FIT VPN

What is VPN FIT good for?

VPN FIT may be used for several purposes:

provide direct encrypted channel to local FIT network (very useful when public unencrypted WiFi is used),
provide access to Windows server (Fik and Aja, file services are blocked at faculty firewall for security reasons),
provide IPv6 connectivity for users who can get either no IPv6 or just over unreliable IPv6 tunnel.

IPv4 uses private addresses of 100.65.80.0/20 range. Traffic is routed to networks 147.229.8.0/23, 147.229.12.0/23, 147.229.15.128/25 and 147.229.176.0/24 only and some other networks of BUT infrastructure (may be subject to change). IPv6 uses addresses from public subnet 2001:67c:1220:a14::/64 and traffic is routed to all global addresses of 2000::/3 range (i.e. VPN provides access to all IPv6 addresses world wide).

Remeber to use FITlogin and FITpassword to connect to VPN FIT

Windows configuration

Download installation package from https://openvpn.net/ (community downloads) and change nothing during installation.
Or you can use https://openvpn.net/client/ instalation package which is avalable for more systems including OSX on Apple Silicon.
Start the OpenVPN GUI (by default it starts automatically after login).
Right-click the icon in the notification area and select Import from Access Server.
If you check Autologin, the VPN will also be the default gateway - suitable for services that are only available from the BUT network.
To use OpenVPN Connect, follow the instructions for Android below.
Right-click again and select Connect. Enter the login name and password, you may check to remember the values.
If the connection is established (the icon in systray is green) you may check your connection by listing routing table, running tracert/traceroute kazi.fit.vutbr.cz (should go through 100.65.8x.yy), tracert6/tracert -6/traceroute6 ipv6.google.com or open Web Fit (right on the bottom should be an address 2001:67c:1220:a14::xx:yy).

Linux configuration

Verified in Ubuntu, Debian and Fedora distributions. So it really should work! However there is no OpenVPN Connect client for Linux so the configuration is a bit more complicated.

Install current openvpn package (Ubuntu/Debian: sudo apt install openvpn)
Download configuration file https://vpn.fit.vutbr.cz/FIT.ovpn
```
wget https://vpn.fit.vutbr.cz/FIT.ovpn
```
Open Connection manager. Add VPN, type OpenVPN. At the bootom of menu is button for import configuration file.
Import previously downloaded FIT.ovpn and you are ready to go.

Android configuration

Go to Google Play and install a client - OpenVPN Connect and run the application
In the Import Profile section in the VIA URL tab, add vpn.fit.vutbr.cz
In the next step, enter the login, password and possibly check "Import autologin profile" - then the VPN will work as the default gateway.

To use this you may need file manager which can access files over network, e.g. ES File Explorer.

iOS/iPadOS

Use AppStore to install OpenVPN Connect client
Follow description for Android

Configuration in OSX

Download the current OpenVPN Connect V3 installation package from https:// openvpn.net/client-connect-vpn-for-mac-os/ and install.
Follow description for Android

FAQ

What is VPN (OpenVPN)?: See Open Virtual Private Network
Can I use OpenVPN over NAT/CGNAT?: Yes if the gateway does not block UPD traffic.
Why there is a TUN driver in configuration file while there is a TAP driver in Windows?: OpenVPN for Windows uses TAP driver (ethernet bridge) in TUN emulation mode. Server runs in point-to-multipoint TUN mode.
Can I use VPN FIT to access web pages limited to IPv4 addresses of BUT?: Yes, you need to check Autologin checkbox when importing configuration.
I can't connect to Samba/CIFS (\\kazi, \\eva, \\fik, \\aja), I don't see Windows servers of FIT in Network Neighborhood: Try to use fully qualified domain names (FQDN) - \\aja.fit.vutbr.cz, \\eva.fit.vutbr.cz etc.

Back to guides

Any comments to this page should be sent to michal@fit.vut.cz