This thread will teach you how to set-up and configure a OpenVPN server on CentOS 6. This tutorial will also teach you how to configure your Windows, OSX, or Linux client to connect to your OpenVPN Server. Before we begin, you'll need to have the Extra Packages for Enterprise Linux (EPEL) Repository enabled on your server. To do this, we're going to want to enter in the following commands on our CentOS Server.
Now that we've downloaded the EPEl Repository we're going to want to install the OpenVPN package from EPEL, to do so, we're going to want to execute the following commands
Now that we've moved our file in the proper location, we are going to want to open the file for editing to make it configured to our server. To do so, we're going to want to use the text editor of our personal preference, I am going to be using "nano" as it's installed on nearly every GNU/Linux system. We're going to want to execute the following command
Our first change we're going to want to make will be to un-comment the "push" parameter which causes traffic on our client systems to be routed through OpenVPN. To do this, we're going to want to execute the following command/line.
Normally that line is commented with a "#" at the beginning, we're going to want to remove it by simply finding the line in our configuration file and removing the "#". We'll also want to change the section that immediately follows route DNS queries to Google's Public DNS servers so our VPNs DNS servers don't go down, Google servers are very reliable to use as DNS servers. You can feel free to use any DNS server although I personally recommend using Google's.
In addition, to enhance security, make sure OpenVPN drops privileges after startup. Uncomment the relevant "user" and "group" lines. This will ensure the fact that no one unless you are root/sudoer can execute root/sudoer commands on our server. Again, this is in the configuration file and we simply change it up a little.
Now that we've finished modifying the configuration file, we'll generate the required keys and certificates. As with the configuration file, OpenVPN places the required scripts in the documentation folder by default. Create the required folder and copy the files over.
With the files in the desired location, we'll edit the "vars" file which provides the easy-rsa scripts with required information. Now, following my php codes you can see the commands to execute to do a specific job that I describe in the little disclaimer part or this part instead. Now again, I am using nano in this example because it's pre-installed on nearly every GNU/Linux system, but you can use the text-editor of your choice.
We're looking to modify the "KEY_" variables, located at the bottom of the file. The variable names are fairly descriptive and should be filled out with the applicable information. After you've done this, your vars folder should look similar to this. Please note that this part is very crucial to follow in-depth, if not, it can ruin your configuration of keys.
Now we're going to want to manually copy the required OpenSSL configuration file. To do so, we're going to want to execute the following command below. Please note that this a precaution so OpenSSL isn't failed to be detected.
[img]http://remibergsma.files.wordpress.com/2013/01/openvpn-secure-wifi-browsing4.png?w=580[/img]
We'll now change into our working directory and build our Certificate Authority, or CA, based on the information as the information that I've provided above of this..
Now that we have our CA, we'll create our certificate for the OpenVPN server. When asked by build-key-server, answer yes to commit. We're also going to need to generate our Diffie Hellman key exchange files using the build-dh script and copy all of our files into /etc/openvpn as follows
In order to allow clients to authenticate, we'll need to create client certificates. You can repeat this as necessary to generate a unique certificate and key for each client or device.
We're going to want to Create an iptables rule to allow proper routing of our VPN subnet and then enable IP Forwarding in sysctl. To do so, we're going to want to execute the following commands as listed.
This part will create a iptable that allows users to connect to your VPN server and then the iptables save will save iptables so if you re-start your server, it's automatically saved and already configured.
Finally, apply our new sysctl settings. Start the server and assure that it starts automatically on boot
Now you finally have a working OpenVPN server. I will be following up with a tutorial shortly on how to configure your OpenVPN client to connect to the OpenVPN server although it's very basic and easy to understand. If you have any questions or concerns regarding this tutorial, please feel free to post below or PM me and I'll assist you to the best of my ability. Thank you and have a fantastic day.
PHP Code
<?php
wget http://dl.fedoraproject.org/pub/epel/6/i386/epel-release-6-8.noarch.rpm
rpm -Uvh epel-release-6-8.noarch.rpm
Now that we've downloaded the EPEl Repository we're going to want to install the OpenVPN package from EPEL, to do so, we're going to want to execute the following commands
PHP Code
<?php
cp /usr/share/doc/openvpn-*/sample-config-files/server.conf /etc/openvpn
Now that we've moved our file in the proper location, we are going to want to open the file for editing to make it configured to our server. To do so, we're going to want to use the text editor of our personal preference, I am going to be using "nano" as it's installed on nearly every GNU/Linux system. We're going to want to execute the following command
PHP Code
<?php
nano -w /etc/openvpn/server.conf
Our first change we're going to want to make will be to un-comment the "push" parameter which causes traffic on our client systems to be routed through OpenVPN. To do this, we're going to want to execute the following command/line.
PHP Code
<?php
push "redirect-gateway def1 bypass-dhcp"
Normally that line is commented with a "#" at the beginning, we're going to want to remove it by simply finding the line in our configuration file and removing the "#". We'll also want to change the section that immediately follows route DNS queries to Google's Public DNS servers so our VPNs DNS servers don't go down, Google servers are very reliable to use as DNS servers. You can feel free to use any DNS server although I personally recommend using Google's.
PHP Code
<?php
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
In addition, to enhance security, make sure OpenVPN drops privileges after startup. Uncomment the relevant "user" and "group" lines. This will ensure the fact that no one unless you are root/sudoer can execute root/sudoer commands on our server. Again, this is in the configuration file and we simply change it up a little.
PHP Code
<?php
user nobody
group nobody
Now that we've finished modifying the configuration file, we'll generate the required keys and certificates. As with the configuration file, OpenVPN places the required scripts in the documentation folder by default. Create the required folder and copy the files over.
PHP Code
<?php
mkdir -p /etc/openvpn/easy-rsa/keys
cp -rf /usr/share/openvpn/easy-rsa/2.0/* /etc/openvpn/easy-rsa
With the files in the desired location, we'll edit the "vars" file which provides the easy-rsa scripts with required information. Now, following my php codes you can see the commands to execute to do a specific job that I describe in the little disclaimer part or this part instead. Now again, I am using nano in this example because it's pre-installed on nearly every GNU/Linux system, but you can use the text-editor of your choice.
PHP Code
<?php
nano -w /etc/openvpn/easy-rsa/vars
We're looking to modify the "KEY_" variables, located at the bottom of the file. The variable names are fairly descriptive and should be filled out with the applicable information. After you've done this, your vars folder should look similar to this. Please note that this part is very crucial to follow in-depth, if not, it can ruin your configuration of keys.
PHP Code
<?php
export KEY_COUNTRY="US"
export KEY_PROVINCE="NY"
export KEY_CITY="New York"
export KEY_ORG="Organization Name"
export KEY_EMAIL="[email protected]"
export KEY_CN=cyphjr.example.com
export KEY_NAME=server
export KEY_OU=server
Now we're going to want to manually copy the required OpenSSL configuration file. To do so, we're going to want to execute the following command below. Please note that this a precaution so OpenSSL isn't failed to be detected.
PHP Code
<?php
cp /etc/openvpn/easy-rsa/openssl-1.0.0.cnf /etc/openvpn/easy-rsa/openssl.cnf
[img]http://remibergsma.files.wordpress.com/2013/01/openvpn-secure-wifi-browsing4.png?w=580[/img]
We'll now change into our working directory and build our Certificate Authority, or CA, based on the information as the information that I've provided above of this..
PHP Code
<?php
cd /etc/openvpn/easy-rsa
source ./vars
./clean-all
./build-ca
Now that we have our CA, we'll create our certificate for the OpenVPN server. When asked by build-key-server, answer yes to commit. We're also going to need to generate our Diffie Hellman key exchange files using the build-dh script and copy all of our files into /etc/openvpn as follows
PHP Code
<?php
./build-key-server server
./build-dh
cd /etc/openvpn/easy-rsa/keys
cp dh1024.pem ca.crt server.crt server.key /etc/openvpn
In order to allow clients to authenticate, we'll need to create client certificates. You can repeat this as necessary to generate a unique certificate and key for each client or device.
PHP Code
<?php
cd /etc/openvpn/easy-rsa
./build-key client
We're going to want to Create an iptables rule to allow proper routing of our VPN subnet and then enable IP Forwarding in sysctl. To do so, we're going to want to execute the following commands as listed.
PHP Code
<?php
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
service iptables save
This part will create a iptable that allows users to connect to your VPN server and then the iptables save will save iptables so if you re-start your server, it's automatically saved and already configured.
PHP Code
<?php
nano -w /etc/sysctl.conf
# Controls IP packet forwarding
net.ipv4.ip_forward = 1
Finally, apply our new sysctl settings. Start the server and assure that it starts automatically on boot
PHP Code
<?php
sysctl -p
service openvpn start
chkconfig openvpn on
Now you finally have a working OpenVPN server. I will be following up with a tutorial shortly on how to configure your OpenVPN client to connect to the OpenVPN server although it's very basic and easy to understand. If you have any questions or concerns regarding this tutorial, please feel free to post below or PM me and I'll assist you to the best of my ability. Thank you and have a fantastic day.
