Series
6 posts
6 posts
The first post in my Owning the Edge series. The VPN into my servers broke in three ways at once, so instead of repairing a box I did not control, I built my own gateway, internal network and DNS from scratch.
How I set up a minimal VPN gateway with two open ports, SSH only on the internal network, a login account without sudo and a default-deny nftables firewall that fits on one screen.
Adding one phone to my OpenVPN fallback revealed that the private key of the old certificate authority no longer existed anywhere. How I searched for it, and the 30-second check that proves whether a certificate and a key belong together.
Building a new certificate authority for my OpenVPN fallback with easy-rsa, choosing validity periods, staging the files with strict permissions, and replacing 150 lines of inlined certificates with five directives.
How my OpenVPN fallback on TCP 443 is configured, why tls-crypt made it stop answering scanners, how I build client profiles, and the steps for adding and revoking a client.
Two small problems that cost me more time than they should have, an openvpn3 error about an invalid D-Bus path and an SSH connection that hung because of a stale ControlMaster socket, plus a recap of the whole series.