VPN [TUTORIAL] OpenVPN Server Setup (Debian 8 Jessie)

[VPN] [TUTORIAL] OpenVPN Server Setup (Debian 8 Jessie) - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: VPN, Proxies, and Socks (https://hackforums.net/forumdisplay.php?fid=91)
+---- Thread: [VPN] [TUTORIAL] OpenVPN Server Setup (Debian 8 Jessie) (/showthread.php?tid=5838690)

[TUTORIAL] OpenVPN Server Setup (Debian 8 Jessie) - Qismon - May 19, 2018

Hello all, I did not see too many tutorials about setting up OpenVPN Server side so hopefully this helps anyone looking for that.

I am installing on Linux Debian 8 Jessie 64Bit (KVM Virtualization).

# STEP 1: Install OpenVPN Server & EasyRSA.

Code 
apt-get update

apt-get dist-upgrade

apt-get install openvpn

apt-get install easy-rsa

# STEP 2: Copy needed EasyRSA files for generating Server-Client keys to OpenVPN folder.

Code 
cp -R /usr/share/easy-rsa /etc/openvpn/

# STEP 3: Edit VARS file Location & Export Keysize.

Code 
nano /etc/openvpn/easy-rsa/vars

Note: These are the default values for fields which will be placed in the certificate. Do not leave any of these fields blank.

export KEY_COUNTRY="US"
export KEY_PROVINCE="CA"
export KEY_CITY="SanFrancisco"
export KEY_ORG="Fort-Funston"
export KEY_EMAIL="[email protected]"
export KEY_OU=ChangeMe

Now find another line that looks like this >> export KEY_SIZE=2048
And we will change the keysize so the line now looks like this >> export KEY_SIZE=4096

After making all needed changes you can save the file and exit.
Using nano this can be done by pressing Ctrl+o...You will be prompted to confirm the change, just press enter. Then Ctrl+x to exit nano.

# STEP 4: Build ca.key

Code 
cd /etc/openvpn/easy-rsa/

source vars

./clean-all

./build-ca

Just press enter for each prompt to use the default settings.

# STEP 5: Build server.key

Code 
./build-key-server server

Note: Do not add a password while generating the server key.

Now you will see 2 prompts to confirm the signing of the certificate.
Press "y" for both prompts and you should see the following message if all went fine :: Write out database with 1 new entries Data Base Updated.

# STEP 6: Generate DH Parameters. (Go for a coffee after this step...this will take a while.)

Code 
./build-dh

# STEP 7: Copy all certs and keys to OpenVPN folder.

Code 
cd /etc/openvpn/easy-rsa/keys

cp server.crt server.key ca.crt dh4096.pem /etc/openvpn/

# STEP 8: Configure OpenVPN server.conf

Code 
cd /etc/openvpn/

zcat /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz > /etc/openvpn/server.conf

sed -i -r 's/^dh (.+)/dh dh4096.pem/g' /etc/openvpn/server.conf

echo 'crl-verify easy-rsa/keys/crl.pem' >> /etc/openvpn/server.conf

echo 'push "redirect-gateway def1 bypass-dhcp"' >> /etc/openvpn/server.conf

echo 'push "dhcp-option DNS 8.8.8.8"' >> /etc/openvpn/server.conf

echo 'push "explicit-exit-notify 3"' >> /etc/openvpn/server.conf

echo 'cipher AES-256-CBC' >> /etc/openvpn/server.conf

Note: If you prefer to change the DNS because you are Anti-Google, here are a few alternatives.
https://www.ungefiltert-surfen.de
https://blog.cloudflare.com/announcing-1111

# STEP 9: Configure Network and IPTables to allow VPN Passthrough.
Note: This step is different if you are using a VPS with KVM or OpenVZ Virtualization. KVM is my preference.
! ONLY RUN THE CODE FOR YOUR VPS VIRTUALIZATION VERSION !

# KVM VERSION BELOW

Code 
iptables -A INPUT -p udp -m state --state NEW -m udp --dport 1194 -j ACCEPT

iptables -A FORWARD -s 10.8.0.0/24 -j ACCEPT

iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT 

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

# OPENVZ VERSION BELOW (Change the WAN IP on line 5 to your VPS IP)

Code 
iptables -F

iptables -P OUTPUT ACCEPT

iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

iptables -A FORWARD -s 10.8.0.0/24 -j ACCEPT

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to-source 123.45.67.89

iptables -A INPUT -p udp --dport 1194 -j ACCEPT

iptables -A INPUT -p icmp -j ACCEPT

iptables -A INPUT -i lo -j ACCEPT

iptables -A INPUT -i tun0 -j ACCEPT

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables-save

Ok now we need to add our IPTables rules to startup incase we reboot the server.

Code 
iptables --list

iptables-save > /etc/firewall.conf

cd /etc/network/if-up.d/

touch iptables

nano iptables

This will open the new blank file we created called "iptables".
Copy the code below to "iptables" then save and exit by pressing
Ctrl+o then Enter to confirm changes, then Ctrl+x to exit nano.

Code 
#!/bin/sh

iptables-restore < /etc/firewall.conf

Make our new "iptables" file executable.

Code 
chmod +x /etc/network/if-up.d/iptables

# STEP 10: Start OpenVPN Service and check status.

Code 
systemctl enable openvpn@server

systemctl start openvpn@server

service openvpn restart

service openvpn status

When you run "service openvpn status" you should see a terminal output similar to the following.

Code 
root@binn:/etc/openvpn/easy-rsa/keys# service openvpn status

● openvpn.service - OpenVPN service

   Loaded: loaded (/lib/systemd/system/openvpn.service; enabled)

   Active: active (exited) since Thu 2018-05-03 22:56:46 MSK; 2 weeks 1 days ago

 Main PID: 455 (code=exited, status=0/SUCCESS)

   CGroup: /system.slice/openvpn.service

If OpenVPN Service is running fine then we can move on to the final step.

# STEP 11: Generate OpenVPN Client File with In-Line CA, Cert and Key.

Code 
cd /etc/openvpn/easy-rsa/

source vars

./build-key client

Note: Just press enter for each prompt to use the default settings.
Do not add a password while generating the client key.

Now you will see 2 prompts to confirm the signing of the certificate.
Press "y" for both prompts and you should see the following message if all went fine :: Write out database with 1 new entries Data Base Updated.

Change the WAN IP on line 4 to your VPS IP, then copy and paste all the code below to make your client.ovpn file.

Code 
echo 'client

dev tun

proto udp

remote 123.45.67.89 1194

resolv-retry infinite

nobind

persist-key

persist-tun

remote-cert-tls server

cipher AES-256-CBC

comp-lzo

verb 3' > /etc/openvpn/client.ovpn

echo '<ca>' >> /etc/openvpn/client.ovpn

cat /etc/openvpn/ca.crt >> /etc/openvpn/client.ovpn

echo '</ca>' >> /etc/openvpn/client.ovpn

echo '<cert>' >> /etc/openvpn/client.ovpn

cat /etc/openvpn/easy-rsa/keys/client.crt >> /etc/openvpn/client.ovpn

echo '</cert>' >> /etc/openvpn/client.ovpn

echo '<key>' >> /etc/openvpn/client.ovpn

cat /etc/openvpn/easy-rsa/keys/client.key >> /etc/openvpn/client.ovpn

echo '</key>' >> /etc/openvpn/client.ovpn

Drop the client.ovpn file in your OpenVPN client config folder and you should be able to connect just fine.

Later on I will add another tutorial of how to create a MySQL Database to manage user/pass with auth-pam module.

Hopefully this will be helpful for some. 🤝

RE: [TUTORIAL] OpenVPN Server Setup (Debian 8 Jessie) - inkbird - May 20, 2018

Wow dude. Thank you for this.

RE: [TUTORIAL] OpenVPN Server Setup (Debian 8 Jessie) - Qismon - May 21, 2018

(May 20, 2018 11:26 AM)inkbird Wrote: Wow dude. Thank you for this.

You are welcome!

If you need any help setting it up let me know. 🤝