OH7LZB VPN - Revision history

KI5QKX: mw push

2026-04-30T18:52:55Z

mw push

← Older revision		Revision as of 18:52, 30 April 2026
Line 173:		Line 173:
	To rephrase: When Tunnelblick says "A passphrase is required to connect to amprnet-vpn", the passphrase being asked is the one you picked when you first applied for a LoTW certificate. It's not something the VPN operator knows (or should know). Only you have ever been aware of that passphrase (hopefully).		To rephrase: When Tunnelblick says "A passphrase is required to connect to amprnet-vpn", the passphrase being asked is the one you picked when you first applied for a LoTW certificate. It's not something the VPN operator knows (or should know). Only you have ever been aware of that passphrase (hopefully).

			[[Category:How-To]]

	[[Category:Reference]][[Category:How-To Guides]]		[[Category:Reference]][[Category:How-To Guides]]
	[[Category:Participation Methods]]		[[Category:Participation Methods]]
	[[Category:VPN]]		[[Category:VPN]]

KI5QKX: mw push

2026-03-01T00:14:55Z

mw push

← Older revision		Revision as of 00:14, 1 March 2026
Line 176:		Line 176:

	[[Category:Reference]][[Category:How-To Guides]]		[[Category:Reference]][[Category:How-To Guides]]
			[[Category:Participation Methods]]
			[[Category:VPN]]

KI5QKX: mw push

2026-02-28T23:20:40Z

mw push

← Older revision		Revision as of 23:20, 28 February 2026
Line 126:		Line 126:
	# Connection should be established		# Connection should be established

	== Linux (Raspberry PI): OpenVPN ==		== Linux (Raspberry Pi): OpenVPN ==

	Log in to Raspberry Pi console. Install openvpn software.		Log in to Raspberry Pi console. Install openvpn software.

KI5QKX at 20:30, 12 December 2024

2024-12-12T20:30:39Z

← Older revision		Revision as of 20:30, 12 December 2024
Line 172:		Line 172:

	To rephrase: When Tunnelblick says "A passphrase is required to connect to amprnet-vpn", the passphrase being asked is the one you picked when you first applied for a LoTW certificate. It's not something the VPN operator knows (or should know). Only you have ever been aware of that passphrase (hopefully).		To rephrase: When Tunnelblick says "A passphrase is required to connect to amprnet-vpn", the passphrase being asked is the one you picked when you first applied for a LoTW certificate. It's not something the VPN operator knows (or should know). Only you have ever been aware of that passphrase (hopefully).



			[[Category:Reference]][[Category:How-To Guides]]

Cross: KC8QBA suggests bolding the sentence about the OH7LZB VPN being down.

2024-05-04T12:03:28Z

KC8QBA suggests bolding the sentence about the OH7LZB VPN being down.

← Older revision		Revision as of 12:03, 4 May 2024
Line 3:		Line 3:
	* [http://www.arrl.org/logbook-of-the-world ARRL Logbook of the World (LoTW)]		* [http://www.arrl.org/logbook-of-the-world ARRL Logbook of the World (LoTW)]

	As of May, 2024, the OH7LZB VPN appears to no longer be operational.		<b>As of May, 2024, the OH7LZB VPN appears to no longer be operational.</b>

	The Certificate Authority (CA) validates using a relatively strong method that the operator is actually licensed, and gives the operator a cryptographic certificate to prove that. Other services, such as this VPN can then check that the operator possesses a valid amateur radio operator certificate (and the accompanying private key), without any manual work being performed by the operators of those services. The operator can use his private key to sign LoTW log files, or any other information he wishes to communicate, and other parties trusting the CA can use the certificate to check that they have been transmitted by someone who has a private key and a certificate for a callsign from the CA.		The Certificate Authority (CA) validates using a relatively strong method that the operator is actually licensed, and gives the operator a cryptographic certificate to prove that. Other services, such as this VPN can then check that the operator possesses a valid amateur radio operator certificate (and the accompanying private key), without any manual work being performed by the operators of those services. The operator can use his private key to sign LoTW log files, or any other information he wishes to communicate, and other parties trusting the CA can use the certificate to check that they have been transmitted by someone who has a private key and a certificate for a callsign from the CA.

Cross: KC8QBA reports on the 44Net mailing list that the OH7LZB VPN is no longer working; mention that on the wiki page.

2024-05-03T17:14:08Z

KC8QBA reports on the 44Net mailing list that the OH7LZB VPN is no longer working; mention that on the wiki page.

← Older revision		Revision as of 17:14, 3 May 2024
Line 1:		Line 1:
	The OH7LZB VPN is an experimental method to access the IPIP Mesh using a VPN from anywhere on the Internet. The VPN is openly available to any amateur radio operators who ~~have~~ successfully applied for an X.509 certificate from one of the following Certificate Authorities:		The OH7LZB VPN was an experimental method to access the IPIP Mesh using a VPN from anywhere on the Internet. The VPN was openly available to any amateur radio operators who had successfully applied for an X.509 certificate from one of the following Certificate Authorities:

	* [http://www.arrl.org/logbook-of-the-world ARRL Logbook of the World (LoTW)]		* [http://www.arrl.org/logbook-of-the-world ARRL Logbook of the World (LoTW)]

			As of May, 2024, the OH7LZB VPN appears to no longer be operational.

	The Certificate Authority (CA) validates using a relatively strong method that the operator is actually licensed, and gives the operator a cryptographic certificate to prove that. Other services, such as this VPN can then check that the operator possesses a valid amateur radio operator certificate (and the accompanying private key), without any manual work being performed by the operators of those services. The operator can use his private key to sign LoTW log files, or any other information he wishes to communicate, and other parties trusting the CA can use the certificate to check that they have been transmitted by someone who has a private key and a certificate for a callsign from the CA.		The Certificate Authority (CA) validates using a relatively strong method that the operator is actually licensed, and gives the operator a cryptographic certificate to prove that. Other services, such as this VPN can then check that the operator possesses a valid amateur radio operator certificate (and the accompanying private key), without any manual work being performed by the operators of those services. The operator can use his private key to sign LoTW log files, or any other information he wishes to communicate, and other parties trusting the CA can use the certificate to check that they have been transmitted by someone who has a private key and a certificate for a callsign from the CA.

G1fef: G1fef moved page AMPRNet VPN to OH7LZB VPN

2023-09-17T17:48:35Z

G1fef moved page AMPRNet VPN to OH7LZB VPN

← Older revision	Revision as of 17:48, 17 September 2023
(No difference)

G1fef at 17:48, 17 September 2023

2023-09-17T17:48:06Z

← Older revision		Revision as of 17:48, 17 September 2023
Line 1:		Line 1:
	OH7LZB VPN is an experimental method to access the IPIP Mesh using a VPN from anywhere on the Internet. The VPN is openly available to any amateur radio operators who have successfully applied for an X.509 certificate from one of the following Certificate Authorities:		The OH7LZB VPN is an experimental method to access the IPIP Mesh using a VPN from anywhere on the Internet. The VPN is openly available to any amateur radio operators who have successfully applied for an X.509 certificate from one of the following Certificate Authorities:

	* [http://www.arrl.org/logbook-of-the-world ARRL Logbook of the World (LoTW)]		* [http://www.arrl.org/logbook-of-the-world ARRL Logbook of the World (LoTW)]

G1fef at 17:47, 17 September 2023

2023-09-17T17:47:52Z

W9OQI: /* Mac OS X: Tunnelblick */

2023-05-31T01:31:24Z

Mac OS X: Tunnelblick

← Older revision		Revision as of 01:31, 31 May 2023
Line 158:		Line 158:
	== Mac OS X: Tunnelblick ==		== Mac OS X: Tunnelblick ==

	# [~~http~~://~~code~~.~~google.com/p/tunnelblick~~/ Download Tunnelblick], it's free and open source, and works like a charm. It's based on OpenVPN.		# [https://tunnelblick.net/ Download Tunnelblick], it's free and open source, and works like a charm. It's based on OpenVPN.
	# [http://he.fi/amprnet-vpn/amprnet-vpn-tblk.zip Download the AMPRNet VPN configuration for Tunnelblick], it's a zip file containing a directory with a couple files		# [http://he.fi/amprnet-vpn/amprnet-vpn-tblk.zip Download the AMPRNet VPN configuration for Tunnelblick], it's a zip file containing a directory with a couple files
	# Double-click the downloaded zip file to extract it, you'll get a directory named '''amprnet-vpn.tblk'''		# Double-click the downloaded zip file to extract it, you'll get a directory named '''amprnet-vpn.tblk'''

← Older revision		Revision as of 17:47, 17 September 2023
Line 1:		Line 1:
	~~AMPRNet~~ VPN is an experimental method to access the ~~AMPRNet~~ using a VPN from anywhere on the Internet. The VPN is openly available to any amateur radio operators who have successfully applied for an X.509 certificate from one of the following Certificate Authorities:		OH7LZB VPN is an experimental method to access the IPIP Mesh using a VPN from anywhere on the Internet. The VPN is openly available to any amateur radio operators who have successfully applied for an X.509 certificate from one of the following Certificate Authorities:

	* [http://www.arrl.org/logbook-of-the-world ARRL Logbook of the World (LoTW)]		* [http://www.arrl.org/logbook-of-the-world ARRL Logbook of the World (LoTW)]

	The Certificate Authority (CA) validates using a relatively strong method that the operator is actually licensed, and gives the operator a cryptographic certificate to prove that. Other services, such as ~~the AMPRNet~~ VPN can then check that the operator possesses a valid amateur radio operator certificate (and the accompanying private key), without any manual work being performed by the operators of those services. The operator can use his private key to sign LoTW log files, or any other information he wishes to communicate, and other parties trusting the CA can use the certificate to check that they have been transmitted by someone who has a private key and a certificate for a callsign from the CA.		The Certificate Authority (CA) validates using a relatively strong method that the operator is actually licensed, and gives the operator a cryptographic certificate to prove that. Other services, such as this VPN can then check that the operator possesses a valid amateur radio operator certificate (and the accompanying private key), without any manual work being performed by the operators of those services. The operator can use his private key to sign LoTW log files, or any other information he wishes to communicate, and other parties trusting the CA can use the certificate to check that they have been transmitted by someone who has a private key and a certificate for a callsign from the CA.

	If and when other organisations start to give out X.509 certificates, after sufficient amateur radio license validation, the ~~AMPRNet~~ VPN will be configured to accept those in addition to the LoTW. If you're not willing to obtain a LoTW certificate, please set up a CA for your local club or association, document the method of license validation you're using, and I'll be happy to trust your certificates.		If and when other organisations start to give out X.509 certificates, after sufficient amateur radio license validation, the VPN will be configured to accept those in addition to the LoTW. If you're not willing to obtain a LoTW certificate, please set up a CA for your local club or association, document the method of license validation you're using, and I'll be happy to trust your certificates.

	The VPN operator (Hessu, OH7LZB) does not have time to run a CA and validate licenses manually, so please don't ask for a certificate from anywhere else than the CAs listed above. Thanks!		The VPN operator (Hessu, OH7LZB) does not have time to run a CA and validate licenses manually, so please don't ask for a certificate from anywhere else than the CAs listed above. Thanks!

	The ~~AMPRNet~~ VPN is only used to access the ~~AMPRNet~~. While you're connected to the ~~AMPRNet~~ VPN, the VPN client will only transmit packets from you to the ~~AMPRNet~~ via the VPN. Packets from you to the rest of the Internet will not go via the VPN - they'll flow out from your local network connection as before. This is called a [http://en.wikipedia.org/wiki/Split_tunneling split tunnel VPN configuration].		The VPN is only used to access the IPIP Mesh. While you're connected to the VPN, the VPN client will only transmit packets from you to the IPIP Mesh via the VPN. Packets from you to the rest of the Internet will not go via the VPN - they'll flow out from your local network connection as before. This is called a [http://en.wikipedia.org/wiki/Split_tunneling split tunnel VPN configuration].

	The setup is still a bit complicated - it can be made easier and more automatic with a little additional software in a later phase.		The setup is still a bit complicated - it can be made easier and more automatic with a little additional software in a later phase.

	The ~~AMPRNet~~ VPN is an experimental service. It might be shut down for technical or political reasons - we'll see if it's a feasible idea or not.		The VPN is an experimental service. It might be shut down for technical or political reasons - we'll see if it's a feasible idea or not.

	= Getting a certificate from LoTW =		= Getting a certificate from LoTW =

	Go through [https://lotw.arrl.org/lotw-help/getting-started/ these simple steps]. After step 4 you're ready to continue with the ~~AMPRNet~~ VPN.		Go through [https://lotw.arrl.org/lotw-help/getting-started/ these simple steps]. After step 4 you're ready to continue with the VPN.

	It's going to take some time to validate, and you'll have to do some manual work (especially if you're outside the USA), but that is intentional. It significantly reduces abuse of the system, and increases its security.		It's going to take some time to validate, and you'll have to do some manual work (especially if you're outside the USA), but that is intentional. It significantly reduces abuse of the system, and increases its security.
Line 74:		Line 74:
	Copy-paste that block to a separate file named '''client.key'''. If you're going to open up the original private key file in a text editor, it's a good idea to make a backup copy of that file first in case of an accidental corruption of its contents.		Copy-paste that block to a separate file named '''client.key'''. If you're going to open up the original private key file in a text editor, it's a good idea to make a backup copy of that file first in case of an accidental corruption of its contents.

	= Configuring ~~AMPRNet~~ VPN =		= Configuring the VPN =

	== Windows: OpenVPN ==		== Windows: OpenVPN ==
Line 95:		Line 95:
	=== Ubuntu 15.10 ===		=== Ubuntu 15.10 ===

	Here is steps to install ~~AMPRNet~~ VPN to Ubuntu 15.10 destop. Install OpenVPN plugin to network manager.		Here is steps to install the VPN to Ubuntu 15.10 destop. Install OpenVPN plugin to network manager.
	Open terminal and type		Open terminal and type

Line 159:		Line 159:

	# [https://tunnelblick.net/ Download Tunnelblick], it's free and open source, and works like a charm. It's based on OpenVPN.		# [https://tunnelblick.net/ Download Tunnelblick], it's free and open source, and works like a charm. It's based on OpenVPN.
	# [http://he.fi/amprnet-vpn/amprnet-vpn-tblk.zip Download the ~~AMPRNet~~ VPN configuration for Tunnelblick], it's a zip file containing a directory with a couple files		# [http://he.fi/amprnet-vpn/amprnet-vpn-tblk.zip Download the VPN configuration for Tunnelblick], it's a zip file containing a directory with a couple files
	# Double-click the downloaded zip file to extract it, you'll get a directory named '''amprnet-vpn.tblk'''		# Double-click the downloaded zip file to extract it, you'll get a directory named '''amprnet-vpn.tblk'''
	# Move the '''private key''' (in a file which was named '''client.key''' in the previous step) to that directory		# Move the '''private key''' (in a file which was named '''client.key''' in the previous step) to that directory