Centos-7
-----
Install OpenVPN to Configure Virtual Private Network.
This example is based on the environment like follows.
By settings of OpenVPN Server/Client, [tun] interface will be configured automatically and when connecting with VPN from Client to Server, Client can access to the the local network of the Server.
On this example, it needs to set IP Masquerading on Router, too.
+----------------------+ | [ OpenVPN Server ] |192.168.100.1 | dlp.srv.world +--------+ | |tun | +-----------+----------+ | eth0|10.0.0.29 | | | | Local Network | 10.0.0.1| | +------+-----+ | -------| Router |-------------|----- +------+-----+ | | | | Internet | --------------+-------------------|----- | | | Local Network | 192.168.0.100| | +-----------+----------+ | | |tun | | VPN Client +--------+ | |192.168.100.x +----------------------+
[1]
Install OpenVPN.
[2]
Create CA and Certificates.
[root@dlp ~]# cd /usr/share/easy-rsa/3
# initialize
[root@dlp 3]# ./easyrsa init-pki
init-pki complete; you may now create a CA or requests. Your newly created PKI dir is: /usr/share/easy-rsa/3/pki
# create CA
[root@dlp 3]# ./easyrsa build-ca
Using SSL: openssl OpenSSL 1.1.1c FIPS 28 May 2019 # set any pass-phrase Enter New CA Key Passphrase: Re-Enter New CA Key Passphrase: Generating RSA private key, 2048 bit long modulus (2 primes) .......+++++ ...........................................+++++ e is 65537 (0x010001) # OK to ignore the error below Can't load /usr/share/easy-rsa/3/pki/.rnd into RNG 139779519366976:error:2406F079:random number generator:RAND_load_file:Cannot open file:crypto/rand/randfile.c:98:Filename=/usr/share/easy-rsa/3/pki/.rnd You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- # set any name Common Name (eg: your user, host, or server name) [Easy-RSA CA]:Server-CA CA creation complete and you may now import and sign cert requests. Your new CA certificate file for publishing is at: /usr/share/easy-rsa/3/pki/ca.crt
# create server certificates
# any name is OK for [server1] name
# (it is set for file name of certs or commonName)
[root@dlp 3]# ./easyrsa build-server-full server1 nopass
Using SSL: openssl OpenSSL 1.1.1c FIPS 28 May 2019 Generating a RSA private key ..................................+++++ ...................................+++++ writing new private key to '/usr/share/easy-rsa/3/pki/private/server1.key.Mxv13uLARL' ----- Using configuration from /usr/share/easy-rsa/3/pki/safessl-easyrsa.cnf # answer with pass-phrase set on CA Enter pass phrase for /usr/share/easy-rsa/3/pki/private/ca.key: Check that the request matches the signature Signature ok The Subject's Distinguished Name is as follows commonName :ASN.1 12:'server1' Certificate is to be certified until Jan 25 03:52:49 2023 GMT (1080 days) Write out database with 1 new entries Data Base Updated
# create client certificates
# any name is OK for [client1] name
# (it is set for file name of certs or commonName)
[root@dlp 3]# ./easyrsa build-client-full client1 nopass
Using SSL: openssl OpenSSL 1.1.1c FIPS 28 May 2019 Generating a RSA private key .............+++++ ................+++++ writing new private key to '/usr/share/easy-rsa/3/pki/private/client1.key.JZkbIpNr3Y' ----- Using configuration from /usr/share/easy-rsa/3/pki/safessl-easyrsa.cnf # answer with pass-phrase set on CA Enter pass phrase for /usr/share/easy-rsa/3/pki/private/ca.key: Check that the request matches the signature Signature ok The Subject's Distinguished Name is as follows commonName :ASN.1 12:'client1' Certificate is to be certified until Jan 25 03:54:36 2023 GMT (1080 days) Write out database with 1 new entries Data Base Updated
# generate Diffie Hellman ( DH ) parameter
[root@dlp 3]# ./easyrsa gen-dh
Using SSL: openssl OpenSSL 1.1.1c FIPS 28 May 2019 Generating DH parameters, 2048 bit long safe prime, generator 2 This is going to take a long time ............++*++*++*++* DH parameters of size 2048 created at /usr/share/easy-rsa/3/pki/dh.pem
# create TLS-Auth key
[root@dlp 3]# openvpn --genkey --secret ./pki/ta.key
# copy generated certs
[root@dlp 3]# cp -pR /usr/share/easy-rsa/3/pki/{issued,private,ca.crt,dh.pem,ta.key} /etc/openvpn/server/
[3]
Enable IP forwarding.
[root@dlp ~]# vi /etc/sysctl.d/10-ipv4_forward.conf
# create new
net.ipv4.ip_forward = 1
[root@dlp ~]# sysctl --system
[4]
Configure OpenVPN.
# copy sample configuration
[root@dlp ~]# cp /usr/share/doc/openvpn/sample/sample-config-files/server.conf /etc/openvpn/server/
[root@dlp ~]# vi /etc/openvpn/server/server.conf
# line 32: change if need (listening port of OpenVPN)
port 1194
# line 35: change if need
;proto tcp
proto udp
# line 78: specify certificates
ca ca.crt
cert issued/server1.crt
key private/server1.key
# line 85: specify DH file
dh dh.pem
# line 101: specify network to be used on VPN
# any network are OK except your local network
server 192.168.100.0 255.255.255.0
# line 142: uncomment and change to your local network
push "route 10.0.0.0 255.255.255.0"
# line 231: keepalive settings
keepalive 10 120
# line 244: specify TLS-Auth key
tls-auth ta.key 0
# line 263: uncomment (enable compress)
comp-lzo
# line 281: enable persist options
persist-key
persist-tun
# line 287: change log path
status /var/log/openvpn-status.log
# line 296: change log path
log /var/log/openvpn.log log-append /var/log/openvpn.log
# line 306: specify log level (0 - 9, 9 means debug lebel)
verb 3
[root@dlp ~]# systemctl enable --now openvpn-server@server
[5]
If Firewalld is running, allow service port.
[root@dlp ~]# firewall-cmd --add-port=1194/udp --permanent
[root@dlp ~]# firewall-cmd --reload
[6]
Transfer certs follows you generated to Client Host you'd like to connect with VPN.
It's OK all for VPN Server settings.
* /etc/openvpn/server/ca.crt
* /etc/openvpn/server/ta.key
* /etc/openvpn/server/issued/client1.crt
* /etc/openvpn/server/private/client1.key
Configure VPN Client
Configure VPN Client. This example is on Windows 10.
This example is based on the environment like follows.
By settings of OpenVPN Server/Client, tun interface will be configured automatically and when connecting with VPN from Client to Server, Client can access to the the local network of the Server.
On this example, it needs to set IP Masquerading on Router, too.
+----------------------+ | [ OpenVPN Server ] |192.168.100.1 | dlp.srv.world +--------+ | |tun | +-----------+----------+ | eth0|10.0.0.29 | | | | Local Network | 10.0.0.1| | +------+-----+ | -------| Router |-------------|----- +------+-----+ | | | | Internet | --------------+-------------------|----- | | | Local Network | 192.168.0.100| | +-----------+----------+ | | |tun | | VPN Client +--------+ | |192.168.100.x +----------------------+
[1]
[2]
[3]
[4]
[5]
[6]
[7]
[8]
Download OpenVPN client from the site below and install it.
⇒ https://openvpn.net/community-downloads/
After installing OpenVPN client, copy the file [client.ovpn] which is under the [C:Program FilesOpenVPNsample-config] into [C:Program FilesOpenVPN.nfig] and rename it to the name which you named when created client certificates on the VPN Server. Furthermore, copy files [ca.crt], [client1.crt], [client1.key] which you created on the server to the same folder like follows.
Open the file [client.ovpn] (before renaming) with text editor like memopad and edit like follows.
# it's OK with default
client
# protocol which you specified in the server's config
;proto tcp
proto udp
# OpenVPN server's global IP and port (replace to your own environment)
remote 172.16.2.1 1194
# retry resolving
resolv-retry infinite
# no bind for local port
nobind
# enable persist options
persist-key
persist-tun
# path for certificates
ca ca.crt
cert client1.crt
key client1.key
# path of TLS-Auth key
tls-auth ta.key 1
# enable compress
comp-lzo
# log level
verb 3
Start [OpenVPN GUI] with admin priviledge.
Click OpenVPN icon which is in taskbar with right button and select [connect].
After connecting, the color of icon turns green.
After connecting, TAP adapter is added like follows.
After connecting, it's possible to access to OpenVPN server's local address.
---