Connecting OpenVPN client to Vyatta OpenVPN server via HTTP-Proxy (Writing...)

 The network configuration is below;

[PC] -----[HTTP-Proxy]----INTERNET---[Router]---[Vyatta]---[Server]

* Vyatta: Vyatta Core 6.2
* PC: Host OS-WindowsXP, Guest OS-CentOS5.5(on VMware Player)

1.Configuring Vyatta OpenVPN server

(1)Making certifications using Vyatta easyrsa

Changing to root

vyatta@vyatta:~$ sudo su
root@vyatta:/home/vyatta#  

Changing current directory to easyrsa directory

root@vyatta:/home/vyatta# cd /usr/share/doc/openvpn/examples/easy-rsa/2.0  
root@vyatta:/usr/share/doc/openvpn/examples/easy-rsa/2.0# 

Making certification

root@vyatta:/usr/share/doc/openvpn/examples/easy-rsa/2.0# source ./vars
NOTE: If you run ./clean-all, I will be doing a rm -rf on /usr/share/doc/openvpn/examples/easy-rsa/2.0/keys
root@vyatta:/usr/share/doc/openvpn/examples/easy-rsa/2.0# 

root@vyatta:/usr/share/doc/openvpn/examples/easy-rsa/2.0# ./clean-all 
root@vyatta:/usr/share/doc/openvpn/examples/easy-rsa/2.0# 

root@vyatta:/usr/share/doc/openvpn/examples/easy-rsa/2.0# ./build-ca
Generating a 1024 bit RSA private key
.....++++++
..................................++++++
writing new private key to 'ca.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [US]:JP
State or Province Name (full name) [CA]:Tokyo
Locality Name (eg, city) [SanFrancisco]:Chiyoda-ku
Organization Name (eg, company) [Fort-Funston]:Private
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) [Fort-Funston CA]:vyatta
Name []:
Email Address [me@myhost.mydomain]:
root@vyatta:/usr/share/doc/openvpn/examples/easy-rsa/2.0# 

To be written...

(2) Configuring Vyatta


2. Configuring OpenVPN client
(1) Installing OpenVPN in CentOS5.5
(2) Installing certifications

3. Connecting to Vyatta from the client

TCP MSS adjustment on Vyatta 6.2

Recently I found Vyatta 6.2 supports TCP MSS configuration;

Vyatta Release 6.2-2011.02.09

ENH: Allow configuration of TCP MSS and "clamp-mss-to-pmtu" option in netfilter

So I've setup configuratin below to adjust TCP MSS 1200 bytes.

firewall {
    modify mss-test {
        default-action accept
        rule 1 {
            action modify
            modify {
                tcp-mss 1200
            }
            protocol tcp
            tcp {
                flags SYN
            }
        }
    }
}
interfaces {
    ethernet eth0 {
        address 192.168.1.250/24
        firewall {
            out {
                modify mss-test
            }
        }
        hw-id 00:0c:29:xx:xx:xx
    }
    ethernet eth1 {
        address 192.168.2.1/24
        hw-id 00:0c:29:xx:xx:xx
    }
    loopback lo {
    }
}

It seems that this configuration worked properly.

Reference
Network/Vyatta - K'Room.net (Japanese)
Vyatta.org :: View topic - vyatta to cisco
Bugzilla – Bug 5309 ENH: Allow configuration of TCP MSS and "clamp-mss-to-pmtu" option in netfilter