Getting started with open vpn (server) – low end box


Published on

Published in: Technology
  • Be the first to comment

  • Be the first to like this

No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide

Getting started with open vpn (server) – low end box

  1. 1. 01/09/13 Getting started with OpenVPN (server) – Low End Box LowEndBox Hosting Websites on Bare Minimum VPS/Dedicated Servers Getting started with OpenVPN (server) tutorials August 31, 2013 @ 1:22 pm, by Maarten Kossen There are various ways to set up a Virtual Private Network (VPN). With the various protocols available to use for VPN and all the software out there, it’s often a spider’s web when you just want to set up a VPN. Well, rest assured: it’s not that hard! A VPN can be useful for various things, but it’s often used for one of these: Secure connection to an internal office network not accessible from the outside Secure connection to the internet on public wifi (although from the VPN server on it’s back to “default” security) Hiding your real IP/masking your location (for example: using Netflix outside the USA) I’m going to show you how to set up OpenVPN using a ‘tap’ device. For this, you need a KVM or Xen VPS, or an OpenVZ VPS which supports TAP. If you use an OpenVZ VPS, be sure to enable TAP first from the control panel (it requires a reboot). Other than that, there’s no real system requirements. This guide works on both CentOS and Ubuntu. I’ve chosen OpenVPN because it’s a well-established open source solution with good client software support. Alternatives I considered were PPTP, which has some security issues, and IPSec/L2TP, which has a more complicated setup and software that has some “quirks”. Installing software First of all, let’s install the software. Ubuntu sudo apt-get install openvpn CentOS sudo yum install openvpn Enable IPv4 forwarding 1/8
  2. 2. 01/09/13 Getting started with OpenVPN (server) – Low End Box IPv4 forwarding needs to be enabled, otherwise packets can’t go from the internet, via the VPS to you. To enable this, open up /etc/sysctl.conf and fine a line that looks like: net.ipv4.ip_forward=1 The value for this option should be ’1′. Sometimes it’s commented (Ubuntu) and sometimes it’s a ’0′ (CentOS). Make sure it looks like the line above, save the file and: sudo sysctl -p Which reloads these settings. Alternatively, reboot. Generating keys Now the software is installed, let’s start by generating the keys used for encryption and authentication. First, create directory that’s going to hold the keys and the scripts to generate these keys: sudo mkdir /etc/openvpn/easy-rsa Next, download the key generation software: wget -O easy-rsa.tar.gz Ubuntu already has these scripts included, but CentOS hasn’t. For the sake of simplicity, downloading them from OpenVPN’s github is the best option. Now, let’s extract the files to the proper directory: sudo tar xvzf easy-rsa.tar.gz -C /etc/openvpn/easy-rsa –strip-components=3 easy-rsa2.2.0/easy-rsa/2.0/ And go to that directory: cd /etc/openvpn/easy-rsa/ OpenVPN uses SSL (certificates) for connection security and authentication. We’re going to generate the certificates required for this: Root key/certificate (ca.key/ca.crt) TLS key (ta.key) Server key/certificate (server.key/server.crt) Client key/certificate (client.key/client.crt) The data being used for these keys (country, organisation, etc.) can be modified. It doesn’t make a real difference if you change these or not, but it does help recognizing the certificate. You could, optionally, require a certain certificate subject (not covered by this tutorial) for added security. Open up /etc/openvpn/easy-rsa/vars and look for the following lines: export KEY_COUNTRY=”US” export KEY_PROVINCE=”CA” 2/8
  3. 3. 01/09/13 Getting started with OpenVPN (server) – Low End Box export KEY_CITY=”SanFrancisco” export KEY_ORG=”Fort-Funston” export KEY_EMAIL=mail@host.domain export KEY_CN=changeme export KEY_NAME=changeme export KEY_OU=changeme You should change these all to reflect your situation. You can remove the duplicate KEY_EMAIL export, as the second one overwrites the first one anyway. You can safely ignore the PK11 variables listed below the above ones in the file. To be sure we have proper permissions, let’s change the group of the easy-rsa directory to sudo: sudo chown -R root:sudo . And set group write permissions, so members of the sudo group can write to it: sudo chmod g+w . With these permissions set, we can generate certificates. First, execute the vars file you’ve just edited to all the vars are available in the environment: source ./vars Next, clean all the keys: ./clean-all Generate the Diffie-Hellman parameters for the server site TLS/SSL: ./build-dh Generate the root key and certificate: ./pkitool –initca And finally, generate the server private key and certificate: ./pkitool –server server Now that all the keys are generated, let’s build a TLS key and put all keys into place. Go to the ‘keys’ directory inside the ‘easy-rsa’ directory where you currently are: cd keys/ And generate the TLS key: openvpn –genkey –secret ta.key Finally, copy all these keys to the openvpn directory: sudo cp server.crt server.key ca.crt dh1024.pem ta.key ../../ 3/8
  4. 4. 01/09/13 Getting started with OpenVPN (server) – Low End Box And we’re done with the server-side keys! Final keys to generate now, are the client-side keys. Make sure you are in /etc/openvpn/easy-rsa/vars again and edit the variables to reflect your client. Otherwise you get an error when generating the certificate because it’s not unique. Initialize the new environment variables: source ./vars And generate the client-side keys: ./pkitool client That’s it! Keys are ready. Finally, set the proper ownership to the ‘keys’ directory, as it’s currently owned by your user: sudo chown root:sudo keys Now, let’s configure OpenVPN! Configuring OpenVPN OpenVPN has a lot of configuration options. I’m going to cover a basic configuration which uses a tap interface. The server configuration file is /etc/openvpn/server.conf. The default configuration file has a lot of comments in it, so it’s a good starting point to discover more about the configuration of OpenVPN. I’m going to give you the configuration that I’ve tested: local # Server IP address through which you connect, replace this with yours port 1194 # Port the server runs on (default) proto udp # Protocol to use (default) dev tap ca ca.crt # Root certificate cert server.crt # Server certificate key server.key # Server key file dh dh1024.pem # DH file server ifconfig-pool-persist ipp.txt # File that keeps track of IP leases push “redirect-gateway def1 bypass-dhcp” # Push some options to the client duplicate-cn keepalive 10 120 # When should we disconnect a client? tls-auth ta.key 0 comp-lzo # Enable compression user nobody # Run as user nobody group nogroup # Run as group nobody persist-key # Avoid trying to access unavailable resources after a restart persist-tun # Avoid trying to access unavailable resources after a restart status openvpn-status.log # Status log for active connections log-append openvpn.log # Append the OpenVPN log rather then starting with a new one every 4/8
  5. 5. 01/09/13 Getting started with OpenVPN (server) – Low End Box time you restart verb 3 # Log verbosity level mute 20 # Limit the number of repeating messages script-security 2 # Set the security level for the usage of external programs and scripts link-mtu 1648 As you can see, I’ve added some inline comments. It would be good to read these. I’ll highlight the lines I would like to discuss in more detail, those are the most important options for you to know about. dev tap This line indicates we use a TAP tunnel, which is an ethernet tunnel rather than a routed IP tunnel. A TAP tunnel passes through all traffic rather than just HTTP and HTTPS. It’s the more “complete” tunnel when compared to TUN. server Set the internal IP range for the server and the clients. The server will get the IP and the client IP addresses will start at Change this to your liking or when it conflicts with other ranges on any of your clients. duplicate-cn This line allows multiple connections with the same client certificates. Leave this out to disable this option. If you edit the vars file for every client certificate you generate, this option can safely be disabled. tls-auth ta.key 0 Name of the TLS key file and the “side” of the TLS connection. Since the server is 0, the client should be 1. This should be configured in you OpenVPN client software. link-mtu 1648 This is the MTU for the VPN connection. The MTU (Maximal Tranmission Unit) is the maximum size in bytes of the largest piece of data that the link can transport. I’ve used this value because it worked for me. This will also need to be configured in your client. If you VPN doesn’t work, check the logs for MTU errors. Once the configuration file is in place, restart OpenVPN: sudo /etc/init.d/openvpn restart And you should be good! Final step is adding three firewall rules to allow traffic to pass through your server: sudo /sbin/iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE sudo /sbin/iptables -A FORWARD -i eth0 -o tap0 -m state –state RELATED,ESTABLISHED -j ACCEPT sudo /sbin/iptables -A FORWARD -i tap0 -o eth0 -j ACCEPT You should replace ‘eth0′ with the device name of your ethernet device. On most OpenVZ VPS this is venet0. What these lines do, is the following (in order): 5/8
  6. 6. 01/09/13 Getting started with OpenVPN (server) – Low End Box 1. Allow transparent NAT traffic over eth0 2. Allow packets to be forwarded from eth0 to tap0 with certain connection states 3. Allow packets to be forwarded from tap0 to eth0 regardless of the connection state Now, with the server up and running and your firewall configured, you need to configure your client. I will cover some clients in next week’s tutorial (it was too much to combine it all in here), but here’s something to get you started on your own. To connect with a client, you need to: 1. 2. 3. 4. 5. Have the client.crt, client.key, ca.crt and ta.key on your client Enable LZO compression Enable TAP Set the link MTU to 1648 Set the TLS “side” to 1 If you’ve done that on you client, you should be able to connect! Final notes As you may have noticed, setting up OpenVPN isn’t hard but it isn’t very easy either. There’s a lot of steps to take, a lot of options available and a lot that can go wrong. I’ve tried to keep this guide concise and limited for the sake of clarity. If there is a clear demand for more explanation on certain subjects, please let me know. I’ll add more explanation/write a more detailed guide on a certain subject in that case. Up next week: Getting started with OpenVPN (client) 3 Comments 1. André: I wrote this “guide” as a reference to myself: I guess the steps are rather similar, I wish you had written this long ago! =) August 31, 2013 @ 1:55 pm | Reply 2. usman: Good effort. Nice updated tutorial on installing openvpn. I also did an attempt to write a detailed openvpn installation guide but i think it is a bit dated now. Referencing it here just to let the readers also have a graphical view of the commands that they are supposed to run. August 31, 2013 @ 3:54 pm | Reply 3. 6/8