CREDITS: I got a lot of assistance from various people on the Proxmox forums, and specifically from one user, Marius.

Prepare the Host Node

There are a few things you will need to do up-front to prepare your “Host Node,” that is, your Proxmox VE host to allow for the TUN network interface that OpenVPN requires. Log in to your Proxmox VE host and open:

nano /etc/vz/vz.conf

Then, scroll down to the section that says “## IPv4 iptables kernel modules” and load a few extra modules for iptables:

IPTABLES="ipt_REJECT ipt_tos ipt_TOS ipt_LOG ip_conntrack ipt_limit ipt_multiport iptable_filter iptable_mangle ipt_TCPMSS ipt_tcpmss ipt_ttl ipt_length ipt_state iptable_nat ip_nat_ftp"

You must restart VZ to load the new modules by running:

/etc/init.d/vz restart

(NOTE: This will shut down any running VMs.) Now, you’re ready to install the OS.

Install the OS

First off, at least for the time being, OpenVPN AS needs a 64-bit OS. Currently there are pre-packaged installation files for Ubuntu and Fedora. Installation packages for 32-bit OSes and other distributions are supposedly in the works. Because Proxmox is based on Debian and there are several Debian and Ubuntu OpenVZ templates available already, I chose to use Ubuntu 8.04 LTS 64-bit. That particular template isn’t included in the “Appliance Templates” in Proxmox (at least not in my version), so I had to download it from the Proxmox repositories first. Simply download the “ubuntu-8.0-standard_8.04-1_amd64.tar.gz” template to your Proxmox host. Go to the Proxmox repositories and find the template you want. In my case it was at ftp://download.proxmox.com/appliances/system/ubuntu-8.0-standard_8.04-1_amd64.tar.gz, so:

cd /var/lib/vz/template/cache/
wget ftp://download.proxmox.com/appliances/system/ubuntu-8.0-standard_8.04-1_amd64.tar.gz

Once the template is downloaded, log in to the web interface of your Proxmox VE host.

Creating the OpenVZ container

Hopefully you already know how to create an OpenVZ container in Proxmox. If not, since it’s not really the focus of this how-to, head over to Proxmox Tutorials. Moving on, for my VPN appliance I selected the following settings:

• Template: ubuntu-8.0-standard_8.04-1_amd64
• Disk space (GB): 8
• Memory (MB): 512
• Swap (MB): 512
• Network type: Bridged Ethernet (veth)

IMPORTANT: You must select ‘Bridged Internet (veth).’ ‘Virtual Network (venet)’ will not work.

You should of course also fill out all the other stuff, like hostname, DNS domain, DNS servers, and so on.

Now, simply start the VM.

Configuring and preparing the VM

First things, first. Update your OS! Use the “Open VNC Console” located in the ‘Virtual Machine Configuration’ settings for your VM and run:

apt-get update
apt-get upgrade


You also need to configure the IP settings of the VM. Add the network config settings for your setup, like in the following example:

# Primary network interface
auto eth0
iface eth0 inet static
address 192.168.1.20
netmask 255.255.255.0
network 192.168.1.0
broadcast 192.168.1.255
gateway 192.168.1.1

Then, restart your networking, like so:

/etc/init.d/networking restart

Install OpenVPN

Obviously, first things first, so you’ll need to download the installation file from OpenVPN. To download it you need to first sign up for an account. Once you’ve signed up, find the URL to the download you want. In my case, using Ubuntu 8.04 LTS 64-bit, the latest available version was OpenVPN AS 1.1.0, so I picked the openvpn-as-1.1.0-Ubuntu8.amd_64.deb file.

That out of the way, last thing to do before you can start configuring your OpenVPN Access Server is to actually install it. This is fast. Log in via SSH or using Proxmox’s VNC Console. Then, do this:

cd /tmp
wget http://path/to/openvpn-as/download/directory/openvpn-as-1.1.0-Ubuntu8.amd_64.deb

It’s a fairly small package, so it should download relatively quickly. Then issue:

dpkg -i openvpn-as-1.1.0-Ubuntu8.amd_64.deb

It should install everything. When the installation completes, to run initial configuration for your newly installed OpenVPN Access Server, issue the following command:

/usr/local/openvpn_as/bin/ovpn-init

Unless you have specific requirements, you can just accept the defaults during the configuration process.

I will not cover configuring OpenVPN for your specific needs here. OpenVPN has a good document outlining how to do that. It’s available to download from their website for people who already have OpenVPN accounts. Obviously, if you’ve already gotten this far, you should have an account.

That’s it. All it took in the end was a few “special” tweaks here and there to make OpenVPN run in an OpenVZ container, and overall it wasn’t that complicated once I figured out what those tweaks were. Of course, it would be more straight forward to install OpenVPN AS on a dedicated server, but that would cost you more. And if you already have spare capacity on a virtual host, why not use that?

I hope you enjoyed this how-to. Comments, corrections, feedback, and ideas below are greatly appreciated.

1. Plugged in the USB modem.
2. Created a new ‘Mobile Broadband’ profile using the connection wizard in Ubuntu’s (Gnome) Network Manager (which already had the T-Mobile USA ‘Internet’ settings pre-configured).
3. Clicked connect on the newly created ‘T-Mobile (Internet)’ profile.

Wow, that was easy! Easier than on Windows or on a Mac.

Again, I tested my download speed … in the same physical location as I tested it on with my Mac … i.e. with somewhat limited coverage. I ran it a few times. I got download speeds of over 800 Kbps every time. Even faster than on my Mac.

Yesterday OpenVPN Technologies, the company behind the OpenVPN open source project, announced the immediate availability of their new OpenVPN Access Server.

OpenVPN Access Server, or OpenVPN AS, is a commercial product based on the open source version originally developed by James Yonan. OpenVPN AS lends itself perfectly to use either on an appliance-style server or for running in a virtual machine. Installation is straight forward and the licensing agreement is too. The performance and scalability of running OpenVPN AS should be at least on par with most other commercial offerings, while no other, if any, commercial offerings comes even close in cost.

There are other reasons for using OpenVPN too. I won’t go into details about the architecture of OpenVPN and why it in many ways is superior to other VPN technologies. However, if you want to read more, you can read this thorough article on VPNs over at Linux.com.

Since I know most other Huawei modems work with Macs, I figured that the E181 must work with a Mac too. So, next I headed over to Huawei’s product support pages. I couldn’t find a download for the E181 specifically, but I did find one for the E180 here. The E180 is essentially the same modem, just for other markets. My somewhat educated guess was that the E180 software would likely work for the E181 too. So, I took the chance and downloaded what appeared to include Mac OS drivers. Curiously, the file included an .exe file. Hmm … Well, I inserted the modem in a Windows machine and ran the newly downloaded application. It warned me that I was about to update the firmware of the modem. Sure. A few moments later I was prompted that the software update had been applied successfully.

Next I moved the modem to my Mac running OS X 10.5.7. It automatically detected the modem and popped up a window with a “Mobile Connect” application. I went ahead and installed the app. Once it was done, I opened up the Mobile Connect app and entered in T-Mobile’s APN details, as follows:

 Name:      T-Mobile USA (this could be named anything)
 Number:    *99***1#
 APN:       internet2.voicestream.com
 Username:  voicestream
 Password:  <blank>

Then I hit connect … and voila … I was online. Sweet!

MobileConnect will create a new modem configuration called “HUAWEI Mobile” in your Mac’s Network Preferences. From now on, if you select the “Show modem status in menu bar,” you can use the modem icon in the menu bar to manage your T-Mobile WWAN connection.

Just out of curiosity I couldn’t help myself running a speed test. Although I only had one to two bars where I was at, I was able to get above 700 Kbps down and 250 Kbps up. Not too shabby, I’d say.

A small disclaimer:  The most expensive plan, about $60/month, does NOT include unlimited data. The $60 plan allows for 5GB/month of downloads. That’s probably enough for most people. But do yourself a favor, don’t watch YouTube or Hulu using your modem. It may end up costing you a lot in overage fees if you run over your 5GB/month.

Proxmox

Once you have downloaded and burned the ISO, it shouldn’t take more than 30 minutes to install. Once installed, one can download ready-built VM OS and app templates directly from the management interface, which is all web based. That’s right, it’s not like VMware’s crippled web UI, where you can only take some actions, like starting and stopping a machine. All management is done through the web UI.

Proxmox VE is a very versatile product. Not only can one run KVM on top of Proxmox, but it will also run OpenVZ containers. The choice between KVM or OpenVZ usually comes down to what kind of OS you need to run. If you need to run a Windows machine, KVM will be your choice, while you will likely use OpenVZ for most Linux servers.

Back to the templates. All templates available at the time of writing this are OpenVZ templates. However, the Proxmox VE developers say that KVM templates are coming. Getting a template is as easy as point-and-click, and a few moments later, as soon as it’s downloaded to your “template library” you point-and-click again to create a new virtual machine container. It literally doesn’t take much longer than half a minute to build a new OpenVZ machine.

There is probably at least 10 different templates available already, varying from basic OS templates to full application appliance templates, such as:

• Ubuntu 8.04
• CentOS 5
• Fedora 9
• Zenoss Core Network Monitoring
• Joomla!
• Drupal
• WordPress

The full list of current templates can be found on the Proxmox VE Wiki.

Even if you don’t have “enterprise hardware” lying around at home, but only have some old clunker hardware with a CPU that supports virtualization, I highly recommend downloading and installing Proxmox VE. It’s a great virtualization platform.

In Part 2, I’ll be discussing more of Proxmox VE’s features and dig a little bit deeper. Stay tuned …

I found AskoziaPBX, a very small distribution (currently) based on FreeBSD. AskoziaPBX is designed with a minimal footprint and runs well on low powered, embedded platforms.

Looking around in my stash of hardware I found a mini-ITX system with a 1.2 GHz VIA CPU, 512KB RAM, and a 1GB Disk on Module (DOM). A DOM is essentially just a solid state hard drive that mounts directly into the IDE socket on the motherboard. Plenty of horsepower to run Askozia PBX.

Since the system I had is essentially a standard x86 PC I downloaded the “Live Install / CD,” an .iso, and burned it to a CD. I connected an external USB CD-ROM and booted the system from my newly burned AskoziaPBX ISO image. Well, that didn’t work so well because of some error with the BTX boot loader, which apparently is a known issue with VIA and FreeBSD. My great master plan of a “simple” installation had failed. So now what? I had to come up with an alternate way of getting the AskoziaPBX image on my DOM. So, this is what I ended up doing, which was really pretty fast and simple.

Besides the hardware, this is what you need:

• Download the AskoziaPBX generic PC image (.img) and put it on a USB drive
• Download an the latest version of Ubuntu and burn the .iso to a CD.

And this is what you need to do to get the AskoziaPBX image onto your computer’s DOM.

1. Boot from the live Ubuntu CD
2. Insert the USB drive (let’s assume it’s named “USB-Drive”)
3. Start Terminal (it runs as user “ubuntu” when in “live” mode)
4. Create a password for the root account

sudo passwd root

5. Type in the password you want twice
6. Now, still in Terminal, log in as root:

su

and provide the password you just created

7. cd to where the USB drive is mounted (normally in /media). Assuming the USB drive is name USB-Drive:

cd /media/usb-drive

8. Check that the AskoziaPBX image is there by listing files in the /media/usb-drive directory, by issuing:

ls

The image should have a name similar to:  pbx-generic-pc-xxx.img

9. If the image is there, which it should be, check the mount point of your DOM by issuing:

fdisk -l

Be sure to find the right drive. In the next few steps you’ll be overwriting everything on the drive you select, so make really sure you know which drive to write to.

10. Assuming your DOM is mounted as /dev/sda, issue the following command:

gunzip -c pbx-generic-pc-xxx.img | dd of=/dev/sda bs=16k

11. The process of writing the image to the DOM could take up to a minute. If all went well, your DOM should now be flashed with the AskoziaPBX image.
12. Shut down Ubuntu.
13. Remove the external CD-ROM.
14. Boot up your system again and it should boot into AskoziaPBX

Now, all you need to do is to configure AskoziaPBX on your network and get a SIP trunk to use for incoming and outgoing calls. Configuring AskoziaPBX is a different article …

If you follow the tutorial step-by-step, you should have a functioning Redmine installation in less than an hour. I’ve tried to be as detailed as possible so that even beginners can get a Redmine system up and running. This is tutorial is more or less a cut-and-paste tutorial.

A lot of the instructions for this tutorial were copied verbatim from the excellent Redmine installation instructions here:

http://www.redmine.org/wiki/redmine/RedmineInstall

Requirements for installing Redmine:

• Ruby on Rails 2.0.2 (Redmine 0.7.x is not compatible with Rails 2.1)
• MySQL 4 or higher

Optional:

• SVN binaries (>= 1.3), for repository browsing (must be available in your PATH)
• RMagick (Gantt export to a png image)

(Note that Rails has some compatibility issues with ruby 1.8.7. The recommended ruby version is 1.8.6.)

Installing Ubuntu

First off, install Ubuntu 8.04 Server. I installed mine on Ubuntu JeOS 8.04. If you will be running Redmine on a virtual server, Ubuntu JeOS is a good choice. JeOS is optimized for virtualization and doesn’t come with a bunch of packages that you don’t need. As such, JeOS will typically create a smaller OS footprint. However, the packages you do need, you will probably have to install manually.

Make sure your server installation is up-to-date by issuing:

> apt-get update
> apt-get upgrade


Package installation and setup

Once you’ve installed the server and updated it, you need to install a bunch of packages that we will prepare the server for the Redmine installation. So, as root, install the following:

> apt-get install build-essential
> apt-get install ssh openssh-server mysql-server phpmyadmin rails rubygems mongrel libmagick9-dev ruby1.8-dev


The packages we’re installing above are MySQL, phpMyAdmin, Rails, Ruby Gems, Mongrel, LibMagick and Ruby Dev environment.

The last two, LibMagick and Ruby Dev, we install to prepare the system for later installation of RMagick to show some fancy Gantt charts.

During the installation of the packages, when MySQL is installed, it will prompt you to create a password. Make sure you remember it. You will need it later to log in to the phpMyAdmin.

If you installed Ubuntu JeOS 8.04 like me, then you probably also want to install:

> apt-get install wget nano cron


Create a new directory for Redmine. I put mine in /opt/redmine, so:

> mkdir /opt/redmine


Then:

> cd /opt/redmine


Download the latest archive from Redmine into your newly created /opt/redmine directory:

> wget http://rubyforge.org/frs/download.php/38377/redmine-0.7.2.tar.gz


In my case the latest stable release was: http://rubyforge.org/frs/download.php/38377/redmine-0.7.2.tar.gz. However, that is likely to change, so look here for the latest release: http://rubyforge.org/frs/?group_id=1850.

Now, untar the file you just downloaded:

>tar xvfc redmine-0.7.2.tar.gz


Database setup

Now it’s time to create an empty database for Redmine. As you may have noticed, we installed phpMyAdmin earlier. phpMyAdmin will come in handy now. Head over to:

You should be presented with the phpMyAdmin login screen.

Type in root and the MySQL password you created when installing MySQL.

First, click on “Databases.” Then, at the bottom of the screen, in the “Create new database” text box create a new database called redmine and set “Collation” to utf8_general_ci.

Now, go back to the home screen and click on:

• “Privileges”
• “Add a new User”

Fill out the “Login Information” boxes. Call your user redmine. Make sure you remember the password you create here. It will be used when you set up the database connection details in Redmine.

In the “Database for user” section, check “Create database with same name and grant all privileges” and click on the “Go” button.

Log out of phpMyAdmin.

Redmine database connection configuration

It’s time to configure the database connection. If you installed Redmine as I did above, then copy config/database.yml.example to config/database.yml and edit this file in order to configure your database settings for “production” environment. You’ll find the database.yml.example here:

/opt/redmine/redmine-0.7.2/config


So now, assuming you’re in the /config directory, do:

> cp database.yml.example database.yml


Then, open the database.yml file, so:

> nano database.yml


… and edit it as in the example for a MySQL database below:

production:
adapter: mysql
socket: /var/run/mysqld/mysqld.sock
database: redmine
host: localhost
username: redmine
password: [password]


Then hit Ctrl+X to exit and answer Y to the prompt and hit enter to write to the database.yml file.

On Ubuntu the mysql.sock is located in /var/run/mysqld/mysqld.sock, as noted in the config above. (The standard Redmine installation assumes the socket is located in /tmp/mysqld.sock.)

Create the database structure, by running the following command under the application root directory:

> rake db:migrate RAILS_ENV="production"


It will create the necessary tables in the redmine database you created earlier and an administrator account.

Insert default configuration data in database, by running the following command:

> rake redmine:load_default_data RAILS_ENV="production"


(This step is optional but highly recommended, as you can define your own configuration from scratch. It will load default roles, trackers, statuses, workflows and enumerations.)

Setting up permissions

The user who runs Redmine must have write permission on the following subdirectories: files, log, tmp (create the last one if not present).

You probably already have a /tmp directory in /opt/redmine/redmine-0.7.2, but if you don’t, create one now:

> mkdir tmp


If you haven’t created a Redmine user, do it now by issuing:

> useradd redmine


Now, assuming you run Redmine with a redmine user, from your /opt/redmine/redmine-0.7.2 directory issue:

> chown -R redmine:redmine files log tmp
> chmod -R 755 files log tmp


A little fancy graphics

To get those fancy looking Gantt charts, install RMagick too:

> gem install rmagick


Testing the installation

It should all be working now. Test the installation by running the WEBrick web server:

> ruby script/server -e production


Once WEBrick has started, point your browser to http://localhost:3000/. Or, if you are using a browser on another computer than what you installed Redmine on, point your browser to http://192.168.1.10:3000/ (if that’s the IP address you gave your Redmine server). You should now see the application welcome page.

Log in

Use default administrator account to log in:

• Login: admin
• Password: admin

You can go to Admin & Settings to modify application settings.

SMTP server configuration>

In config/environment.rb, you can set parameters for your SMTP server:

config.action_mailer.smtp_settings: SMTP server configuration
config.action_mailer.perform_deliveries: set to false to disable mail delivering


Don’t forget to restart the application after any change.

Start application boot time

To automatically start the application on booting your server you need to modify your crontab, like so:

export EDITOR=nano
crontab -e


Your crontab file will be presented. This is the list of programs that start at certain times or at boot. Add the following to the crontab (all on one line):

@reboot cd /opt/redmine/redmine-0.7.2 ; rm -f log/mongrel.pid ; mongrel_rails start -e production -p 3000 -d


Backups

Running backups is always a good idea. Right? Redmine backups should include:

• data (stored in your redmine database)
• attachments (stored in the files directory of your Redmine install)

Here is a simple shell script that can be used for daily backups (assuming you’re using a mysql database):

# Database
/usr/bin/mysqldump -u -p | gzip > /path/to/backup/db/redmine_`date +%y_%m_%d`.gz

# Attachments
rsync -a /path/to/redmine/files /path/to/backup/files


• They don’t make regular backups of their laptops.
• If they have a “corporate” file server, they don’t back that up either.
• They can’t remotely access their file server.
• If they do have remote access to their file server, typically their small business network is not configured in a very secure way.

When I talk to friends and colleagues who operate small businesses, they all seem to have the same problem. They don’t have the knowledge and/or time to set up a good network and computing environment for themselves and their company. They can’t buying expensive and proprietary hardware and software to solve these problems. And, on top of that, they can’t afford hiring a consultant to implement all these things for them.

In order to see if I could solve at least part of the dilemma, for the last few months I’ve been looking for a Virtual Private Network (VPN) solution that meets the following five requirements:

1. Inexpensive
2. Simple
3. Reliable
4. Scalable
5. OS independent

Well, there’s a sixth requirement, secure, but that’s a given. There are countless VPN solutions on the market and many good ones. But, they typically only meet three or four of the five requirements I have defined as necessary to solve the problem.

So, for the past few months I’ve been doing a lot of research on VPNs. IPSec and PPTP VPNs keep on popping up all the time as the core offerings of the large, well-known firms providing VPN products. Fairly recently many of the established firms have also started offering SSL VPN solutions. No matter what protocols are used, for the most part, what they have to offer is technically sound from a reliability and scalability perspective. And there’s certainly no reason to doubt that these products meet the security requirements expected from a VPN. However, most of the solutions are not:

• inexpensive (at least not in the eyes of the small companies I’m talking about),
• simple enough to install and configure for the lay person with almost no networking and security knowledge, and
• they are not OS independent.

Why is OS independence so important? Well, maybe it’s not … yet. However, more and more people I know and talk to, especially in small companies, are getting Mac OS computers; an operating system largely ignored by most VPN product vendors. So, therefore, I believe OS independence is becoming more and more important. Because of that belief I set my mind on finding a solution that will work for nearly all situations, and not just for Windows users. (I mostly work on Macs myself, so that’s a big driver too.)

After a lot of searching, reading, and testing I found OpenVPN founded by James Yonan. As the name suggests, OpenVPN is an open source product and is therefore free to use and distribute. OpenVPN is a so-called SSL VPN, using Secure Socket Layer (SSL) to to encrypt all traffic. SSL is the same security technology used on e-commerce websites and what banks use for Internet banking. Furthermore, OpenVPN is compatible with a large range of operating systems, including Windows, Mac, and Linux. It is also very scalable and is being actively used in large installations all over the world. Scalability of course depends on the horsepower of the computer hardware on which it is installed, but for a small company, a simple computer, which may otherwise not be fit for today’s computing needs, can be reused to handle many simultaneous VPN connections. That pretty much covers four out of my five requirements. So, what about simplicity? Well, to be quite honest, OpenVPN is not that simple for the average person with limited computing, networking, and security skills. But neither are the big “brand name” vendors’ solutions. Because it does meet all the other requirements, I believe it’s the best fit out there for small businesses.

For a small business that wants to significantly improve its computing environment, I think it’s affordable and worthwhile to hire a good network/security consultant to deploy a VPN. Once installed, OpenVPN is extremely easy to use and it work really well. Obviously, to resolve all the issues around backup, etc, mentioned above, simply installing a VPN won’t solve all that in one swoop, but it does go a long way towards creating a better environment for the “road warrior” and it does open up the doors to a nice and cost effective setup for centralized file storage, management, and backups.