X

Installing and configuring OpenVPN server in CentOS 5.4

First assuming you already had rpmforge yum repos.
Just need to get open rpm installed..

 yum install openvpn -y

Now start configure it :
get into the OpenVPN configuration folder

  cd /etc/openvpn/

Generate the secret key at the server ..
(this file shall be transferred to each client too..)

 openvpn --genkey --secret ta.key

Now get the rest of cert and generate appropriate keys/pair.
The tools are provided under the following directory

  cd /usr/share/doc/openvpn-2.0.9/easy-rsa/

make all the script there it executable ..

  chmod a+x *

Prepare the output keys folder

  mkdir keys
  ./vars

Clean it up..

 ./clean-all

Start building server key first ..

 ./build-ca
./build-key-server home.namran.net

Okay .. now try to add a client cert to it..

 ./build-key nbnamran

Some encryption/decipher thing..

 ./build-dh

Now copied the generated keys/cert into openvpn configuration folder.

  cp /usr/share/doc/openvpn-2.0.9/easy-rsa/keys/* /etc/openvpn/

Time to config the configuration file ..

  cd /etc/openvpn

Let’s just copy from sample first ..

  
 cp /usr/share/doc/openvpn-2.0.9/sample-config-files/server.conf .

Edit it ..

   vi server.conf 

.. so that it become something like this :

diff -up /usr/share/doc/openvpn-2.0.9/sample-config-files/server.conf /etc/openvpn/server.conf 
--- /usr/share/doc/openvpn-2.0.9/sample-config-files/server.conf        2006-01-07 05:49:27.000000000 +0800
+++ /etc/openvpn/server.conf    2010-02-01 21:10:48.000000000 +0800
@@ -32,8 +32,8 @@
 port 1194
 
 # TCP or UDP server?
-;proto tcp
-proto udp
+proto tcp
+;proto udp
 
 # "dev tun" will create a routed IP tunnel,
 # "dev tap" will create an ethernet tunnel.
@@ -75,16 +75,16 @@ dev tun
 # Any X509 key management system can be used.
 # OpenVPN can also use a PKCS #12 formatted key file
 # (see "pkcs12" directive in man page).
-ca ca.crt
-cert server.crt
-key server.key  # This file should be kept secret
+ca /etc/openvpn/ca.crt
+cert /etc/openvpn/home.namran.net.crt
+key /etc/openvpn/home.namran.net.key  # This file should be kept secret
 
 # Diffie hellman parameters.
 # Generate your own with:
 #   openssl dhparam -out dh1024.pem 1024
 # Substitute 2048 for 1024 if you are using
 # 2048 bit keys. 
-dh dh1024.pem
+dh /etc/openvpn/dh1024.pem
 
 # Configure server mode and supply a VPN subnet
 # for OpenVPN to draw client addresses from.
@@ -93,14 +93,14 @@ dh dh1024.pem
 # Each client will be able to reach the server
 # on 10.8.0.1. Comment this line out if you are
 # ethernet bridging. See the man page for more info.
-server 10.8.0.0 255.255.255.0
+server 192.168.144.0 255.255.255.0
 
 # Maintain a record of client <-> virtual IP address
 # associations in this file.  If OpenVPN goes down or
 # is restarted, reconnecting clients can be assigned
 # the same virtual IP address from the pool that was
 # previously assigned.
-ifconfig-pool-persist ipp.txt
+ifconfig-pool-persist /etc/openvpn/ipp.txt
 
 # Configure server mode for ethernet bridging.
 # You must first use your OS's bridging capability
@@ -121,7 +121,7 @@ ifconfig-pool-persist ipp.txt
 # to know to route the OpenVPN client
 # address pool (10.8.0.0/255.255.255.0)
 # back to the OpenVPN server.
-;push "route 192.168.10.0 255.255.255.0"
+push "route 192.168.133.0 255.255.255.0"
 ;push "route 192.168.20.0 255.255.255.0"
 
 # To assign specific IP addresses to specific
@@ -193,7 +193,7 @@ ifconfig-pool-persist ipp.txt
 # To force clients to only see the server, you
 # will also need to appropriately firewall the
 # server's TUN/TAP interface.
-;client-to-client
+client-to-client
 
 # Uncomment this directive if multiple clients
 # might connect with the same certificate/key
@@ -206,7 +206,7 @@ ifconfig-pool-persist ipp.txt
 # CERTIFICATE/KEY PAIRS FOR EACH CLIENT,
 # EACH HAVING ITS OWN UNIQUE "COMMON NAME",
 # UNCOMMENT THIS LINE OUT.
-;duplicate-cn
+duplicate-cn
 
 # The keepalive directive causes ping-like
 # messages to be sent back and forth over
@@ -228,7 +228,7 @@ keepalive 10 120
 # a copy of this key.
 # The second parameter should be '0'
 # on the server and '1' on the clients.
-;tls-auth ta.key 0 # This file is secret
+tls-auth /etc/openvpn/ta.key 0 # This file is secret
 
 # Select a cryptographic cipher.
 # This config item must be copied to
@@ -251,8 +251,8 @@ comp-lzo
 #
 # You can uncomment this out on
 # non-Windows systems.
-;user nobody
-;group nobody
+user nobody
+group nobody
 
 # The persist options will try to avoid
 # accessing certain resources on restart
@@ -264,7 +264,7 @@ persist-tun
 # Output a short status file showing
 # current connections, truncated
 # and rewritten every minute.
-status openvpn-status.log
+status /var/log/openvpn-status.log
 
 # By default, log messages will go to the syslog (or
 # on Windows, if running as a service, they will go to



Start the openvpn server services :

  service openvpn start

setup the client and then Monitor the incoming connection..

  
 tail -f /var/log/messages

… ops.. firewall might need to open the port accordingly first!

  vi /etc/arno-iptables-firewall/firewall.conf
  /etc/init.d/arno-iptables-firewall restart

.. the client preparation is as below :

  cp /usr/share/doc/openvpn-2.0.9/easy-rsa/keys/nbnamran.* /home/namran/Desktop/vpn
  cp /usr/share/doc/openvpn-2.0.9/easy-rsa/keys/ca.crt /home/namran/Desktop/vpn
  

  cp /etc/openvpn/ta.key /home/namran/Desktop/vpn
  chown namran:namran /home/namran/Desktop/vpn/nbnamran.*
  chown namran:namran /home/namran/Desktop/vpn/ta.key 
[namran@nb-namran openvpn]$ cat client.ovpn 
##############################################
# Sample client-side OpenVPN 2.0 config file #
# for connecting to multi-client server.     #
#                                            #
# This configuration can be used by multiple #
# clients, however each client should have   #
# its own cert and key files.                #
#                                            #
# On Windows, you might want to rename this  #
# file so it has a .ovpn extension           #
##############################################

# Specify that we are a client and that we
# will be pulling certain config file directives
# from the server.
client

# Use the same setting as you are using on
# the server.
# On most systems, the VPN will not 
# unless you partially or fully disable
# the firewall for the TUN/TAP interface.
;dev tap
dev tun

# Windows needs the TAP-Win32 adapter name
# from the Network Connections panel
# if you have more than one.  On XP SP2,
# you may need to disable the firewall
# for the TAP adapter.
;dev-node MyTap

# Are we connecting to a TCP or
# UDP server?  Use the same setting as
# on the server.
proto tcp
;proto udp

# The hostname/IP and port of the server.
# You can have multiple remote entries
# to load balance between the servers.
remote home.namran.net 1194
;remote my-server-2 1194

# Choose a random host from the remote
# list for load-balancing.  Otherwise
# try hosts in the order specified.
;remote-random

# Keep trying indefinitely to resolve the
# host name of the OpenVPN server.  Very useful
# on machines which are not permanently connected
# to the internet such as laptops.
resolv-retry infinite

# Most clients don't need to bind to
# a specific local port number.
nobind

# Downgrade privileges after initialization (non-Windows only)
;user nobody
;group nobody

# Try to preserve some state across restarts.
persist-key
persist-tun

# If you are connecting through an
# HTTP proxy to reach the actual OpenVPN
# server, put the proxy server/IP and
# port number here.  See the man page
# if your proxy server requires
# authentication.
;http-proxy-retry # retry on connection failures
;http-proxy [proxy server] [proxy port #]

# Wireless networks often produce a lot
# of duplicate packets.  Set this flag
# to silence duplicate packet warnings.
;mute-replay-warnings

# SSL/TLS parms.
# See the server config file for more
# description.  It's best to use
# a separate .crt/.key file pair
# for each client.  A single ca
# file can be used for all clients.
ca ca.crt
cert nbnamran.crt
key nbnamran.key

# Verify server certificate by checking
# that the certicate has the nsCertType
# field set to "server".  This is an
# important precaution to protect against
# a potential attack discussed here:
#  http://openvpn.net/howto.html#mitm
#
# To use this feature, you will need to generate
# your server certificates with the nsCertType
# field set to "server".  The build-key-server
# script in the easy-rsa folder will do this.
ns-cert-type server

# If a tls-auth key is used on the server
# then every client must also have the key.
tls-auth ta.key 1

# Select a cryptographic cipher.
# If the cipher option is used on the server
# then you must also specify it here.
;cipher x

# Enable compression on the VPN link.
# Don't enable this unless it is also
# enabled in the server config file.
comp-lzo

# Set log file verbosity.
verb 3

# Silence repeating messages
;mute 20

and the files needed for the client is as below :

[namran@nb-namran openvpn]$ ls
ca.crt  client.ovpn  nbnamran.crt  nbnamran.csr  nbnamran.key  ta.key

.. that’s it.!

p/s : .. pretty nice as it also work on windows machine…
only the part of cert would make it a bit difficult to connect from other native device such as handphone!
.. if someone happen to hack the way for IPSec on this.. kindly leave your note below .. hehe..

Namran Hussin: a soft spoken guy... with exceptional interest in computers and technology. I love to learn new thing and also love to break thing for the sake of learning.. but I do abide to the self-imposed limitation or certain thing such as social thing in life, thing can be done and thing that must be avoided at whatever cost such as drug,illegal tracking, smoke,illicit activity..etc.muahahaha let's share what we had in this short term of the life.! make it worth of the living.~

View Comments (4)

  • ocal Options hash (VER=V4): '3a33122d'
    192.168.0.238:4987 TLS: Initial packet from 192.168.0.238:4987, sid=c3af5dde a883362d
    : 192.168.0.238:4957 TLS Error: TLS handshake failed
    192.168.0.238:4957 SIGUSR1[soft,tls-error] received, client-instance restarting
    : MULTI: multi_create_instance called
    192.168.0.238:4988 Re-using SSL/TLS context
    192.168.0.238:4988 LZO compression initialized
    192.168.0.238:4988 Control Channel MTU parms [ L:1538 D:138 EF:38 EB:0 ET:0 EL:0 ]

  • please any one help on this

    ocal Options hash (VER=V4): '3a33122d'
    192.168.0.238:4987 TLS: Initial packet from 192.168.0.238:4987, sid=c3af5dde a883362d
    : 192.168.0.238:4957 TLS Error: TLS handshake failed
    192.168.0.238:4957 SIGUSR1[soft,tls-error] received, client-instance restarting
    : MULTI: multi_create_instance called
    192.168.0.238:4988 Re-using SSL/TLS context
    192.168.0.238:4988 LZO compression initialized
    192.168.0.238:4988 Control Channel MTU parms [ L:1538 D:138 EF:38 EB:0 ET:0 EL:0 ]

  • Thank you for posting this awesome article. I search since a long time an answer
    to this subject and I have finally found it on your site.
    I subscribed to your blog and shared it on my Facebook.
    Thanks again for this great post!

Related Post
Leave a Comment