Openvpn in EC2 for Chromebooks : Part 2

[ Update: take a look at this write up as well ]

ChromeOS has a minimalistic design does a fairly good job at hiding the complex internals of the operating system. But deep inside it still runs linux and has a full blown openvpn client. In this post I'll show you how to use "ONC" (Open Network Configuration) format to configure OpenVPN client inside ChromeOS. This file is very similar to an .ovpn file.

The core scripts which did the cert conversion and created the sample ONC file was contributed by Ralph by reading the ONC documentations by himself. If there is a bleeding-edge user of chromebook.. he is the best example I can think off.

These scripts are now published on github and here is a step by step guide of how to use it.

Step 1: Launch a new amazon instance ( Based on Amazon Linux AMI )


  • Pick defaults for everything ( Use t1.micro for the cheapest instance )
  • If you don't already have a keypair, create one yourself and upload your public key to amazon


Step 2: Update security group you used. Allow UDP:1194 incoming.

  • Open 1194 UDP incoming 
  • Open 22 TCP incoming

Step 3: Find the IP address of the new instance.

  • Find the "Public DNS" address. This is the address we will SSH to.

Step 4: SSH into the server

  • If you only have a chromebook, use this extension to initiate ssh
  • Upload both private and public key to this extension.
  • Fill in the hostname and username (ec2-user)

Step 5: Run the quick setup script


curl https://raw.github.com/royans/ec2_chromeos_openvpn/master/quicksetup.sh > quicksetup.sh; 
chmod +x quicksetup.sh;
sudo ./quicksetup.sh email_address@blogofy.com
  • These three lines downloads the script and launches the setup script.
  • Remember to put in your email address instead of the one listed here
  • This step may take two to three minutes before it prompts you for anything

Step 6: Select default values


  • When it does prompt you, just choose the defaults
  • If it asks you y/n questions... just select 'y' 
  • It will ask you for password a few times... just press enter (which sets no password on the keys)
  • Remember this is proof of concept and that you should customize it before you can use it for real stuff

Step 7: Wait for the email. Download the ONC file attached.


Step 8: Upload ONC file into chromebook

  • Make sure it says "ONC file successfully parsed" after the import.
  • [Advanced users: /var/logs/ui/ui.LATEST will have parse errors if you want to investigate a failed import]

Step 9: Try to connect to the openvpn server






  • Just click on "Connect"

Step 10: Connected


  • At this point you should see a solid (should not be blinking) VPN signal on the wifi icon. 

Step 11: Verify if its traffic is being routed through amazon

Comments

Ralf Robert Stebner said…
don't get me wrong, the rest is very impressive and well documented by yours.
8:07 PM
Royans Tharakan said…
Definitely. Let me add you as a contributor.
This is awesome stuff.
2:11 AM
Post a Comment

Popular posts from this blog

Chrome Frame - How to add command line parameters

Image
Chrome frame intentionally does stuff without getting in the way of the user. This sometimes makes things harder to debug. For example how can one debug an issue if chrome frame doesn't even launch ? Apparently there is a flag for that. But you have to know how to enable it. Here are the steps. Make sure chrome frame is installed. We can enable startup flags for dumping debug logs using a policy called AdditionalLaunchParameters If this is just for one desktop, I recommend doing a registry edit (it can be pushed via GPO as well) Add a REG_SZ property " AdditionalLaunchParameters " to " SoftwarePoliciesGoogleChromeAdditionalLaunchParameters " with the value "--enable-logging --v=1" (also documented here  and mentioned here )  [ Attachment 1 ] Next kill the IE browser and make sure chrome is also dead by checking taskmgr Restart IE and go to " gcf:about:version " and confirm that the parameters you added show up next to "Command Line:"
Read more

Creating your first chrome app on a Chromebook

Image
Doing development on Chromebook usually means developing online. There are a lot of sites around for that. But with the APIs getting more mature, its just a matter of time before someone builds a kick-ass IDE which runs natively on Chromebooks without network connectivity. One such tool which I've been exploring for a last few weeks is from Google and called " Chrome Dev Editor " If you have never built and run a chrome app or extension, I'll show you how to do this in 3 easy steps.     Step 1 Launch the app and click on the "+" button to add a new project. Pick a project name and select "JavaScript Chrome App" in the drop down menu.       Step 2 Notice how it automatically adds the minimum code required for it to run. This will be the template you are going to work with. You are almost done, but lets review the files in there to understand why they are there.   manifest.json - This is the most important file. Modify the app name, version number
Read more

Brewers CAP Theorem on distributed systems

Image
Large distributed systems run into a problem which smaller systems don’t usually have to worry about. “ Brewers CAP Theorem ” [ Ref 1 ] [ Ref 2 ] [ Ref 3 ]  defines this problem in a very simple way. It states, that though its desirable to have Consistency, High-Availability and Partition-tolerance in every system, unfortunately no system can achieve all three at the same time . C onsistent : A fully Consistent system is one where the system can guarantee that once you store a state (lets say “x=y”) in the system, it will report the same state in every subsequent operation until the state is explicitly changed by something outside the system. [ Example 1 ] A single MySQL database instance is automatically fully consistent since there is only one node keeping the state. [ Example 2 ] If two MySQL servers are involved, and if the system is designed in such a way that all keys starting “a” to “m” is kept on server 1, and keys “n” to “z” are kept on server
Read more