OpenVPN
Historical administrator reference. These instructions describe the older server installation. The Rocky Linux 9 server procedure has not yet been validated for this cluster. Preserve the deployed addresses, port, certificates, and routing rules when planning a migration. For workstation setup, use the OpenVPN client guide.
OpenVPN Server on CentOS 7
Server Installation
On CentOS, install the Extra Packages for Enterprise Linux (EPEL) repository:
yum install epel-release
yum install openvpn easy-rsa -y
yum output:
[root@rupc07:~]#yum install openvpn easy-rsa -y Loaded plugins: fastestmirror, langpacks base | 3.6 kB 00:00:00 epel/x86_64/metalink | 16 kB 00:00:00 epel | 4.7 kB 00:00:00 extras | 3.4 kB 00:00:00 updates | 3.4 kB 00:00:00 (1/5): extras/7/x86_64/primary_db | 166 kB 00:00:00 (2/5): updates/7/x86_64/primary_db | 6.0 MB 00:00:00 (3/5): epel/x86_64/updateinfo | 892 kB 00:00:00 (4/5): epel/x86_64/group_gz | 266 kB 00:00:00 (5/5): epel/x86_64/primary_db | 6.2 MB 00:00:04 Determining fastest mirrors * base: mirror.ash.fastserv.com * epel: fedora-epel.mirrors.tds.net * extras: mirror.ash.fastserv.com * updates: mirror.cc.columbia.edu Resolving Dependencies --> Running transaction check ---> Package easy-rsa.noarch 0:3.0.3-1.el7 will be installed ---> Package openvpn.x86_64 0:2.4.3-1.el7 will be updated ---> Package openvpn.x86_64 0:2.4.4-1.el7 will be an update --> Finished Dependency Resolution Dependencies Resolved ==================================================================================================================== Package Arch Version Repository Size ==================================================================================================================== Installing: easy-rsa noarch 3.0.3-1.el7 epel 31 k Updating: openvpn x86_64 2.4.4-1.el7 epel 457 k Transaction Summary ==================================================================================================================== Install 1 Package Upgrade 1 Package Total download size: 488 k Downloading packages: Delta RPMs disabled because /usr/bin/applydeltarpm not installed. (1/2): easy-rsa-3.0.3-1.el7.noarch.rpm | 31 kB 00:00:00 (2/2): openvpn-2.4.4-1.el7.x86_64.rpm | 457 kB 00:00:00 -------------------------------------------------------------------------------------------------------------------- Total 1.3 MB/s | 488 kB 00:00:00 Running transaction check Running transaction test Transaction test succeeded Running transaction Installing : easy-rsa-3.0.3-1.el7.noarch 1/3 Updating : openvpn-2.4.4-1.el7.x86_64 2/3 Cleanup : openvpn-2.4.3-1.el7.x86_64 3/3 Verifying : openvpn-2.4.4-1.el7.x86_64 1/3 Verifying : easy-rsa-3.0.3-1.el7.noarch 2/3 Verifying : openvpn-2.4.3-1.el7.x86_64 3/3 Installed: easy-rsa.noarch 0:3.0.3-1.el7 Updated: openvpn.x86_64 0:2.4.4-1.el7 Complete!
Configuration
cp /usr/share/doc/openvpn-*/sample/sample-config-files/server.conf /etc/openvpn
vi /etc/openvpn/server.conf
server.conf
#change with your port port 1194 #You can use udp or tcp proto udp # "dev tun" will create a routed IP tunnel. dev tun #Certificate Configuration #ca certificate ca /etc/openvpn/server/ca.crt #Server Certificate cert /etc/openvpn/server/server.crt #Server Key and keep this is secret key /etc/openvpn/server/server.key #See the size a dh key in /etc/openvpn/keys/ dh /etc/openvpn/server/dh2048.pem tls-auth /etc/openvpn/server/ta.key 0 remote-cert-tls client #Internal IP will get when already connect server 10.7.0.0 255.255.255.0 #this line will redirect all traffic through our OpenVPN #push "redirect-gateway def1 bypass-dhcp" #Provide DNS servers to the client, you can use goolge DNS push "dhcp-option DNS 128.6.1.1" push "dhcp-option DNS 8.8.8.8" push "dhcp-option DNS 8.8.4.4" push "route 10.10.10.0 255.255.255.0" # #Enable multiple client to connect with same key duplicate-cn keepalive 20 60 comp-lzo persist-key persist-tun daemon #openvpn status log status /var/log/openvpn/openvpn-status.log #enable log log-append /var/log/openvpn/openvpn.log #Log Level verb 3
Certificates
cp -rf /usr/share/easy-rsa/3.0/* /etc/openvpn/easy-rsa
cd /etc/openvpn/easy-rsa
vi vars
Output:
# Easy-RSA 3 parameter settings
# NOTE: If you installed Easy-RSA from your distro's package manager, don't edit
# this file in place -- instead, you should copy the entire easy-rsa directory
# to another location so future upgrades don't wipe out your changes.
# HOW TO USE THIS FILE
#
# vars.example contains built-in examples to Easy-RSA settings. You MUST name
# this file 'vars' if you want it to be used as a configuration file. If you do
# not, it WILL NOT be automatically read when you call easyrsa commands.
#
# It is not necessary to use this config file unless you wish to change
# operational defaults. These defaults should be fine for many uses without the
# need to copy and edit the 'vars' file.
#
# All of the editable settings are shown commented and start with the command
# 'set_var' -- this means any set_var command that is uncommented has been
# modified by the user. If you're happy with a default, there is no need to
# define the value to its default.
# NOTES FOR WINDOWS USERS
#
# Paths for Windows *MUST* use forward slashes, or optionally double-esscaped
# backslashes (single forward slashes are recommended.) This means your path to
# the openssl binary might look like this:
# "C:/Program Files/OpenSSL-Win32/bin/openssl.exe"
# A little housekeeping: DON'T EDIT THIS SECTION
#
# Easy-RSA 3.x doesn't source into the environment directly.
# Complain if a user tries to do this:
if [ -z "$EASYRSA_CALLER" ]; then
echo "You appear to be sourcing an Easy-RSA 'vars' file." >&2
echo "This is no longer necessary and is disallowed. See the section called" >&2
echo "'How to use this file' near the top comments for more details." >&2
return 1
fi
# DO YOUR EDITS BELOW THIS POINT
# This variable is used as the base location of configuration files needed by
# easyrsa. More specific variables for specific files (e.g., EASYRSA_SSL_CONF)
# may override this default.
#
# The default value of this variable is the location of the easyrsa script
# itself, which is also where the configuration files are located in the
# easy-rsa tree.
#set_var EASYRSA "${0%/*}"
# If your OpenSSL command is not in the system PATH, you will need to define the
# path to it here. Normally this means a full path to the executable, otherwise
# you could have left it undefined here and the shown default would be used.
#
# Windows users, remember to use paths with forward-slashes (or escaped
# back-slashes.) Windows users should declare the full path to the openssl
# binary here if it is not in their system PATH.
set_var EASYRSA_OPENSSL "openssl"
#
# This sample is in Windows syntax -- edit it for your path if not using PATH:
#set_var EASYRSA_OPENSSL "C:/Program Files/OpenSSL-Win32/bin/openssl.exe"
# Edit this variable to point to your soon-to-be-created key directory. By
# default, this will be "$PWD/pki" (i.e. the "pki" subdirectory of the
# directory you are currently in).
#
# WARNING: init-pki will do a rm -rf on this directory so make sure you define
# it correctly! (Interactive mode will prompt before acting.)
#set_var EASYRSA_PKI "$PWD/pki"
# Define X509 DN mode.
# This is used to adjust what elements are included in the Subject field as the DN
# (this is the "Distinguished Name.")
# Note that in cn_only mode the Organizational fields further below aren't used.
#
# Choices are:
# cn_only - use just a CN value
# org - use the "traditional" Country/Province/City/Org/OU/email/CN format
#set_var EASYRSA_DN "cn_only"
set_var EASYRSA_DN "org"
# Organizational fields (used with 'org' mode and ignored in 'cn_only' mode.)
# These are the default values for fields which will be placed in the
# certificate. Don't leave any of these fields blank, although interactively
# you may omit any specific field by typing the "." symbol (not valid for
# email.)
set_var EASYRSA_REQ_COUNTRY "US"
set_var EASYRSA_REQ_PROVINCE "NJ"
set_var EASYRSA_REQ_CITY "Piscataway"
set_var EASYRSA_REQ_ORG "Rutgers University"
set_var EASYRSA_REQ_EMAIL "udo@rutgers.edu"
set_var EASYRSA_REQ_OU "Department of Physics and Astronomy"
# Choose a size in bits for your keypairs. The recommended value is 2048. Using
# 2048-bit keys is considered more than sufficient for many years into the
# future. Larger keysizes will slow down TLS negotiation and make key/DH param
# generation take much longer. Values up to 4096 should be accepted by most
# software. Only used when the crypto alg is rsa (see below.)
set_var EASYRSA_KEY_SIZE 2048
# The default crypto mode is rsa; ec can enable elliptic curve support.
# Note that not all software supports ECC, so use care when enabling it.
# Choices for crypto alg are: (each in lower-case)
# * rsa
# * ec
#set_var EASYRSA_ALGO rsa
# Define the named curve, used in ec mode only:
#set_var EASYRSA_CURVE secp384r1
# In how many days should the root CA key expire?
set_var EASYRSA_CA_EXPIRE 3650
# In how many days should certificates expire?
set_var EASYRSA_CERT_EXPIRE 3650
# How many days until the next CRL publish date? Note that the CRL can still be
# parsed after this timeframe passes. It is only used for an expected next
# publication date.
#set_var EASYRSA_CRL_DAYS 180
# Support deprecated "Netscape" extensions? (choices "yes" or "no".) The default
# is "no" to discourage use of deprecated extensions. If you require this
# feature to use with --ns-cert-type, set this to "yes" here. This support
# should be replaced with the more modern --remote-cert-tls feature. If you do
# not use --ns-cert-type in your configs, it is safe (and recommended) to leave
# this defined to "no". When set to "yes", server-signed certs get the
# nsCertType=server attribute, and also get any NS_COMMENT defined below in the
# nsComment field.
#set_var EASYRSA_NS_SUPPORT "no"
# When NS_SUPPORT is set to "yes", this field is added as the nsComment field.
# Set this blank to omit it. With NS_SUPPORT set to "no" this field is ignored.
#set_var EASYRSA_NS_COMMENT "Easy-RSA Generated Certificate"
# A temp file used to stage cert extensions during signing. The default should
# be fine for most users; however, some users might want an alternative under a
# RAM-based FS, such as /dev/shm or /tmp on some systems.
#set_var EASYRSA_TEMP_FILE "$EASYRSA_PKI/extensions.temp"
# !!
# NOTE: ADVANCED OPTIONS BELOW THIS POINT
# PLAY WITH THEM AT YOUR OWN RISK
# !!
# Broken shell command aliases: If you have a largely broken shell that is
# missing any of these POSIX-required commands used by Easy-RSA, you will need
# to define an alias to the proper path for the command. The symptom will be
# some form of a 'command not found' error from your shell. This means your
# shell is BROKEN, but you can hack around it here if you really need. These
# shown values are not defaults: it is up to you to know what you're doing if
# you touch these.
#
#alias awk="/alt/bin/awk"
#alias cat="/alt/bin/cat"
# X509 extensions directory:
# If you want to customize the X509 extensions used, set the directory to look
# for extensions here. Each cert type you sign must have a matching filename,
# and an optional file named 'COMMON' is included first when present. Note that
# when undefined here, default behaviour is to look in $EASYRSA_PKI first, then
# fallback to $EASYRSA for the 'x509-types' dir. You may override this
# detection with an explicit dir here.
#
#set_var EASYRSA_EXT_DIR "$EASYRSA/x509-types"
# OpenSSL config file:
# If you need to use a specific openssl config file, you can reference it here.
# Normally this file is auto-detected from a file named openssl-easyrsa.cnf from the
# EASYRSA_PKI or EASYRSA dir (in that order.) NOTE that this file is Easy-RSA
# specific and you cannot just use a standard config file, so this is an
# advanced feature.
#set_var EASYRSA_SSL_CONF "$EASYRSA/openssl-easyrsa.cnf"
# Default CN:
# This is best left alone. Interactively you will set this manually, and BATCH
# callers are expected to set this themselves.
#set_var EASYRSA_REQ_CN "ChangeMe"
# Cryptographic digest to use.
# Do not change this default unless you understand the security implications.
# Valid choices include: md5, sha1, sha256, sha224, sha384, sha512
#set_var EASYRSA_DIGEST "sha256"
# Batch mode. Leave this disabled unless you intend to call Easy-RSA explicitly
# in batch mode without any user input, confirmation on dangerous operations,
# or most output. Setting this to any non-blank string enables batch mode.
#set_var EASYRSA_BATCH ""
./easyrsa init-pki
Output:
Note: using Easy-RSA configuration from: ./vars init-pki complete; you may now create a CA or requests. Your newly created PKI dir is: /etc/openvpn/easy-rsa/pki
./easyrsa build-ca
Output:
Note: using Easy-RSA configuration from: ./vars Generating a 2048 bit RSA private key .+++ .....................................................................+++ writing new private key to '/etc/openvpn/easy-rsa/pki/private/ca.key.kuAgmj8pBL' Enter PEM pass phrase: Verifying - Enter PEM pass phrase: ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [US]: State or Province Name (full name) [NJ]: Locality Name (eg, city) [Piscataway]: Organization Name (eg, company) [Rutgers University]: Organizational Unit Name (eg, section) [Department of Physics and Astronomy]: Common Name (eg: your user, host, or server name) [Easy-RSA CA]: Email Address [udo@rutgers.edu]: CA creation complete and you may now import and sign cert requests. Your new CA certificate file for publishing is at: /etc/openvpn/easy-rsa/pki/ca.crt
./easyrsa gen-req rupc07 nopass
Output:
Note: using Easy-RSA configuration from: ./vars Generating a 2048 bit RSA private key ......+++ .................................+++ writing new private key to '/etc/openvpn/easy-rsa/pki/private/rupc07.key.Rk9IMPgn99' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [US]: State or Province Name (full name) [NJ]: Locality Name (eg, city) [Piscataway]: Organization Name (eg, company) [Rutgers University]: Organizational Unit Name (eg, section) [Department of Physics and Astronomy]: Common Name (eg: your user, host, or server name) [rupc07]: Email Address [udo@rutgers.edu]: Keypair and certificate request completed. Your files are: req: /etc/openvpn/easy-rsa/pki/reqs/rupc07.req key: /etc/openvpn/easy-rsa/pki/private/rupc07.key
./easyrsa show-req rupc07
Output:
Note: using Easy-RSA configuration from: ./vars
Showing req details for 'rupc07'.
This file is stored at:
/etc/openvpn/easy-rsa/pki/reqs/rupc07.req
Certificate Request:
Data:
Version: 0 (0x0)
Subject:
countryName = US
stateOrProvinceName = NJ
localityName = Piscataway
organizationName = Rutgers University
organizationalUnitName = Department of Physics and Astronomy
commonName = rupc07
emailAddress = udo@rutgers.edu
Attributes:
a0:00
./easyrsa sign-req server rupc07
Output:
Note: using Easy-RSA configuration from: ./vars
You are about to sign the following certificate.
Please check over the details shown below for accuracy. Note that this request
has not been cryptographically verified. Please be sure it came from a trusted
source or that you have verified the request checksum with the sender.
Request subject, to be signed as a server certificate for 3650 days:
subject=
countryName = US
stateOrProvinceName = NJ
localityName = Piscataway
organizationName = Rutgers University
organizationalUnitName = Department of Physics and Astronomy
commonName = rupc07
emailAddress = udo@rutgers.edu
Type the word 'yes' to continue, or any other input to abort.
Confirm request details: yes
Using configuration from ./openssl-1.0.cnf
Enter pass phrase for /etc/openvpn/easy-rsa/pki/private/ca.key:
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName :PRINTABLE:'US'
stateOrProvinceName :ASN.1 12:'NJ'
localityName :ASN.1 12:'Piscataway'
organizationName :ASN.1 12:'Rutgers University'
organizationalUnitName:ASN.1 12:'Department of Physics and Astronomy'
commonName :ASN.1 12:'rupc07'
emailAddress :IA5STRING:'udo@rutgers.edu'
Certificate is to be certified until Feb 22 06:28:05 2028 GMT (3650 days)
Write out database with 1 new entries
Data Base Updated
Certificate created at: /etc/openvpn/easy-rsa/pki/issued/rupc07.crt
./easyrsa gen-req client_udo_mac nopass
Output:
Note: using Easy-RSA configuration from: ./vars Generating a 2048 bit RSA private key ................+++ ............................................+++ writing new private key to '/etc/openvpn/easy-rsa/pki/private/client_udo_mac.key.5dPBAbxbsJ' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [US]: State or Province Name (full name) [NJ]: Locality Name (eg, city) [Piscataway]: Organization Name (eg, company) [Rutgers University]: Organizational Unit Name (eg, section) [Department of Physics and Astronomy]: Common Name (eg: your user, host, or server name) [client_udo_mac]: Email Address [udo@rutgers.edu]: Keypair and certificate request completed. Your files are: req: /etc/openvpn/easy-rsa/pki/reqs/client_udo_mac.req key: /etc/openvpn/easy-rsa/pki/private/client_udo_mac.key
./easyrsa sign-req client client_udo_mac
Output:
Note: using Easy-RSA configuration from: ./vars
You are about to sign the following certificate.
Please check over the details shown below for accuracy. Note that this request
has not been cryptographically verified. Please be sure it came from a trusted
source or that you have verified the request checksum with the sender.
Request subject, to be signed as a client certificate for 3650 days:
subject=
countryName = US
stateOrProvinceName = NJ
localityName = Piscataway
organizationName = Rutgers University
organizationalUnitName = Department of Physics and Astronomy
commonName = client_udo_mac
emailAddress = udo@rutgers.edu
Type the word 'yes' to continue, or any other input to abort.
Confirm request details: yes
Using configuration from ./openssl-1.0.cnf
Enter pass phrase for /etc/openvpn/easy-rsa/pki/private/ca.key:
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName :PRINTABLE:'US'
stateOrProvinceName :ASN.1 12:'NJ'
localityName :ASN.1 12:'Piscataway'
organizationName :ASN.1 12:'Rutgers University'
organizationalUnitName:ASN.1 12:'Department of Physics and Astronomy'
commonName :ASN.1 12:'client_udo_mac'
emailAddress :IA5STRING:'udo@rutgers.edu'
Certificate is to be certified until Feb 22 06:32:19 2028 GMT (3650 days)
Write out database with 1 new entries
Data Base Updated
Certificate created at: /etc/openvpn/easy-rsa/pki/issued/client_udo_mac.crt
./easyrsa gen-crl
Output:
Note: using Easy-RSA configuration from: ./vars Using configuration from ./openssl-1.0.cnf Enter pass phrase for /etc/openvpn/easy-rsa/pki/private/ca.key: An updated CRL has been created. CRL file: /etc/openvpn/easy-rsa/pki/crl.pem
./easyrsa gen-dh
Output:
Note: using Easy-RSA configuration from: ./vars Generating DH parameters, 2048 bit long safe prime, generator 2 This is going to take a long time .............................................................................................................................................................+..................................................................................+....................................+..................................................................................................................................................................................................................................................................................................................................................................................................................+...............................................................................................+................................................+...+...............................................................................................................................................................................................................................................+................................................................................+.....+.....+..........................+.......+..................+.....................+...........................................................+................................................+..........+.......+...........................................................................................+..............................................+........................................................+.................................................................................+............+........................................................................................................................................................................................................................................+................................................................................+..........................................................................................................................................................................+.....................................................+...............................................................+.......................................++*++* DH parameters of size 2048 created at /etc/openvpn/easy-rsa/pki/dh.pem
cp /etc/openvpn/easy-rsa/pki/dh.pem /etc/openvpn/server/dh2048.pem
cd /etc/openvpn/easy-rsa/pki
openvpn --genkey --secret ta.key
Output:
# # 2048 bit OpenVPN static key # -----BEGIN OpenVPN Static key V1----- 72ae7cc6a3e41f3cb45b54e7aae6dab9 d11dd8b699c5773b831b477a7ea7c192 .... .... .... 35164bebd8cab1f1be3f7a4cd625034b -----END OpenVPN Static key V1-----
cp ca.crt issued/rupc07.crt private/rupc07.key crl.pem ta.key /etc/openvpn/server
cd /etc/openvpn/server
ln -s rupc07.crt server.crt; ln -s rupc07.key server.key;
Firewall configuration
Enable IP forwarding:
echo "net.ipv4.ip_forward = 1" > /etc/sysctl.conf
Apply the settings:
sysctl -p
firewall-cmd --zone=external --add-port=1194/udp --permanent
Remember to adjust the firewall rules in /etc/firewalld/zones/trusted.xmlAdd the following line
<source address="192.168.0.0/16" >or this alternative
<source address="10.0.0.0/8" >depending on which push command you chose in the
server.conf file:
#push "route 192.168.100.0 255.255.255.0" #push "route 10.10.10.0 255.255.255.0"Next, configure the server's firewall for routing:
firewall-cmd --permanent --direct --add-rule ipv4 nat POSTROUTING 0 -o enp4s0f0 -j MASQUERADE
Here, "enp4s0f0" is the internal interface for the "192.168.0.0/16" or "10.0.0.0/8" subnet. In this example, it corresponds to "10.10.10.0/24" (see the server.conf file).
The following is the content of /etc/firewalld/direct.xml . You can edit it manually instead of using the command above.
cat /etc/firewalld/direct.xml
direct.xml:
<?xml version="1.0" encoding="utf-8"?> <direct> <rule priority="0" table="filter" ipv="ipv4" chain="FORWARD">-i tun0 -o enp4s0f0 -p icmp -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT</rule> <rule priority="0" table="nat" ipv="ipv4" chain="POSTROUTING">-o enp4s0f0 -j MASQUERADE</rule> </direct>
You can achieve the same result with the iptables command. To open the UDP port:
iptables -A INPUT -s 0/0 -p udp -m udp --dport 1194 -j ACCEPT
and to enable routing:
iptables -t nat -A POSTROUTING -s 10.7.0.0/24 -o enp4s0f0 -j MASQUERADE
Here, "10.7.0.0/24" is the subnet specified by the following line in server.conf:
server 10.7.0.0 255.255.255.0
Additional information about the server
To help explain the server configuration, the examples below show the interface names and routing information from a configured server. The output is from the ifconfig
ifconfig:
[root@rupc07:/etc/openvpn]#ifconfig
enp2s0f0: flags=4163 mtu 1500
inet 192.168.100.7 netmask 255.255.255.0 broadcast 192.168.100.255
ether ac:1f:6b:12:e4:da txqueuelen 1000 (Ethernet)
RX packets 13420997 bytes 1310459231 (1.2 GiB)
RX errors 0 dropped 42572 overruns 0 frame 0
TX packets 2227137 bytes 2020921398 (1.8 GiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
device memory 0xdfbe0000-dfbfffff
enp2s0f1: flags=4163 mtu 1500
inet 128.6.224.217 netmask 255.255.255.192 broadcast 128.6.224.255
inet6 fe80::ae1f:6bff:fe12:e4db prefixlen 64 scopeid 0x20
ether ac:1f:6b:12:e4:db txqueuelen 1000 (Ethernet)
RX packets 14972911 bytes 9204940348 (8.5 GiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 1577254 bytes 661742723 (631.0 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
device memory 0xdfb60000-dfb7ffff
enp4s0f0: flags=4163 mtu 9000
inet 10.10.10.7 netmask 255.255.255.0 broadcast 10.10.10.255
inet6 fe80::a236:9fff:fe0b:fda0 prefixlen 64 scopeid 0x20
ether a0:36:9f:0b:fd:a0 txqueuelen 1000 (Ethernet)
RX packets 188017029 bytes 1570378314648 (1.4 TiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 49844925 bytes 3870618538 (3.6 GiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
enp4s0f1: flags=4163 mtu 1500
ether a0:36:9f:0b:fd:a2 txqueuelen 1000 (Ethernet)
RX packets 1840774 bytes 110448560 (105.3 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
lo: flags=73 mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10
loop txqueuelen 1 (Local Loopback)
RX packets 5150 bytes 334908 (327.0 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 5150 bytes 334908 (327.0 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
tun0: flags=4305 mtu 1500
inet 10.7.0.1 netmask 255.255.255.255 destination 10.7.0.2
inet6 fe80::d6d5:c312:3247:c95a prefixlen 64 scopeid 0x20
unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 txqueuelen 100 (UNSPEC)
RX packets 1983 bytes 128466 (125.4 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 1337 bytes 156724 (153.0 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
route commands:
route:
[root@rupc07:/etc/openvpn]#route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 128.6.224.193 0.0.0.0 UG 100 0 0 enp2s0f1 10.7.0.0 10.7.0.2 255.255.255.0 UG 0 0 0 tun0 10.7.0.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0 10.10.10.0 0.0.0.0 255.255.255.0 U 100 0 0 enp4s0f0 128.6.224.192 0.0.0.0 255.255.255.192 U 100 0 0 enp2s0f1 192.168.100.0 0.0.0.0 255.255.255.0 U 100 0 0 enp2s0f0
Service commands
mkdir /var/log/openvpn/
systemctl start openvpn@server.service
Automated scripts
Server installation:
vi s1-install-server.sh
s1-install-server.sh:
# chage the following lines with your Local Server Name (the short one i.e. without domain) # and ichange port number if necessary # LSN=rupc07 PORT=1194 # yum install openvpn easy-rsa -y ls -l /usr/share/easy-rsa/3/ cp -rf /usr/share/easy-rsa/3.0/* /etc/openvpn/easy-rsa # if you had previous installation then you can simply copy it over: # rsync -avz rupc07g:/etc/openvpn/ /etc/openvpn/ cd /etc/openvpn/easy-rsa/ ./easyrsa init-pki ./easyrsa build-ca ./easyrsa gen-req $LSN nopass ./easyrsa show-req $LSN ./easyrsa sign-req server $LSN ./easyrsa gen-crl ./easyrsa gen-dh openvpn --genkey --secret ta.key rm -rf /etc/openvpn/server mkdir /etc/openvpn/server cd pki/ cp pki/dh.pem /etc/openvpn/server/dh2048.pem cp ca.crt issued/$LSN.crt private/$LSN.key crl.pem ../ta.key /etc/openvpn/server cd ../../server ln -s $LSN.crt server.crt ln -s $LSN.key server.key ls -l cd /etc/openvpn/ # client config can be done using s2-client-add.sh script # which beside two main commands below also adds some more config commands # ./easyrsa gen-req client_$LSN nopass # ./easyrsa sign-req client client_$LSN # # in s2=client-add.sh script change server name and port number: vi s2-client-add.sh sh s2-client-add.sh client_$LSN # to check if everything is in place (especially certificates): more /etc/openvpn/client/client_$LSN/client_$LSN.ovpn mkdir /var/log/openvpn/ #udo systemctl start openvpn@server.service firewall-cmd --zone=external --add-port=$PORT/udp --permanent echo "don't forget to ajust firewall rules : #add the following line # # or this one # # in to file: /etc/firewalld/zones/trusted.xml # # depending which push you choose in the server.conf file: #push "route 192.168.100.0 255.255.255.0" #push "route 10.10.10.0 255.255.255.0" # # and reload firewall: firewall-cmd --reload
Adding a client
sh s2-client-add.sh client_name
s2-client-add.sh:
#!/bin/bash
#
# You must configure this variables before using the script!!!
#
OPENVPN_PORT="1194"
OPENVPN_REMOTE="rupc07.rutgers.edu"
EASYRSA_PATH="/etc/openvpn/easy-rsa"
OPENVPNCLIENT_PATH="/etc/openvpn/client"
TA_KEY_PATH="/etc/openvpn/server/ta.key"
###########################################################################
# Don't modify anything down this block
##########################################################################
abort() {
echo $1;
exit 1;
}
username=$1
addtofile() {
mkdir -p "$OPENVPNCLIENT_PATH/.tmp"
echo $1 >> "$OPENVPNCLIENT_PATH/.tmp/${username}.ovpn"
}
## Init process
if [ -z "$username" ]
then
abort "You must provide the name for the client"
fi
cd $EASYRSA_PATH
if [ -s ./easyrsa ]
then
echo "Generating key for user ${username}"
./easyrsa gen-req $1 nopass
./easyrsa sign-req client $1
echo "Done"
else
abort "easyrsa script not found in path"
fi
echo "Preparing .ovpn file..."
addtofile "client"
addtofile "dev tun"
addtofile "proto udp"
addtofile "port $OPENVPN_PORT"
addtofile "remote $OPENVPN_REMOTE $OPENVPN_PORT udp"
addtofile "#remote-cert-tls server"
addtofile "resolv-retry infinite"
addtofile "nobind"
addtofile "persist-key"
addtofile "persist-tun"
addtofile "comp-lzo"
addtofile "verb 3"
# Ensure we can connect securely to the server
echo "Adding security parameters to client configuration file"
addtofile "#cipher AES-256-CBC"
addtofile "#auth SHA512"
addtofile "#tls-version-min 1.2"
addtofile "#tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384"
# Adding ca certificate to ovpn client configuration file
echo "Adding ca certificate to ovpn client configuration file"
addtofile "" >> "$OPENVPNCLIENT_PATH"/.tmp/${username}.ovpn
cat "$EASYRSA_PATH"/pki/ca.crt | grep -A 100 "BEGIN CERTIFICATE" | grep -B 100 "END CERTIFICATE" >> "$OPENVPNCLIENT_PATH"/.tmp/${username}.ov
pn
addtofile ""
echo "Done"
# Adding user certificate to ovpn client configuration file
echo "Adding user certificate to ovpn client configuration file"
addtofile ""
cat "$EASYRSA_PATH"/pki/issued/${username}.crt | grep -A 100 "BEGIN CERTIFICATE" | grep -B 100 "END CERTIFICATE" >> "$OPENVPNCLIENT_PATH"/.tm
p/${username}.ovpn
addtofile ""
echo "Done"
# Adding user key to ovpn client configuration file
echo "Adding user key to ovpn client configuration file"
addtofile ""
cat "$EASYRSA_PATH"/pki/private/${username}.key | grep -A 100 "BEGIN PRIVATE KEY" | grep -B 100 "END PRIVATE KEY" >> "$OPENVPNCLIENT_PATH"/.t
mp/${username}.ovpn
addtofile ""
# Adding ta file to ovpn client configuration file
echo "Adding tls-auth to ovpn client configuration file"
addtofile "key-direction 1"
addtofile ""
cat "$TA_KEY_PATH" | grep -A 100 "BEGIN OpenVPN Static key V1" | grep -B 100 "END OpenVPN Static key V1" >> "$OPENVPNCLIENT_PATH"/.tmp/${user
name}.ovpn
addtofile ""
mkdir -p "$OPENVPNCLIENT_PATH"/${username}
mv "$OPENVPNCLIENT_PATH"/.tmp/${username}.ovpn "$OPENVPNCLIENT_PATH"/${username}/${username}.ovpn
cd "$OPENVPNCLIENT_PATH"; tar -zcf ${username}.tar.gz ${username}/
echo "Done"
echo "
=========================================================================================
Configurations are located in $OPENVPNCLIENT_PATH/${username}
=========================================================================================
"
exit 0
Revoking Untrusted Certificates
sh s3-client-revoke.sh clien_name
Output:
Revoking cert for user haule
Note: using Easy-RSA configuration from: ./vars
Please confirm you wish to revoke the certificate with the following subject:
subject=
countryName = US
stateOrProvinceName = NJ
localityName = Piscataway
organizationName = Rutgers University
organizationalUnitName = Department of Physics and Astronomy
commonName = haule
emailAddress = udo@rutgers.edu
Type the word 'yes' to continue, or any other input to abort.
Continue with revocation: yes
Using configuration from ./openssl-1.0.cnf
Enter pass phrase for /etc/openvpn/easy-rsa/pki/private/ca.key:
Revoking Certificate CCB64FC4CDEA3DC2E480FED372AE0582.
Data Base Updated
IMPORTANT!!!
Revocation was successful. You must run gen-crl and upload a CRL to your
infrastructure in order to prevent the revoked cert from being accepted.
Note: using Easy-RSA configuration from: ./vars
Using configuration from ./openssl-1.0.cnf
Enter pass phrase for /etc/openvpn/easy-rsa/pki/private/ca.key:
An updated CRL has been created.
CRL file: /etc/openvpn/easy-rsa/pki/crl.pem
Done
s3-client-revoke.sh:
## Remember to adjust these variables before running the script!!!
EASYRSA_PATH="/etc/openvpn/easy-rsa"
OPENVPNSSL_PATH="/etc/openvpn/server"
#############################################################
## Don't modify anything starting here
#############################################################
username=$1
if [ -z "$username" ]
then
echo "You must provide the name for the client"
exit 1
fi
cd $EASYRSA_PATH
if [ -s ./easyrsa ]
then
echo "Revoking cert for user ${username}"
./easyrsa revoke "$username"
./easyrsa gen-crl
cp "$EASYRSA_PATH"/pki/crl.pem "$OPENVPNSSL_PATH"/crl.pem
echo "Done"
else
echo "easyrsa script not found in path"
exit 1
fi
exit 0
Useful Links and References
The following references were used to install and configure the server:- How To Setup and Configure an OpenVPN Server on CentOS 7
- Easy-RSA v3 OpenVPN Howto
- Raspberry Pi Running Wheezy Raspbian
- Setting up OpenVPN 2.4 with EasyRSA 3
- OpenVPN HOWTO
- OpenVPN Downloads
- Install and Configure OpenVPN on CentOS 7
- Firewalld Rich and Direct Rules: Setting up RHEL 7 Server as a Router
- Install and Configure OpenVPN on CentOS 7
- How To Install OpenVPN on CentOS 7
- Firewalld : IP Masquerade
- OpenVPN Tunnels and Bridges
- OpenVPN Road Warrior Setup