View source for Setup VPN with SafeSquid Web Security Client


== Overview ==

SafeSquid web security client enables remote users to connect to private computer networks to gain access to their data in a secure way. The users gets authenticated from your LDAP server with IP assigned by the SafeSquid VPN server. For example, an employee traveling or working from home can use SafeSquid web security client to securely access the office network through the Internet. Instead of remotely logging on to a private network using an unencrypted and unsecure Internet connection, the use of a safesquid web security client ensures that unauthorized parties cannot access the office network and cannot intercept any of the information that is exchanged between the employee and the office network. &nbsp;When client requests a webpage then request comes to the web security client installed in client machine without setting proxy settings in the browser.

&nbsp;

== Prerequisites ==

*Go to SafeSquid Subscription server [https://key.safesquid.com/ https://key.safesquid.com/] 
*Generate Activation key, download and save it. 
*[[Setting_up_SSL_certificates_from_Self_Service_Portal|Manage SSL Trusted Root Certificate Authority]] 
*Deploy SafeSquid - [[Getting_Started|Getting Started]]&nbsp; 
*Once installation get completed access SafeSquid Web Interface using [http://safesquid.cfg/ http://safesquid.cfg/] 
*[http://2017.swg.safesquid.com/wiki/Getting_Started#Activate_your_Product <span class="toctext">Activate your Product</span>] 


== Server Side Configuration ==

*[[Configure_HTTPS_Inspection|Enable HTTPS inspection on SafeSquid Interface]]&nbsp; 
**'''Note&nbsp;: '''No need to download and import your SSL certificate into Chrome or IE, in HTTPS configuration because it will import automatically.   
*[http://2017.swg.safesquid.com/wiki/Integrate_Active_Directory_For_Simple_Authentication Integrate your LDAP server with SafeSquid]&nbsp;for [http://2017.swg.safesquid.com/wiki/Enable_authentication_for_LDAP_users LDAP authentication]. 
*Integrate your PAM service for PAM authentication in case you don't have Active Directory for LDAP configuration. Add PAM user and set password. 
*[[Manage_VPN_settings|Manage VPN settings]] 
*Download VPN binary [http://downloads.safesquid.net/VPN/safesquid_vpn_latest.tar.gz http://downloads.safesquid.net/VPN/safesquid_vpn_latest.tar.gz] and [[How_To_Upgrade_SafeSquid_To_A_Newer_Version|upgrade from]] the interface 
*Start openvpn service using following command 

{| width="320" cellspacing="1" cellpadding="1" border="0"
|-
| style="width: 207px" | <div style="background:#eee;  border:1px solid #ccc;  padding:5px 10px">'''&nbsp;&nbsp; /etc/init.d/openvpn start'''</div> 
|}

*Verify openvpn service status using following command 

{| width="326" cellspacing="1" cellpadding="1" border="0"
|-
| style="width: 207px" | <div style="background:#eee;  border:1px solid #ccc;  padding:5px 10px">'''&nbsp;&nbsp; /etc/init.d/openvpn status'''</div> 
|}

*[http://2017.swg.safesquid.com/wiki/Enable_captive_portal_port_on_SafeSquid Enable captive portal port on SafeSquid&nbsp;]&nbsp;&nbsp; 
*[http://2017.swg.safesquid.com/wiki/Restart_the_SafeSquid_Service_from_Interface Restart SafeSquid service] 
*Verify redirection policies using following command (On Linux Box)&nbsp; 

{| style="width: 250px" cellspacing="1" cellpadding="1" border="0"
|-
| style="width: 207px" | <div style="background:#eee;  border:1px solid #ccc;  padding:5px 10px">'''iptables -L -v -n -t nat'''</div> 
|}

*&nbsp;If redirection policies are not found then follow [http://2017.swg.safesquid.com/wiki/Redirecting_Rules_For_SafeSquid_Captive_Portal SafeSquid Sever]&nbsp; 
*&nbsp;If redirection policies found follow steps '''<u>Enable forwarding in /etc/sysctl.conf</u> '''and'''&nbsp;'''<u>'''Reload settings'''</u>&nbsp; from [http://2017.swg.safesquid.com/wiki/Redirecting_Rules_For_SafeSquid_Captive_Portal SafeSquid Sever]&nbsp; 

&nbsp;

&nbsp;

== Client side configuration ==

*Add FQDN of proxy server in your hosts file of the system where you are running the installer at given path 
**'''Path:'''C:\Windows\System32\drivers\etc   

<u>'''Note''':</u> If your OPEN VPN server is setup on public IP address <span class="mw-headline" id="Set_URL.28FQDN_of_SafeSquid_Server.29">, and your set URL(FQDN of SafeSquid Server) is resolved then no need to do above step.</span>

&nbsp;

{| style="width: 500px" cellspacing="1" cellpadding="1" border="1"
|-
| 
Copyright (c) 1993-2009 Microsoft Corp.<br/> #<br/> # This is a sample HOSTS file used by Microsoft TCP/IP for Windows.<br/> #<br/> # This file contains the mappings of IP addresses to host names. Each<br/> # entry should be kept on an individual line. The IP address should<br/> # be placed in the first column followed by the corresponding host name.<br/> # The IP address and the host name should be separated by at least one<br/> # space.<br/> #<br/> # Additionally, comments (such as these) may be inserted on individual<br/> # lines or following the machine name denoted by a '#' symbol.<br/> #<br/> # For example:<br/> #<br/> #&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 102.54.94.97&nbsp;&nbsp;&nbsp;&nbsp; rhino.acme.com&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; # source server<br/> #&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 38.25.63.10&nbsp;&nbsp;&nbsp;&nbsp; x.acme.com&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; # x client host

localhost name resolution is handled within DNS itself.<br/> #&nbsp;&nbsp; &nbsp;127.0.0.1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; localhost<br/> #&nbsp;&nbsp; &nbsp;::1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; localhost<br/> 192.168.221.222&nbsp;&nbsp;&nbsp; sabproxy.safesquid.test&nbsp;&nbsp; sabproxy

|}

*Remove proxy setting from (IE and Chrome) browser before installing websecurity client. 
*Download web security client [http://downloads.safesquid.net/VPN/websecurity.exe http://downloads.safesquid.net/VPN/websecurity.exe] 
*[[Installation_Of_Web_Security_Client|Install web security client]] 

== Testing ==

*Go to SafeSquid server and run the below commands: 

{| width="578" cellspacing="1" cellpadding="1" border="0"
|-
| style="width: 207px" | <div style="background:#eee;  border:1px solid #ccc;  padding:5px 10px">'''&nbsp;&nbsp; <code>pidof openvpn</code> &nbsp;'''&nbsp;&nbsp;&nbsp;&nbsp;(or) &nbsp; &nbsp;'''&nbsp;<code>netstat -tulnp &#124; grep "openvpn"</code>'''</div> 
|}

{| style="width: 100%" cellspacing="1" cellpadding="1" border="0"
|-
| [[File:VPNSlide1 (2).PNG|border|left|VPNSlide1 (2).PNG|link=]]
|}

*Check openvpn logs by using below command 

&nbsp;

{| style="width: 500px" cellspacing="1" cellpadding="1" border="0"
|-
| <code>&nbsp; '''tail -F /etc/openvpn/openvpn.log'''</code>
|}

&nbsp;

{| style="width: 524px" cellspacing="1" cellpadding="1" border="1"
|-
| style="width: 514px" | 
root@sabproxy:~# tail -f /etc/openvpn/openvpn.log

&nbsp;&nbsp;&nbsp; Mon Dec 26 19:20:10 2016 UID set to nobody<br/> &nbsp;&nbsp; &nbsp;Mon Dec 26 19:20:10 2016 UDPv4 link local (bound): [undef]<br/> &nbsp;&nbsp; &nbsp;Mon Dec 26 19:20:10 2016 UDPv4 link remote: [undef]<br/> &nbsp;&nbsp; &nbsp;Mon Dec 26 19:20:10 2016 MULTI: multi_init called, r=256 v=256<br/> &nbsp;&nbsp; &nbsp;Mon Dec 26 19:20:10 2016 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0<br/> &nbsp;&nbsp; &nbsp;Mon Dec 26 19:20:10 2016 ifconfig_pool_read(), in='gangadhar,10.8.0.4', TODO: IPv6<br/> &nbsp;&nbsp; &nbsp;Mon Dec 26 19:20:10 2016 succeeded -> ifconfig_pool_set()<br/> &nbsp;&nbsp; &nbsp;Mon Dec 26 19:20:10 2016 IFCONFIG POOL LIST<br/> &nbsp;&nbsp; &nbsp;Mon Dec 26 19:20:10 2016 Initialization Sequence Completed

|}

*Check your WebSecurity Service status from Windows Service Manager. 
<ol style="margin-left: 40px;">
<li>If it stopped then check your "C:\ProgramData\websecurity\config\" directory.</li>
<li>You must see two files client '''.sovpn '''and&nbsp; '''ca'''</li>
</ol>

*Check the safesquid certificate in IE and chrome browser. By default websecurity client installs certificates in IE and chrome. 
*Import the certificate in Firefox using the steps shown in the installation document WebSecurity installation guide downloaded above. 
<ol style="margin-left: 40px;">
<li>Once the installation is successful, open your browser and start surfing.</li>
<li>Your traffic should flow through SafeSquid.</li>
<li>Verify SafeSquid logs to ensure traffic flow.</li>
</ol>

{{Seo|keywords=vpn,secure private network,remote users,secure web gateway,control remote users|description=Secure your private network from unauthorized access and enable remote users to connect and use your private network securely via Internet using Secure Web Gateway for VPN}}

[[Category:How To]]