Installing and Configuring OpenVPN on CentOS
OpenVPN is an open software implementation of the VPN protocol. A distinctive feature of this product is the ability to create encrypted tunnels, while there are implementations for most popular OS, including for mobile platforms.
The CentOS repository feature is that OpenVPN is not included in it. But this package can be obtained using the EPEL repository (Enterprise Linux), which is managed by Fedora Project. From this repository, by the way, you can get other packages that are not included in the standard CentOS repository. Install with the command:
Proceed to install OpenVPN. Install the package:
Proceed to configure the server. Copy server.conf:
It is important to pay attention to the “*”. If only one attempt was made to install, then the program version can be replaced with an asterisk symbol. If there were several installation attempts, you may have to specify the path to the file completely.
Before generating the keys, make a few changes to the server configuration file
Open server.conf with any editor.
Find the line “Diffie hellman parameters.” and look for:
If it is indicated exactly, then no changes need to be made. The nuance of the new version of the package is that the parameter already has values. In older versions there is simply “dh”. We make it look like our own.
Next, look for the line “# Certain Windows-specific network settings”. uncomment one of the parameters below (delete the symbol “semicolon” (;) at the beginning of the line). It should look something like this:
You can specify your DNS server if desired. Also, you can uncomment the second line to pass an alternative DNS server to clients as well.
For server security, we will start with the user nobody and the nogroup group. Uncomment the lines:
We begin to create certificates
Using the previously installed easy-rsa package, create the server and client keys.
Create a directory in which the keys will lie:
In the newly created easy-rsa directory, copy the scripts:
Go to the /etc /openvpn/easy-rsa/3/ directory and create a vars script
cd /etc/openvpn/easy-rsa/
Important! The easy-rsa version may be different, and therefore the path will need to be adjusted.
Add the following lines to the open file:
Allow file execution:
We initialize the PKI directory and create a CA certificate:
Important! When creating a CA certificate, the script will ask for a password of at least 4 characters. The entered password should be remembered.
Create the server key.
If you do not specify the “nopass” attribute, then when creating the key, the script will ask for a password.
We sign the server certificate:
The script will take an interest in our confidence with the first action, answer “Yes”. Then it will ask for the password that was specified when creating the CA certificate.
Check if the certificate is signed:
We generate an additional server key ta.key:
User certificates
The process of creating a user certificate is identical to creating a server certificate.
1. We create without password protection:
2. Signing the certificate:
3. Verify the signature:
Diffie Hellman.
Creating a certificate
As a result, the dh.pem file will be created, and in the dh2048.pem config. Rename it later when copying keys.
We transfer certificates
Copy the server key files. To do this, we sequentially perform:
Copy client keys
Copy the Diffie-Hellman key file
Important! The target file name is intentionally changed to the name in the config.
Configuring routing
To speed up configuration, work will be performed with iptables, not with FirewallD. Consistently perform:
Before further configuration, you should look at the names of the interfaces using the command:
Add a rule for NAT:
As an example:
Allow packet forwarding between network interfaces. To do this, edit the sysctl.conf system file:
At the beginning of the file, insert the line:
We save the file, close the editor and restart the network service with the command:
We start the OpenVPN server
To start, add the service to the auto-upload:
Launch OpenVPN:
Client setting.
The server is configured, it remains to configure the client so that it can connect.
Regardless of the OS used, whether it’s a mobile, server or home version, Linux or Windows, you will always need 4 files:
- ca.crt;
- client.crt;
- client.key;
- client.ovpn
The first 3 files are located in the /etc/openvpn /client/directory, and client.ovpn will have to be created. To do this, go to the directory where all the client keys are:
Create a file:
Fill in the following contents:
comp-lzo