text:
OpenVPN is a full-featured SSL VPN which implements OSI layer 2 or 3 secure network extension using the industry standard SSL/TLS protocol, supports flexible client authentication methods based on certificates, smart cards, and/or username/password credentials, and allows user or group-specific access control policies using firewall rules applied to the VPN virtual interface. OpenVPN is not a web application proxy and does not operate through a web browser.
OpenVPN 2.0 expands on the capabilities of OpenVPN 1.x by offering a scalable client/server mode, allowing multiple clients to connect to a single OpenVPN server process over a single TCP or UDP port.
This document provides step-by-step instructions for configuring an OpenVPN 2.0 client/server VPN, including:
- OpenVPN Quickstart.
- Installing OpenVPN.
- Determining whether to use a routed or bridged VPN.
- Numbering private subnets.
- Setting up your own Certificate Authority (CA) and generating certificates and keys for an OpenVPN server and multiple clients.
- Creating configuration files for server and clients.
- Starting up the VPN and testing for initial connectivity.
- Configuring OpenVPN to run automatically on system startup.
- Controlling a running OpenVPN process.
- Expanding the scope of the VPN to include additional machines on either the client or server subnet.
- Pushing DHCP options to clients.
- Configuring client-specific rules and access policies.
- Using alternative authentication methods.
- How to add dual-factor authentication to an OpenVPN configuration using client-side smart cards.
- Routing all client traffic (including web-traffic) through the VPN.
- Running an OpenVPN server on a dynamic IP address.
- Connecting to an OpenVPN server via an HTTP proxy.
- Connecting to a Samba share over OpenVPN.
- Implementing a load-balancing/failover configuration.
- Hardening OpenVPN Security.
- Revoking Certificates.
- Additional Security Notes.
The impatient may wish to jump straight to the sample configuration files:
Intended Audience
This HOWTO assumes that readers possess a prior understanding of basic networking concepts such as IP addresses, DNS names, netmasks, subnets, IP routing, routers, network interfaces, LANs, gateways, and firewall rules.
Additional Documentation
OpenVPN Books
Beginning OpenVPN 2.0.9
OpenVPN 1.x HOWTO
The original OpenVPN 1.x HOWTO is still available, and remains relevant for point-to-point or static-key configurations.
OpenVPN Articles
For additional documentation, see the articles page.
OpenVPN Quickstart
While this HOWTO will guide you in setting up a scalable client/server VPN using an X509 PKI (public key infrastruction using certificates and private keys), this might be overkill if you are only looking for a simple VPN setup with a server that can handle a single client.
If you would like to get a VPN running quickly with mimimal configuration, you might check out the Static Key Mini-HOWTO.
Static Key advantages
- Simple Setup
- No X509 PKI (Public Key Infrastructure) to maintain
Static Key disadvantages
- Limited scalability -- one client, one server
- Lack of perfect forward secrecy -- key compromise results in total disclosure of previous sessions
- Secret key must exist in plaintext form on each VPN peer
- Secret key must be exchanged using a pre-existing secure channel
Installing OpenVPN
OpenVPN can be downloaded here.
For security, it's a good idea to check the file release signature after downloading.
The OpenVPN executable should be installed on both server and client machines, since the single executable provides both client and server functions.
Linux Notes (using RPM package)
If you are using a Linux distribution which supports RPM packages (SuSE, Fedora, Redhat, etc.), it's best to install using this mechanism. The easiest method is to find an existing binary RPM file for your distribution. You can also build your own binary RPM file:
rpmbuild -tb openvpn-[version].tar.gz
Once you have the .rpm file, you can install it with the usual
rpm -ivh openvpn-[details].rpm
or upgrade an existing installation with
rpm -Uvh openvpn-[details].rpm
Installing OpenVPN from a binary RPM package has these dependencies:
- openssl
- lzo
- pam
Furthermore, if you are building your own binary RPM package, there are several additional dependencies:
- openssl-devel
- lzo-devel
- pam-devel
See the openvpn.spec file for additional notes on building an RPM package for Red Hat Linux 9 or building with reduced dependencies.
Linux Notes (without RPM)
If you are using Debian, Gentoo, or a non-RPM-based Linux distribution, use your distro-specific packaging mechanism such as apt-get on Debian or emerge on Gentoo.
It is also possible to install OpenVPN on Linux using the universal ./configure method. First expand the .tar.gz file:
tar xfz openvpn-[version].tar.gz
Then cd to the top-level directory and type:
make install
Windows Notes
OpenVPN for Windows can be installed from the self-installing exe file on the OpenVPN download page. Remember that OpenVPN will only run on Windows 2000 or later. Also note that OpenVPN must be installed and run by a user who has administrative privileges (this restriction is imposed by Windows, not OpenVPN). The restriction can be sidestepped by running OpenVPN in the background as a service, in which case even non-admin users will be able to access the VPN, once it is installed. More discussion on OpenVPN + Windows privilege issues.
OpenVPN can also be installed as a GUI on Windows, using Mathias Sundman's installation package, which will install both OpenVPN and the Windows GUI.
After you run the Windows installer, OpenVPN is ready to use and will associate itself with files having the .ovpn extension. To run OpenVPN, you can:
- Right click on an OpenVPN configuration file (.ovpn) and select Start OpenVPN on this configuration file. Once running, you can use the F4 key to exit.
- Run OpenVPN from a command prompt Window with a command such as:
openvpn myconfig.ovpn
Once running in a command prompt window, OpenVPN can be stopped by the F4 key.
- Run OpenVPN as a service by putting one or more .ovpn configuration files in \Program Files\OpenVPN\config and starting the OpenVPN Service, which can be controlled from Start Menu -> Control Panel -> Administrative Tools -> Services.
A GUI is also available for the Windows version of OpenVPN.
Additional Windows install notes.
Mac OS X Notes
Angelo Laub and Dirk Theisen have developed an OpenVPN GUI for OS X.
Other OSes
Some notes are available in the INSTALL file for specific OSes. In general, the
make install
method can be used, or you can search for an OpenVPN port or package which is specific to your OS/distribution.
Determining whether to use a routed or bridged VPN
See FAQ for an overview of Routing vs. Ethernet Bridging. See also the OpenVPN Ethernet Bridging page for more notes and details on bridging.
Overall, routing is probably a better choice for most people, as it is more efficient and easier to set up (as far as the OpenVPN configuration itself) than bridging. Routing also provides a greater ability to selectively control access rights on a client-specific basis.
I would recommend using routing unless you need a specific feature which requires bridging, such as:
- the VPN needs to be able to handle non-IP protocols such as IPX,
- you are running applications over the VPN which rely on network broadcasts (such as LAN games), or
- you would like to allow browsing of Windows file shares across the VPN without setting up a Samba or WINS server.
Numbering private subnets
Setting up a VPN often entails linking together private subnets from different locations.
The Internet Assigned Numbers Authority (IANA) has reserved the following three blocks of the IP address space for private internets (codified in RFC 1918):
|(10/8 prefix)
|(172.16/12 prefix)
|(192.168/16 prefix)
While addresses from these netblocks should normally be used in VPN configurations, it's important to select addresses that minimize the probability of IP address or subnet conflicts. The types of conflicts that need to be avoided are:
- conflicts from different sites on the VPN using the same LAN subnet numbering, or
- remote access connections from sites which are using private subnets which conflict with your VPN subnets.
For example, suppose you use the popular 192.168.0.0/24 subnet as your private LAN subnet. Now you are trying to connect to the VPN from an internet cafe which is using the same subnet for its WiFi LAN. You will have a routing conflict because your machine won't know if 192.168.0.1 refers to the local WiFi gateway or to the same address on the VPN.
As another example, suppose you want to link together multiple sites by VPN, but each site is using 192.168.0.0/24 as its LAN subnet. This won't work without adding a complexifying layer of NAT translation, because the VPN won't know how to route packets between multiple sites if those sites don't use a subnet which uniquely identifies them.
The best solution is to avoid using 10.0.0.0/24 or 192.168.0.0/24 as private LAN network addresses. Instead, use something that has a lower probability of being used in a WiFi cafe, airport, or hotel where you might expect to connect from remotely. The best candidates are subnets in the middle of the vast 10.0.0.0/8 netblock (for example 10.66.77.0/24).
And to avoid cross-site IP numbering conflicts, always use unique numbering for your LAN subnets.
Setting up your own Certificate Authority (CA) and generating certificates and keys for an OpenVPN server and multiple clients
The first step in building an OpenVPN 2.0 configuration is to establish a PKI (public key infrastructure). The PKI consists of:
- a separate certificate (also known as a public key) and private key for the server and each client, and
- a master Certificate Authority (CA) certificate and key which is used to sign each of the server and client certificates.
OpenVPN supports bidirectional authentication based on certificates, meaning that the client must authenticate the server certificate and the server must authenticate the client certificate before mutual trust is established.
Both server and client will authenticate the other by first verifying that the presented certificate was signed by the master certificate authority (CA), and then by testing information in the now-authenticated certificate header, such as the certificate common name or certificate type (client or server).
This security model has a number of desirable features from the VPN perspective:
- The server only needs its own certificate/key -- it doesn't need to know the individual certificates of every client which might possibly connect to it.
- The server will only accept clients whose certificates were signed by the master CA certificate (which we will generate below). And because the server can perform this signature verification without needing access to the CA private key itself, it is possible for the CA key (the most sensitive key in the entire PKI) to reside on a completely different machine, even one without a network connection.
- If a private key is compromised, it can be disabled by adding its certificate to a CRL (certificate revocation list). The CRL allows compromised certificates to be selectively rejected without requiring that the entire PKI be rebuilt.
- The server can enforce client-specific access rights based on embedded certificate fields, such as the Common Name.
Generate the master Certificate Authority (CA) certificate & key
In this section we will generate a master CA certificate/key, a server certificate/key, and certificates/keys for 3 separate clients.
For PKI management, we will use a set of scripts bundled with OpenVPN.
If you are using Linux, BSD, or a unix-like OS, open a shell and cd to the easy-rsa subdirectory of the OpenVPN distribution. If you installed OpenVPN from an RPM file, the easy-rsa directory can usually be found in /usr/share/doc/packages/openvpn or /usr/share/doc/openvpn-2.0 (it's best to copy this directory to another location such as /etc/openvpn, before any edits, so that future OpenVPN package upgrades won't overwrite your modifications). If you installed from a .tar.gz file, the easy-rsa directory will be in the top level directory of the expanded source tree.
If you are using Windows, open up a Command Prompt window and cd to \Program Files\OpenVPN\easy-rsa. Run the following batch file to copy configuration files into place (this will overwrite any preexisting vars.bat and openssl.cnf files):
Now edit the vars file (called vars.bat on Windows) and set the KEY_COUNTRY, KEY_PROVINCE, KEY_CITY, KEY_ORG, and KEY_EMAIL parameters. Don't leave any of these parameters blank.
Next, initialize the PKI. On Linux/BSD/Unix:
. ./vars
On Windows:
The final command (build-ca) will build the certificate authority (CA) certificate and key by invoking the interactive openssl command:
ai:easy-rsa # ./build-ca
Generating a 1024 bit RSA private key
writing new private key to 'ca.key'
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
Country Name (2 letter code) [KG]:
State or Province Name (full name) [NA]:
Locality Name (eg, city) [BISHKEK]:
Organization Name (eg, company) [OpenVPN-TEST]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:OpenVPN-CA
Email Address [firstname.lastname@example.com]:
Note that in the above sequence, most queried parameters were defaulted to the values set in the vars or vars.bat files. The only parameter which must be explicitly entered is the Common Name. In the example above, I used "OpenVPN-CA".
Generate certificate & key for server
Next, we will generate a certificate and private key for the server. On Linux/BSD/Unix:
./build-key-server server
On Windows:
build-key-server server
As in the previous step, most parameters can be defaulted. When the Common Name is queried, enter "server". Two other queries require positive responses, "Sign the certificate? [y/n]" and "1 out of 1 certificate requests certified, commit? [y/n]".
Generate certificates & keys for 3 clients
Generating client certificates is very similar to the previous step. On Linux/BSD/Unix:
./build-key client1
On Windows:
build-key client1
If you would like to password-protect your client keys, substitute the build-key-pass script.
Remember that for each client, make sure to type the appropriate Common Name when prompted, i.e. "client1", "client2", or "client3". Always use a unique common name for each client.
Generate Diffie Hellman parameters
Diffie Hellman parameters must be generated for the OpenVPN server. On Linux/BSD/Unix:
On Windows:
ai:easy-rsa # ./build-dh
Generating DH parameters, 1024 bit long safe prime, generator 2
This is going to take a long time
Key Files
Now we will find our newly-generated keys and certificates in the keys subdirectory. Here is an explanation of the relevant files:
The final step in the key generation process is to copy all files to the machines which need them, taking care to copy secret files over a secure channel.
Now wait, you may say. Shouldn't it be possible to set up the PKI without a pre-existing secure channel?
The answer is ostensibly yes. In the example above, for the sake of brevity, we generated all private keys in the same place. With a bit more effort, we could have done this differently. For example, instead of generating the client certificate and keys on the server, we could have had the client generate its own private key locally, and then submit a Certificate Signing Request (CSR) to the key-signing machine. In turn, the key-signing machine could have processed the CSR and returned a signed certificate to the client. This could have been done without ever requiring that a secret .key file leave the hard drive of the machine on which it was generated.
Creating configuration files for server and clients
Getting the sample config files
It's best to use the OpenVPN sample configuration files as a starting point for your own configuration. These files can also be found in
Note that on Linux, BSD, or unix-like OSes, the sample configuration files are named server.conf and client.conf. On Windows they are named server.ovpn and client.ovpn.
Editing the server configuration file
The sample server configuration file is an ideal starting point for an OpenVPN server configuration. It will create a VPN using a virtual TUN network interface (for routing), will listen for client connections on UDP port 1194 (OpenVPN's official port number), and distribute virtual addresses to connecting clients from the 10.8.0.0/24 subnet.
Before you use the sample configuration file, you should first edit the ca, cert, key, and dh parameters to point to the files you generated in the PKI section above.
At this point, the server configuration file is usable, however you still might want to customize it further:
If you want to run multiple OpenVPN instances on the same machine, each using a different configuration file, it is possible if you:
Editing the client configuration files
The sample client configuration file (client.conf on Linux/BSD/Unix or client.ovpn on Windows) mirrors the default directives set in the sample server configuration file.
Starting up the VPN and testing for initial connectivity
Starting the server
First, make sure the OpenVPN server will be accessible from the internet. That means:
Next, make sure that the TUN/TAP interface is not firewalled.
To simplify troubleshooting, it's best to initially start the OpenVPN server from the command line (or right-click on the .ovpn file on Windows), rather than start it as a daemon or service:
openvpn [server config file]
A normal server startup should look like this (output will vary across platforms):
Sun Feb 6 20:46:38 2005 OpenVPN 2.0_rc12 i686-suse-linux [SSL] [LZO] [EPOLL] built on Feb 5 2005
Sun Feb 6 20:46:38 2005 Diffie-Hellman initialized with 1024 bit key
Sun Feb 6 20:46:38 2005 TLS-Auth MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sun Feb 6 20:46:38 2005 TUN/TAP device tun1 opened
Sun Feb 6 20:46:38 2005 /sbin/ifconfig tun1 10.8.0.1 pointopoint 10.8.0.2 mtu 1500
Sun Feb 6 20:46:38 2005 /sbin/route add -net 10.8.0.0 netmask 255.255.255.0 gw 10.8.0.2
Sun Feb 6 20:46:38 2005 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:23 ET:0 EL:0 AF:3/1 ]
Sun Feb 6 20:46:38 2005 UDPv4 link local (bound): [undef]:1194
Sun Feb 6 20:46:38 2005 UDPv4 link remote: [undef]
Sun Feb 6 20:46:38 2005 MULTI: multi_init called, r=256 v=256
Sun Feb 6 20:46:38 2005 IFCONFIG POOL: base=10.8.0.4 size=62
Sun Feb 6 20:46:38 2005 IFCONFIG POOL LIST
Sun Feb 6 20:46:38 2005 Initialization Sequence Completed
Starting the client
As in the server configuration, it's best to initially start the OpenVPN server from the command line (or on Windows, by right-clicking on the client.ovpn file), rather than start it as a daemon or service:
openvpn [client config file]
A normal client startup on Windows will look similar to the server output above, and should end with the Initialization Sequence Completed message.
Now, try a ping across the VPN from the client. If you are using routing (i.e. dev tun in the server config file), try:
ping 10.8.0.1
If you are using bridging (i.e. dev tap in the server config file), try to ping the IP address of a machine on the server's ethernet subnet.
If the ping succeeds, congratulations! You now have a functioning VPN.
If the ping failed or the OpenVPN client initialization failed to complete, here is a checklist of common symptoms and their solutions:
See the FAQ for additional troubleshooting information.
Configuring OpenVPN to run automatically on system startup
The lack of standards in this area means that most OSes have a different way of configuring daemons/services for autostart on boot. The best way to have this functionality configured by default is to install OpenVPN as a package, such as via RPM on Linux or using the Windows installer.
If you install OpenVPN via an RPM package on Linux, the installer will set up an initscript. When executed, the initscript will scan for .conf configuration files in /etc/openvpn, and if found, will start up a separate OpenVPN daemon for each file.
The Windows installer will set up a Service Wrapper, but leave it turned off by default. To activate it, go to Control Panel / Administrative Tools / Services, select the OpenVPN service, right-click on properties, and set the Startup Type to Automatic. This will configure the service for automatic start on the next reboot.
When started, the OpenVPN Service Wrapper will scan the \Program Files\OpenVPN\config folder for .ovpn configuration files, starting a separate OpenVPN process on each file.
Controlling a running OpenVPN process
Running on Linux/BSD/Unix
OpenVPN accepts several signals:
Use the writepid directive to write the OpenVPN daemon's PID to a file, so that you know where to send the signal (if you are starting openvpn with an initscript, the script may already be passing a --writepid directive on the openvpn command line).
Running on Windows as a GUI
See the OpenVPN GUI page.
Running in a Windows command prompt window
On Windows, you can start OpenVPN by right clicking on an OpenVPN configuration file (.ovpn file) and selecting "Start OpenVPN on this config file".
Once running in this fashion, several keyboard commands are available:
Running as a Windows Service
When OpenVPN is started as a service on Windows, the only way to control it is:
Modifying a live server configuration
While most configuration changes require you to restart the server, there are two directives in particular which refer to files which can be dynamically updated on-the-fly, and which will take immediate effect on the server without needing to restart the server process.
client-config-dir -- This directive sets a client configuration directory, which the OpenVPN server will scan on every incoming connection, searching for a client-specific configuration file (see the the manual page for more information). Files in this directory can be updated on-the-fly, without restarting the server. Note that changes in this directory will only take effect for new connections, not existing connections. If you would like a client-specific configuration file change to take immediate effect on a currently connected client (or one which has disconnected, but where the server has not timed-out its instance object), kill the client instance object by using the management interface (described below). This will cause the client to reconnect and use the new client-config-dir file.
crl-verify -- This directive names a Certificate Revocation List file, described below in the Revoking Certificates section. The CRL file can be modified on the fly, and changes will take effect immediately for new connections, or existing connections which are renegotiating their SSL/TLS channel (occurs once per hour by default). If you would like to kill a currently connected client whose certificate has just been added to the CRL, use the management interface (described below).
Status File
The default server.conf file has a line
status openvpn-status.log
which will output a list of current client connections to the file openvpn-status.log once per minute.
Using the management interface
The OpenVPN management interface allows a great deal of control over a running OpenVPN process. You can use the management interface directly, by telneting to the management interface port, or indirectly by using an OpenVPN GUI which itself connects to the management interface.
To enable the management interface on either an OpenVPN server or client, add this to the configuration file:
management localhost 7505
This tells OpenVPN to listen on TCP port 7505 for management interface clients (port 7505 is an arbitrary choice -- you can use any free port).
Once OpenVPN is running, you can connect to the management interface using a telnet client. For example:
ai:~ # telnet localhost 7505
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
>INFO:OpenVPN Management Interface Version 1 -- type 'help' for more info
Management Interface for OpenVPN 2.0_rc14 i686-suse-linux [SSL] [LZO] [EPOLL] built on Feb 15 2005
echo [on|off] [N|all] : Like log, but only show messages in echo buffer.
exit|quit : Close management session.
help : Print this message.
hold [on|off|release] : Set/show hold flag to on/off state, or
release current hold and start tunnel.
kill cn : Kill the client instance(s) having common name cn.
kill IP:port : Kill the client instance connecting from IP:port.
log [on|off] [N|all] : Turn on/off realtime log display
+ show last N lines or 'all' for entire history.
mute [n] : Set log mute level to n, or show level if n is absent.
net : (Windows only) Show network info and routing table.
password type p : Enter password p for a queried OpenVPN password.
signal s : Send signal s to daemon,
s = SIGHUP|SIGTERM|SIGUSR1|SIGUSR2.
state [on|off] [N|all] : Like log, but show state history.
status [n] : Show current daemon status info using format #n.
test n : Produce n lines of output for testing/debugging.
username type u : Enter username u for a queried OpenVPN username.
verb [n] : Set log verbosity level to n, or show if n is absent.
version : Show current version number.
Connection closed by foreign host.
ai:~ #
For more information, see the OpenVPN Management Interface Documentation.
Expanding the scope of the VPN to include additional machines on either the client or server subnet.
Including multiple machines on the server side when using a routed VPN (dev tun)
Once the VPN is operational in a point-to-point capacity between client and server, it may be desirable to expand the scope of the VPN so that clients can reach multiple machines on the server network, rather than only the server machine itself.
For the purpose of this example, we will assume that the server-side LAN uses a subnet of 10.66.0.0/24 and the VPN IP address pool uses 10.8.0.0/24 as cited in the server directive in the OpenVPN server configuration file.
First, you must advertise the 10.66.0.0/24 subnet to VPN clients as being accessible through the VPN. This can easily be done with the following server-side config file directive:
push "route 10.66.0.0 255.255.255.0"
Next, you must set up a route on the server-side LAN gateway to route the VPN client subnet (10.8.0.0/24) to the OpenVPN server (this is only necessary if the OpenVPN server and the LAN gateway are different machines).
Make sure that you've enabled IP and TUN/TAP forwarding on the OpenVPN server machine.
Including multiple machines on the server side when using a bridged VPN (dev tap)
One of the benefits of using ethernet bridging is that you get this for free without needing any additional configuration.
Including multiple machines on the client side when using a routed VPN (dev tun)
In a typical road-warrior or remote access scenario, the client machine connects to the VPN as a single machine. But suppose the client machine is a gateway for a local LAN (such as a home office), and you would like each machine on the client LAN to be able to route through the VPN.
For this example, we will assume that the client LAN is using the 192.168.4.0/24 subnet, and that the VPN client is using a certificate with a common name of client2. Our goal is to set up the VPN so that any machine on the client LAN can communicate with any machine on the server LAN through the VPN.
Before setup, there are some basic prerequisites which must be followed:
First, make sure that IP and TUN/TAP forwarding is enabled on the client machine.
Next, we will deal with the necessary configuration changes on the server side. If the server configuration file does not currently reference a client configuration directory, add one now:
client-config-dir ccd
In the above directive, ccd should be the name of a directory which has been pre-created in the default directory where the OpenVPN server daemon runs. On Linux this tends to be /etc/openvpn and on Windows it is usually \Program Files\OpenVPN\config. When a new client connects to the OpenVPN server, the daemon will check this directory for a file which matches the common name of the connecting client. If a matching file is found, it will be read and processed for additional configuration file directives to be applied to the named client.
The next step is to create a file called client2 in the ccd directory. This file should contain the line:
iroute 192.168.4.0 255.255.255.0
This will tell the OpenVPN server that the 192.168.4.0/24 subnet should be routed to client2.
Next, add the following line to the main server config file (not the ccd/client2 file):
route 192.168.4.0 255.255.255.0
Why the redundant route and iroute statements, you might ask? The reason is that route controls the routing from the kernel to the OpenVPN server (via the TUN interface) while iroute controls the routing from the OpenVPN server to the remote clients. Both are necessary.
Next, ask yourself if you would like to allow network traffic between client2's subnet (192.168.4.0/24) and other clients of the OpenVPN server. If so, add the following to the server config file.
This will cause the OpenVPN server to advertise client2's subnet to other connecting clients.
The last step, and one that is often forgotten, is to add a route to the server's LAN gateway which directs 192.168.4.0/24 to the OpenVPN server box (you won't need this if the OpenVPN server box is the gateway for the server LAN). Suppose you were missing this step and you tried to ping a machine (not the OpenVPN server itself) on the server LAN from 192.168.4.8? The outgoing ping would probably reach the machine, but then it wouldn't know how to route the ping reply, because it would have no idea how to reach 192.168.4.0/24. The rule of thumb to use is that when routing entire LANs through the VPN (when the VPN server is not the same machine as the LAN gateway), make sure that the gateway for the LAN routes all VPN subnets to the VPN server machine.
Similarly, if the client machine running OpenVPN is not also the gateway for the client LAN, then the gateway for the client LAN must have a route which directs all subnets which should be reachable through the VPN to the OpenVPN client machine.
Including multiple machines on the client side when using a bridged VPN (dev tap)
This requires a more complex setup (maybe not more complex in practice, but more complicated to explain in detail):
Pushing DHCP options to clients
The OpenVPN server can push DHCP options such as DNS and WINS server addresses to clients (some caveats to be aware of). Windows clients can accept pushed DHCP options natively, while non-Windows clients can accept them by using a client-side up script which parses the foreign_option_n environmental variable list. See the man page or openvpn-users mailing list archive for non-Windows foreign_option_n documentation and script examples.
For example, suppose you would like connecting clients to use an internal DNS server at 10.66.0.4 or 10.66.0.5 and a WINS server at 10.66.0.8. Add this to the OpenVPN server configuration:
push "dhcp-option DNS 10.66.0.4"
To test this feature on Windows, run the following from a command prompt window after the machine has connected to an OpenVPN server:
ipconfig /all
The entry for the TAP-Win32 adapter should show the DHCP options which were pushed by the server.
Configuring client-specific rules and access policies
Suppose we are setting up a company VPN, and we would like to establish separate access policies for 3 different classes of users:
The basic approach we will take is (a) segregate each user class into its own virtual IP address range, and (b) control access to machines by setting up firewall rules which key off the client's virtual IP address.
In our example, suppose that we have a variable number of employees, but only one system administrator, and two contractors. Our IP allocation approach will be to put all employees into an IP address pool, and then allocate fixed IP addresses for the system administrator and contractors.
Note that one of the prerequisites of this example is that you have a software firewall running on the OpenVPN server machine which gives you the ability to define specific firewall rules. For our example, we will assume the firewall is Linux iptables.
First, let's create a virtual IP address map according to user class:
Next, let's translate this map into an OpenVPN server configuration. First of all, make sure you've followed the steps above for making the 10.66.4.0/24 subnet available to all clients (while we will configure routing to allow client access to the entire 10.66.4.0/24 subnet, we will then impose access restrictions using firewall rules to implement the above policy table).
First, define a static unit number for our tun interface, so that we will be able to refer to it later in our firewall rules:
dev tun0
In the server configuration file, define the Employee IP address pool:
server 10.8.0.0 255.255.255.0
Add routes for the System Administrator and Contractor IP ranges:
route 10.8.1.0 255.255.255.0
Because we will be assigning fixed IP addresses for specific System Administrators and Contractors, we will use a client configuration directory:
client-config-dir ccd
Now place special configuration files in the ccd subdirectory to define the fixed IP address for each non-Employee VPN client.
ifconfig-push 10.8.1.1 10.8.1.2
ifconfig-push 10.8.2.1 10.8.2.2
ifconfig-push 10.8.2.5 10.8.2.6
Each pair of ifconfig-push addresses represent the virtual client and server IP endpoints. They must be taken from successive /30 subnets in order to be compatible with Windows clients and the TAP-Win32 driver. Specifically, the last octet in the IP address of each endpoint pair must be taken from this set:
[ 1, 2] [ 5, 6] [ 9, 10] [ 13, 14] [ 17, 18]
[ 21, 22] [ 25, 26] [ 29, 30] [ 33, 34] [ 37, 38]
[ 41, 42] [ 45, 46] [ 49, 50] [ 53, 54] [ 57, 58]
[ 61, 62] [ 65, 66] [ 69, 70] [ 73, 74] [ 77, 78]
[ 81, 82] [ 85, 86] [ 89, 90] [ 93, 94] [ 97, 98]
[101,102] [105,106] [109,110] [113,114] [117,118]
[121,122] [125,126] [129,130] [133,134] [137,138]
[141,142] [145,146] [149,150] [153,154] [157,158]
[161,162] [165,166] [169,170] [173,174] [177,178]
[181,182] [185,186] [189,190] [193,194] [197,198]
[201,202] [205,206] [209,210] [213,214] [217,218]
[221,222] [225,226] [229,230] [233,234] [237,238]
[241,242] [245,246] [249,250] [253,254]
This completes the OpenVPN configuration. The final step is to add firewall rules to finalize the access policy. For this example, we will use firewall rules in the Linux iptables syntax:
# Employee rule
iptables -A FORWARD -i tun0 -s 10.8.0.0/24 -d 10.66.4.4 -j ACCEPT
# Sysadmin rule
iptables -A FORWARD -i tun0 -s 10.8.1.0/24 -d 10.66.4.0/24 -j ACCEPT
# Contractor rule
iptables -A FORWARD -i tun0 -s 10.8.2.0/24 -d 10.66.4.12 -j ACCEPT
Using alternative authentication methods
OpenVPN 2.0 includes a feature that allows the OpenVPN server to securely obtain a username and password from a connecting client, and to use that information as a basis for authenticating the client.
To use this authentication method, first add the auth-user-pass directive to the client configuration. It will direct the OpenVPN client to query the user for a username/password, passing it on to the server over the secure TLS channel.
Next, configure the server to use an authentication plugin, which may be a script, shared object, or DLL. The OpenVPN server will call the plugin every time a VPN client tries to connect, passing it the username/password entered on the client. The authentication plugin can control whether or not the OpenVPN server allows the client to connect by returning a failure (1) or success (0) value.
Using Script Plugins
Script plugins can be used by adding the auth-user-pass-verify directive to the server-side configuration file. For example:
auth-user-pass-verify auth-pam.pl via-file
will use the auth-pam.pl perl script to authenticate the username/password of connecting clients. See the description of auth-user-pass-verify in the manual page for more information.
The auth-pam.pl script is included in the OpenVPN source file distribution in the sample-scripts subdirectory. It will authenticate users on a Linux server using a PAM authentication module, which could in turn implement shadow password, RADIUS, or LDAP authentication. auth-pam.pl is primarily intended for demonstration purposes. For real-world PAM authentication, use the openvpn-auth-pam shared object plugin described below.
Using Shared Object or DLL Plugins
Shared object or DLL plugins are usually compiled C modules which are loaded by the OpenVPN server at run time. For example if you are using an RPM-based OpenVPN package on Linux, the openvpn-auth-pam plugin should be already built. To use it, add this to the server-side config file:
plugin /usr/share/openvpn/plugin/lib/openvpn-auth-pam.so login
This will tell the OpenVPN server to validate the username/password entered by clients using the login PAM module.
For real-world production use, it's better to use the openvpn-auth-pam plugin, because it has several advantages over the auth-pam.pl script:
If you would like more information on developing your own plugins for use with OpenVPN, see the README files in the plugin subdirectory of the OpenVPN source distribution.
To build the openvpn-auth-pam plugin on Linux, cd to the plugin/auth-pam directory in the OpenVPN source distribution and run make.
Using username/password authentication as the only form of client authentication
By default, using auth-user-pass-verify or a username/password-checking plugin on the server will enable dual authentication, requiring that both client-certificate and username/password authentication succeed in order for the client to be authenticated.
While it is discouraged from a security perspective, it is also possible to disable the use of client certificates, and force username/password authentication only. On the server:
Such configurations should usually also set:
which will tell the server to use the username for indexing purposes as it would use the Common Name of a client which was authenticating via a client certificate.
Note that client-cert-not-required will not obviate the need for a server certificate, so a client connecting to a server which uses client-cert-not-required may remove the cert and key directives from the client configuration file, but not the ca directive, because it is necessary for the client to verify the server certificate.
How to add dual-factor authentication to an OpenVPN configuration using client-side smart cards
Also see Article: The OpenVPN Smartcard HOWTO
About dual-factor authentication
Dual-factor authentication is a method of authentication that combines two elements: something you have and something you know.
Something you have should be a device that cannot be duplicated; such a device can be a cryptographic token that contains a private secret key. This private key is generated inside the device and never leaves it. If a user possessing this token attempts to access protected services on a remote network, the authorization process which grants or denies network access can establish, with a high degree of certainty, that the user seeking access is in physical possession of a known, certified token.
Something you know can be a password presented to the cryptographic device. Without presenting the proper password you cannot access the private secret key. Another feature of cryptographic devices is to prohibit the use of the private secret key if the wrong password had been presented more than an allowed number of times. This behavior ensures that if a user lost his device, it would be infeasible for another person to use it.
Cryptographic devices are commonly called "smart cards" or "tokens", and are used in conjunction with a PKI (Public Key Infrastructure). The VPN server can examine a X.509 certificate and verify that the user holds the corresponding private secret key. Since the device cannot be duplicated and requires a valid password, the server is able to authenticate the user with a high degree of confidence.
Dual-factor authentication is much stronger than password-based authentication, because in the worst-case scenario, only one person at a time can use the cryptographic token. Passwords can be guessed and can be exposed to other users, so in the worst-case scenario an infinite number of people could attempt to gain unauthorized access when resources are protected using password-only authentication.
If you store the secret private key in a file, the key is usually encrypted by a password. The problem with this approach is that the encrypted key is exposed to decryption attacks or spyware/malware running on the client machine. Unlike when using a cryptographic device, the file cannot erase itself automatically after several failed decryption attempts.
What is PKCS#11?
This standard specifies an API, called Cryptoki, to devices which hold cryptographic information and perform cryptographic functions. Cryptoki, pronounced "crypto-key" and short for cryptographic token interface, follows a simple object-based approach, addressing the goals of technology independence (any kind of device) and resource sharing (multiple applications accessing multiple devices), presenting to applications a common, logical view of the device called a cryptographic token.
Source: RSA Security Inc. http://www.rsasecurity.com/rsalabs/pkcs/pkcs-11.
To summarize, PKCS#11 is a standard that can be used by application software to access cryptographic tokens such as smart cards and other devices. Most device vendors provide a library that implements the PKCS#11 provider interface -- this library can be used by applications in order to access these devices. PKCS#11 is a cross-platform, vendor-independent free standard.
Finding PKCS#11 provider library
The first thing you need to do is to find the provider library, it should be installed with the device drivers. Each vendor has its own library. For example, the OpenSC PKCS#11 provider is located at /usr/lib/pkcs11/opensc-pkcs11.so on Unix or at opensc-pkcs11.dll on Windows.
How to configure cryptographic token
You should follow an enrollment procedure:
A configured token is a token that has a private key object and a certificate object, where both share the same id and label attributes.
A simple enrollment utility is Easy-RSA 2.0 which is part of OpenVPN 2.1 series. Follow the instructions specified in the README file, and then use the pkitool in order to enroll.
Initialize a token using the following command:
$ ./pkitool --pkcs11-slots /usr/lib/pkcs11/<provider>
$ ./pkitool --pkcs11-init /usr/lib/pkcs11/<provider> <slot> <label>
Enroll a certificate using the following command:
$ ./pkitool --pkcs11 /usr/lib/pkcs11/<provider> <slot> <label> client1
How to modify an OpenVPN configuration to make use of cryptographic tokens
You should have OpenVPN 2.1 or above in order to use the PKCS#11 features. You can grab the latest beta from http://openvpn.net/download.html.
Determine the correct object
Each PKCS#11 provider can support multiple devices. In order to view the available object list you can use the following command:
$ openvpn --show-pkcs11-ids /usr/lib/pkcs11/<provider>
The following objects are available for use.
Each object shown below may be used as parameter to
--pkcs11-id option please remember to use single quote mark.
DN: /CN=User1
Serial: 490B82C4000000000075
Serialized id: aaaa/bbb/41545F5349474E415455524581D2A1A1B23C4AA4CB17FAF7A4600
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
This command assumes that the VPN subnet is 10.8.0.0/24 (taken from the server directive in the OpenVPN server configuration) and that the local ethernet interface is eth0.
When redirect-gateway is used, OpenVPN clients will route DNS queries through the VPN, and the VPN server will need handle them. This can be accomplished by pushing a DNS server address to connecting clients which will replace their normal DNS server settings during the time that the VPN is active. For example:
push "dhcp-option DNS 10.8.0.1"
will configure Windows clients (or non-Windows clients with some extra server-side scripting) to use 10.8.0.1 as their DNS server. Any address which is reachable from clients may be used as the DNS server address.
Redirecting all network traffic through the VPN is not entirely a problem-free proposition. Here are some typical gotchas to be aware of:
For more information on the mechanics of the redirect-gateway directive, see the manual page.
Running an OpenVPN server on a dynamic IP address
While OpenVPN clients can easily access the server via a dynamic IP address without any special configuration, things get more interesting when the server itself is on a dynamic address. While OpenVPN has no trouble handling the situation of a dynamic server, some extra configuration is required.
The first step is to get a dynamic DNS address which can be configured to "follow" the server every time the server's IP address changes. There are several dynamic DNS service providers available, such as dyndns.org.
The next step is to set up a mechanism so that every time the server's IP address changes, the dynamic DNS name will be quickly updated with the new IP address, allowing clients to find the server at its new IP address. There are two basic ways to accomplish this:
The OpenVPN client by default will sense when the server's IP address has changed, if the client configuration is using a remote directive which references a dynamic DNS name. The usual chain of events is that (a) the OpenVPN client fails to receive timely keepalive messages from the server's old IP address, triggering a restart, and (b) the restart causes the DNS name in the remote directive to be re-resolved, allowing the client to reconnect to the server at its new IP address.
More information can be found in the FAQ.
Connecting to an OpenVPN server via an HTTP proxy.
OpenVPN supports connections through an HTTP proxy, with the following authentication modes:
First of all, HTTP proxy usage requires that you use TCP as the tunnel carrier protocol. So add the following to both client and server configurations:
proto tcp
Make sure that any proto udp lines in the config files are deleted.
Next, add the http-proxy directive to the client configuration file (see the manual page for a full description of this directive).
For example, suppose you have an HTTP proxy server on the client LAN at 192.168.4.1, which is listening for connections on port 1080. Add this to the client config:
http-proxy 192.168.4.1 1080
Suppose the HTTP proxy requires Basic authentication:
http-proxy 192.168.4.1 1080 stdin basic
Suppose the HTTP proxy requires NTLM authentication:
http-proxy 192.168.4.1 1080 stdin ntlm
The two authentication examples above will cause OpenVPN to prompt for a username/password from standard input. If you would instead like to place these credentials in a file, replace stdin with a filename, and place the username on line 1 of this file and the password on line 2.
Connecting to a Samba share over OpenVPN
This example is intended show how OpenVPN clients can connect to a Samba share over a routed dev tun tunnel. If you are ethernet bridging (dev tap), you probably don't need to follow these instructions, as OpenVPN clients should see server-side machines in their network neighborhood.
For this example, we will assume that:
If the Samba and OpenVPN servers are running on different machines, make sure you've followed the section on expanding the scope of the VPN to include additional machines.
Next, edit your Samba configuration file (smb.conf). Make sure the hosts allow directive will permit OpenVPN clients coming from the 10.8.0.0/24 subnet to connect. For example:
hosts allow = 10.66.0.0/24 10.8.0.0/24 127.0.0.1
If you are running the Samba and OpenVPN servers on the same machine, you may want to edit the interfaces directive in the smb.conf file to also listen on the TUN interface subnet of 10.8.0.0/24:
interfaces = 10.66.0.0/24 10.8.0.0/24
If you are running the Samba and OpenVPN servers on the same machine, connect from an OpenVPN client to a Samba share using the folder name:
If the Samba and OpenVPN servers are on different machines, use folder name:
For example, from a command prompt window:
net use z: \\10.66.0.4\sharename /USER:myusername
Implementing a load-balancing/failover configuration
The OpenVPN client configuration can refer to multiple servers for load balancing and failover. For example:
remote server1.mydomain
will direct the OpenVPN client to attempt a connection with server1, server2, and server3 in that order. If an existing connection is broken, the OpenVPN client will retry the most recently connected server, and if that fails, will move on to the next server in the list. You can also direct the OpenVPN client to randomize its server list on startup, so that the client load will be probabilistically spread across the server pool.
If you would also like DNS resolution failures to cause the OpenVPN client to move to the next server in the list, add the following:
resolv-retry 60
The 60 parameter tells the OpenVPN client to try resolving each remote DNS name for 60 seconds before moving on to the next server in the list.
The server list can also refer to multiple OpenVPN server daemons running on the same machine, each listening for connections on a different port, for example:
remote smp-server1.mydomain 8000
If your servers are multi-processor machines, running multiple OpenVPN daemons on each server can be advantageous from a performance standpoint.
OpenVPN also supports the remote directive referring to a DNS name which has multiple A records in the zone configuration for the domain. In this case, the OpenVPN client will randomly choose one of the A records every time the domain is resolved.
The simplest approach to a load-balanced/failover configuration on the server is to use equivalent configuration files on each server in the cluster, except use a different virtual IP address pool for each server. For example:
server 10.8.0.0 255.255.255.0
server 10.8.1.0 255.255.255.0
server 10.8.2.0 255.255.255.0
Hardening OpenVPN Security
One of the often-repeated maxims of network security is that one should never place so much trust in a single security component that its failure causes a catastrophic security breach. OpenVPN provides several mechanisms to add additional security layers to hedge against such an outcome.
The tls-auth directive adds an additional HMAC signature to all SSL/TLS handshake packets for integrity verification. Any UDP packet not bearing the correct HMAC signature can be dropped without further processing. The tls-auth HMAC signature provides an additional level of security above and beyond that provided by SSL/TLS. It can protect against:
Using tls-auth requires that you generate a shared-secret key that is used in addition to the standard RSA certificate/key:
openvpn --genkey --secret ta.key
This command will generate an OpenVPN static key and write it to the file ta.key. This key should be copied over a pre-existing secure channel to the server and all client machines. It can be placed in the same directory as the RSA .key and .crt files.
In the server configuration, add:
tls-auth ta.key 0
In the client configuration, add:
tls-auth ta.key 1
proto udp
While OpenVPN allows either the TCP or UDP protocol to be used as the VPN carrier connection, the UDP protocol will provide better protection against DoS attacks and port scanning than TCP:
proto udp
user/group (non-Windows only)
OpenVPN has been very carefully designed to allow root privileges to be dropped after initialization, and this feature should always be used on Linux/BSD/Solaris. Without root privileges, a running OpenVPN server daemon provides a far less enticing target to an attacker.
user nobody
Unprivileged mode (Linux only)
On Linux OpenVPN can be run completely unprivileged. This configuration is a little more complex, but provides best security.
In order to work with this configuration, OpenVPN must be configured to use iproute interface, this is done by specifying --enable-iproute2 to configure script. sudo package should also be available on your system.
This configuration uses the Linux ability to change the permission of a tun device, so that unprivileged user may access it. It also uses sudo in order to execute iproute so that interface properties and routing table may be modified.
OpenVPN configuration:
You can also enable a group of users with the following command:user1 ALL=(ALL) NOPASSWD: /sbin/ip
%users ALL=(ALL) NOPASSWD: /sbin/ip
Please note that you must select constant X and specify tun or tap not both.dev tunX/tapX
openvpn --mktun --dev tunX --type tun --user user1 --group users
Further security constraints may be added by examining the parameters at the /usr/local/sbin/unpriv-ip script.
chroot (non-Windows only)
The chroot directive allows you to lock the OpenVPN daemon into a so-called chroot jail, where the daemon would not be able to access any part of the host system's filesystem except for the specific directory given as a parameter to the directive. For example,
chroot jail
would cause the OpenVPN daemon to cd into the jail subdirectory on initialization, and would then reorient its root filesystem to this directory so that it would be impossible thereafter for the daemon to access any files outside of jail and its subdirectory tree. This is important from a security perspective, because even if an attacker were able to compromise the server with a code insertion exploit, the exploit would be locked out of most of the server's filesystem.
Caveats: because chroot reorients the filesystem (from the perspective of the daemon only), it is necessary to place any files which OpenVPN might need after initialization in the jail directory, such as:
Larger RSA keys
The RSA key size is controlled by the KEY_SIZE variable in the easy-rsa/vars file, which must be set before any keys are generated. Currently set to 1024 by default, this value can reasonably be increased to 2048 with no negative impact on VPN tunnel performance, except for a slightly slower SSL/TLS renegotiation handshake which occurs once per client per hour, and a much slower one-time Diffie Hellman parameters generation process using the easy-rsa/build-dh script.
Larger symmetric keys
By default OpenVPN uses Blowfish, a 128 bit symmetrical cipher.
OpenVPN automatically supports any cipher which is supported by the OpenSSL library, and as such can support ciphers which use large key sizes. For example, the 256-bit version of AES (Advanced Encryption Standard) can be used by adding the following to both server and client configuration files:
cipher AES-256-CBC
Keep the root key (ca.key) on a standalone machine without a network connection
One of the security benefits of using an X509 PKI (as OpenVPN does) is that the root CA key (ca.key) need not be present on the OpenVPN server machine. In a high security environment, you might want to specially designate a machine for key signing purposes, keep the machine well-protected physically, and disconnect it from all networks. Floppy disks can be used to move key files back and forth, as necessary. Such measures make it extremely difficult for an attacker to steal the root key, short of physical theft of the key signing machine.
Revoking Certificates
Revoking a certificate means to invalidate a previously signed certificate so that it can no longer be used for authentication purposes.
Typical reasons for wanting to revoke a certificate include:
As an example, we will revoke the client2 certificate, which we generated above in the "key generation" section of the HOWTO.
First open up a shell or command prompt window and cd to the easy-rsa directory as you did in the "key generation" section above. On Linux/BSD/Unix:
. ./vars
On Windows:
You should see output similar to this:
Using configuration from /root/openvpn/20/openvpn/tmp/easy-rsa/openssl.cnf
DEBUG[load_index]: unique_subject = "yes"
Revoking Certificate 04.
Data Base Updated
Using configuration from /root/openvpn/20/openvpn/tmp/easy-rsa/openssl.cnf
DEBUG[load_index]: unique_subject = "yes"
client2.crt: /firstname.lastname@example.com
error 23 at 0 depth lookup:certificate revoked
Note the "error 23" in the last line. That is what you want to see, as it indicates that a certificate verification of the revoked certificate failed.
The revoke-full script will generate a CRL (certificate revocation list) file called crl.pem in the keys subdirectory. The file should be copied to a directory where the OpenVPN server can access it, then CRL verification should be enabled in the server configuration:
crl-verify crl.pem
Now all connecting clients will have their client certificates verified against the CRL, and any positive match will result in the connection being dropped.
CRL Notes
Important Note on possible "Man-in-the-Middle" attack if clients do not verify the certificate of the server they are connecting to.
To avoid a possible Man-in-the-Middle attack where an authorized client tries to connect to another client by impersonating the server, make sure to enforce some kind of server certificate verification by clients. There are currently five different ways of accomplishing this, listed in the order of preference:
Sample OpenVPN 2.0 configuration files
# Sample OpenVPN 2.0 config file for #
# multi-client server. #
# #
# This file is for the server side #
# of a many-clients <-> one-server #
# OpenVPN configuration. #
# #
# OpenVPN also supports #
# single-machine <-> single-machine #
# configurations (See the Examples page #
# on the web site for more info). #
# #
# This config should work on Windows #
# or Linux/BSD systems. Remember on #
# Windows to quote pathnames and use #
# double backslashes, e.g.: #
# "C:\\Program Files\\OpenVPN\\config\\foo.key" #
# #
# Comments are preceded with '#' or ';' #
# Which local IP address should OpenVPN
# listen on? (optional)
;local a.b.c.d
# Which TCP/UDP port should OpenVPN listen on?
# If you want to run multiple OpenVPN instances
# on the same machine, use a different port
# number for each one. You will need to
# open up this port on your firewall.
port 1194
# TCP or UDP server?
;proto tcp
proto udp
# "dev tun" will create a routed IP tunnel,
# "dev tap" will create an ethernet tunnel.
# Use "dev tap0" if you are ethernet bridging
# and have precreated a tap0 virtual interface
# and bridged it with your ethernet interface.
# If you want to control access policies
# over the VPN, you must create firewall
# rules for the the TUN/TAP interface.
# On non-Windows systems, you can give
# an explicit unit number, such as tun0.
# On Windows, use "dev-node" for this.
# On most systems, the VPN will not function
# unless you partially or fully disable
# the firewall for the TUN/TAP interface.
;dev tap
dev tun
# Windows needs the TAP-Win32 adapter name
# from the Network Connections panel if you
# have more than one. On XP SP2 or higher,
# you may need to selectively disable the
# Windows firewall for the TAP adapter.
# Non-Windows systems usually don't need this.
;dev-node MyTap
# SSL/TLS root certificate (ca), certificate
# (cert), and private key (key). Each client
# and the server must have their own cert and
# key file. The server and all clients will
# use the same ca file.
# See the "easy-rsa" directory for a series
# of scripts for generating RSA certificates
# and private keys. Remember to use
# a unique Common Name for the server
# and each of the client certificates.
# Any X509 key management system can be used.
# OpenVPN can also use a PKCS #12 formatted key file
# (see "pkcs12" directive in man page).
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
# Diffie hellman parameters.
# Generate your own with:
# openssl dhparam -out dh1024.pem 1024
# Substitute 2048 for 1024 if you are using
# 2048 bit keys.
dh dh1024.pem
# Configure server mode and supply a VPN subnet
# for OpenVPN to draw client addresses from.
# The server will take 10.8.0.1 for itself,
# the rest will be made available to clients.
# Each client will be able to reach the server
# on 10.8.0.1. Comment this line out if you are
# ethernet bridging. See the man page for more info.
server 10.8.0.0 255.255.255.0
# Maintain a record of client <-> virtual IP address
# associations in this file. If OpenVPN goes down or
# is restarted, reconnecting clients can be assigned
# the same virtual IP address from the pool that was
# previously assigned.
ifconfig-pool-persist ipp.txt
# Configure server mode for ethernet bridging.
# You must first use your OS's bridging capability
# to bridge the TAP interface with the ethernet
# NIC interface. Then you must manually set the
# IP/netmask on the bridge interface, here we
# assume 10.8.0.4/255.255.255.0. Finally we
# must set aside an IP range in this subnet
# (start=10.8.0.50 end=10.8.0.100) to allocate
# to connecting clients. Leave this line commented
# out unless you are ethernet bridging.
;server-bridge 10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100
# Push routes to the client to allow it
# to reach other private subnets behind
# the server. Remember that these
# private subnets will also need
# to know to route the OpenVPN client
# address pool (10.8.0.0/255.255.255.0)
# back to the OpenVPN server.
;push "route 192.168.10.0 255.255.255.0"
;push "route 192.168.20.0 255.255.255.0"
# To assign specific IP addresses to specific
# clients or if a connecting client has a private
# subnet behind it that should also have VPN access,
# use the subdirectory "ccd" for client-specific
# configuration files (see man page for more info).
# EXAMPLE: Suppose the client
# having the certificate common name "Thelonious"
# also has a small subnet behind his connecting
# machine, such as 192.168.40.128/255.255.255.248.
# First, uncomment out these lines:
;client-config-dir ccd
;route 192.168.40.128 255.255.255.248
# Then create a file ccd/Thelonious with this line:
# iroute 192.168.40.128 255.255.255.248
# This will allow Thelonious' private subnet to
# access the VPN. This example will only work
# if you are routing, not bridging, i.e. you are
# using "dev tun" and "server" directives.
# EXAMPLE: Suppose you want to give
# Thelonious a fixed VPN IP address of 10.9.0.1.
# First uncomment out these lines:
;client-config-dir ccd
;route 10.9.0.0 255.255.255.252
# Then add this line to ccd/Thelonious:
# ifconfig-push 10.9.0.1 10.9.0.2
# Suppose that you want to enable different
# firewall access policies for different groups
# of clients. There are two methods:
# (1) Run multiple OpenVPN daemons, one for each
# group, and firewall the TUN/TAP interface
# for each group/daemon appropriately.
# (2) (Advanced) Create a script to dynamically
# modify the firewall in response to access
# from different clients. See man
# page for more info on learn-address script.
;learn-address ./script
# If enabled, this directive will configure
# all clients to redirect their default
# network gateway through the VPN, causing
# all IP traffic such as web browsing and
# and DNS lookups to go through the VPN
# (The OpenVPN server machine may need to NAT
# the TUN/TAP interface to the internet in
# order for this to work properly).
# CAVEAT: May break client's network config if
# client's local DHCP server packets get routed
# through the tunnel. Solution: make sure
# client's local DHCP server is reachable via
# a more specific route than the default route
# of 0.0.0.0/0.0.0.0.
;push "redirect-gateway"
# Certain Windows-specific network settings
# can be pushed to clients, such as DNS
# or WINS server addresses. CAVEAT:
# http://openvpn.net/faq.html#dhcpcaveats
;push "dhcp-option DNS 10.8.0.1"
;push "dhcp-option WINS 10.8.0.1"
# Uncomment this directive to allow different
# clients to be able to "see" each other.
# By default, clients will only see the server.
# To force clients to only see the server, you
# will also need to appropriately firewall the
# server's TUN/TAP interface.
# Uncomment this directive if multiple clients
# might connect with the same certificate/key
# files or common names. This is recommended
# only for testing purposes. For production use,
# each client should have its own certificate/key
# pair.
# The keepalive directive causes ping-like
# messages to be sent back and forth over
# the link so that each side knows when
# the other side has gone down.
# Ping every 10 seconds, assume that remote
# peer is down if no ping received during
# a 120 second time period.
keepalive 10 120
# For extra security beyond that provided
# by SSL/TLS, create an "HMAC firewall"
# to help block DoS attacks and UDP port flooding.
# Generate with:
# openvpn --genkey --secret ta.key
# The server and each client must have
# a copy of this key.
# The second parameter should be '0'
# on the server and '1' on the clients.
;tls-auth ta.key 0 # This file is secret
# Select a cryptographic cipher.
# This config item must be copied to
# the client config file as well.
;cipher BF-CBC # Blowfish (default)
;cipher AES-128-CBC # AES
;cipher DES-EDE3-CBC # Triple-DES
# Enable compression on the VPN link.
# If you enable it here, you must also
# enable it in the client config file.
# The maximum number of concurrently connected
# clients we want to allow.
;max-clients 100
# It's a good idea to reduce the OpenVPN
# daemon's privileges after initialization.
# You can uncomment this out on
# non-Windows systems.
;user nobody
;group nobody
# The persist options will try to avoid
# accessing certain resources on restart
# that may no longer be accessible because
# of the privilege downgrade.
# Output a short status file showing
# current connections, truncated
# and rewritten every minute.
status openvpn-status.log
# By default, log messages will go to the syslog (or
# on Windows, if running as a service, they will go to
# the "\Program Files\OpenVPN\log" directory).
# Use log or log-append to override this default.
# "log" will truncate the log file on OpenVPN startup,
# while "log-append" will append to it. Use one
# or the other (but not both).
;log openvpn.log
;log-append openvpn.log
# Set the appropriate level of log
# file verbosity.
# 0 is silent, except for fatal errors
# 4 is reasonable for general usage
# 5 and 6 can help to debug connection problems
# 9 is extremely verbose
verb 3
# Silence repeating messages. At most 20
# sequential messages of the same message
# category will be output to the log.
;mute 20
# Sample client-side OpenVPN 2.0 config file #
# for connecting to multi-client server. #
# #
# This configuration can be used by multiple #
# clients, however each client should have #
# its own cert and key files. #
# #
# On Windows, you might want to rename this #
# file so it has a .ovpn extension #
# Specify that we are a client and that we
# will be pulling certain config file directives
# from the server.
# Use the same setting as you are using on
# the server.
# On most systems, the VPN will not function
# unless you partially or fully disable
# the firewall for the TUN/TAP interface.
;dev tap
dev tun
# Windows needs the TAP-Win32 adapter name
# from the Network Connections panel
# if you have more than one. On XP SP2,
# you may need to disable the firewall
# for the TAP adapter.
;dev-node MyTap
# Are we connecting to a TCP or
# UDP server? Use the same setting as
# on the server.
;proto tcp
proto udp
# The hostname/IP and port of the server.
# You can have multiple remote entries
# to load balance between the servers.
remote my-server-1 1194
;remote my-server-2 1194
# Choose a random host from the remote
# list for load-balancing. Otherwise
# try hosts in the order specified.
# Keep trying indefinitely to resolve the
# host name of the OpenVPN server. Very useful
# on machines which are not permanently connected
# to the internet such as laptops.
resolv-retry infinite
# Most clients don't need to bind to
# a specific local port number.
# Downgrade privileges after initialization (non-Windows only)
;user nobody
;group nobody
# Try to preserve some state across restarts.
# If you are connecting through an
# HTTP proxy to reach the actual OpenVPN
# server, put the proxy server/IP and
# port number here. See the man page
# if your proxy server requires
# authentication.
;http-proxy-retry # retry on connection failures
;http-proxy [proxy server] [proxy port #]
# Wireless networks often produce a lot
# of duplicate packets. Set this flag
# to silence duplicate packet warnings.
# SSL/TLS parms.
# See the server config file for more
# description. It's best to use
# a separate .crt/.key file pair
# for each client. A single ca
# file can be used for all clients.
ca ca.crt
cert client.crt
key client.key
# Verify server certificate by checking
# that the certicate has the nsCertType
# field set to "server". This is an
# important precaution to protect against
# a potential attack discussed here:
# http://openvpn.net/howto.html#mitm
# To use this feature, you will need to generate
# your server certificates with the nsCertType
# field set to "server". The build-key-server
# script in the easy-rsa folder will do this.
;ns-cert-type server
# If a tls-auth key is used on the server
# then every client must also have the key.
;tls-auth ta.key 1
# Select a cryptographic cipher.
# If the cipher option is used on the server
# then you must also specify it here.
;cipher x
# Enable compression on the VPN link.
# Don't enable this unless it is also
# enabled in the server config file.
# Set log file verbosity.
verb 3
# Silence repeating messages
;mute 20


text:
Are you tired of staying up late at night and still losing auction in the last seconds? You need JoyBidder eBay Auction Sniper to help you! It can automatically submit your bid seconds before auction ends, so other bidders won't have time to respond. It runs on your own computer, so your eBay password is secure. In addition to advanced snipe function, Pro Edition can also search auctions, monitor item status and price, and analyze eBay sales data! JoyBidder eBay Auction Sniper runs on Windows, Mac OS X and Linux. * snipe eBay auction from your own computer * import from watch list, scheduled search and build-in web browser * bid groups * support 22 eBay sites including eBay motor * translate eBay international site * outbid and search result email alert * eBay data extraction and analysis * data backup/restore * automatic raise max bid to outbid rival * optional multiple-location server sniping service for extra reliability and convenience
What's new in this version:
When exiting the app, the program may show a message waiting for several seconds to make sure data is saved correctly. Occasionally there is a bug that the program asks for unnecessarily much longer waiting time. This bug is fixed. This program will continue to automatically update item status unless there are 4 consecutive updating failures. In previous version, the program stops updating item status immediately after first updating error.

subset: commoncrawl


text:
Please stop what you are doing and read this. Really! Right now!
It made me angry. It made me sad. And then I just sat there with that "what the what?!" look on my face. So I read it again! I don't get mad often-I'm actually a look on the bright side 99% of the time kind of person, but this makes me ANGRY!
This really has to stop! I wish I knew the answers to things like this. I know that moving schools saved me, but that isn't (and shouldn't) be the fix. Thankfully, I am now in a school where I am expected to teach all day long–really, that's my job and what is expected of me. I call it teaching nirvana! My administration knows what our kids need and they love our kids. This should be the case at every school, for every teacher, and for every student! Ugh!
At a time when teachers are constantly under the microscope and under the gun, I think we need to make the shift to looking at the absurd things we are often forced to do by administrators that (all too often) left teaching because they weren't good at it.
Teachers: You are doing an amazing job. If you really aren't happy, get out. Administrators, so many of you are awesome. Help those that aren't!
As always, your thoughts, experiences, and feedback are welcome!


text:
Posted by Editor on 12/20/06
Norco Named in 'Top 20 Best Companies to Work for in BC'
Norco Products Ltd, one of Canada's leading bicycle manufacturers and distributors, was honoured, for the 2nd year in a row by BC Business Magazine & Watson Wyatt Worldwide, as one of the '25 Best Companies to Work for in BC'.
"We're pleased to not only be recognized once again as one of the top companies in this province, but also to see that Norco ranks high in the business community on making our working environment a #1 priority for our employees," commented Jim Harman, Norco's President, "Much of our company's growth and success over the years can be attributed to the fact that our employees make the culture, and that they are personally invested in Norco's success."
The rankings are based primarily on a confidential survey feedback from each company's employees. Over 800 companies from the private, public, Crown, university, municipality, branch plant, and hospital sectors were eligible for inclusion. Roughly 80 companies made it to the final qualifications.
|Return to Canadian Cyclist homepage | Back to Top


text:
We've prevously tested and adored SIM2's HT3000 Full HD DLP projector. But great though that was, SIM2 apparently thought there was still room for improvement.
Sat before us today is the HT3000E, where the extra E signifies a really pretty major upgrade of the original model.
And so it should, really. For even though it's possible to get Full HD DLP projectors now for under £2k, the HT3000E costs £10,000, defining it as an ultra-premium product that therefore needs to deliver an ultra-premium performance if it's to win hearts and minds. Fingers crossed it doesn't let us down.
If it were safe to judge a book by its cover, the HT3000E would arguably be the finest projector ever. For its extravagantly curvaceous and glossy styling - created by Italian concept designer Giorgio Revoldini - really is a joy to behold, resembling both SIM2's three-chip DLP superstar, the C3X-E and, to some extent, the profile of a Ferrari. You see: really 'serious' home cinema does not have to look dour and miserable.
However much we like our projectors to look sexy, it's what's inside them that really counts. Fortunately the HT3000E punches its weight here too.
For starters, the 1920 x 1080 DLP system is based around a new 0.95in chipset, meaning that the mirrors are so tightly crammed together that it should be practically impossible to 'see the joins' even if you watch the projector on a truly prodigious screen (the projector is rated up to 300in, though to be honest, I suspect it could go even bigger if you really wanted it to).
Arguably even more significant, though, is the projector's phenomenal brightness. New Unishape lamp technology, which allows output of the lamp to be controlled according to scene content, works in conjunction with a full 1080p implementation of Texas Instruments' BrilliantColor system (including the six-segment colour wheel arrangement as well as the software part) to help the HT3000E deliver almost 100 per cent more brightness from a standard 200W lamp than was possible on the original HT3000.
Its potential for making pictures look more dynamic, created by so much extra brightness really, cannot be overstated - especially as the huge boost in brightness is also joined by a massive 60 per cent rise in contrast. The colour temperature, meanwhile, remains set at the D65 level recognised as the best for video playback.
SIM2 quotes a contrast ratio of more than 6500:1 for the HT3000E - a terrific figure by DLP standards - especially as it's not dependent on dynamic iris technology of the sort employed by many LCD-based products.
Nasty person that I am, my main test material was Kill Bill Volume 1 recorded in high-definition from Sky. Now there's nothing wrong with the broadcast; in fact it's quite superb in terms of both its detailing and its freedom from noise.
But I know from experience that its demanding colour palette, sporadically extremely dark scenes and highly stylised lighting conditions can cause real headaches for projectors and flat TVs alike. But the HT3000E passes even the most difficult sequences with utter aplomb.
For instance, when The Bride dumps Sofia Fatale outside a hospital at night, the dark sky looks convincingly black in a way I can't recall ever seeing on a single-chip DLP projector before.
Even better, the immaculate black level reproduction of the background night sky is emphasised dramatically by the extraordinary intensity, solidity, colour richness and brightness of the main action. In fact, this juxtaposition of total darkness and unprecedented vibrancy is the HT3000E's main - or at least most instant and cinematic - appeal. And it's also here that the projector most justifies its cost.
Extreme close-ups reveal the HT3000E's fine detailing, and on many occasions I found myself spotting little details in backgrounds that I don't recall seeing before.
This sharpness isn't weakened in the slightest by any kind of video noise either, be it colour moiré, dot crawl, grain, or motion blur. I couldn't detect any trace of pixellation caused by the mirror array, despite watching the projector on a 200in screen.
The final superb element in the HT3000E's cutting-edge visual performance is the colour toning. It's more or less flawless, with everything from the richest reds and blues, of the Manga animation sequence in Kill Bill, to the subtlest of skin tones all looking equally convincing. BrilliantColor take a bow.
One disappointing aspect of the SIM2 HT3000E is its unnecessarily complicated user interface. I've long found SIM2's onscreen menus quite unhelpful to use, requiring you to 'learn' your way around them rather than just be able to get to grips with them straight away. I repeatedly had to refer to the manual to figure out how to do something or other, and I don't feel this should be necessary.
Particularly irksome is setting up the projector's inputs to receive the correct video signals - the system for doing this just doesn't seem logical at all. And in the majority of other projectors we see most input detection is done automatically.
Of course, nearly all users will opt to have their SIM2 installed and calibrated for them, and so won't come across this setup issue, but there still doesn't seem any need for it to be so fiddly.
Another problem I had was with the DLP 'rainbow effect'. Now, at a recent press briefing, SIM2 UK head honcho Alan Roser suggested to us journos that we stop banging on about the rainbow effect, claiming it really isn't an issue any more.
But while it's very rarely apparent on the HT3000E, I certainly still noticed it - without looking especially - over parts of the image where there's a particularly stark dark/light contrast.
However, the traces of rainbow effect I detected seem like a pretty small price to pay for all the other strengths the HT3000E brings to the table.
While had my doubts about that £10K price tag, I'm already wondering which elderly relative I can bump off to get hold of the necessary cash. This is truly a 'reference' status projector.


text:
CNN PoliticalTicker…
February 15th, 2012
3 hours ago
Washington (CNN) – President Barack Obama's approval rating is back to 50% for the first time in more than eight months, and he currently holds an edge against all the remaining Republican presidential candidates in hypothetical head-to-head match-ups, according to a new national survey.
And a CNN/ORC International Poll released Wednesday also indicates that the GOP's advantage on enthusiasm has been erased, and that the number of Americans who think things are going well in the country is on the rise. Six out of ten say things are going poorly in the country, but four out of ten say things are going well, up 15 points since November.
See full results (pdf) Follow the Ticker on Twitter: @PoliticalTicker
"Does that mean it's morning in America? It is for Democrats – a solid majority of them now say things are going well in the country. But overall, six in ten still have a gloomy outlook about the state of the country," says CNN Polling Director Keating Holland. "Optimism is on the rise among independent voters, with a notable increase among men as well, although a majority of both groups still think things are going poorly."
The rise of Americans who say things are going well appears to be helping the president, whose approval rating now stands at 50%, with 48% saying they disapprove of the job Obama's doing in the White House. The president's approval rating has edged up three points from last month and is up six points from November. The last time Obama's approval rating was at 50% or above was last May, as a result of the killing of Osama bin Laden, and it stayed there for about a month before fading.
"Independents now have a net-positive view of President Obama," says Holland. "His approval rating has also reached 50% in the suburbs."
Looking ahead to November, the poll indicates that the president's re-election chances are on the rise. In hypothetical matchups among registered voters, Obama holds a 51%-46% margin over former Massachusetts Gov. Mitt Romney, leads both former Sen. Rick Santorum of Pennsylvania and Rep. Ron Paul of Texas by the same 52%-45% advantage, and beats former House Speaker Newt Gingrich 55%-42%.
The president appears to have gained ground since January against Romney, Paul, and Gingrich. Only Santorum has held steady. The poll also indicates that Obama wins a majority of independent voters in all four general election match-ups.
"More than six in ten Americans believe that the policies of Romney and Gingrich favor the rich; Santorum and Paul do better on that measure, but only a quarter feel that way about Obama," says Holland.
The survey suggests that the contentious Republican primary season has decreased enthusiasm among Republican voters, virtually erasing the "enthusiasm gap" that promised to provide the ultimate GOP presidential nominee with a major advantage in the fall. In October, 64% of Republicans said that they were extremely or very enthusiastic about voting for president, compared to only 43% of Democratic voters. GOP enthusiasm since that time has tumbled 13 points, to 51%, virtually the same as the Democrats' level of enthusiasm.
Other findings in the poll: 67% of the public says they are either very or somewhat angry about the way things are going in the country, down five points from September. And 31% approve of the job Democrats in Congress are doing, with 22% giving congressional Republicans a thumbs up. Both numbers are virtually unchanged from last autumn. The CNN poll was conducted by ORC International from February 10-13, with 1,026 adult Americans questioned by telephone. The survey's overall sampling error is plus or minus three percentage points.
– CNN Political Editor Paul Steinhauser contributed to this report
Also see:
Gingrich: Santorum 'misunderstands' modern warfare
Santorum slams Obama administration as 'elite snobs'
Romney surrogates attack Santorum's record
CNN Poll: Romney's likability fading
CNN Poll: Gender and income gaps in GOP nomination battle


text:
Phil B writes:
My day job does include parameter and state estimation using Least Squares and Kalman filtering.
I have replicated several of the non-ice borehole temperature reconstructions and I'll "share" my observations. The inversion problem boils down to finding the solution to the inconsistent set of linear equations Ax~b, where A is a skinny matrix (mxn) whose columns are generated from the solution of the heat conduction equation. x is a nx1 solution vector where the first two elements are a slope and intercept and the remaining elements are the temperature reconstruction. The b mx1 vector is the borehole temperature profile. The solution is calculated using the pseudo inverse based on the singular value decomposition (svd) where A = U*S*V' and where U (mxm) and V (nxn) are complete orthonormal basis sets. The A matrix is ill-conditioned with ratio of max to min singular value on the order of 1e6 to 1e7 on the boreholes I replicated. In the older literature only singular values of greater than 0.3 are used in the pseudo inverse, with recent literature using a ridge regression that optimizes the norm of the residual versus the norm of the solution. If you keep singular values that are less than 0.3, the reconstruction is physical unreasonable, i.e. pulses on the order of 20-40 deg K. For 500 year reconstruction and 100 year steps, the 3 smallest singular values out of the seven total aren't used in the psuedoinverse.
So what is the problem??? The ill-conditioning of A!! For instance if A is rank deficient i.e. rank = n-1, then one has a single null vector z such that A*z = 0_mx1 and an infinite number of solutions for x. For our A, there are 3 "almost" null vectors which are the last three columns of V. So A*v(5), A*v(6), A*v(7)~0_mx1. Let x_est be the pseudo inverse solution using only singular values greater than 0.3. Let's create a new solution x_new = x_est + 2*v(7). The individual residual changes are on the order of millikelvins. x_new "looks" substantial different then x_est but the values are reasonable. The point is that there are many x_estimates and many reasonable temperature reconstructions that have residuals that are almost identical, with differences that are less then the temperature sensor noise level.
Summarizing, the columns of the ill-conditioned A matrix are created using solutions to the heat conducting equation. x_est is one of many possible temperature histories.


text:
Overview of program:
The Food and Hospitality Certificate program prepares students for careers in food services, restaurants, and the hospitality industry. The program emphasizes the personal and professional skills used in a wide variety of food service settings. This is an excellent option for those already working in the food services environment who want to apply for management positions, or for those interested in starting new careers. The program also prepares students to take the Prometric Certified Professional Food Manager (CPFM) exam.
Career information and outlook:
Professionals in the food and hospitality industry work in restaurants, hotels, resorts, and cafeterias. Some of the tasks they perform are food preparation, serving food, assisting customers, and managing restaurants or hotels. Although the careers in this industry vary, many have bright outlooks. For example, the employment of food servers is expected to increase by 10 percent from 2014 to 2024.* Employment of combined food preparation and serving workers is expected to grow faster than the average in that time frame.**
Topics You Will Learn About Include:
- HACCP (Hazard Analysis Critical Control Points) principles
- U.S. food service regulation
- Food preparation and safety
- Foodborne illnesses & bloodborne pathogens
- Receiving and storing food items
- Working in teams
- Communication skills
- How to advance at work
- Workplace challenges and opportunities
Program Courses:
What do students graduate with?
- High School Diploma from Career Online High School
- Food and Hospitality Certificate
*Bureau of Labor Statistics, U.S. Department of Labor, Occupational Outlook Handbook, 2014-15 Edition, Food and Beverage Serving and Related Workers, on the Internet at http://www.bls.gov/ooh/food-preparation-and-serving/food-and-beverage-serving-and-related-workers.htm (visited October 20, 2015).
**O*Net Online, Combined Food Preparation and Serving Workers, Including Fast Food


text:
After getting into hot water earlier today for opening new PC copies of Square Enix's Deus Ex: Human Revolution and removing codes for a free OnLive version of the game prior to sale, video game retailer GameStop has pulled the games from its shelves pending recall.
According to an email forwarded to Kotaku from an anonymous source and confirmed via GameStop retail employees, the company instructs employees to remove any retail copies of the PC version of the game to the back room of the store pending recall at a later date. Note that the recall is being performed in agreement with Square Enix, indicating the two companies have been in communication regarding the situation.
While preorder copies of the PC version will still be available, it's likely the code was removed from those, so I'd suggest picking it up somewhere else. I've been a staunch defender of the retailer in the past, but this is a bit much.
You can contact Michael Fahey, the author of this post, at email@example.com. You can also find him on Twitter, Facebook, and lurking around our #tips page.


text:
To finish off my division by division breakdowns, we have the NFC West. This division has become a two headed monster. There are two very good teams at the top, one mediocre squad, and a very weak team at the bottom. When Brett Favre officially announces his return, which will hopefully be sooner rather than later, the Vikings and Packers will begin duking it out for divisional supremacy. Lets get ready to rumble in the NFC North.
NFC North: Bears, Lions, Packers, Vikings (alphabetical order)
Detroit Lions (4th place): Detroit's suffering will continue for at least another year. This team has only won 2 games over the course of the past two years and has not won more than 7 games in a season since the year 2000. It has been a brutal last 10 years. Well expect this year to be pretty typical for the Lion's faithful. This team had the worst defense in the League last year and an almost equally as bad offensive attack. Lots of weight will placed on 2nd year quarterback Matthew Stafford. Can he live up to the lofty expectations? Calvin Johnson is one of the best receivers in the game. It is a shame that the Lions cannot really give him another solid receiver to play alongside. Guys like Dennis Northcutt and Bryant Johnson have not been able to cut the mustard. From a rushing standpoint, they still have Kevin Smith, who will hopefully be fully recovered from a devastating Week 14 ACL tear (last season). They also have rookie Jahvid Best. Do not expect too much from this duo though due to lack of an offensive line. Defensively it gets worse. There is really not one player of note on the entire unit other than recently drafted Ndamukong Suh. Lions' fans better pray this guy gets signed, lives up to the hype, and is ready to be an instant leader for this team on the defensive side of the ball. That is a lot to ask of a rookie. Do not expect the Lion's
to win more than 5 games this year.
Chicago Bears (3rd place): Da Bears! Yes Chris Berman is in the Hall of Fame, but the Bears still do not have the look of a contender sadly. No matter how excited Chris Berman can get people when talking about the boys out of the windy city, the team is not ready to be a force yet. The Bears have not been to the postseason since 2006, and do not count on that streak ending this year. This team suffered without Brian Urlacher last year defensively, and did not do much with the newly acquired Jay Cutler from an offensive standpoint. Though the Bears finally added a complement to Matt Forte in Chester Taylor, this does not appear to solve the rushing issues. This team was near the bottom of the League in rushing yards last year, and though Taylor should help a little, these guys do not really compliment each other well in that they each have a very similar style. I just hope for the Bear's sake, conflict does not arise between Forte and Taylor. The receiving corps has not improved either. This team is still lacking a number 1 threat for Jay Cutler to use his "super" strong-arm to throw too. So do not expect this team to put up a flurry of points on a weekly basis. Defensively, the unquestioned leader is still the man with "swag," Brian Urlacher. Urlacher along with Lance Briggs make up one of the League's best linebacker duos. Also, the addition of Julius Peppers to the defensive line should make an instant impact. If Urlacher can stay healthy, expect this team to be much better defensively than they were last year. The secondary did do a solid job against the pass so hopefully with Peppers rushing the opposing quarterback, their jobs can be even easier this year. The Bears will be a decent team. But do not expect them to sneak into the playoffs. I am predicting 7 or 8 wins due to the lack of offensive stability.
Green Bay Packers (2nd place): The Cheesheads may be disappointed with another 2nd place appearance, but count on this team to roll deep into the playoffs. I have them cruising all the way to the Super Bowl. It will take this team time to gel and it will help when Favre tires down the stretch for the Vikings come playoff time. This team is led by a lethal offensive attack. Aaron Rodgers has become one of the top 5 quarterbacks in the League hands down. They got a great duo at receiver in the up and coming Greg Jennings and the seasoned veteran Donald Driver. Hopefully Driver is healthy after undergoing arthroscopic knee surgery on both of his knees this off-season. But luckily for the Packers, they have young guns James Jones and Jordy Nelson waiting in the wings. Not to mention they have a very solid tandem of receiving tight ends in Jermichael Finley and Donald Lee. I also forgot to mention that though this team lives on the pass, do not sleep on Ryan Grant pounding the rock. The question is who can complement Grant down the stretch? Possibly the seasoned veteran Ahmad Brooks or the Florida product DeShawn Wynn. Offensively, this is the only question mark this team has if any. Defensively the Packers number 2 defense of a season ago will be led by the linebacking trio of Nick Barnett, AJ Hawk, and Clay Matthews. This the best linebacking trio in the League in my eyes. They are young, tough, and very fun to watch. Lastly, you have 2 very strong veterans in Charles Woodson and Al Harris anchoring the secondary. Good luck scoring points on these guys. Neither AJ Hawk nor Clay Matthews has really entered their prime yet. There is lots of upside. The Packers have the best combination of offense and defense in the entire NFC.
Minnesota Vikings (1st place): This team came up just short of making an appearance in the Super Bowl last season. They are determined to go one step further this year and bring a Super Bowl title back to the twin cities of Minnesota. And why shouldn't they be confident? They have a great core group of guys returning. Minnesota also possesses both a great offense and defense. Last season, the Vikings became a pass first offense. I think Brett Favre is the only player in the League that could make a team that has the one they call "All Day" (Adrian Peterson) a pass first team. Brett can still really play and put on quite a show last season. And I fully expect him to put up great numbers again this year. Sidney Rice, Percy Harvin, and Bernard Berrian are a great trio of targets for Favre. All 3 are young and have a ton of upside. Look for Favre to be slinging the ball all over the field again this year. My question is will Sidney Rice be healthy? Either way the passing attack will be lethal. Then of course the Vikings do have the luxury of handing the ball off to Adrian Peterson, who has the ability to turn any play into a big time play. If AP starts fumbling again though, who is the next guy in? Ryan Moats or the rookie Toby Gerhart? This team does not really have a sure-fire compliment for Peterson nor do they really need one. As long as Peterson stays healthy, it will be paradise in the Minnesota backfield. Then from a defensive standpoint, this team stops the run with the best of them. Guys like Jared Allen, Kevin Williams, and Pat Williams are absolutely outstanding. They not only stop the run, but they pressure the quarterback early and often. Then in the secondary, the addition of veteran cornerback Lito Shephard should help turn this unit from average, to pretty good. Big things will also be expected from the outstanding cornerback Antoine Winfield, and their injury prone safety, Madieu Williams. All I can say is, watch out, because this Viking's team will be scary. Do not be surprised to see this team roll deep into the postseason.
So the NFC North should have a repeat champion in the Minnesota Vikings. But do not sleep on the Green Bay Packers, who I think could overtake the Vikings come playoff time on their way to making an appearance in the Super Bowl for the first time since 1997. Both of these teams are very strong in nearly all aspects of the game.
Stay tuned for the next edition of TheSportsKraze.