Debian 12 bookworm
Sponsored Link

OpenVPN : Configure VPN Server2023/07/18
 
Install OpenVPN to Configure Virtual Private Network.
This example is based on the environment like follows.
By settings of OpenVPN Server/Client, [tun] interface will be configured automatically and when connecting with VPN from Client to Server, Client can access to the the local network of the Server.
On this example, it needs to set IP Masquerading on Router, too. 
  +----------------------+
  | [  OpenVPN Server  ] |192.168.100.1
  |    dlp.srv.world     +--------+
  |                      |tun     |
  +-----------+----------+        |
        enp1s0|10.0.0.30          |
              |                   |
              |  Local Network    |
      10.0.0.1|                   |
       +------+-----+             |
-------|   Router   |-------------|-----
       +------+-----+             |
              |                   |
              |  Internet         |
--------------+-------------------|-----
              |                   |
              |  Local Network    |
 192.168.0.100|                   |
  +-----------+----------+        |
  |                      |tun     |
  |      VPN Client      +--------+
  |                      |192.168.100.x
  +----------------------+
[1] Install OpenVPN.
root@dlp:~#
apt -y install openvpn easy-rsa iptables
[2] Create CA and Certificates.
root@dlp:~#
cd /usr/share/easy-rsa
# initialize

root@dlp:/usr/share/easy-rsa#
./easyrsa init-pki 


* Notice:

  init-pki complete; you may now create a CA or requests.

  Your newly created PKI dir is:
  * /usr/share/easy-rsa/pki

* Notice:
  IMPORTANT: Easy-RSA 'vars' file has now been moved to your PKI above.
# create CA

root@dlp:/usr/share/easy-rsa#
./easyrsa build-ca 

* Notice:
Using SSL: openssl OpenSSL 3.0.9 30 May 2023 (Library: OpenSSL 3.0.9 30 May 2023)

# set any pass-phrase
Enter New CA Key Passphrase:
Re-Enter New CA Key Passphrase:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
# set any name
Common Name (eg: your user, host, or server name) [Easy-RSA CA]:Server-CA

* Notice:

CA creation complete and you may now import and sign cert requests.
Your new CA certificate file for publishing is at:
/usr/share/easy-rsa/pki/ca.crt
# create server certificates
# any name is OK for [server1] name
# (it is set for file name of certs or commonName)

root@dlp:/usr/share/easy-rsa#
./easyrsa build-server-full server1 nopass 

* Notice:
Using SSL: openssl OpenSSL 3.0.9 30 May 2023 (Library: OpenSSL 3.0.9 30 May 2023)

-----
* Notice:

Keypair and certificate request completed. Your files are:
req: /usr/share/easy-rsa/pki/reqs/server1.req
key: /usr/share/easy-rsa/pki/private/server1.key


You are about to sign the following certificate.
Please check over the details shown below for accuracy. Note that this request
has not been cryptographically verified. Please be sure it came from a trusted
source or that you have verified the request checksum with the sender.

Request subject, to be signed as a server certificate for 825 days:

subject=
    commonName                = server1

Type the word 'yes' to continue, or any other input to abort.
  Confirm request details: yes

Using configuration from /usr/share/easy-rsa/pki/8931a156/temp.a29069b3
# answer with pass-phrase set on CA
Enter pass phrase for /usr/share/easy-rsa/pki/private/ca.key:
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName            :ASN.1 12:'server1'
Certificate is to be certified until Oct 20 04:34:15 2025 GMT (825 days)

Write out database with 1 new entries
Data Base Updated

* Notice:
Certificate created at: /usr/share/easy-rsa/pki/issued/server1.crt
# create client certificates
# any name is OK for [client1] name
# (it is set for file name of certs or commonName)

root@dlp:/usr/share/easy-rsa#
./easyrsa build-client-full client1 nopass 

* Notice:
Using Easy-RSA configuration from: /usr/share/easy-rsa/pki/vars

* Notice:
Using SSL: openssl OpenSSL 3.0.9 30 May 2023 (Library: OpenSSL 3.0.9 30 May 2023)

* Notice:

Keypair and certificate request completed. Your files are:
req: /usr/share/easy-rsa/pki/reqs/client1.req
key: /usr/share/easy-rsa/pki/private/client1.key

You are about to sign the following certificate.
Please check over the details shown below for accuracy. Note that this request
has not been cryptographically verified. Please be sure it came from a trusted
source or that you have verified the request checksum with the sender.

Request subject, to be signed as a client certificate for 825 days:

subject=
    commonName                = client1

Type the word 'yes' to continue, or any other input to abort.
  Confirm request details: yes

Using configuration from /usr/share/easy-rsa/pki/f58905b9/temp.79e305f7
# answer with pass-phrase set on CA
Enter pass phrase for /usr/share/easy-rsa/pki/private/ca.key:
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName            :ASN.1 12:'client1'
Certificate is to be certified until Oct 20 04:37:39 2025 GMT (825 days)

Write out database with 1 new entries
Data Base Updated

* Notice:
Certificate created at: /usr/share/easy-rsa/pki/issued/client1.crt
# generate Diffie Hellman ( DH ) parameter

root@dlp:/usr/share/easy-rsa#
./easyrsa gen-dh 

* Notice:
Using Easy-RSA configuration from: /usr/share/easy-rsa/pki/vars

* Notice:
Using SSL: openssl OpenSSL 3.0.9 30 May 2023 (Library: OpenSSL 3.0.9 30 May 2023)

Generating DH parameters, 2048 bit long safe prime

* Notice:

DH parameters of size 2048 created at /usr/share/easy-rsa/pki/dh.pem
# create TLS-Auth key

root@dlp:/usr/share/easy-rsa#
openvpn --genkey secret ./pki/ta.key
# copy generated certs

root@dlp:/usr/share/easy-rsa#
cp -pR /usr/share/easy-rsa/pki/{issued,private,ca.crt,dh.pem,ta.key} /etc/openvpn/server/

[3] Configure OpenVPN.
It based on the environment Firewalld is running because of using routing rules.
# copy sample configuration

root@dlp:~#
cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf /etc/openvpn/server/
root@dlp:~#
vi /etc/openvpn/server/server.conf
# line 32 : change if need (listening port of OpenVPN)

port 1194
# line 35 : change if need (use udp on this example)

;proto tcp
proto udp
# line 53 : change if need (use tun on this example)

;dev tap
dev tun
# line 78 : specify certificates

ca
ca.crt

cert
issued/server1.crt

key
private/server1.key
# line 85 : specify DH file

dh
dh.pem
# line 101 : specify network to be used on VPN
# any network are OK except your local network

server
192.168.100.0 255.255.255.0
# line 142 : uncomment and change to your local network

push "route
10.0.0.0 255.255.255.0
"
# line 231 : keepalive settings

keepalive 10 120
# line 244 : specify TLS-Auth key

tls-auth
ta.key 0
# line 281 : enable persist options

persist-key
persist-tun
# line 306 : specify log level (0 - 9, 9 means debug level)

verb 3
root@dlp:~#
vi /etc/openvpn/server/add-bridge.sh
# create new

#!/bin/bash

# network interface which can connect to local network
IF=enp1s0
# interface VPN tunnel uses
# for the case of this example like specifying [tun] on the config, generally this param is [tun0]
VPNIF=tun0

echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -A FORWARD -i ${VPNIF} -j ACCEPT
iptables -t nat -A POSTROUTING -o ${IF} -j MASQUERADE
root@dlp:~#
vi /etc/openvpn/server/remove-bridge.sh
# create new

#!/bin/bash

# network interface which can connect to local network
IF=enp1s0
# interface VPN tunnel uses
# for the case of this example like specifying [tun] on the config, generally this param is [tun0]
VPNIF=tun0

echo 0 > /proc/sys/net/ipv4/ip_forward
iptables -D FORWARD -i  ${VPNIF} -j ACCEPT
iptables -t nat -D POSTROUTING -o ${IF} -j MASQUERADE
root@dlp:~#
chmod 700 /etc/openvpn/server/{add-bridge.sh,remove-bridge.sh}

root@dlp:~#
vi /lib/systemd/system/openvpn-server@.service
# add into [Service] section

[Service]
.....
.....
ExecStartPost=/etc/openvpn/server/add-bridge.sh
ExecStopPost=/etc/openvpn/server/remove-bridge.sh
root@dlp:~#
systemctl daemon-reload

root@dlp:~#
systemctl enable --now openvpn-server@server

[4]
Transfer certs follows you generated to Client Host you'd like to connect with VPN.
It's OK all for VPN Server settings.
・/etc/openvpn/server/ca.crt
・/etc/openvpn/server/ta.key
・/etc/openvpn/server/issued/client1.crt
・/etc/openvpn/server/private/client1.key
Matched Content