I am not using network-manager in the following examples. And honestly network-manager only makes life easier on a laptop, or desktop when operating wirelessly.

Make sure your network interface is set to dhcp, as network-manager is installed by default the relevant line may be commented out (also if your not using it, purge network-manager from your system). The relevant entries from my /etc/network/interfaces:


# The primary network interface
auto eth0
iface eth0 inet dhcp


Add an script in /etc/dhcp3/dhclient-exit-hooks.d. It should check if GDM is running, as after it has started up you should not change the hostname. My script read as follows:
/etc/dhcp3/dhclient-exit-hooks.d/set_hostname

# If you want to enable this script, change SETHOSTNAME to "yes"

SETHOSTNAME="yes"

if [ "$SETHOSTNAME" = "yes" ]; then
	if test -r /var/run/gdm.pid && ps -ef | grep $(cat /var/run/gdm.pid) | g
rep -q /usr/sbin/gdm ; then
	echo "$(date): GDM running, not changing host name"
	else
		hostname $new_host_name;
	fi
fi

That should be it. Though you may need to remove some incorrect entries from /etc/hosts, and remove /etc/hostname if the file contents are wrong.

It has very good iPhone integration too. What it is still lacking is some of the utilities to make tethering easy. For USB tethering you can you can use Diego Giagio’s ipheth driver. I haven’t yet found a PPA for lucid, so you will need to compile from source.

For Bluetooth Tethering, Ubuntu comes with a nice new version of blueman, but it does not have the tight integration with network-manager.

To install blueman:
# apt-get install blueman

Pair your 2 devices. Pairing between blueman and the iphone generally works (even when it says it failed).

The trick to getting the network tether to work everytime is by starting the connection from your iphone. Once bluetooth is connected you can then right-click on you phone in blueman and access the network-point.

Because blueman and network-manager are not integrated you need one final commnand:

# dhcliet bnep0

Network Manager

The easiest openvpn client is network-manager. If you are using Ubuntu run:

# aptitude install network-manager-openvpn
# restart network-manager

• Now click on the network-manager applet, select configure VPN, and setup a new open-vpn connection.
• Set the gateway to you server
• Set the type to Password
• Point your CA to a copy of your server’s ca.crt and everything should just work

Everything Else

Linux, Windows and OSX all have ports of OpenVPN, and I have setup the client on each of them. Unless you want to pay for Viscosity on the mac, the chances are you will need a client configuration file.

Attached is a simple client configuration file that will work. Edit it to match your server’s settings where appropriate. You will need this and your ca.crt in the same directory. On Windows the file extenion is “.ovpn”. On linux my file is called /etc/openvpn/client.conf

##############################################
# Sample client-side OpenVPN 2.0 config file.
# for connecting to multi-client server.
##############################################

# Specify that we are a client and that we
# will be pulling certain config file directives
# from the server.
client

dev tun
proto udp

# The hostname/IP and port of the server.
remote my-server-2.domain 1194

# host name of the OpenVPN server.  Very useful
# on machines which are not permanently connected
# to the internet such as laptops.
resolv-retry infinite

# Most clients don't need to bind to
# a specific local port number.
nobind

# Try to preserve some state across restarts.
persist-key
persist-tun

# Certificate Authority
ca ca.crt

# Username/Password authentication is used on the server
auth-user-pass

# Verify server certificate by checking
# that the certicate has the nsCertType
# field set to "server".  This is an
# important precaution to protect against
# a potential attack discussed here:
#  http://openvpn.net/howto.html#mitm
#
# To use this feature, you will need to generate
# your server certificates with the nsCertType
# field set to "server".  The build-key-server
# script in the easy-rsa folder will do this.
ns-cert-type server

# Set log file verbosity.
verb 3

On linux to start the openvpn client simply type:
# openvpn -config /etc/openvpn/client.conf

To manage the connection on Windows I would suggest using OpenVPN GUI. And either tunnelblick, or Viscosity (non-free) on OSX.

Setup IP Forwarding/Masquerading/Firewall

To turn on IP Forwarding:
# echo 1 > /proc/sys/net/ipv4/ip_forward

Set the change permanantly in /etc/sysctl.conf by uncommenting the line:
net.ipv4.ip_forward=1

To turn on IP Masquerading add the following IP Tables rule:

# iptables --table nat --append POSTROUTING \
--out-interface eth0 --jump MASQUERADE

Firewall
If you are running a firewall, and I strongly recommend you do on a public facing box you need to allow UDP on port 1194 into you box.
# iptables -A INPUT -udp -m udp --dport 1194 -j ACCEPT

But these rules need be persistant so we need to create a script to run when the interface starts up

# iptables-save > /etc/iptables.conf

Create a new file: /etc/network/if-up.d/iptables and paste in the following:

#!/bin/sh
/sbin/iptables-restore < /etc/iptables.conf

Set it to executable:
# chmod 755 /etc/network/if-up.d/iptables

Now when networking starts the firewall is brought up. If all you have done is what is above, your box is not really firewalled, as no traffic is dropped or blocked. For a basic firewall the following config, forwards everything, allows bind internally and only allows SSH and OpenVPN on the external interface.

/etc/iptables.conf (example):

#
*nat
:PREROUTING ACCEPT [36:18250]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [12:806]
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT
#
*filter
:INPUT ACCEPT [19:1037]
:FORWARD ACCEPT [420:191307]
:OUTPUT ACCEPT [314:39042]
# Allow everything on loopback
-A INPUT -i lo -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
# Allow already established connections
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
# Allow SSH
-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -j ACCEPT
# Allow DNS to this machine fron the private network
# (If you plan to run you own DNS, I run dns_masq)
-A INPUT -p tcp --dport 53 -s 10.8.0.0/16 -j ACCEPT
# Allow OpenVPN
-A INPUT -p udp -m udp --dport 1194 -j ACCEPT
# DROP the rest
-A INPUT -i eth0 -j DROP
COMMIT
#

Setup Open VPN

Installation

Install OpenVPN:

# aptitude install openvpn openssl


Edit /etc/default/openvpn. Comment all lines, and add:

AUTOSTART="openvpn"

Create Certificates and Keys

On you server as root:

# cd /etc/openvpn

Copy the the following directory

# cp -r /usr/share/doc/openvpn/examples/easy-rsa .
# cd easy-rsa/2.0/

Edit the file “vars”. Change the default values at the bottom of the file to match your details.

Import you ssl settings:
# . ./vars

run: # ./cleann-all. Do not run this every time as it will remove all existing certificates.

Create your Certificate Authority

# ./build-ca

Give it a sensible common-name, something like: “OpenVPN CA”

Now build the key and certificate for you server

# ./build-key-server server

Set the common name to “server”

Answer yes to signing the certificate and commiting it.

Now let’s create Diffie Hellman parameters:

# ./build-dh

Most other guides now get you to generate client certs, but we are using  username and password authentication so we do not need to do this.

Configure OpenVPN

Edit the file /etc/openvpn/openvpn.conf and add the following (the comments are unnecessary they are just there for explanation):

    dev tun
    ## udp is recommended, avoid TCP over TCP
    proto udp
    ## any port will do, this is the standard
    port 1194 

    ## certs we created earlier
    ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
    cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
    key /etc/openvpn/easy-rsa/2.0/keys/server.key
    dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem

    user nobody
    group nogroup
    ## You can make this any private subnet you like
    server 10.8.0.0 255.255.255.0

    persist-key
    persist-tun

    #status openvpn-status.log
    #verb 3
    client-to-client

    ## make this connection the default gateway for network traffic
    push "redirect-gateway def1"
    ## I am running dns_masq, you may want to put your server's DNS here
    ## or even google: 8.8.8.8
    push "dhcp-option DNS 10.8.0.1"

    log-append /var/log/openvpn

    ## User authentication settings. Usernames must be able to authenticate with PAM
    ## To use radius or another auth mechanism create /etc/pam.d/openvpn
    ## by default it is doing common-auth (a user must have a local accout and pasword)
    plugin /usr/lib/openvpn/openvpn-auth-pam.so login
    client-cert-not-required
    username-as-common-name

    ## A management interface allows you to telnet from local host to use
    ## telnet localhost 7505
    management localhost 7505

Restart OpenVPN: # /etc/init.d/openvpn restart

So this is the server done. We haven’t configured anything to connect to it yet.
Client how-to comming up next time.

Update. Client how-to is available

I will get around to writing a full howto in the next week or so.

The OS is nice, I upgraded to the OpenEclair ROM to give 2.1 a try. It was way to slow on the Magic but it gave me an appreciation for where google is going, and I would love a Nexus One. I also tried rolling my own android ROM and it was surprisingly easy.

I installed the Cyanogen ROM. It was nice. Fast and Stable. My problem is simple. The Magic has a fairly small screen and the default Android fonts are tiny. I can’t use it. After 5 minutes, my eyes hurt and I can no longer focus them. My eyes are crap, but I have no problem using the iPhone. So for the moment I am sticking with my iPhone. When the Nexus One finally makes it to Australia, I will get one I think.

For an easy to install Ubuntu package use this PPA, from pmcenery.

https://wiki.ubuntu.com/HardwareSupport/Machines/Netbooks#Karmic

Thing is, the driver packges needed by the Broadcom Wireless card are on the Install Media, they are just not included in the default install set. So a couple of commands during the install process and you can have wireless working on first boot.

Install Ubuntu. After install, before you hit restart press: ctrl+alt+F1

At the terminal prompt:

$ sudo su -
# chroot /target
# aptitude install bcmwl-kernel-sources

Now press ctrl+alt+F7 and click Reboot. You should now have wireless on first boot.

But I just found DavMail, and it appears to work great. It is basically a java program that connects to an Outlook OWA (up tp 2007) and presents the information through standard services IMAP/SMTP/CalDAV. So I can now use Sunbird as my Calendar client, pointing it to a CalDAV server running on localhost,  and it seems to work a treat. Installation is straightforward on most platforms and after a bit of fidlling with the settings it is up and running.