How to Configure openvpn on linux
OpenVPN on Linux
Headline text
Introduction-: OpenVPN is an open source virtual private network (VPN) software for creating point-to-point encrypted tunnels between host computers.
OpenVPN is a full-featured SSL VPN solution which can accomodate a wide range of configurations, including remote access, site-to-site VPNs, WiFi security, and enterprise-scale remote access solutions with load balancing, failover, and fine-grained access-controls
OpenVPN implements OSI layer 2 or 3 secure network extension using the industry standard SSL/TLS protocol, supports flexible client authentication methods based on certificates, smart cards, and/or 2-factor authentication, and allows user or group-specific access control policies using firewall rules applied to the VPN virtual interface. OpenVPN is not a web application proxy and does not operate through a web browser.
- OpenVPN Installation and configuration -:
Installing OpenVPN from a binary RPM package has these dependencies: openssl lzo pam Furthermore, if you are building your own binary RPM package, there are several additional dependencies: openssl-devel lzo-devel pam-devel
1) tar -xvf openvpn.tar.gz OR Install Using RPM # rpm -ivh openvpn
2) cd /usr/local/openvpn
3) ./configure
4) make
5) make install
6) cp /usr/local/openvpn/easy-rsa/* /etc/openvpn OR
cp /usr/share/doc/openvpn-2.0.9/easy-rsa/* /etc/openvp
7) cd /etc/openvpn
8) vi vars -:
Now edit the vars file (called vars.bat on Windows) and set the KEY_COUNTRY, KEY_PROVINCE, KEY_CITY, KEY_ORG, and KEY_EMAIL parameters. Don't leave any of these parameters blank.
9) source ./vars
10) ./clean-all
11) ./build-ca Generating a 1024 bit RSA private key ..++++++ ........++++++ writing new private key to 'ca.key'
You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank.
Country Name (2 letter code) [INDIA]: string is too long, it needs to be less than 2 bytes long Country Name (2 letter code) [INDIA]:INDIA string is too long, it needs to be less than 2 bytes long Country Name (2 letter code) [INDIA]: string is too long, it needs to be less than 2 bytes long Country Name (2 letter code) [INDIA]:IN State or Province Name (full name) [MAHARASTRA]:MAHARASTRA Locality Name (eg, city) [PUNE]:PUNE Organization Name (eg, company) [Software]: Organizational Unit Name (eg, section) []:PMSG Common Name (eg, your name or your server's hostname) [software CA]:fc7 Email Address [PRADIP_GUDALE@yahoo.com]: ===========================================================================
12)./build-key-server server (Created Server Certificate) Generating a 1024 bit RSA private key .....................++++++ ..++++++ writing new private key to 'server.key'
You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank.
Country Name (2 letter code) [INDIA]:IN State or Province Name (full name) [MAHARASTRA]: Locality Name (eg, city) [PUNE]: Organization Name (eg, company) [Software]: Organizational Unit Name (eg, section) []:PMSG INFRA Common Name (eg, your name or your server's hostname) [server]:fc7 Email Address [PRADIP_GUDALE@yahoo.com]:
Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []:root123 An optional company name []:software Using configuration from /etc/openvpn/openssl.cnf Check that the request matches the signature Signature ok The Subject's Distinguished Name is as follows countryName :PRINTABLE:'IN' stateOrProvinceName :PRINTABLE:'MAHARASTRA' localityName :PRINTABLE:'PUNE' organizationName :PRINTABLE:'software' organizationalUnitName:PRINTABLE:'PMSG INFRA' commonName :PRINTABLE:'fc7' emailAddress :IA5STRING:'PRADIP_GUDALE@yahoo.com' Certificate is to be certified until Dec 25 09:57:31 2017 GMT (3650 days) Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y Write out database with 1 new entries Data Base Updated ===========================================================================
13) ./build-key client3 (Created 3 Clients Certificate) Generating a 1024 bit RSA private key .........++++++ .........++++++ writing new private key to 'client3.key'
You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank.
Country Name (2 letter code) [INDIA]:IN State or Province Name (full name) [MAHARASTRA]: Locality Name (eg, city) [PUNE]: Organization Name (eg, company) [software]: Organizational Unit Name (eg, section) []:pmsg Common Name (eg, your name or your server's hostname) [client3]: Email Address [PRADIP_GUDALE@yahoo.com]:
Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: Using configuration from /etc/openvpn/openssl.cnf Check that the request matches the signature Signature ok The Subject's Distinguished Name is as follows countryName :PRINTABLE:'IN' stateOrProvinceName :PRINTABLE:'MAHARASTRA' localityName :PRINTABLE:'PUNE' organizationName :PRINTABLE:'software' organizationalUnitName:PRINTABLE:'pmsg' commonName :PRINTABLE:'client3' emailAddress :IA5STRING:'PRADIP_GUDALE@yahoo.com' Certificate is to be certified until Dec 25 10:24:23 2017 GMT (3650 days) Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y Write out database with 1 new entries Data Base Updated ===========================================================================
14) ./build-dh-: (Diffie Hellman parameters must be generated for the OpenVPN server.) Generating DH parameters, 1024 bit long safe prime, generator 2 This is going to take a long time
===========================================================================
15) Creating Sample configuration files for server and clients-:
Note that on Linux, BSD, or unix-like OSes, the sample configuration files are named server.conf and client.conf. On Windows they are named server.ovpn and client.ovpn.
# cp /usr/share/doc/openvpn-2.0.9/sample-config-files/server.conf /etc/openvpn
# cp /usr/share/doc/openvpn-2.0.9/sample-config-files/client.conf /etc/openvpn
16) # less /etc/openvpn/server.conf
port 1194
proto tcp
dev tun
ca keys/ca.crt
cert keys/server.crt
key keys/server.key # This file should be kept secret
dh keys/dh1024.pem
server 10.88.88.65 255.255.224.0
# Diffie hellman parameters.
dh keys/dh1024.pem
server 10.8.0.0 255.255.255.0
;server-bridge 10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100
;client-to-client
duplicate-cn
keepalive 10 120
comp-lzo
max-clients 100
status openvpn-status.log
log openvpn.log
log-append openvpn.log
===========================================================================
17) # less /etc/openvpn/client.conf
client
dev tun
proto tcp
remote 10.88.88.65 1194
resolv-retry infinite
ca keys/ca.crt
cert keys/client1.crt
key keys/client1.key
18) Start the Openvpn Daemon or start from command line.
# service openvpn start
# chkconfig openvpn on
# openvpn /etc/openvpn/server.conf
# openvpn /etc/openvpn/client.conf