Update and Install OpneVPN
$ sudo apt-get update -y $ sudo apt-get upgrade -y $sudo apt-get install openvpn -y
Download the latest version of EasyRSA from the Git repository using the following command:
$ wget https://github.com/OpenVPN/easy-rsa/releases/download/v3.0.8/EasyRSA-3.0.8.tgz
extract the downloaded file using the following command:
$ tar -xvzf EasyRSA-3.0.8.tgz
Next, copy the extracted directory to the OpenVPN directory:
$ sudo cp -r EasyRSA-3.0.8 /etc/openvpn/easy-rsa
Next, you will need to build the Certificate Authority (CA) for OpenVPN.
First, change the directory to EasyRSA with the following command:
$ sudo cd /etc/openvpn/easy-rsa
Next, you will need to create a vars file inside this. A vars file is a simple file that Easy-RSA will source for configuration.
You can create it with the following command:
$ sudo nano vars
Add the following lines as per your needs:
Add the following lines as per your needs:
set_var EASYRSA_REQ_COUNTRY "USA" set_var EASYRSA_REQ_PROVINCE "Texas" set_var EASYRSA_REQ_CITY "Buda" set_var EASYRSA_REQ_ORG "GEEKDECODER" set_var EASYRSA_REQ_EMAIL "admin@domain.com" set_var EASYRSA_REQ_OU "IT"
Save and close the file when you are finished.
Next, initiate the public key infrastructure with the following command:
$ sudo ./easyrsa init-pki
You should get the following output:
Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa/vars init-pki complete; you may now create a CA or requests. Your newly created PKI dir is: /etc/openvpn/easy-rsa/pki
Next, you will need to run build-ca command to create ca.crt and ca.key file. You can run it with the following command:
$ sudo ./easyrsa build-ca nopass
You will be asked for several questions as shown below:
Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa/vars Using SSL: openssl OpenSSL 1.1.1f 31 Mar 2020 Enter New CA Key Passphrase: Re-Enter New CA Key Passphrase: Generating RSA private key, 2048 bit long modulus (2 primes) ...+++++ ......................................................................+++++ e is 65537 (0x010001) You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Common Name (eg: your user, host, or server name) [Easy-RSA CA]:vpnserver CA creation complete and you may now import and sign cert requests. Your new CA certificate file for publishing is at: /etc/openvpn/easy-rsa/pki/ca.crt
Next, you will need to use the gen-req command followed by common name to generate the server key.
$ sudo ./easyrsa gen-req vpnserver nopass
You should see the following output:
Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa/vars Using SSL: openssl OpenSSL 1.1.1f 31 Mar 2020 Generating a RSA private key .......................................................+++++ ....+++++ writing new private key to '/etc/openvpn/easy-rsa/pki/easy-rsa-1428.Angtmh/tmp.C9prw4' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Common Name (eg: your user, host, or server name) [vpnserver]: Keypair and certificate request completed. Your files are: req: /etc/openvpn/easy-rsa/pki/reqs/vpnserver.req key: /etc/openvpn/easy-rsa/pki/private/vpnserver.key
Next, you will need to sign the vpnserver key using your CA certificate. You can do it with the following command:
$ sudo ./easyrsa sign-req server vpnserver
You should get the following output:
Check that the request matches the signature Signature ok The Subject's Distinguished Name is as follows commonName :ASN.1 12:'vpnserver' Certificate is to be certified until Feb 6 14:38:52 2022 GMT (365 days) Write out database with 1 new entries Data Base Updated Certificate created at: /etc/openvpn/easy-rsa/pki/issued/vpnserver.crt
Next, you will need to generate a strong Diffie-Hellman key to use for the key exchange. You can generate it with the following command:
$ sudo ./easyrsa gen-dh
Next, you will need to copy all certificate and key file to the /etc/openvpn/server/ directory. You can copy the using the following command:
$ sudo cp pki/ca.crt /etc/openvpn/server/ $ sudo cp pki/dh.pem /etc/openvpn/server/ $ sudo cp pki/private/vpnserver.key /etc/openvpn/server/ $ sudo cp pki/issued/vpnserver.crt /etc/openvpn/server/
Next, you will need to generate a certificate and key file for the client system.
You can create it with the following command:
$ sudo ./easyrsa gen-req vpnclient nopass
You should get the following output:
Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa/vars Using SSL: openssl OpenSSL 1.1.1f 31 Mar 2020 Generating a RSA private key ....+++++ .................................+++++ writing new private key to '/etc/openvpn/easy-rsa/pki/easy-rsa-1563.TeOf5v/tmp.i4YxLz' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Common Name (eg: your user, host, or server name) [vpnclient]: Keypair and certificate request completed. Your files are: req: /etc/openvpn/easy-rsa/pki/reqs/vpnclient.req key: /etc/openvpn/easy-rsa/pki/private/vpnclient.key
Next, sign the client key with the following command:
$ sudo ./easyrsa sign-req client vpnclient
You should get the following output:
Signature ok The Subject's Distinguished Name is as follows commonName :ASN.1 12:'vpnclient' Certificate is to be certified until Feb 6 14:43:18 2022 GMT (365 days) Write out database with 1 new entries Data Base Updated Certificate created at: /etc/openvpn/easy-rsa/pki/issued/vpnclient.crt
Next, copy all client certificate and key to the /etc/openvpn/client/ directory.
$ sudo cp pki/ca.crt /etc/openvpn/client/ $ sudo cp pki/issued/vpnclient.crt /etc/openvpn/client/ $ sudo cp pki/private/vpnclient.key /etc/openvpn/client/
At this point, both server and client certificate and key are ready. Now, you will need to create an OpenVPN configuration file and define all certificates and keys.
$ sudo nano /etc/openvpn/server.conf
Add the following lines ( add in server_ip you ip for openvpn server):
port 1194 proto udp dev tun ca /etc/openvpn/server/ca.crt cert /etc/openvpn/server/vpnserver.crt key /etc/openvpn/server/vpnserver.key dh /etc/openvpn/server/dh.pem server 10.8.0.0 255.255.255.0 push "redirect-gateway def1" push "dhcp-option DNS 208.67.222.222" push "dhcp-option DNS 208.67.220.220" duplicate-cn cipher AES-256-CBC tls-version-min 1.2 tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-256-CBC-SHA256:TLS-DHE-RSA-WITH-AES-128-GCM-SHA256:TLS-DHE-RSA-WITH-AES-128-CBC-SHA256 auth SHA512 auth-nocache keepalive 20 60 persist-key persist-tun compress lz4 daemon user nobody group nogroup log-append /var/log/openvpn.log verb 3
Save and close the file then start the OpenVPN service and enable it to start at system reboot:
$ sudo systemctl start openvpn@server $ sudo systemctl enable openvpn@server
If everything is fine, a new interface will be created. You can check it using the following command:
ip a show tun0
You should get the following output:
4: tun0: mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 100
link/none
inet 10.8.0.1 peer 10.8.0.2/32 scope global tun0
valid_lft forever preferred_lft forever
inet6 fe80::153d:f29:39a2:571a/64 scope link stable-privacy
valid_lft forever preferred_lft forever
IP forwarding allows your operating system to accept the incoming network packets and forward it to the other network. You can enable it with the following command:
$ sudo nano /etc/sysctl.conf
Uncomment or add the following line:
net.ipv4.ip_forward = 1
Save the file then apply the configuration changes with the following command:
sysctl -p
Next, you will need to install the OpenVPN client on another system and connect to the OpenVPN server.
First, install the OpenVPN with the following command:
apt-get install openvpn -y
Once installed, copy all Client certificate and key from the OpenVPN server to the Client machine. You can do it with the following command:
scp -r root@vpn-server-ip:/etc/openvpn/client .
Next, change the directory to client and create a Client configuration file:
cd client nano client.ovpn
Add the following lines:
remote server_ip 1194 client dev tun proto udp remote vpn-server-ip 1194 ca ca.crt cert vpnclient.crt key vpnclient.key cipher AES-256-CBC auth SHA512 auth-nocache tls-version-min 1.2 tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-256-CBC-SHA256:TLS-DHE-RSA-WITH-AES-128-GCM-SHA256:TLS-DHE-RSA-WITH-AES-128-CBC-SHA256 resolv-retry infinite compress lz4 nobind persist-key persist-tun mute-replay-warnings verb 3
Save and close the file then connect to your OpenVPN server with the following command:
openvpn --config client.ovpn
Once the connection has been established, you should get the following output:
Sat Feb 6 14:53:50 2021 SENT CONTROL [vpnserver]: 'PUSH_REQUEST' (status=1) Sat Feb 6 14:53:50 2021 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,route 10.8.0.1,topology net30,ping 20,ping-restart 60,ifconfig 10.8.0.6 10.8.0.5,peer-id 0,cipher AES-256-GCM' Sat Feb 6 14:53:50 2021 OPTIONS IMPORT: timers and/or timeouts modified Sat Feb 6 14:53:50 2021 OPTIONS IMPORT: --ifconfig/up options modified Sat Feb 6 14:53:50 2021 OPTIONS IMPORT: route options modified
You can verify the OpenVPN interface on the client machine with the following command:
ip a show tun0
You should get the following output:
4: tun0: mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 100
link/none
inet 10.8.0.6 peer 10.8.0.5/32 scope global tun0
valid_lft forever preferred_lft forever
inet6 fe80::9206:94d7:8fb2:6b21/64 scope link stable-privacy
valid_lft forever preferred_lft forever
dfdf