then check the logread output with:</div><div><br></div><div><font face="monospace">logread | grep openwisp</font></div><div><br></div><div><span style="line-height:1.5">Do you see any mention of tinc? </span></div></div></div></div></div>