Configuring OpenVPN on Ubuntu

OpenVPN is an open implementation of one of the VPN technologies, designed to organize secure virtual private networks between geographically remote local networks, as well as individual clients. Tunnel security is provided by encryption using OpenSSL.

Cloud Servers from $5 / moIntel Xeon Gold 6254 3.1 GHz CPU, SLA 99,9%, 100 Mbps channelTry

How does OpenVPN work?

Upon completion of the server setup and its launch, it will enter the standby mode of receiving and redirecting external secure SSL connections to the virtual network adapter (tun/tap).

Optionally, server routing can be configured so that client Internet traffic passes through the server and becomes server traffic. In this case, OpenVPN will perform proxy traffic.

What is required from the operating system?

Before installing OpenVPN, you need to make sure that the basic parameters are correct.

1. The server has at least one “white” static IP address. Those. The server must be accessible from the Internet. If the address is dynamic, but the server remains accessible from the global network, use the DynDNS services.
2. Allowed to download and install packages from official repositories. To check, run cat /tc/apt/sources.list. Lines with instructions from the repositories should be uncommented (there should be no “#" sign at the beginning of the line).
3. The network parameters must be correctly specified - hostname, parameters of DNS servers.

Getting to the installation.

All installation steps will be performed by the root user.

1. Updating repository information:

2. Install the current system updates and installed programs:

3. Install OpenVPN:

Important. In basic repositories, the latest version of a package is often missing. OpenVPN developers maintain their repository, how to configure it can be found on the official website of the.

4. Install the easy-rsa package in the same way:

Post-installation steps

We place easy-rsa scripts:

We prepare public keys (PKI - Public Key Infrastructure):

1. Go to the / etc / openvpn / easy-rsa directory:

2. Creating a symbolic link to the openssl configuration file:

3. We initialize the vars script:

The system will report: NOTE: If you run ./clean-all, I will be doing a rm -rf on / etc / openvpn / easy-rsa / keys

4. We carry out ./clean-all
5. To create a certification authority, run the script:

In the course of its work, the program will ask several questions. They should be answered in Latin letters. If you do not fill in any field, the program will substitute default values, usually indicated in parentheses.

Create the server key

To create the server key, execute the command:

It should be noted that the process is similar to generating a certificate of a certification authority, however, before signing the certificate, the program will ask 2 clarifying questions. If everything is correct, answer “y”.

Generation of client keys

Similarly to generating server keys, client keys are also created:

It should be noted that the created client1.key does not have a password or cryptographic protection. This can lead to the fact that any user who has taken possession of the file can try to connect to the server. If such a threat exists, it is better to generate keys with another script:

The script will ask for a passphrase at the very beginning. Further, the process is no different from generating server keys and a simple client.

Keep in mind that key names must be unique. One user - one key with a unique name.

It happens that in the course of the server’s operation, after some time, it is necessary to create one or more certificates. To do this, you will need to reinitialize the vars script and only then start the key generation process:

Diffie-Hellman key generation

Thanks to the Diffie-Hellman protocol, two or more parties can receive one secret key, which will allow building a secure communication channel. The keys are generated by the command:

The result will be something like this.

When the program is finished, the dh2048.pem file will appear in the /etc/openvpn/easy-rsa/keys/ directory

Moving certificates and keys

Server

Keys and certificates created. It is time to distribute them to users, and copy server keys to the appropriate directories on the server.

1. Go to the directory with the keys:

2. We copy only the files necessary for the server:

It is important to understand that the above files are the basis of the operation and security of the VPN server. Loss or substitution of these files can have extremely negative consequences. It is important to store them in a safe place and not transmit them over open communication channels.

Clients

The client will need only 3 files ca.crt, client1.crt, client1.key. Each client needs to give only his keys. These files can be placed in the / etc / openvpn directory on the client machine if it is running a Linux-like OS.

On Windows, they should be placed in the user directory.

Server and client setup

Server

Most installed programs on Linux have so-called sample files. These files contain configuration examples and explanations of them. OpenVPN was no exception. Unpack the server configuration file into the / etc / openvpn directory:

The server is ready to work with the received file. It is configured with the possibility of tunneling, but cannot proxy, i.e. sending client traffic on its behalf. Fix this.

First, check which files are in the / etc / openvpn directory:

Open the configuration file:

And we check the compliance of the files prescribed in the configuration with the files in the directory. Interesting lines after " SSL/TLS root certificate (ca), certificate (cert), and private key (key).”

If the names differ from the existing ones, the necessary corrections should be made. Exit the editor by pressing Ctrl + X.

We start the server:

Check the launch result:

Client settings.

It is assumed that the OpenVPN package is already installed on the client side.

1. Copy the client settings file to the user's home directory:

2. Copy the generated keys - client1.key, client1.crt, ca.crt:

3. Editing the client configuration file:

4. We find the commented out lines “# The hostname / IP and port of the server”. For the remote parameter, change my-server-1 to the IP address of the server or its domain name.
5. In the same file, below, we find the block “# SSL / TLS parms.”. Editing key names.
6. We exit editing with the combination Ctrl + X. We answer “Y” to the question of saving changes. The file name is left unchanged.
7. Transfer the files client1.key, client1.crt, ca.crt and client.conf to the client computer from which the connection to the OpenVPN server will take place.

Important! Some client implementations of OpenVPN only work with * .ovpn files. In such cases, it is enough to change the file extension (rename) from client.conf to client.ovpn.

8. We connect to the server with the command:

It should be noted that proxying is still not configured. At the same time, when the client machine is connected to the OpenVPN server, Internet access is terminated. This is because the created TUN adapter, and in the place with it the server itself, is the default gateway.

Configuring routing.

1. On the server, edit the server.conf file:

2. We find the following line in the file and delete the “;” symbol in front of it, thus uncommenting it:

3. Save and close the editor.
4. Editing the file /etc/sysctl:

5. At the end of the file, add the following line:

This will allow the system to forward traffic between interfaces, but the changes will only take effect after a reboot. Save the file and close the editor.

6. Allow forwarding packages without rebooting the server:

7. Configure NAT in iptables. We enter the commands one by one:

You can also simply enter them into the /etc/rc.local file up to the line “exit 0” or configure the firewall.

The server is ready to use. However, the task is to proxy all traffic, and therefore it is necessary to configure forwarding of DNS queries. Customize.

1. Install dnsmasq

If the installation is performed on an Ubuntu OS:

Even though in most modern versions of the Ubuntu OS, dnsmasq is already preinstalled, in older versions you must do this:

The installation wizard dialogue box may start. There will be 2 questions in it. In the first case, the question “prepare /etc/resolv.conf for dynamic updates” is answered with “Yes”, and in the next, “Append original file to dynamic file?” answer “No”.

For Debian 7 OS:

2. Edit the dnsmasq settings file:

Add the following parameters:

Save the file and close the editor.

3. Editing the network settings file:

It is required to specify the address of DNS servers in the corresponding sections of the adapter settings:

Perhaps this action has already been performed. You do not need to perform it again.

4. Considering the peculiarity of dnsmasq startup and subsequent operation - the possibility of crashing before initializing the virtual tun adapter, add the following line to the rc.local file, before “exit 0”:

5. Now let the OpenVPN server clients use DNS. Using the nano editor, uncomment the line:

We fix the changes in the file.

6. Reboot the server:

Checking the operation

We are reconnecting to the server. We are trying to open a website to check the IP address. The result should be the IP address of the server.

Cloud Servers from $5 / moIntel Xeon Gold 6254 3.1 GHz CPU, SLA 99,9%, 100 Mbps channelTry