/documentation

eduVPN documentation

Primary LanguageShell

Introduction

NOTE: this is documentation for Let's Connect!/eduVPN 2.0. Click here for the 1.0 documentation.

This is the eduVPN/Let's Connect! documentation repository. This repository targets administrators and developers. It contains information on how to deploy the VPN software, but also (technical) details about the implementation needed to (better) integrate it in existing infrastructure, and how to modify the software for one's own needs.

For more information see:

NOTE: if you are an end-user of eduVPN and want to contact someone, please contact eduvpn-support@lists.geant.org.

Features

This is an (incomplete) list of features of the VPN software:

  • OpenVPN server accepting connections on both UDP and TCP ports;
  • Uses multiple OpenVPN processes for load sharing purposes;
  • Scales from a Raspberry Pi to many core systems with 10GBit networking;
  • Full IPv6 support, using IPv6 inside the tunnel and connecting over IPv6;
  • Support both NAT and publically routable IP addresses;
  • CA for managing client certificates;
  • Secure server and client configuration out of the box;
  • User Portal to allow users to manage their configurations for their devices;
  • Admin Portal to manage users, configurations and connections;
  • Multi Language support in User Portal and Admin Portal;
  • Authentication to portals using "static" username and password, LDAP, RADIUS and SAML;
  • OAuth 2.0 API for integration with applications;
  • Two-factor authentication TOTP support with user self-enrollment;
  • Deployment scenarios:
    • Route all traffic over the VPN (for safer Internet usage on untrusted networks);
    • Route only some traffic over the VPN (for access to the organization network);
    • Client-to-client (only) networking;
  • Group ACL support with SAML and LDAP;
  • Ability to disable all OpenVPN logging (default);
  • Support multiple deployment scenarios simultaneously;
  • SELinux fully enabled;
  • Guest Usage scenario;
  • Native applications available for most common platforms.

Client Support

See Client Compatibility for more information about the supported OpenVPN clients.

Deployment

NOTE: if you plan to run eduVPN/Let's Connect! please consider subscribing to the mailing list here. It will be used for announcements of updates and discussion about running eduVPN/Let's Connect!.

You can also use IRC for support & feedback: freenode, channel #eduvpn.

Supported Operating Systems

Currently we do NOT support CentOS & Red Hat Enterprise Linux 8. We are waiting for this to be resolved. We avoid using third party PHP repositories to prevent having to support these repositories in the future.

NOTE: we expect ALL software updates to be installed and the server rebooted before you install the software!

NOTE: if you want to deploy on multiple machines for load balancing, please follow these instructions!

Experimental

  • Debian 9 (x86_64) (Open Issues)
  • Fedora 31 (aarch64), 32 (x86_64, aarch64) (Only available through the "development" repository)

You can use the aarch64 packages on e.g. the Raspberry Pi.

Development

See DEVELOPMENT_SETUP.

Security Contact

If you find a security problem in the code, the deployed service(s) and want to report it responsibly, contact fkooman@tuxed.net. You can use PGP. My key is 0x9C5EDD645A571EB2. The full fingerprint is 6237 BAF1 418A 907D AA98 EAA7 9C5E DD64 5A57 1EB2.