User Tools
openvpn
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| openvpn [2021/11/10 00:06] – [Here is my steps] vissie | openvpn [2021/11/10 03:39] (current) – [Here is my steps] vissie | ||
|---|---|---|---|
| Line 9: | Line 9: | ||
| ====Here is my steps==== | ====Here is my steps==== | ||
| - | Step 1 — Installing OpenVPN and EasyRSA | + | ===Step 1 — Installing OpenVPN and EasyRSA=== |
| sudo apt install openvpn | sudo apt install openvpn | ||
| wget https:// | wget https:// | ||
| aunpack ./ | aunpack ./ | ||
| - | Step 2 — Configuring the EasyRSA Variables and Building the CA | + | ===Step 2 — Configuring the EasyRSA Variables and Building the CA=== |
| cd ./ | cd ./ | ||
| cp vars.example vars | cp vars.example vars | ||
| Line 27: | Line 27: | ||
| set_var EASYRSA_REQ_EMAIL | set_var EASYRSA_REQ_EMAIL | ||
| set_var EASYRSA_REQ_OU | set_var EASYRSA_REQ_OU | ||
| - | Step 3 — Creating the Server Certificate, | + | ===Step 3 — Creating the Server Certificate, |
| ./easyrsa init-pki | ./easyrsa init-pki | ||
| "... Your newly created PKI dir is: / | "... Your newly created PKI dir is: / | ||
| Line 39: | Line 39: | ||
| sudo cp ./ | sudo cp ./ | ||
| ./easyrsa sign-req server server | ./easyrsa sign-req server server | ||
| + | sudo cp ./ | ||
| + | sudo cp ./ | ||
| ./easyrsa gen-dh | ./easyrsa gen-dh | ||
| sudo openvpn --genkey --secret ta.key | sudo openvpn --genkey --secret ta.key | ||
| sudo cp ./ta.key / | sudo cp ./ta.key / | ||
| sudo cp ./ | sudo cp ./ | ||
| - | Step 4 — Generating a Client Certificate and Key Pair | + | ===Step 4 — Generating a Client Certificate and Key Pair=== |
| cd ~ | cd ~ | ||
| mkdir -p ~/ | mkdir -p ~/ | ||
| Line 56: | Line 58: | ||
| sudo cp ~/ | sudo cp ~/ | ||
| sudo cp / | sudo cp / | ||
| - | Step 5 — Configuring the OpenVPN Service | + | ===Step 5 — Configuring the OpenVPN Service=== |
| sudo cp / | sudo cp / | ||
| sudo gzip -d / | sudo gzip -d / | ||
| Line 75: | Line 77: | ||
| push " | push " | ||
| # Optional! | # Optional! | ||
| - | port 443 | + | port 11 |
| # Optional! | # Optional! | ||
| proto tcp | proto tcp | ||
| Line 81: | Line 83: | ||
| explicit-exit-notify 0 | explicit-exit-notify 0 | ||
| ... | ... | ||
| - | Step 6 — Adjusting the Server Networking Configuration | + | ===Step 6 — Adjusting the Server Networking Configuration=== |
| sudo vim / | sudo vim / | ||
| ... | ... | ||
| Line 99: | Line 101: | ||
| # from the VPN. Remember to replace eth0 in the -A POSTROUTING line below with the interface you found in the above command: | # from the VPN. Remember to replace eth0 in the -A POSTROUTING line below with the interface you found in the above command: | ||
| - | / | + | <sxh bash; gutter: false> |
| # | # | ||
| # rules.before | # rules.before | ||
| Line 122: | Line 124: | ||
| *filter | *filter | ||
| . . . | . . . | ||
| + | </ | ||
| | | ||
| + | sudo vim / | ||
| + | ... | ||
| + | DEFAULT_FORWARD_POLICY=" | ||
| + | ... | ||
| + | sudo ufw allow 1194/udp | ||
| + | sudo ufw allow OpenSSH | ||
| + | ===Step 7 — Starting and Enabling the OpenVPN Service=== | ||
| + | sudo systemctl start openvpn@server | ||
| + | sudo systemctl status openvpn@server | ||
| + | sudo systemctl enable openvpn@server | ||
| + | ===Step 8 — Creating the Client Configuration Infrastructure=== | ||
| + | mkdir -p ~/ | ||
| + | cp / | ||
| + | vim ~/ | ||
| + | ... | ||
| + | remote my.server.com 1194 | ||
| + | proto udp | ||
| + | # Downgrade privileges after initialization (non-Windows only) | ||
| + | user nobody | ||
| + | group nogroup | ||
| + | #ca ca.crt | ||
| + | #cert client.crt | ||
| + | #key client.key | ||
| + | #tls-auth ta.key 1 | ||
| + | cipher AES-256-CBC | ||
| + | auth SHA256 | ||
| + | key-direction 1 | ||
| + | # Finally, add a few commented out lines. Although you can include these directives in every client configuration file, you only need to enable them for Linux clients | ||
| + | # that ship with an / | ||
| + | # script-security 2 | ||
| + | # up / | ||
| + | # down / | ||
| + | ... | ||
| + | vim ~/ | ||
| + | | ||
| + | #!/bin/bash | ||
| + | |||
| + | # First argument: Client identifier | ||
| + | <sxh bash; gutter: false> | ||
| + | KEY_DIR=/ | ||
| + | OUTPUT_DIR=/ | ||
| + | BASE_CONFIG=/ | ||
| + | |||
| + | cat ${BASE_CONFIG} \ | ||
| + | <(echo -e '< | ||
| + | ${KEY_DIR}/ | ||
| + | <(echo -e '</ | ||
| + | ${KEY_DIR}/ | ||
| + | <(echo -e '</ | ||
| + | ${KEY_DIR}/ | ||
| + | <(echo -e '</ | ||
| + | ${KEY_DIR}/ | ||
| + | <(echo -e '</ | ||
| + | > ${OUTPUT_DIR}/ | ||
| + | </ | ||
| + | chmod 700 ~/ | ||
| + | ===Step 9 — Generating Client Configurations=== | ||
| + | cd ~/ | ||
| + | sudo ./ | ||
| + | ls ~/ | ||
| + | ===Step 10 — Installing the Client Configuration=== | ||
| + | sudo apt install openvpn | ||
| + | # Check to see if your distribution includes an / | ||
| + | ls / | ||
| + | update-resolv-conf | ||
| + | #Next, edit the OpenVPN client configuration file you transfered: | ||
| + | vim client1.ovpn | ||
| + | <sxh bash; gutter: false> | ||
| + | ... | ||
| + | script-security 2 | ||
| + | up / | ||
| + | down / | ||
| + | ... | ||
| + | </ | ||
| + | | ||
| + | |||
| | | ||
| ==== Here is my notes: ==== | ==== Here is my notes: ==== | ||
openvpn.1636531591.txt.gz · Last modified: 2021/11/10 00:06 by vissie