A Little More September...

 the artists in action :) i love that they both love to color. flint is by far the youngest art-lover in the family. neither cole nor brookie liked to color at his age, but he seems to enjoy it. :) love these kiddos!

flint's real passion is putting the lid back on anything. this seems to be a favorite! :) admittedly, the cork is pretty interesting. :)

Coleman's SIX

Wow! Where has the time gone? It for sure has flown by! It seems like you were just a little guy and now I look at you - you're tall and thin and responsible. You are fun to talk to. You're smart and funny. You make my heart happy. You are kind and loving toward others. You are obedient and gentle. You're a good friend. You have grown so much and we are so proud of the amazing young man you are becoming! We love you so much!

Here's a little about you:

You like to play. You can keep yourself busy doing about anything. You love to play Legos! You also build with Trios and Zoobs. You like to play make believe games and dress up like superheroes and real life heroes. :) You love to play with friends. You love to jump off of stuff and climb on stuff. You are quite brave and loud. :) You are starting to enjoy drawing and writing. I love the pictures you make. My favorite one is the one you drew of you and Dad. :)

Every morning you get up and get ready for the day all by yourself.  Sometimes you come in and cuddle me in bed and sometimes you set off to play with toys. You're happy every morning and you're always ready to get going with your day. :) Your life is exciting and it makes me happy to watch you grow and learn and do all the things that boys do. :)

You are a bit of a picky eater. You prefer foods that are plain like grilled chicken, steamed veggies (or raw), & BBQed steak. You don't like sauce, but we've found that sweet and sour (you call it sour sweet sauce) is ok and sometimes you like to dip your chicken in honey... You like PB&J, nutella sandwiches, turkey and bread sandwiches & plain baked potatoes (sometimes you like butter on the skins). You'll eat almost any vegetable (as long as it doesn't have sauce on it) and every fruit you've ever tried. You are a healthy eater and we're proud of you. We've recently started requiring you to eat casseroles (you'll thank me later) and dishes with sauce and you don't love it, but you do it and you're still alive, so I guess it's going ok. :)

You started Kindergarten this year and love school. You love your teacher and your friends and you love recess. You ride the bus home and I love to pick you up every day - especially because when I ask how your day was, you always say "GREAT!" You are so positive and full of energy! Everyone loves being around you. Your teachers have commented to me about how smart you are. They say they just love to listen to you talk, and I agree. I do too. :) You are also learning a lot of fun new things and showing us at home. You even like to do your homework (most of the time). You're getting really good at writing and you love counting to 100. You are a good reader when you give yourself a chance. :)You're learning so much and we're so proud of you!

You are also enjoying Primary and are learning a lot at church. You have lots of fun buddies in your class and you're learning a lot there. You are very good at memorizing and have memorized lots of the Articles of Faith. :) You also like to sing. You are a good singer and love the primary songs. Your favorite song is still "I Am A Child of God." I loved it when your bore your testimony about how Heavenly Father answered your prayer and helped you find your airplane.

Coleman Lee! We love you so much! You make life exciting and fun for everyone around you! You are a good example to your brother and sister and to your parents. You are a special member of our family and we adore you! :) Thanks for the hugs and the smiles and the uncontrollable laughter. We enjoy you every minute! xoxoxo

September 2013

Playing with good friend, Milo :)

In hopes that it will soon (or even eventually) feel like fall, we made caramel dipping sauce for our apples. Yummy recipe! I posted it here: http://www.saltboxhousecreations.com/2013/09/honey-caramel-sauce.html

Brookie, Cole and Tyler worked hard to sand down our bathroom stools so we can repaint them to match each other. :)

Big F enjoyed watching and playing around outside too.

...did we mention he LOVES remotes?

I asked Coleman if he felt bigger and stronger because he's 6 now. This is the response I got. :)

She plays so hard. :) A little cat nap will do the trick to rejuvinate and get her back in the game! :)

Our big 6 year old! :) He still loves to dress up! They've been learning about community helpers at school this month, so why not be a firefighter? :)

Flint and I are still getting used to the big kids being at school. Sometimes we stay home too much and things get a little boring. We decided we'd better call some friends and go to the park. :) We had a blast! Thanks Emily and Wright! :)

Enjoying the sun and the water!

Wright. :) What a cutie!

He even tried the big slide. :) This guy has no fear! He's growing up so fast!

World's greatest dad! :)

Legos for the birthday boy! We didn't get many pictures of him on his birthday. We were having too much fun I guess. :) This is the first present he opened. He was over the moon about it. I love that he's so easy to please! What a joyful boy we are blessed to have! We love you big 6 year old!

We had Cole's birthday cake the day after his birthday. We ran out of time to do all the fun things we had planned. :) He even wore the hat he got at school for his birthday! :)

Coleman is very good at sharing. He had an early day at school and when we got home he found this cool package from Uncle Scott, Aunt Leanne, Addie and Eden on the porch. He was so excited! He got his other switch and go dino out too so he and Flint could both play. What a sweetie! :) Thanks fun cousins for the birthday surprise!

Connecting to my home network securely with OpenVPN

I know you've all been anxiously awaiting another blog post about my nerdy projects. If I recall correctly I haven't posted anything since the RaspBMC post. You are in luck because today you get another nerdy post from me

Project Inspiration:
Seems like with rare exception I spend most of my time somewhere that has wireless internet access. This is one major reason I still have a "dumb" phone and don't pay for data service. Unfortunately, the problem with using free Wifi is you don't know who else is using it and potentially watching your activity. For the last several years I've always had some type of iOS device with me in the at work all the time. I know many people disregard this issue and just use the free wifi to do whatever they would do normally. I'm a little paranoid so because of the security issue I mentioned I've never checked my e-mail or even used it to connect to any online accounts unless I'm at home connected to my own secure wireless network.

Realizing that I will be spending the rest of my working life in an operating room, where I may or may not have cellular service, but will likely have wifi. I decided it was time to have a secure way to connect to the internet through the hospital wifi and also a secure means of connecting to my server at home.

Although there are different ways to do this I chose to create a virtual private network or VPN. I know corporations use them to create secure connections between offices. Hospitals use them to allow physicians to connect to the electronic medical record over the internet.

Equipment and software:  
I'm cheap (Remember I don't have a smart phone because I don't want to pay for the data service.). I'm sure I cold have paid someone to set this all up for me, or used some integrated software solution but I don't like to pay for things I don't have to and I like to figure things out myself.  To complete this project I used all free and/or open-source services

1. Server
This was an easy choice. Although I could have used the computer that is functioning as my file server as a VPN server also, that would mean that it would have to be on all the time. Right now it is setup to go to sleep every 45 minutes until someone tries to access files. I installed DD-WRT on my router several months ago. I have a version of DD-WRT which can function as a VPN server. Since my router is on all the time anyway and uses much less power than my computer, this seemed the logical choice.

2. VPN protocol
DD-WRT has PPTP and OpenVPN built in as well as IPSec, L2TP, and PPTP passthrough capabilities. We're already established that I'm paranoid and want the best security I can get so I went with OpenVPN. Plus, it is open source and free.

The Setup:

1. Download OpenVPN - from here and install

2. Use OpenVPN to create certificates - How to outline from openvpn.com

Essentially, I ran cmd.exe as an administrator under windows.
Once running I executed the following commands:
  cd C:\Program Files\OpenVPN\easy-rsa
  init-config
Now I edited the vars.bat file using Notepad++ to set my country, state, city, and e-mail. I then continued with the following commands
  vars
  clean-all
  build-ca (You must define a common name during this process)
After this is complete I built the keys for my server and on client
  build-key server server
  build-key client1 (This step can be repeated to create more client certificates)
I then generated the Diffie-Hellman parameters
  build-dh

All of the keys and certificates I just created were saved in C:\Program Files\OpenVPN\easy-rsa\keys
We will access these later to copy these to the appropriate areas.

3. Setup a dynamic DNS.

I need a way for to locate my OpenVPN server on the world wide web. Because I don't pay for a static IP address, which is the case for most residential customers, my IP address changes periodically. There are several dynamic DNS services which circumvent the problem of the changing IP address by associating you IP address with a domain and then changing that association when your IP address changed by your ISP.  I chose no-ip.com

DD-WRT has the ability to connect to and update no-ip.com so I don't need to install the no-ip.com windows client.

Here's the setup in DD-WRT

4. DD-WRT OpenVPN configuration

In addition to generating keys and certificates with OpenVPN you need server and client configuration files. The DD-WRT web GUI will create most of the server configuration file automatically. You can then provided additional configuration in the box labeled as such.

Here is the setup I used

I chose a Router (TUN) configuration because I wanted to be able to connect using my iPad and the OpenVPN application for iOS does not support TAP interfaces

I have this working with the default port 1194. What I don't yet know is whether the hospital will block that port and prevent my connection. I may have to change it later to something that won't be blocked like 443.

I may change the Hash Algorithm to something more secure than SHA1 but didn't for the initial setup. Also for security I may adopt a TLS cipher later.

Although "Redirect default Gateway" is disabled, I enabled it again in the additional config. I had it disabled for testing and because I wasn't sure which commands that would add to the server configuration file created by the GUI.

The contents of the appropriate certificates and keys are pasted from the C:\Program Files\OpenVPN\easy-rsa\keys folder at this point.
server.crt is pasted in entirety in "Public Server Cert" box
ca.crt is pasted from begin to end certificate in the "CA Cert" box
server.key  is pasted from begin to end certificate in the "Private Serve Key" box
dh.pem is pasted from begin DH parameters to end in the DH PEM" box.

Since the config file is mostly created by GUI above you just add additional parameters below.
  push "route 192.168.8.0 255.255.255.0" - haven't tested if this is necessary as it may already be in the config file created by the GUI. The goal is to get the VPN network at 10.8.0.0/24 to connect to my LAN at 192.168.8.0/24.

As you can see the push "route-gateway 192.168.8.1" is commented out. This is because the GUI creates a push "route-gateway 10.8.0.1" command and I found I didn't need it.

Since I wanted to direct all my internet traffic through the VPN tunnel I included the line push "redirect-gateway def1." Unfortunately, this created a few problems. I discovered that the VPN connection was working but would not allow me to access the internet from my client when this line was included. This was resolved with 2 things. First, I had to provide a DNS server. It was not sufficient to provide the IP address of my router to then connect to a DNS server. I had to provide my Comcast DNS server IP address. I provided 2 just in case one stops working. Second, I let the router know what to do with the internet traffic sent over the VPN.  I was able to find an iptables firewall command in the OpenVPN how to which NATs the traffic to the internet. This was then modified based on some DD-WRT form posts to work with DD-WRT as follows

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j MASQUERADE

I wish I could say that I fully understand syntax of this command and why it fixes my problem, but I don't.

5. Client configuration

Although the DD-WRT GUI creates the server configuration file. I had to create my own client configuration file, but there are good examples all over the web including on OpenVPN. I've included it below

client #Defines the type of configuration file
dev tun #Defines the interface, either tun or tap
proto udp #Defines the protocol, either udp or tcp
remote myaddress.noip.com 1194 #let the client know where to locate the server.
resolv-retry infinite
persist-key
persist-tun
mute-reply-warnings
# Define security certificates and keys
ca ca.crt
cert client1.crt
key client1.key
ns-cert-type server
ciper AES-256-CBC #This must match the server configuration
auth sha1 #This must match the server configuration
comp-lzo #Enable compression
verb 3 #Set log file verbosity

Further clarification on these commands is available in the OpenVPN manual.

6. Download and install OpenVPN connect for iOS

7. Transfer the appropriate certificates and keys (ca.crt, client1.key, and client1.crt in my case) to my iPad through iTunes. I chose iTunes because e-mail would be an insecure way to transfer a secure certificate.

8. Test connection

There are a few caveats with this one. First, you have to be connected to the internet through another network. That means my home wireless won't work. I used a wireless modem I purchased so we could have internet during our recent move. Second, the way windows uses system time and the way Linux based systems like DD-WRT use it are different. If you create your keys and certificates with Windows they may not be valid with DD-WRT for several hours. This will be noted in the server log in DD-WRT.

9. Accessing windows file shares.

Although I had shared files to all users on my network using Windows, the default firewall setting for this is limited to the local subnet. Since my VPN is on a different network 10.8.0.0/24, I had to allow sharing to that network in the windows firewall.

I was successfully able to connect to my network using my cellular modem. All of my internet traffic is routed through the VPN tunnel so that when I query my IP online it shows the same as my home address. I was also able to access my windows shares through this connection. Now I just have to test this through the hospital network to confirm functionality.

Update: I was unable to connect to my server when I tried through the hospital network. I'm guessing this is likely secondary to the UDP 1194 port being blocked to outbound traffic on their network. I will change my port and protocol to 443 and TCP respectively and test it again at the hospital. It is very unlikely that this port will be blocked; however, I'm not certain at this time if there are any other ramifications associated with this change. I do know from a bit of internet reading that this method is likely slower.

Update 2: I could not connect on UDP port 1194 at the hospital. Connecting through port 443 did work.  My major concern now is the security risk of having port 443 open for inbound traffic.