OpenVPN : Configure VPN Server2024/07/19 |
Install OpenVPN to Configure Virtual Private Network.
This example is based on the environment like follows.
By settings of OpenVPN Server/Client, [tun] interface will be configured automatically and when connecting with VPN from Client to Server, Client can access to the the local network of the Server.
On this example, it needs to set IP Masquerading on Router, too.
+----------------------+ | [ OpenVPN Server ] |172.16.100.1 | dlp.srv.world +--------+ | |tun | +-----------+----------+ | enp1s0|10.0.0.30 | | | | Local Network | 10.0.0.1| | +------+-----+ | -------| Router |-------------|----- +------+-----+ | | | | Internet | --------------+-------------------|----- | | | Local Network | 192.168.0.30| | +-----------+----------+ | | |tun | | VPN Client +--------+ | |172.16.100.x +----------------------+ |
[1] | Install OpenVPN. |
root@dlp:~# apt -y install openvpn easy-rsa iptables
|
[2] | Create CA and Certificates. |
root@dlp:~#
cd /usr/share/easy-rsa
# initialize root@dlp:/usr/share/easy-rsa# ./easyrsa init-pki Notice ------ 'init-pki' complete; you may now create a CA or requests. Your newly created PKI dir is: * /usr/share/easy-rsa/pki Using Easy-RSA configuration: * undefined # create CA root@dlp:/usr/share/easy-rsa# ./easyrsa build-ca No Easy-RSA 'vars' configuration file exists! Using SSL: * openssl OpenSSL 3.0.13 30 Jan 2024 (Library: OpenSSL 3.0.13 30 Jan 2024) # set any pass-phrase Enter New CA Key Passphrase: Re-Enter New CA Key Passphrase: You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- # set any name Common Name (eg: your user, host, or server name) [Easy-RSA CA]:Server-CA Notice ------ CA creation complete. Your new CA certificate is at: * /usr/share/easy-rsa/pki/ca.crt # create server certificates # any name is OK for [server1] name # (it is set for file name of certs or commonName) root@dlp:/usr/share/easy-rsa# ./easyrsa build-server-full server1 nopass No Easy-RSA 'vars' configuration file exists! Using SSL: * openssl OpenSSL 3.0.13 30 Jan 2024 (Library: OpenSSL 3.0.13 30 Jan 2024) Notice ------ Private-Key and Public-Certificate-Request files created. Your files are: * req: /usr/share/easy-rsa/pki/reqs/server1.req * key: /usr/share/easy-rsa/pki/private/server1.key You are about to sign the following certificate: Request subject, to be signed as a server certificate for '825' days: subject= commonName = server1 Type the word 'yes' to continue, or any other input to abort. Confirm request details: yes Using configuration from /usr/share/easy-rsa/pki/openssl-easyrsa.cnf # answer with pass-phrase set on CA Enter pass phrase for /usr/share/easy-rsa/pki/private/ca.key: Check that the request matches the signature Signature ok The Subject's Distinguished Name is as follows commonName :ASN.1 12:'server1' Certificate is to be certified until Oct 22 03:49:15 2026 GMT (825 days) Write out database with 1 new entries Database updated Notice ------ Certificate created at: * /usr/share/easy-rsa/pki/issued/server1.crt Notice ------ Inline file created: * /usr/share/easy-rsa/pki/inline/server1.inline # create client certificates # any name is OK for [client1] name # (it is set for file name of certs or commonName) root@dlp:/usr/share/easy-rsa# ./easyrsa build-client-full client1 nopass No Easy-RSA 'vars' configuration file exists! Using SSL: * openssl OpenSSL 3.0.13 30 Jan 2024 (Library: OpenSSL 3.0.13 30 Jan 2024) Notice ------ Private-Key and Public-Certificate-Request files created. Your files are: * req: /usr/share/easy-rsa/pki/reqs/client1.req * key: /usr/share/easy-rsa/pki/private/client1.key You are about to sign the following certificate: Request subject, to be signed as a client certificate for '825' days: subject= commonName = client1 Type the word 'yes' to continue, or any other input to abort. Confirm request details: yes Using configuration from /usr/share/easy-rsa/pki/openssl-easyrsa.cnf # answer with pass-phrase set on CA Enter pass phrase for /usr/share/easy-rsa/pki/private/ca.key: Check that the request matches the signature Signature ok The Subject's Distinguished Name is as follows commonName :ASN.1 12:'client1' Certificate is to be certified until Oct 22 03:52:33 2026 GMT (825 days) Write out database with 1 new entries Database updated Notice ------ Certificate created at: * /usr/share/easy-rsa/pki/issued/client1.crt Notice ------ Inline file created: * /usr/share/easy-rsa/pki/inline/client1.inline # generate Diffie Hellman ( DH ) parameter root@dlp:/usr/share/easy-rsa# ./easyrsa gen-dh No Easy-RSA 'vars' configuration file exists! Using SSL: * openssl OpenSSL 3.0.13 30 Jan 2024 (Library: OpenSSL 3.0.13 30 Jan 2024) Generating DH parameters, 2048 bit long safe prime DH parameters appear to be ok. Notice ------ DH parameters of size 2048 created at: * /usr/share/easy-rsa/pki/dh.pem # create TLS-Auth key root@dlp:/usr/share/easy-rsa# openvpn --genkey secret ./pki/ta.key
# copy generated certs root@dlp:/usr/share/easy-rsa# cp -pR /usr/share/easy-rsa/pki/{issued,private,ca.crt,dh.pem,ta.key} /etc/openvpn/server/ |
[3] | Configure OpenVPN. It based on the environment Firewalld is running because of using routing rules. |
# copy sample configuration root@dlp:~# cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf /etc/openvpn/server/
root@dlp:~#
vi /etc/openvpn/server/server.conf # line 32 : change if need (listening port of OpenVPN) port 1194 # line 35 : change if need (use udp on this example) ;proto tcp proto udp # line 53 : change if need (use tun on this example) ;dev tap dev tun # line 78 : specify certificates ca ca.crt cert issued/server1.crt key private/server1.key
# line 85 : specify DH file dh dh.pem
# line 101 : specify network to be used on VPN # any network are OK except your local network server 172.16.100.0 255.255.255.0
# line 142 : uncomment and change to your local network push "route 10.0.0.0 255.255.255.0 "
# line 231 : keepalive settings keepalive 10 120 # line 244 : specify TLS-Auth key tls-auth ta.key 0
# line 281 : enable persist options persist-key persist-tun # line 306 : specify log level (0 - 9, 9 means debug level) verb 3
root@dlp:~#
vi /etc/openvpn/server/add-bridge.sh # create new #!/bin/bash # network interface which can connect to local network IF=enp1s0 # interface VPN tunnel uses # for the case of this example like specifying [tun] on the config, generally this param is [tun0] VPNIF=tun0 echo 1 > /proc/sys/net/ipv4/ip_forward iptables -A FORWARD -i ${VPNIF} -j ACCEPT iptables -t nat -A POSTROUTING -o ${IF} -j MASQUERADE
root@dlp:~#
vi /etc/openvpn/server/remove-bridge.sh # create new #!/bin/bash # network interface which can connect to local network IF=enp1s0 # interface VPN tunnel uses # for the case of this example like specifying [tun] on the config, generally this param is [tun0] VPNIF=tun0 echo 0 > /proc/sys/net/ipv4/ip_forward iptables -D FORWARD -i ${VPNIF} -j ACCEPT iptables -t nat -D POSTROUTING -o ${IF} -j MASQUERADE chmod 700 /etc/openvpn/server/{add-bridge.sh,remove-bridge.sh}
root@dlp:~#
systemctl edit openvpn-server@server
# add following lines
[Service]
ExecStartPost=/etc/openvpn/server/add-bridge.sh
ExecStopPost=/etc/openvpn/server/remove-bridge.sh
systemctl enable --now openvpn-server@server |
[4] |
Transfer certs follows you generated to Client Host you'd like to connect with VPN.
It's OK all for VPN Server settings.
* /etc/openvpn/server/ca.crt
* /etc/openvpn/server/ta.key * /etc/openvpn/server/issued/client1.crt * /etc/openvpn/server/private/client1.key |
Sponsored Link |
|