OpenVPN server installation

Server side

Firstly, I must install necessary packages.

apt-get install openvpn easy-rsa

Now it’s time to enable TLS.

cd /etc/openvpn
mkdir easy-rsa
cp -R /usr/share/easy-rsa/* easy-rsa/

Then I must edit /etc/openvpn/easy-rsa/vars according to my organization (see end of file).

vim /etc/openvpn/easy-rsa/vars
export KEY_CITY="SanFrancisco"
export KEY_ORG="Fort-Funston"
export KEY_EMAIL="mail@domain"
export KEY_EMAIL=mail@domain

Generate CA keys ca.crt and ca.key.

cd easy-rsa/
mkdir keys
touch keys/index.txt
echo 01 > keys/serial
. ./vars # set environment variables

Generate a server key server.crt and server.key.

./build-key-server server

Generate DIFFIE-HELLMAN for SSL/TLS connection.


Generate key for each client.

./build-key clientname

Generate key with password (optional).

./build-key-pass clientname

Generated keys are in /etc/openvpn/easy-rsa/keys/.

Copy the ca.crt, clientname.crt, clientname.key from the server to the client.

Now create /etc/openvpn/server.conf:

port 1194
proto udp
dev tun

ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
dh /etc/openvpn/easy-rsa/keys/dh2048.pem

server # internal tun0 interface
topology subnet
ifconfig-pool-persist ipp.txt

keepalive 10 120

comp-lzo # compression - must be set on both sides

status log/openvpn-status.log

verb 3 # verbose mode

Create log file.

cd /etc/openvpn
mkdir -p log/
touch log/openvpn-status.log

Define a directory where the client scripts should be stored , e.g. /etc/openvpn/staticclients and create the directory.

mkdir /etc/openvpn/staticclients

Add this directory as option to your openvpn configfile at the server.

client-config-dir /etc/openvpn/staticclients

For each client you have to create a file. The filename must match the “common name” attribute that was specified at the X509 certificate of the client. This command gets the CN from the computers certificate:

openssl x509 -in /etc/openvpn/yourClientCertificate.cer -noout -subject | sed -e 's/.*CN=\(.*\)\/.*/\1/'

Example of static client:

# push "route"
# push "dhcp-option WINS addr"
# push "dhcp-option DNS addr"

If OpenVPN configuration file is server.conf, I can start it by:

systemctl start [email protected]

Start your VPN at boot.

systemctl enable [email protected]

This actually creates a symlink in /etc/systemd/system/[email protected] pointing to /lib/systemd/system/[email protected].

Enable forward

sysctl -w net.ipv4.ip_forward=1

You have to enable masquerade and set up the firewall to get redirect via default gw working.

-A FORWARD -i eth0 -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i tun0 -o eth0 -j ACCEPT

Client side

Parameters of client.conf:

dev tun
port 1194
proto udp
topology subnet

remote MyVPNserverIP 1194

ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/clientname.crt
key /etc/openvpn/easy-rsa/keys/clientname.key


verb 3

If you want to start client side VPN automatically, you have to enable (uncomment) AUTOSTART=“all“ in the /etc/default/openvpn !! Also you have to run once „systemctl daemon-reload“.

Napsat komentář

Vaše e-mailová adresa nebude zveřejněna. Vyžadované informace jsou označeny *