Got OpenVPN Running on 2.1!!!

[prochobo]

Finally got it figured out ! Must have busybox installed if you want to use cp (and possibly ln). All commands below assume you have root access.

First, get TunnelDroid from the market place. Then, copy your client OpenVPN files to the openvpn directory on your SD card. This includes your client cert, client key, server ca.crt, and client .ovpn config file.

Now this is where you've gotta do some work. The Droid does not have the tun.ko module needed to create the VPN tunnel. Get it from here (just download the tun.ko):

get-a-robot-vpnc - Project Hosting on Google Code

Then remount your file system to r/w and copy the tun.ko module to your /system/lib/modules directory

su
mount -o remount,rw /dev/block/mtdblock4 /system 
cp /sdcard/tun.ko /system/lib/modules/tun.ko

Then grab the OpenVPN binaries from here (zipped, at the bottom of the list):
Browse TunnelDroid Files on SourceForge.net

Now follow these instructions:

Step 1 - Take back and secure externally - optional, but always a good idea.

Step 2 - Make a backup of the original files, you never know...
> adb shell remount
> adb shell
# cd /system/lib
# cp libcrypto.so libcrypto-orig.so
# cp libssl.so libssl-orig.so
# exit

Step 3 - Perform the following text commands at a command prompt
From the unzipped fries download find all the files (should be 5 in total) and do
> adb shell remount
> adb push libcrypto.so /system/lib/
> adb push liblzo.so /system/lib/
> adb push libssl.so /system/lib/
> adb push openvpn /system/bin/

Then reboot the phone

Make sure you have a kernel with the tun device installed and loaded.

You can either use the sdk and use adb, or you can use "cp" from a terminal on your phone.

One addition to the procedure directly above is that I had to change the permissions on the openvpn binary:

chmod 755 /system/bin/openvpn

Then, load the tun.ko module:

insmod /system/lib/modules/tun.ko

Now, in this version of TunnelDroid at the time of this post, it looks to /system/xbin for the "ifconfig" and "route" binaries. Since the Droid doesn't have these binaries in the /system/xbin folder, you can make sym links:

cd /system/xbin
ln -s /system/bin/ifconfig ifconfig
ln -s /system/bin/route route

Now you should be able to open TunnelDroid, see your .ovpn client config file, and connect!!!

Works over wifi and 3G.

[mudtoe]

Wow, that's great! I'm using PPTP right now, and it kind of stinks. I'm going to have to upgrade to 2.1 from 2.0.1 first though. One question, is there some way to backup the entire phone (i.e. take an image backup) before trying all this, so that if I brick it, I have a way back?

mudtoe

[hughesjr]

Wow, that's great! I'm using PPTP right now, and it kind of stinks. I'm going to have to upgrade to 2.1 from 2.0.1 first though. One question, is there some way to backup the entire phone (i.e. take an image backup) before trying all this, so that if I brick it, I have a way back?

The openvpn procedure here also works on android 2.0.1 as well, so you are not forced to upgrade.

[mudtoe]

I'm going through the procedure now, but I wanted to find out if I have to use a routed connection versus a bridged one because the device created was called "tun". Also, if that's the case, is the version of OpenVPN that goes with this one of the older ones where you have to use all those alias subnets in order to get a routed VPN?

mudtoe


Edit: Looks like the version is 2.1 rc15, which has the topology routing feature in it, so no messing with extra subnets . I got the software installed on the phone and I ran a test where I just keyed in "openvpn --mktun --dev tap0" and that worked as well (response was that tap0 device was created and opened), so it appears that the tun.so driver also can do an ethernet bridging VPN as well as a routed VPN ("openvpn --mktun --dev tun0" worked too). That's good as I use a bridged VPN to connect my laptop to my home office network, and I had originally thought that the driver would only allow a routed VPN device to be created. I haven't created a full config file yet or done the work to create a new set of encryption keys for the droid, but that's on the list for today.

[mudtoe]

I was able to get a tap connection active, but I can't ping or transfer any data across it. I'm not sure what's wrong, as I didn't change the server side at all, and I used a .ovpn configuration file from my laptop as the model for the droid, and just took out the windows specific stuff. I'm curious if the people who have this working have it working in bridging mode (tap) or tunnel mode (tun)?

I'm starting the process of creating a tunnel mode connection on my OpenVPN server so that I can try that.

mudtoe

[mudtoe]

Update: It looks like the issue is that the ifconfig command doesn't work from within openvpn on the droid, either in tap or tun mode. I checked and the symlink is set in /system/xbin. The tap or tun device always ends up with an invalid IP address which consists of the correct subnet with a 255 suffix (e.g. should be 192.168.5.10 and ends up 192.168.5.255). If I manually create the tap or tun device first via "openvpn --mktun -dev tap5", followed by manually keying "ifconfig tap5 192.168.5.10 netmask 255.255.255.0" in a rooted terminal session, and then setting "ifconfig-noexec" in the openvpn config file I can get it to work in either tap or tun mode. I have no idea why ifconfig directive inside openvpn isn't working right.

[LillieBennett]

The native setting in Droid will connect but the tunnel won't work. I'm trying openvpn to see if it will connect to a plain vanilla pptp encrypted windows vpn server.

This is probably very stupid but where does one get the client config files ("Then, copy your client OpenVPN files to the openvpn directory on your SD card. This includes your client cert, client key, server ca.crt, and client .ovpn config file.")?

Hopefully, I'll be able to figure out how to edit them

[gavron]

SG6.0 vpn works with PPTP out of the box.

E

[adrynalyne]

my rom has tun.ko built in natively

[Chris.Nelson]

I know I've got my stoopid hat on today but how do I get a console window to enter the cp, etc. commands?