Loading...First assuming you already had rpmforge yum repos.
Just need to get open rpm installed..
yum install openvpn -y |
Now start configure it :
get into the OpenVPN configuration folder
cd /etc/openvpn/ |
Generate the secret key at the server ..
(this file shall be transferred to each client too..)
openvpn --genkey --secret ta.key |
Now get the rest of cert and generate appropriate keys/pair.
The tools are provided under the following directory
cd /usr/share/doc/openvpn-2.0.9/easy-rsa/ |
make all the script there it executable ..
chmod a+x * |
Prepare the output keys folder
mkdir keys ./vars |
Clean it up..
./clean-all |
Start building server key first ..
./build-ca ./build-key-server home.namran.net |
Okay .. now try to add a client cert to it..
./build-key nbnamran |
Some encryption/decipher thing..
./build-dh |
Now copied the generated keys/cert into openvpn configuration folder.
cp /usr/share/doc/openvpn-2.0.9/easy-rsa/keys/* /etc/openvpn/ |
Time to config the configuration file ..
cd /etc/openvpn |
Let’s just copy from sample first ..
cp /usr/share/doc/openvpn-2.0.9/sample-config-files/server.conf . |
Edit it ..
vi server.conf |
.. so that it become something like this :
diff -up /usr/share/doc/openvpn-2.0.9/sample-config-files/server.conf /etc/openvpn/server.conf --- /usr/share/doc/openvpn-2.0.9/sample-config-files/server.conf 2006-01-07 05:49:27.000000000 +0800 +++ /etc/openvpn/server.conf 2010-02-01 21:10:48.000000000 +0800 @@ -32,8 +32,8 @@ port 1194 # TCP or UDP server? -;proto tcp -proto udp +proto tcp +;proto udp # "dev tun" will create a routed IP tunnel, # "dev tap" will create an ethernet tunnel. @@ -75,16 +75,16 @@ dev tun # Any X509 key management system can be used. # OpenVPN can also use a PKCS #12 formatted key file # (see "pkcs12" directive in man page). -ca ca.crt -cert server.crt -key server.key # This file should be kept secret +ca /etc/openvpn/ca.crt +cert /etc/openvpn/home.namran.net.crt +key /etc/openvpn/home.namran.net.key # This file should be kept secret # Diffie hellman parameters. # Generate your own with: # openssl dhparam -out dh1024.pem 1024 # Substitute 2048 for 1024 if you are using # 2048 bit keys. -dh dh1024.pem +dh /etc/openvpn/dh1024.pem # Configure server mode and supply a VPN subnet # for OpenVPN to draw client addresses from. @@ -93,14 +93,14 @@ dh dh1024.pem # Each client will be able to reach the server # on 10.8.0.1. Comment this line out if you are # ethernet bridging. See the man page for more info. -server 10.8.0.0 255.255.255.0 +server 192.168.144.0 255.255.255.0 # Maintain a record of client <-> virtual IP address # associations in this file. If OpenVPN goes down or # is restarted, reconnecting clients can be assigned # the same virtual IP address from the pool that was # previously assigned. -ifconfig-pool-persist ipp.txt +ifconfig-pool-persist /etc/openvpn/ipp.txt # Configure server mode for ethernet bridging. # You must first use your OS's bridging capability @@ -121,7 +121,7 @@ ifconfig-pool-persist ipp.txt # to know to route the OpenVPN client # address pool (10.8.0.0/255.255.255.0) # back to the OpenVPN server. -;push "route 192.168.10.0 255.255.255.0" +push "route 192.168.133.0 255.255.255.0" ;push "route 192.168.20.0 255.255.255.0" # To assign specific IP addresses to specific @@ -193,7 +193,7 @@ ifconfig-pool-persist ipp.txt # To force clients to only see the server, you # will also need to appropriately firewall the # server's TUN/TAP interface. -;client-to-client +client-to-client # Uncomment this directive if multiple clients # might connect with the same certificate/key @@ -206,7 +206,7 @@ ifconfig-pool-persist ipp.txt # CERTIFICATE/KEY PAIRS FOR EACH CLIENT, # EACH HAVING ITS OWN UNIQUE "COMMON NAME", # UNCOMMENT THIS LINE OUT. -;duplicate-cn +duplicate-cn # The keepalive directive causes ping-like # messages to be sent back and forth over @@ -228,7 +228,7 @@ keepalive 10 120 # a copy of this key. # The second parameter should be '0' # on the server and '1' on the clients. -;tls-auth ta.key 0 # This file is secret +tls-auth /etc/openvpn/ta.key 0 # This file is secret # Select a cryptographic cipher. # This config item must be copied to @@ -251,8 +251,8 @@ comp-lzo # # You can uncomment this out on # non-Windows systems. -;user nobody -;group nobody +user nobody +group nobody # The persist options will try to avoid # accessing certain resources on restart @@ -264,7 +264,7 @@ persist-tun # Output a short status file showing # current connections, truncated # and rewritten every minute. -status openvpn-status.log +status /var/log/openvpn-status.log # By default, log messages will go to the syslog (or # on Windows, if running as a service, they will go to |
Start the openvpn server services :
service openvpn start |
setup the client and then Monitor the incoming connection..
tail -f /var/log/messages |
… ops.. firewall might need to open the port accordingly first!
vi /etc/arno-iptables-firewall/firewall.conf /etc/init.d/arno-iptables-firewall restart |
.. the client preparation is as below :
cp /usr/share/doc/openvpn-2.0.9/easy-rsa/keys/nbnamran.* /home/namran/Desktop/vpn cp /usr/share/doc/openvpn-2.0.9/easy-rsa/keys/ca.crt /home/namran/Desktop/vpn cp /etc/openvpn/ta.key /home/namran/Desktop/vpn chown namran:namran /home/namran/Desktop/vpn/nbnamran.* chown namran:namran /home/namran/Desktop/vpn/ta.key |
[namran@nb-namran openvpn]$ cat client.ovpn ############################################## # Sample client-side OpenVPN 2.0 config file # # for connecting to multi-client server. # # # # This configuration can be used by multiple # # clients, however each client should have # # its own cert and key files. # # # # On Windows, you might want to rename this # # file so it has a .ovpn extension # ############################################## # Specify that we are a client and that we # will be pulling certain config file directives # from the server. client # Use the same setting as you are using on # the server. # On most systems, the VPN will not function # unless you partially or fully disable # the firewall for the TUN/TAP interface. ;dev tap dev tun # Windows needs the TAP-Win32 adapter name # from the Network Connections panel # if you have more than one. On XP SP2, # you may need to disable the firewall # for the TAP adapter. ;dev-node MyTap # Are we connecting to a TCP or # UDP server? Use the same setting as # on the server. proto tcp ;proto udp # The hostname/IP and port of the server. # You can have multiple remote entries # to load balance between the servers. remote home.namran.net 1194 ;remote my-server-2 1194 # Choose a random host from the remote # list for load-balancing. Otherwise # try hosts in the order specified. ;remote-random # Keep trying indefinitely to resolve the # host name of the OpenVPN server. Very useful # on machines which are not permanently connected # to the internet such as laptops. resolv-retry infinite # Most clients don't need to bind to # a specific local port number. nobind # Downgrade privileges after initialization (non-Windows only) ;user nobody ;group nobody # Try to preserve some state across restarts. persist-key persist-tun # If you are connecting through an # HTTP proxy to reach the actual OpenVPN # server, put the proxy server/IP and # port number here. See the man page # if your proxy server requires # authentication. ;http-proxy-retry # retry on connection failures ;http-proxy [proxy server] [proxy port #] # Wireless networks often produce a lot # of duplicate packets. Set this flag # to silence duplicate packet warnings. ;mute-replay-warnings # SSL/TLS parms. # See the server config file for more # description. It's best to use # a separate .crt/.key file pair # for each client. A single ca # file can be used for all clients. ca ca.crt cert nbnamran.crt key nbnamran.key # Verify server certificate by checking # that the certicate has the nsCertType # field set to "server". This is an # important precaution to protect against # a potential attack discussed here: # http://openvpn.net/howto.html#mitm # # To use this feature, you will need to generate # your server certificates with the nsCertType # field set to "server". The build-key-server # script in the easy-rsa folder will do this. ns-cert-type server # If a tls-auth key is used on the server # then every client must also have the key. tls-auth ta.key 1 # Select a cryptographic cipher. # If the cipher option is used on the server # then you must also specify it here. ;cipher x # Enable compression on the VPN link. # Don't enable this unless it is also # enabled in the server config file. comp-lzo # Set log file verbosity. verb 3 # Silence repeating messages ;mute 20 |
and the files needed for the client is as below :
[namran@nb-namran openvpn]$ ls ca.crt client.ovpn nbnamran.crt nbnamran.csr nbnamran.key ta.key |
.. that’s it.!
p/s : .. pretty nice as it also work on windows machine…
only the part of cert would make it a bit difficult to connect from other native device such as handphone!
.. if someone happen to hack the way for IPSec on this.. kindly leave your note below .. hehe..
