OpenVPN

The following guide shows how to install and configure OpenVPN for use on your VPS.

As root:

apt-get install openvpn

As root:

rpm -Uvh http://dl.fedoraproject.org/pub/epel/5/i386/epel-release-5-4.noarch.rpm
yum update
yum install openvpn

To configure OpenVZ, simply run the following commands as root.

cp -r /usr/share/doc/openvpn/examples/easy-rsa/2.0/ /etc/openvpn/ca
cd /etc/openvpn/ca
nano -w vars

Note: newer versions of openvpn do not ship easy-rsa in the package anymore. You can download the latest version of easy-rsa from github at the following address: https://github.com/OpenVPN/easy-rsa/archive/master.zip

It is recommended to change the default RSA key size to 2048 on the line export KEY_SIZE=1024.

For centos, the path would be /usr/share/openvpn/easy-rsa/2.0/. The sample configuration files will also be in the /usr/share/openvpn path.

With vars open, edit the values as needed (city, etc), then use Ctrl-X to save and exit nano.

source ./vars
./clean-all
./build-ca
./build-key-server server
./build-dh

Now generate a client certificate. You'll make one of these per client, use a different name for each one.

./build-key <CLIENTNAME>

Choose 'Yes' to sign and commit the keys. If desired, the passwords may be left empty (recommended).

Copy the example configuration file to /etc/openvpn

cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz /etc/openvpn
cd /etc/openvpn
gunzip server.conf.gz

Change the lines for ca, cert, key, and dh to point to the files created by easy-rsa, which will look like the following:

ca /etc/openvpn/ca/keys/ca.crt
cert /etc/openvpn/ca/keys/server.crt
key /etc/openvpn/ca/keys/server.key  # This file should be kept secret
dh /etc/openvpn/ca/keys/dh1024.pem

Uncomment the lines for user, group, and maxclients. Set max-clients to something reasonable.

user nobody
group nogroup
max-clients 10

If you want all traffic to be routed over the vpn (true in most cases, including US VPN), uncomment the following line

push "redirect-gateway def1 bypass-dhcp"

Under redirect-gateway, add the following two lines, to add DNS to clients on connect.

push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 4.2.2.2"

If you plan on using the us vpn, change the server line to use 10.0.0.0

server 10.0.0.0 255.255.255.0

Otherwise add the following rule to your firewall.

iptables -t nat -A POSTROUTING -s <SERVER_NET> -j SNAT --to <EXTERNAL IP>

You may need this to be more specific if you're routing over more than one interface. In that case, adding -o venet0 (openvz) or -o eth0 (kvm) may be appropriate.

If your iptables policy for the FORWARD chain is not set to ACCEPT, you may need the following rules:

iptables -A FORWARD -o <venet0 or eth0> -i tun0 -j ACCEPT
iptables -A FORWARD -o tun0 -i <venet0 or eth0> -m state --state RELATED,ESTABLISHED -j ACCEPT

Without comments, the final config should look something like this

$ egrep -v '^(#|;|$)' /etc/openvpn/server.conf

port 1194
proto udp
dev tun
ca /etc/openvpn/ca/keys/ca.crt
cert /etc/openvpn/ca/keys/server.crt
key /etc/openvpn/ca/keys/server.key  # This file should be kept secret
dh /etc/openvpn/ca/keys/dh1024.pem
server 10.0.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 4.2.2.2"
keepalive 10 120
comp-lzo
max-clients 10
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3

Start it as root

/etc/init.d/openvpn start

For all but the smallest vpn servers, you'll want a different certificate per client. Refer to the Certificate Configuration above for how to generate client keys.

Copy the example configuration file to the working directory. Replace CLIENTNAME with the name you picked for the certificate above.

cp /usr/share/doc/openvpn/examples/sample-config-files/client.conf $HOME/client-<CLIENTNAME>.ovpn

Put the certificate, ca, and key inline in the client config file. Change the first line of the following script to match CLIENTNAME from above and execute it.

clientname=<CLIENTNAME>
clientfile=$HOME/client-${clientname}.ovpn
echo "<ca>" >> $clientfile
openssl x509 -in /etc/openvpn/ca/keys/ca.crt >> $clientfile
echo "</ca>" >> $clientfile
echo "<cert>" >> $clientfile
openssl x509 -in /etc/openvpn/ca/keys/${clientname}.crt >> $clientfile
echo "</cert>" >> $clientfile
echo "<key>" >> $clientfile
openssl rsa -in /etc/openvpn/ca/keys/${clientname}.key >> $clientfile
echo "</key>" >> $clientfile

Remove the following lines for ca, cert, and key

ca ca.crt
cert client.crt
key client.key

Change the server address to the address or hostname of your server.

remote <SERVER NAME> 1194

Now send the client config to the user/machine where it will be used and test it by starting openvpn.

cat /proc/sys/net/ipv4/ip_forward

If not, edit /etc/sysctl.conf and uncomment or add the following line.

net.ipv4.ip_forward=1

Then apply the changes

sysctl -p

$ cat /dev/net/tun
cat: /dev/net/tun: File descriptor in bad state

If it isn't available on a KVM, you'll have to modprobe tun. It is available on all of the ovz nodes.