Servizi > Calcolo e Reti > Information (EN) > VPN (EN)

VPN (EN)

Italian instructions may be found here.

 

There are several VPN (Virtual Private Network) available to connect to our local network. Depending on which server is in use you can either authenticate with your LDAP credentials (same user & password used for email/cerbero) or with your personal X.509 certificate, issued by Sectigo/Harica. These are the OpenVPN server:

  • sansone.mib.infn.it
    • Either LDAP or X.509 auth
  • seven.mib.infn.it
    • X.509 auth only
  • sette.mib.infn.it
    • LDAP auth only

Warning: it's impossible to use sansone.mib.infn.it with LDAP credentials from certain networks (e.g. unimib, eduroam). This configuration uses the non-standard port 1195/UDP, blocked on some networks. All other server/auth combinations may be used on said networks.

On this page you'll be able to download .ovpn configuration files for every VPN server. Some of them require the presence of additional files and/or slight edits to the configuration: all configurations with X.509 auth require that your personal certificate file, in the pkcs12 format (.p12 extension), be present in the same folder as the .ovpn file. You will also have to modify the .ovpn file itself, changing the line "pkcs12 cert.p12" and putting the name of your personal certificate file instead of "cert.p12".

These changes aren't necessary on Linux, as the personal certificate must be manually inserted during configuration.

Here you can find the .ovpn configuration files:

 

Here you can find instructions to use the .ovpn configuration files on various operating systems:

 

Alternative Configuration (separate CA file)

The provided .ovpn files contain the intermediate certificate of the Certification Authority (CA, Harica) inside them, hence the name 'unified': with the exception of your personal certificate for X.509 configurations, no additional files are required to setup a VPN connection.
Here you can find .ovpn files that do not contain the CA certificate, but that require its presence anyway in a separate file. These are completely equivalent to their unified version and there's no reason to setup both at the same time: non-unified configurations are just simpler to update if INFN were to change its Certification Authority in the future.
 
All the following configurations require the presence of Harica_intermediate.crt in the same folder as the .ovpn file. This is nor required on Linux, as the CA certificate has to be loaded manually during configuration.
 

 

 

 

 

     last updated on: 27.03.2025, 09:47 by: Stefano Pozzi
    Servizi