[Qismon]

Hello all, I did not see too many tutorials about setting up OpenVPN Server side so hopefully this helps anyone looking for that.

I am installing on Linux Debian 8 Jessie 64Bit (KVM Virtualization).

# STEP 1: Install OpenVPN Server & EasyRSA.

Code

apt-get update

apt-get dist-upgrade

apt-get install openvpn

apt-get install easy-rsa

# STEP 2: Copy needed EasyRSA files for generating Server-Client keys to OpenVPN folder.

Code

cp -R /usr/share/easy-rsa /etc/openvpn/

# STEP 3: Edit VARS file Location & Export Keysize.

Code

nano /etc/openvpn/easy-rsa/vars

Note: These are the default values for fields which will be placed in the certificate. Do not leave any of these fields blank.

export KEY_COUNTRY="US"
export KEY_PROVINCE="CA"
export KEY_CITY="SanFrancisco"
export KEY_ORG="Fort-Funston"
export KEY_EMAIL="[email protected]"
export KEY_OU=ChangeMe

Now find another line that looks like this >> export KEY_SIZE=2048
And we will change the keysize so the line now looks like this >> export KEY_SIZE=4096

After making all needed changes you can save the file and exit.
Using nano this can be done by pressing Ctrl+o...You will be prompted to confirm the change, just press enter. Then Ctrl+x to exit nano.

# STEP 4: Build ca.key

Code

cd /etc/openvpn/easy-rsa/

source vars

./clean-all

./build-ca

Just press enter for each prompt to use the default settings.

# STEP 5: Build server.key

Code

./build-key-server server

Note: Do not add a password while generating the server key.

Now you will see 2 prompts to confirm the signing of the certificate.
Press "y" for both prompts and you should see the following message if all went fine :: Write out database with 1 new entries Data Base Updated.

# STEP 6: Generate DH Parameters. (Go for a coffee after this step...this will take a while.)

Code

./build-dh

# STEP 7: Copy all certs and keys to OpenVPN folder.

Code

cd /etc/openvpn/easy-rsa/keys

cp server.crt server.key ca.crt dh4096.pem /etc/openvpn/

# STEP 8: Configure OpenVPN server.conf

Code

cd /etc/openvpn/

zcat /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz > /etc/openvpn/server.conf

sed -i -r 's/^dh (.+)/dh dh4096.pem/g' /etc/openvpn/server.conf
echo 'crl-verify easy-rsa/keys/crl.pem' >> /etc/openvpn/server.conf
echo 'push "redirect-gateway def1 bypass-dhcp"' >> /etc/openvpn/server.conf
echo 'push "dhcp-option DNS 8.8.8.8"' >> /etc/openvpn/server.conf
echo 'push "explicit-exit-notify 3"' >> /etc/openvpn/server.conf
echo 'cipher AES-256-CBC' >> /etc/openvpn/server.conf

Note: If you prefer to change the DNS because you are Anti-Google, here are a few alternatives.
https://www.ungefiltert-surfen.de
https://blog.cloudflare.com/announcing-1111

# STEP 9: Configure Network and IPTables to allow VPN Passthrough.
Note: This step is different if you are using a VPS with KVM or OpenVZ Virtualization. KVM is my preference.
! ONLY RUN THE CODE FOR YOUR VPS VIRTUALIZATION VERSION !

# KVM VERSION BELOW

Code

iptables -A INPUT -p udp -m state --state NEW -m udp --dport 1194 -j ACCEPT

iptables -A FORWARD -s 10.8.0.0/24 -j ACCEPT

iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

# OPENVZ VERSION BELOW (Change the WAN IP on line 5 to your VPS IP)

Code

iptables -F

iptables -P OUTPUT ACCEPT

iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

iptables -A FORWARD -s 10.8.0.0/24 -j ACCEPT

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to-source 123.45.67.89

iptables -A INPUT -p udp --dport 1194 -j ACCEPT

iptables -A INPUT -p icmp -j ACCEPT

iptables -A INPUT -i lo -j ACCEPT

iptables -A INPUT -i tun0 -j ACCEPT

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables-save

Ok now we need to add our IPTables rules to startup incase we reboot the server.

Code

iptables --list

iptables-save > /etc/firewall.conf

cd /etc/network/if-up.d/

touch iptables

nano iptables

This will open the new blank file we created called "iptables".
Copy the code below to "iptables" then save and exit by pressing
Ctrl+o then Enter to confirm changes, then Ctrl+x to exit nano.

Code

#!/bin/sh
iptables-restore < /etc/firewall.conf

Make our new "iptables" file executable.

Code

chmod +x /etc/network/if-up.d/iptables

# STEP 10: Start OpenVPN Service and check status.

Code

systemctl enable openvpn@server

systemctl start openvpn@server

service openvpn restart

service openvpn status

When you run "service openvpn status" you should see a terminal output similar to the following.

Code

root@binn:/etc/openvpn/easy-rsa/keys# service openvpn status
● openvpn.service - OpenVPN service
  Loaded: loaded (/lib/systemd/system/openvpn.service; enabled)
  Active: active (exited) since Thu 2018-05-03 22:56:46 MSK; 2 weeks 1 days ago
Main PID: 455 (code=exited, status=0/SUCCESS)
  CGroup: /system.slice/openvpn.service

If OpenVPN Service is running fine then we can move on to the final step.

# STEP 11: Generate OpenVPN Client File with In-Line CA, Cert and Key.

Code

cd /etc/openvpn/easy-rsa/
source vars
./build-key client

Note: Just press enter for each prompt to use the default settings.
Do not add a password while generating the client key.

Now you will see 2 prompts to confirm the signing of the certificate.
Press "y" for both prompts and you should see the following message if all went fine :: Write out database with 1 new entries Data Base Updated.

Change the WAN IP on line 4 to your VPS IP, then copy and paste all the code below to make your client.ovpn file.

Code

echo 'client
dev tun
proto udp
remote 123.45.67.89 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
cipher AES-256-CBC
comp-lzo
verb 3' > /etc/openvpn/client.ovpn
echo '<ca>' >> /etc/openvpn/client.ovpn
cat /etc/openvpn/ca.crt >> /etc/openvpn/client.ovpn
echo '</ca>' >> /etc/openvpn/client.ovpn
echo '<cert>' >> /etc/openvpn/client.ovpn
cat /etc/openvpn/easy-rsa/keys/client.crt >> /etc/openvpn/client.ovpn
echo '</cert>' >> /etc/openvpn/client.ovpn
echo '<key>' >> /etc/openvpn/client.ovpn
cat /etc/openvpn/easy-rsa/keys/client.key >> /etc/openvpn/client.ovpn
echo '</key>' >> /etc/openvpn/client.ovpn

Drop the client.ovpn file in your OpenVPN client config folder and you should be able to connect just fine.

Later on I will add another tutorial of how to create a MySQL Database to manage user/pass with auth-pam module.

Hopefully this will be helpful for some.  🤝

[inkbird]

Wow dude. Thank you for this.

[Qismon]

Wow dude. Thank you for this.

You are welcome!

If you need any help setting it up let me know. 🤝