OpenVPN Tutorial

In: Khaled| Linux| OpenVPN| TCP/IP| ubuntu

17 Feb 2010

Article by Khaled

Openvpn is an open source software, allows us to create a Virtual Private Network.


1. Installing openvpn

install these packages openvpn openssh-server openssl:

laptop:~$ sudo apt-get install openvpn openssh-server openssl

Now the ssh server is installed we can control it and access to it from anywhere on the web using the IP and port 22.

In reality 22 is for SSH The best port for OpenVPN (http://www.iana.org/assignments/port-numbers) is 1194.

There is special web interfaces to can interact and configure openVPN through a browser like webmin,

so we should install apache, php and mysql with this command:

laptop:~$ sudo apt-get install apache2 mysql-server-5.0 libapache2-mod-php5 php5 php5-common php5-mysql

To install webmin:

laptop:~$ sudo apt-get install webmin

2. VPN configuration:

The openvpn use Private Key Infrastructure (PKI):

1. One Public key for server and Private keys for each client.

2. It uses Certification for more security each Certification is valid for one couple (Server, Client)

The authentication With OpenVPN is a bidirectional, means the sever identify the client before trusting on and client identify the server too.

Key Generation:

To generate a Key we can use scripts provided by OpenVPN

We create openvpn/ in /home to manipulate and create keys there:

laptop:~$ sudo cp /usr/share/doc/openvpn/examples/easy-rsa /home/openvpn/ -R

All commands are in /home/openvpn/2.0/ file

laptop:~$ cd /home/openvpn/2.0

Edit vars file:

laptop:~$ sudo nano vars ————–// (nano is a text editor you can use others: gedit, …)

Setup these variables KEY_COUNTRY, KEY_PROVINCE, KEY_CITY, KEY_ORG, and KEY_EMAIL

EX:

export KEY_COUNTRY=DZ

export KEY_PROVINCE=ALGER

export KEY_CITY=alger

export KEY_ORG=alger

export KEY_EMAIL=xxxxxxxxx@xxx.dz

* We can find other variables like:

* KEY_SIZE by default set to 1024 in some countries there is limit that you

should respect for this KEY_SIZE you can’t go over the limitation.

* CA_EXPIRE : In how many days your certification will expire?

Save and close (in nano ctrl+x)

To set these variables we run this:

laptop:~$ . ./vars ——————– //first dot isn’t a mistake

We should clean all existing certification we have to not have conflits (run this command):

laptop:~$ sudo ./clean-all ———————-// will delete /home/openvpn/2.0/keys

If you do’nt have certification set before nothing will be done.

Now we create our Certification and key with CA (master Certification Authority) with this command:

laptop:~$ sudo ./build-ca

The certification now are created in keys directory: ca.crt ca.key

Generate a certification and key to the SERVER:

laptop:~$ sudo ./build-key-server SERVER ——————- //we suppose that server’s named SERVER

When common name is required type the name OS the server (here SERVER)

Generate certification and key for client:

laptop:~$ sudo ./build-key client1

when common name is required type the name of the client (client1)

this common name MUST be different if you have many clients.

To protect your key with a password use ./build-key-pass instead of ./build-key

NB: We were able to generate the client key on its own end to avoid transfer through the network

Diffie Hellman parameters should be generated for the openvpn server:

laptop:~$ sudo ./build-dh

these parameters are copied in keys directory dh1024.pem

So now all Certifications and keys are in /home/openvpn/2.0/keys directory:

name Utile for Role Secret

ca.crt servers and all clients root Certification CA no

ca.key key signing the machine (both) root key CA yes

dh1024.pem server Diffie Hellman parameters no

SERVER.crt server server certification no

SERVER.key server server key yes

client1.crt Client1 Client1 certification no

client1.key Client1 Client1 key yes

We copy files to the client machines using a secured tunel

3. Creation of the file configuration for clients and server

There is samples of this configuration in /usr/share/doc/openvpn/examples/sample-config-files/ client.conf and server.conf.gz

1. Server configuration:

We should gunzip the server.conf.gz

laptop:~$ sudo gunzip server.conf.gz

and then copy this file to /home/openvpn using:

laptop:~$ sudo cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf /etc/openvpn/

Edit server.conf:

laptop:~$ sudo nano /home/openvpn/server.conf

this would create a VPN with virtual interface and listen to the connections in 1194 port and distribute

virtual addresses to clients that connect through 10.8.0.0/24

By default this server.conf is useful but we can set more parameters(directives) like (IP, PORT, KEY_SIZE etc…)

Client configuration and server one must be coherent.

1. Client configuration:

Edit the client.conf:

laptop:~$ sudo nano /home/openvpn/client.conf

Verify the name of certification and key of each client:

ca ca.crt

cert client.crt

key client.key

Go to the remote parameter and set up the server IP

remote my-server-1 1194

save the file

Now we verify if client parameters if they correspond to the server one:

dev (tun ou tap)

proto (udp ou tcp)

comp-lzo

fragment

4. Starting the VPN:

4.1. Before we start we should copy all file in keys directory and .conf to /etc/openvpn:

4.1.1 SERVER:

laptop:~$ sudo cp /home/openvpn/keys/SERVER.crt /etc/openvpn

laptop:~$ sudo cp /home/openvpn/keys/SERVER.key /etc/openvpn

laptop:~$ sudo cp /home/openvpn/keys/dh1024.pem /etc/openvpn

laptop:~$ sudo cp /home/openvpn/server.conf /etc/openvpn

laptop:~$ sudo cp /home/openvpn/keys/ca.crt /etc/openvpn

4.1.2 Client:

laptop:~$ sudo cp /home/openvpn/keys/client1.crt /etc/openvpn

laptop:~$ sudo cp /home/openvpn/keys/client1.key /etc/openvpn

laptop:~$ sudo cp /home/openvpn/keys/ca.crt /etc/openvpn

laptop:~$ sudo cp /home/openvpn/client1.conf /etc/openvpn

4.2 Start the server:

laptop:~$ cd /etc/openvpn

laptop:/etc/openvpn$ sudo openvpn server.conf

4.3 Start the client1:

aptop:~$ cd /etc/openvpn

laptop:/etc/openvpn$ sudo openvpn client1.conf

4.4 Test the VPN:

From the client terminal try to ping the server which has the 10.8.0.1 by default:

ping 10.8.0.1

To can communicate with other client through the network with the VPN you have to uncomment the client-to-client parameter in server.conf
and then you would be able to ping the other clients.

Share and Enjoy:

  • Print this article!
  • Digg
  • Sphinn
  • del.icio.us
  • Facebook
  • Mixx
  • Google Bookmarks
  • Live
  • MySpace
  • Netvibes
  • Reddit
  • Slashdot
  • SphereIt
  • StumbleUpon
  • Suggest to Techmeme via Twitter
  • Technorati
  • Twitter
  • Yahoo! Bookmarks

Related Posts:

  • No Related Posts

48 Responses to OpenVPN Tutorial

Avatar

uberVU - social comments

February 18th, 2010 at 2:25 am

Social comments and analytics for this post…

This post was mentioned on Twitter by megcox22: OpenVPN tutorial from HA: #linux #openvpn http://bit.ly/asrSiC…

Avatar

Matilde

June 12th, 2011 at 5:18 pm

hello…

really good article. Ready to hear more next week,my blog http://talonmpgraham.blogdrive.com/archive/20.html Many Thanks….

Avatar

venzingS

June 20th, 2011 at 3:52 am

hello…

Hi there just quality post! http://pearl11.bloges.org/ ,i’d a good read.appreciate your article,My problem continues to be resolved….

Avatar

Xehmer

June 20th, 2011 at 4:31 pm

very helpful…

I preferred to thank you for this good article. http://dshkm.blogreaction.com/ I by all odds liked every little bit of it…

Avatar

Sterker

June 21st, 2011 at 2:07 pm

Avatar

Chantelle

June 22nd, 2011 at 4:59 am

Avatar

Richelle

June 26th, 2011 at 2:49 am

quality post…

I have spent a bit of time going through your posts! http://demetrice.blogdumps.net/2011/06/17/boy-chanel-bag/ ,i had a good read….

Avatar

TadWinett

June 27th, 2011 at 12:02 pm

Greate…

It’s such a great site! http://www.blurty.com/users/kateyfiallen/ Great post, I just bookmarked it on Digg….

Avatar

Alexander7

July 17th, 2011 at 9:10 am

buy@generic.LEVITRA” rel=”nofollow”>…

Need cheap generic LEVITRA?…

Avatar

SALVADOR

July 29th, 2011 at 3:48 pm

Cheap@Abilify.Online” rel=”nofollow”>..

Buygeneric meds…

Avatar

WALLACE

July 30th, 2011 at 2:40 pm

Purchase@Cheap.Acai” rel=”nofollow”>…

Buygeneric drugs…

Avatar

LEWIS

July 31st, 2011 at 9:07 am

Purchase@Acai.Without.Prescription” rel=”nofollow”>..…

Buynow it…

Avatar

ENRIQUE

July 31st, 2011 at 10:40 am

Buy@Acai.500mg” rel=”nofollow”>.…

Buynow it…

Avatar

JIMMIE

August 1st, 2011 at 1:26 am

Buy@Discount.Coral.Calcium” rel=”nofollow”>..

Buygeneric meds…

Avatar

EDUARDO

August 1st, 2011 at 8:05 am

Purchase@Discount.Abana” rel=”nofollow”>..

Buygeneric pills…

Avatar

TREVOR

October 16th, 2011 at 9:27 pm

herpes kelly dating kansas

Buy_no prescription…

Avatar

DUSTIN

October 18th, 2011 at 9:53 am

strong insulin

Buy_generic meds…

Avatar

RALPH

October 19th, 2011 at 5:53 am

erectile dysfunction herbal treatment

Buy_drugs without prescription…

Avatar

JESUS

October 19th, 2011 at 9:13 am

brown algae good for slow thyroid

Buy_generic drugs…

Avatar

DALE

October 19th, 2011 at 5:34 pm

novo 50 allergy medicine

Buy_now it…

Avatar

HERBERT

October 21st, 2011 at 12:54 am

Avatar

Benzing

October 21st, 2011 at 3:04 pm

Great…

Im in my 30’s, looking to make friends, and learn a sport. The only sport I kind of know how to play is volleyball. I am interested in learning other team sports. Is thier a way to learn the sport and eventaully play on a team? Maybe I need to go to a…

Avatar

AUSTIN

October 23rd, 2011 at 2:21 am

lithium alcohol

Buy_generic drugs…

Avatar

KIRK

October 25th, 2011 at 5:06 pm

embed video webpage

Buy_generic drugs…

Avatar

PEDRO

October 26th, 2011 at 6:06 pm

what is plavix

Buy_drugs without prescription…

Avatar

DOUGLAS

October 27th, 2011 at 12:46 am

postpartum remeron

Buy_no prescription…

Avatar

CALVIN

October 27th, 2011 at 7:06 pm

medication errors 2nd ed

Buy_no prescription…

Avatar

MELVIN

October 29th, 2011 at 6:59 am

oral cancer hospital

Buy_generic meds…

Avatar

PATRICK

October 29th, 2011 at 1:39 pm

joke male birth control

Buy_generic meds…

Avatar

FREDRICK

October 30th, 2011 at 5:03 pm

prozac daily strength

Buy_generic pills…

Avatar

LOUIS

October 30th, 2011 at 11:43 pm

acne in cats

Buy_it now…

Avatar

WESLEY

October 31st, 2011 at 11:03 pm

Avatar

BILLY

November 1st, 2011 at 10:43 am

Avatar

FRANCIS

November 1st, 2011 at 8:43 pm

pet ct scan results accuracy cancer

Buy_drugs without prescription…

Avatar

NATHAN

November 2nd, 2011 at 3:23 am

pictures of herpes blisters

Buy_generic pills…

Avatar

WESLEY

November 3rd, 2011 at 9:50 pm

reversing alcohol induced neuropathy

Buy_generic meds…

Avatar

MITCHELL

November 4th, 2011 at 7:50 am

Avatar

CASEY

November 5th, 2011 at 11:27 am

Avatar

KEN

November 6th, 2011 at 4:07 am

Avatar

RUBEN

November 6th, 2011 at 7:07 pm

emotions surviveing uterine cancer

Buy_generic meds…

Avatar

LESLIE

November 7th, 2011 at 8:07 pm

clinical studies of clonidine

Buy_no prescription…

Avatar

RYAN

November 8th, 2011 at 3:21 pm

diet generator reviews

Buy_it now…

Avatar

ALEJANDRO

November 8th, 2011 at 10:01 pm

psychiatric care model

Buy_generic meds…

Avatar

TED

November 10th, 2011 at 7:21 am

Avatar

MARVIN

November 11th, 2011 at 3:21 am

most successful diet ever

Buy_generic pills…

Avatar

NATHANIEL

November 12th, 2011 at 4:21 am

sleep apnea side effect of lexapro

Buy_generic pills…

Avatar

DAN

November 13th, 2011 at 1:41 pm

acute angle-closure glaucoma

Buy_drugs without prescription…

Avatar

JACKIE

December 11th, 2011 at 4:02 am

benadryl dogs

Buy_generic drugs…

Comment Form

Recent Posts