Share My Inspiration

<div style="text-align: justify;">
<span style="font-size: large; letter-spacing: -0.5px;"><b>Introduction</b></span></div>
<div class="content-body tutorial-content" style="background-color: white; font-family: proxima-nova, sans-serif;">
<div style="font-size: 16px; line-height: 28px; margin-bottom: 22px; padding: 0px; text-align: justify;">
OpenVPN Access Server, from the official website is "a full featured SSL VPN software solution that integrates OpenVPN server capabilities, enterprise management capabilities, simplified OpenVPN Connect UI, and OpenVPN Client software packages that accommodate Windows, MAC, and Linux OS environments."<br />
The installation of OpenVPN AS is much simpler compared to the traditional OpenVPN (without any GUI). Another great thing about about OpenVPN AS (Access Server) is that it has a mobile application for both Android and iOS platforms, enabling you to access your OpenVPN server on your smartphone as well.</div>
<h3 style="color: #2d2d2d; letter-spacing: 0.2px; margin: 10px 0px; padding: 0px; text-align: justify;">
<span style="font-size: large;">Installing OpenVPN Acess Server</span></h3>
<div>
<div style="border: 0px; color: #2b2b2b; font-family: Lato, sans-serif; font-size: 16px; line-height: 24px; margin-bottom: 24px; outline: 0px; padding: 0px; text-align: justify; vertical-align: baseline;">
<div style="border: 0px; margin-bottom: 24px; outline: 0px; padding: 0px; text-align: start; vertical-align: baseline;">
Before we begin, lets get the installation of the pre-reqs done.</div>
<pre style="border: 1px solid rgba(0, 0, 0, 0.0980392); box-sizing: border-box; font-family: monospace, serif; font-size: 15px; margin-bottom: 24px; max-width: 100%; outline: 0px; overflow: auto; padding: 12px; text-align: start; vertical-align: baseline; white-space: pre-wrap; word-wrap: break-word;">apt-get install bridge-utils openvpn libssl-dev openssl
</pre>
<div style="border: 0px; margin-bottom: 24px; outline: 0px; padding: 0px; text-align: start; vertical-align: baseline;">
On the Ubuntu Server, we need to start by configuring the bridge adapter with Bridge Utilities. OpenVPN requires this ‘virtual interface’ when setting up the tap interface it needs to pass traffic into the internal network. This is done by modifying the interfaces file.</div>
<pre style="border: 1px solid rgba(0, 0, 0, 0.0980392); box-sizing: border-box; font-family: monospace, serif; font-size: 15px; margin-bottom: 24px; max-width: 100%; outline: 0px; overflow: auto; padding: 12px; text-align: start; vertical-align: baseline; white-space: pre-wrap; word-wrap: break-word;">nano /etc/network/interfaces
</pre>
<div style="border: 0px; margin-bottom: 24px; outline: 0px; padding: 0px; text-align: start; vertical-align: baseline;">
When editing this file, you need to remove or comment out the original eth port settings and replace with what you see below. This creates a new br0 interface and allows eth0 to essentially communicate across it (hence the label ‘bridge’). You will, of course, adjust the file for your specific subnet scheme.</div>
<pre style="border: 1px solid rgba(0, 0, 0, 0.0980392); box-sizing: border-box; font-family: monospace, serif; font-size: 15px; margin-bottom: 24px; max-width: 100%; outline: 0px; overflow: auto; padding: 12px; text-align: start; vertical-align: baseline; white-space: pre-wrap; word-wrap: break-word;"> 
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
auto eth0

#iface eth0 inet static
#       address 192.168.1.15
#       netmask 255.255.255.0
#       network 192.168.1.0
#       broadcast 192.168.1.255
#       gateway 192.168.1.1
#        # dns-* options are implemented by the resolvconf package, if installed
#       dns-nameservers 192.168.1.15
#       dns-search myhome.local

auto br0
iface br0 inet static
        address 192.168.1.15
        netmask 255.255.255.0
        gateway 192.168.1.1
        network 192.168.1.0
        broadcast 192.168.1.255
        bridge_ports eth0
#### NOTE: If you are running OpenVPN in a virtual machine, then uncomment these lines:
# bridge_fd 9
# bridge_hello 2
# bridge_maxage 12
# bridge_stp off

iface eth0 inet manual
        up ifconfig $IFACE 0.0.0.0 up
        up ip link set $IFACE promisc on
        down ip link set $IFACE promisc off
        down ifconfig $IFACE down
</pre>
<div style="border: 0px; margin-bottom: 24px; outline: 0px; padding: 0px; text-align: start; vertical-align: baseline;">
Next, we need to allow IPv4 forwarding so the server can send out packets on the VPN’s behalf.</div>
<pre style="border: 1px solid rgba(0, 0, 0, 0.0980392); box-sizing: border-box; font-family: monospace, serif; font-size: 15px; margin-bottom: 24px; max-width: 100%; outline: 0px; overflow: auto; padding: 12px; text-align: start; vertical-align: baseline; white-space: pre-wrap; word-wrap: break-word;">nano /etc/sysctl.conf
</pre>
<div style="border: 0px; margin-bottom: 24px; outline: 0px; padding: 0px; text-align: start; vertical-align: baseline;">
Uncomment the line net.ipv4.ip_forward=1</div>
<div style="border: 0px; margin-bottom: 24px; outline: 0px; padding: 0px; text-align: start; vertical-align: baseline;">
Restart networking and run ‘sysctl -p’ for the changes to take effect. Or just restart the server.</div>
<div style="border: 0px; margin-bottom: 24px; outline: 0px; padding: 0px; text-align: start; vertical-align: baseline;">
Create Server Keys<br />
We need to create the server keys and client keys that we need for the OpenVPN server and the eventual client. Easy-RSA will be used to generate the items we need.</div>
<div style="border: 0px; margin-bottom: 24px; outline: 0px; padding: 0px; text-align: start; vertical-align: baseline;">
<span style="border: 0px; font-family: inherit; font-style: inherit; font-weight: 700; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">If you are on 12.04</span> Create the easy-rsa folder and copy the sample files into it.</div>
<pre style="border: 1px solid rgba(0, 0, 0, 0.0980392); box-sizing: border-box; font-family: monospace, serif; font-size: 15px; margin-bottom: 24px; max-width: 100%; outline: 0px; overflow: auto; padding: 12px; text-align: start; vertical-align: baseline; white-space: pre-wrap; word-wrap: break-word;">sudo mkdir /etc/openvpn/easy-rsa/
sudo cp -R /usr/share/doc/openvpn/examples/easy-rsa/2.0/* /etc/openvpn/easy-rsa/
sudo chown -R $USER /etc/openvpn/easy-rsa/
</pre>
<div style="border: 0px; margin-bottom: 24px; outline: 0px; padding: 0px; text-align: start; vertical-align: baseline;">
<span style="border: 0px; font-family: inherit; font-style: inherit; font-weight: 700; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">If you are on 14.04</span>, easy-rsa is an installed application with the utilities built in to create the needed directory.</div>
<pre style="border: 1px solid rgba(0, 0, 0, 0.0980392); box-sizing: border-box; font-family: monospace, serif; font-size: 15px; margin-bottom: 24px; max-width: 100%; outline: 0px; overflow: auto; padding: 12px; text-align: start; vertical-align: baseline; white-space: pre-wrap; word-wrap: break-word;"> 
apt-get install easy-rsa
make-cadir /etc/openvpn/easy-rsa
</pre>
<div style="border: 0px; margin-bottom: 24px; outline: 0px; padding: 0px; text-align: start; vertical-align: baseline;">
Edit the vars file and edit the following items for your needs. These items are located near the bottom of the vars file.</div>
<pre style="border: 1px solid rgba(0, 0, 0, 0.0980392); box-sizing: border-box; font-family: monospace, serif; font-size: 15px; margin-bottom: 24px; max-width: 100%; outline: 0px; overflow: auto; padding: 12px; text-align: start; vertical-align: baseline; white-space: pre-wrap; word-wrap: break-word;">sudo nano /etc/openvpn/easy-rsa/vars

export KEY_COUNTRY="US"
export KEY_PROVINCE="NY"
export KEY_CITY="New York City"
export KEY_ORG="Queens"
export KEY_EMAIL="me@myhost.mydomain"
</pre>
<div style="border: 0px; margin-bottom: 24px; outline: 0px; padding: 0px; text-align: start; vertical-align: baseline;">
Next step is to generate the Server Keys</div>
<pre style="border: 1px solid rgba(0, 0, 0, 0.0980392); box-sizing: border-box; font-family: monospace, serif; font-size: 15px; margin-bottom: 24px; max-width: 100%; outline: 0px; overflow: auto; padding: 12px; text-align: start; vertical-align: baseline; white-space: pre-wrap; word-wrap: break-word;">cd /etc/openvpn/easy-rsa/
source vars
./clean-all
./build-dh
./pkitool --initca
./pkitool --server server
cd keys
openvpn --genkey --secret ta.key
</pre>
<div style="border: 0px; margin-bottom: 24px; outline: 0px; padding: 0px; text-align: start; vertical-align: baseline;">
<span style="border: 0px; font-family: inherit; font-style: inherit; font-weight: 700; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Note:</span> if you get an error on the command “./pkitool –initca”<br />
grep: /etc/openvpn/easy-rsa/openssl.cnf: No such file or directory<br />
pkitool: KEY_CONFIG (set by the ./vars script) is pointing to the wrong<br />
version of openssl.cnf: /etc/openvpn/easy-rsa/openssl.cnf<br />
The correct version should have a comment that says: easy-rsa version 2.x</div>
<div style="border: 0px; margin-bottom: 24px; outline: 0px; padding: 0px; text-align: start; vertical-align: baseline;">
You are hitting a known bug #998918 https://bugs.launchpad.net/ubuntu/+source/openvpn/+bug/998918.<br />
In a nutshell, openvpn easy-rsa is missing the openssl.cnf file in the package. As a workaround, create a softlink and rerun the pkitool using the following:</div>
<pre style="border: 1px solid rgba(0, 0, 0, 0.0980392); box-sizing: border-box; font-family: monospace, serif; font-size: 15px; margin-bottom: 24px; max-width: 100%; outline: 0px; overflow: auto; padding: 12px; text-align: start; vertical-align: baseline; white-space: pre-wrap; word-wrap: break-word;">    cd /etc/openvpn/easy-rsa/
    ln -s openssl-1.0.0.cnf openssl.cnf     
    ./pkitool --initca
</pre>
<div style="border: 0px; margin-bottom: 24px; outline: 0px; padding: 0px; text-align: start; vertical-align: baseline;">
Continue on from there.</div>
<div style="border: 0px; margin-bottom: 24px; outline: 0px; padding: 0px; text-align: start; vertical-align: baseline;">
Now copy certain keys to the openvpn directory</div>
<pre style="border: 1px solid rgba(0, 0, 0, 0.0980392); box-sizing: border-box; font-family: monospace, serif; font-size: 15px; margin-bottom: 24px; max-width: 100%; outline: 0px; overflow: auto; padding: 12px; text-align: start; vertical-align: baseline; white-space: pre-wrap; word-wrap: break-word;">cp server.crt server.key ca.crt dh1024.pem ta.key /etc/openvpn/
</pre>
<div style="border: 0px; margin-bottom: 24px; outline: 0px; padding: 0px; text-align: start; vertical-align: baseline;">
<span style="border: 0px; font-family: inherit; font-style: inherit; font-weight: 700; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Create Client Certificates</span></div>
<div style="border: 0px; margin-bottom: 24px; outline: 0px; padding: 0px; text-align: start; vertical-align: baseline;">
If you are using the default method of authentication, have a client cert per client, then you need to create the cert on the openvpn server for the client. This is done on the server, not on the client because the server’s CA needs to sign the key. Also, the client cert process will prompt you for a client cert password. You need to give this to the client along with the cert.</div>
<pre style="border: 1px solid rgba(0, 0, 0, 0.0980392); box-sizing: border-box; font-family: monospace, serif; font-size: 15px; margin-bottom: 24px; max-width: 100%; outline: 0px; overflow: auto; padding: 12px; text-align: start; vertical-align: baseline; white-space: pre-wrap; word-wrap: break-word;">cd /etc/openvpn/easy-rsa/
source vars
./pkitool client-name
</pre>
<div style="border: 0px; margin-bottom: 24px; outline: 0px; padding: 0px; text-align: start; vertical-align: baseline;">
Those commands will create new files int the easy-rsa/keys directory called client-name.crt and client-name.key (client-name.csr is the text request and can be ignored/deleted). These 2 files need to be copied out the client, along with the server ca.crt and the ta.key (the ta.key is used if TLS is enabled in server conf).</div>
<div style="border: 0px; margin-bottom: 24px; outline: 0px; padding: 0px; text-align: start; vertical-align: baseline;">
/etc/openvpn/ca.crt<br />
/etc/openvpn/ta.key<br />
/etc/openvpn/easy-rsa/keys/client-name.crt<br />
/etc/openvpn/easy-rsa/keys/client-name.key</div>
<div style="border: 0px; margin-bottom: 24px; outline: 0px; padding: 0px; text-align: start; vertical-align: baseline;">
These files need to be copied to the client and placed in the proper folder. For a linux client, this would usually be the /home/folder for the user. For windows based machines, this would be in the openvpn client install folder where the profiles are stored.</div>
<div style="border: 0px; margin-bottom: 24px; outline: 0px; padding: 0px; text-align: start; vertical-align: baseline;">
<span style="border: 0px; font-family: inherit; font-style: inherit; font-weight: 700; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Create OpenVPN Server scripts</span></div>
<div style="border: 0px; margin-bottom: 24px; outline: 0px; padding: 0px; text-align: start; vertical-align: baseline;">
We need 2 scripts in the /etc/openvpn directory to manage bringing the server up and down.</div>
<pre style="border: 1px solid rgba(0, 0, 0, 0.0980392); box-sizing: border-box; font-family: monospace, serif; font-size: 15px; margin-bottom: 24px; max-width: 100%; outline: 0px; overflow: auto; padding: 12px; text-align: start; vertical-align: baseline; white-space: pre-wrap; word-wrap: break-word;">nano /etc/openvpn/up.sh

#!/bin/sh
BR=$1
DEV=$2
MTU=$3
/sbin/ifconfig $DEV mtu $MTU promisc up
/sbin/brctl addif $BR $DEV
</pre>
<div style="border: 0px; margin-bottom: 24px; outline: 0px; padding: 0px; text-align: start; vertical-align: baseline;">
and</div>
<pre style="border: 1px solid rgba(0, 0, 0, 0.0980392); box-sizing: border-box; font-family: monospace, serif; font-size: 15px; margin-bottom: 24px; max-width: 100%; outline: 0px; overflow: auto; padding: 12px; text-align: start; vertical-align: baseline; white-space: pre-wrap; word-wrap: break-word;">nano /etc/openvpn/down.sh

#!/bin/sh
BR=$1
DEV=$2
/sbin/brctl delif $BR $DEV
/sbin/ifconfig $DEV down
</pre>
<div style="border: 0px; margin-bottom: 24px; outline: 0px; padding: 0px; text-align: start; vertical-align: baseline;">
Then we need to make the scripts executable:</div>
<pre style="border: 1px solid rgba(0, 0, 0, 0.0980392); box-sizing: border-box; font-family: monospace, serif; font-size: 15px; margin-bottom: 24px; max-width: 100%; outline: 0px; overflow: auto; padding: 12px; text-align: start; vertical-align: baseline; white-space: pre-wrap; word-wrap: break-word;"> 
sudo chmod 755 /etc/openvpn/down.sh
sudo chmod 755 /etc/openvpn/up.sh
</pre>
<div style="border: 0px; margin-bottom: 24px; outline: 0px; padding: 0px; text-align: start; vertical-align: baseline;">
Last step is to copy in the sample server config file and edit it to support our config. This sample is a default method using only certificates, but this could be changed to support id/pw instead of user certs (good for large subscription based services), or even 2 factor auth requiring both the cert and the password.</div>
<div style="border: 0px; margin-bottom: 24px; outline: 0px; padding: 0px; text-align: start; vertical-align: baseline;">
Also note that this config is a bridged network where the client will have an IP right on the target subnet. This sample server config reflects that solution. The Alternative is to create a 2nd subnet for the clients and have the server route between the vpn client and target subnet. For this home solution, that’s overkill, but would be useful in larger setups or where extra security is needed and the remote subnets can be used for access control.</div>
<pre style="border: 1px solid rgba(0, 0, 0, 0.0980392); box-sizing: border-box; font-family: monospace, serif; font-size: 15px; margin-bottom: 24px; max-width: 100%; outline: 0px; overflow: auto; padding: 12px; text-align: start; vertical-align: baseline; white-space: pre-wrap; word-wrap: break-word;">cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz /etc/openvpn/
gzip -d /etc/openvpn/server.conf.gz
nano /etc/openvpn/server.conf
</pre>
<div style="border: 0px; margin-bottom: 24px; outline: 0px; padding: 0px; text-align: start; vertical-align: baseline;">
Edit the /etc/openvpn/server.conf file and make the following changes:</div>
<div style="border: 0px; margin-bottom: 24px; outline: 0px; padding: 0px; text-align: start; vertical-align: baseline;">
Change the following because we don’t want a routed solution.</div>
<pre style="border: 1px solid rgba(0, 0, 0, 0.0980392); box-sizing: border-box; font-family: monospace, serif; font-size: 15px; margin-bottom: 24px; max-width: 100%; outline: 0px; overflow: auto; padding: 12px; text-align: start; vertical-align: baseline; white-space: pre-wrap; word-wrap: break-word;">;dev tap
dev tun
;to
dev tap0
;dev tun
</pre>
<div style="border: 0px; margin-bottom: 24px; outline: 0px; padding: 0px; text-align: start; vertical-align: baseline;">
Change the following because bridged networks don’t need it.</div>
<pre style="border: 1px solid rgba(0, 0, 0, 0.0980392); box-sizing: border-box; font-family: monospace, serif; font-size: 15px; margin-bottom: 24px; max-width: 100%; outline: 0px; overflow: auto; padding: 12px; text-align: start; vertical-align: baseline; white-space: pre-wrap; word-wrap: break-word;">server 10.8.0.0 255.255.255.0
;to
;server 10.8.0.0 255.255.255.0
</pre>
<div style="border: 0px; margin-bottom: 24px; outline: 0px; padding: 0px; text-align: start; vertical-align: baseline;">
Change the following so OpenVPN can manage the bridged traffic ans assign IPs. (edit these to reflect your scheme).</div>
<pre style="border: 1px solid rgba(0, 0, 0, 0.0980392); box-sizing: border-box; font-family: monospace, serif; font-size: 15px; margin-bottom: 24px; max-width: 100%; outline: 0px; overflow: auto; padding: 12px; text-align: start; vertical-align: baseline; white-space: pre-wrap; word-wrap: break-word;">;server-bridge 10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100
;to
server-bridge 'server-ip' 'subnetmask' 'DHCP start ip' 'DHCP Ending ip'
</pre>
<div style="border: 0px; margin-bottom: 24px; outline: 0px; padding: 0px; text-align: start; vertical-align: baseline;">
Change this so the vpn clients have the correct GW router for all your IP traffic (edit these to reflect your scheme)</div>
<pre style="border: 1px solid rgba(0, 0, 0, 0.0980392); box-sizing: border-box; font-family: monospace, serif; font-size: 15px; margin-bottom: 24px; max-width: 100%; outline: 0px; overflow: auto; padding: 12px; text-align: start; vertical-align: baseline; white-space: pre-wrap; word-wrap: break-word;">;push "route 192.168.10.0 255.255.255.0"
;to
push "route 192.168.1.1 255.255.255.0"
</pre>
<div style="border: 0px; margin-bottom: 24px; outline: 0px; padding: 0px; text-align: start; vertical-align: baseline;">
Change this so all your client traffic passes through the VPN.</div>
<pre style="border: 1px solid rgba(0, 0, 0, 0.0980392); box-sizing: border-box; font-family: monospace, serif; font-size: 15px; margin-bottom: 24px; max-width: 100%; outline: 0px; overflow: auto; padding: 12px; text-align: start; vertical-align: baseline; white-space: pre-wrap; word-wrap: break-word;">;push "redirect-gateway def1 bypass-dhcp"
;to
push "redirect-gateway def1 bypass-dhcp"
</pre>
<div style="border: 0px; margin-bottom: 24px; outline: 0px; padding: 0px; text-align: start; vertical-align: baseline;">
Change these to 1 of your internal DNS servers if you have 1, otherwise use any public dns you want.</div>
<pre style="border: 1px solid rgba(0, 0, 0, 0.0980392); box-sizing: border-box; font-family: monospace, serif; font-size: 15px; margin-bottom: 24px; max-width: 100%; outline: 0px; overflow: auto; padding: 12px; text-align: start; vertical-align: baseline; white-space: pre-wrap; word-wrap: break-word;">;push "dhcp-option DNS 208.67.222.222"
;push "dhcp-option DNS 208.67.220.220"
;to
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
</pre>
<div style="border: 0px; margin-bottom: 24px; outline: 0px; padding: 0px; text-align: start; vertical-align: baseline;">
Change this to implement tls auth, without a proper file, the initial UDP communication is dropped. It also saves on processor time since it doesn’t have to service bad requests.</div>
<pre style="border: 1px solid rgba(0, 0, 0, 0.0980392); box-sizing: border-box; font-family: monospace, serif; font-size: 15px; margin-bottom: 24px; max-width: 100%; outline: 0px; overflow: auto; padding: 12px; text-align: start; vertical-align: baseline; white-space: pre-wrap; word-wrap: break-word;">;tls-auth ta.key 0 # This file is secret
;to
tls-auth ta.key 0 # This file is secret
</pre>
<div style="border: 0px; margin-bottom: 24px; outline: 0px; padding: 0px; text-align: start; vertical-align: baseline;">
Change the following to increase security so the VPN service has restricted access</div>
<pre style="border: 1px solid rgba(0, 0, 0, 0.0980392); box-sizing: border-box; font-family: monospace, serif; font-size: 15px; margin-bottom: 24px; max-width: 100%; outline: 0px; overflow: auto; padding: 12px; text-align: start; vertical-align: baseline; white-space: pre-wrap; word-wrap: break-word;">;user nobody
;group nogroup
;to
user nobody
group nogroup
</pre>
<div style="border: 0px; margin-bottom: 24px; outline: 0px; padding: 0px; text-align: start; vertical-align: baseline;">
Add this to the bottom of the file to manage starting and stopping the networking for VPN.</div>
<pre style="border: 1px solid rgba(0, 0, 0, 0.0980392); box-sizing: border-box; font-family: monospace, serif; font-size: 15px; margin-bottom: 24px; max-width: 100%; outline: 0px; overflow: auto; padding: 12px; text-align: start; vertical-align: baseline; white-space: pre-wrap; word-wrap: break-word;">up "/etc/openvpn/up.sh br0"
down "/etc/openvpn/down.sh br0"
script-security 3
</pre>
<div style="border: 0px; margin-bottom: 24px; outline: 0px; padding: 0px; text-align: start; vertical-align: baseline;">
With that, you should be able to load the openvpn client, copy in the Ca and user certs and get a connection.</div>
<div style="border: 0px; margin-bottom: 24px; outline: 0px; padding: 0px; text-align: start; vertical-align: baseline;">
Remember the ta.key is used if ‘tls-auth’ is activated on the server.conf.</div>
</div>
</div>
</div>

How To Install OpenVPN on Ubuntu Server 12.04

Introduction OpenVPN Access Server, from the official website is "a full featured SSL VPN software solution that integrates OpenVPN...

+ Baca selengkapnya »