> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/linux-server-administrator/servers-configurations-debian/openvpn-2.x.md).
# OpenVPN 2.x
## **OpenVPN Server Installation and Configuration (UDP)**
This guide explains the process of installing and configuring an OpenVPN server for UDP communication, enabling both internet access and internal network access via the VPN.
***
### **Install Required Packages**
Run the following commands to install OpenVPN and its dependencies:
```bash
apt install -y openvpn iptables openssl wget ca-certificates curl
```
***
### **Set Up Easy-RSA**
Download and configure Easy-RSA for managing certificates:
```bash
wget -O ~/easy-rsa.tgz https://github.com/OpenVPN/easy-rsa/releases/download/v3.1.2/EasyRSA-3.1.2.tgz
mkdir -p /etc/openvpn/easy-rsa
tar xzf ~/easy-rsa.tgz --strip-components=1 --no-same-owner --directory /etc/openvpn/easy-rsa
rm -f ~/easy-rsa.tgz
cd /etc/openvpn/easy-rsa/
```
Initialize variables for certificate generation:
```bash
echo "set_var EASYRSA_ALGO ec" > vars
echo "set_var EASYRSA_CURVE prime256v1" >> vars
```
***
### **Generate Server Keys and Certificates**
Generate unique identifiers for the server:
```bash
command1=$(head /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 16 | head -n 1)
command2=$(head /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 16 | head -n 1)
SERVER_CN="cn_${command1}"
SERVER_NAME="server_${command2}"
```
Example:
```bash
cn_XpnclzWPgfh1mn0c
server_6xcJEyXeKMsMQ4Lw
```
Initialize the PKI and generate the server certificates:
```bash
./easyrsa init-pki
EASYRSA_CA_EXPIRE=3650 ./easyrsa --batch --req-cn="${SERVER_CN}" build-ca nopass
openssl dhparam -out dh.pem 2048
EASYRSA_CERT_EXPIRE=3650 ./easyrsa --batch build-server-full "${SERVER_NAME}" nopass
EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl
```
Generate a TLS key:
```bash
openvpn --genkey --secret /etc/openvpn/tls-crypt.key
```
Move necessary files to `/etc/openvpn`:
```bash
cp pki/ca.crt pki/private/ca.key pki/issued/"${SERVER_NAME}".crt pki/private/"${SERVER_NAME}".key /etc/openvpn/easy-rsa/pki/crl.pem /etc/openvpn
cp dh.pem /etc/openvpn
chmod 644 /etc/openvpn/crl.pem
```
***
### **Configure OpenVPN Server**
Create the OpenVPN server configuration file:
```bash
vim /etc/openvpn/server-udp.conf
```
Example configuration:
```ini
port 1194 # Listening port
proto udp # Protocol
dev tun
user nobody
group nogroup
persist-key
persist-tun
keepalive 10 120
topology subnet
server 10.8.0.0 255.255.255.0 # Tunnel network
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
push "redirect-gateway def1 bypass-dhcp"
dh none
ecdh-curve prime256v1
tls-crypt tls-crypt.key
crl-verify crl.pem
ca ca.crt
cert ${SERVER_NAME}.crt
key ${SERVER_NAME}.key
auth SHA256
cipher AES-128-GCM
ncp-ciphers AES-128-GCM
tls-server
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
client-config-dir /etc/openvpn/ccd
status /var/log/openvpn/status.log
verb 3
```
***
### **Configure Networking and IP Forwarding**
Create directories for client-specific configurations and logs:
```bash
mkdir -p /etc/openvpn/ccd
mkdir -p /var/log/openvpn
```
Identify the network interface:
```bash
ip -4 route ls | grep default | grep -Po '(?<=dev )(\S+)' | head -1
```
Set up the necessary `iptables` rules:
Replace `NIC` with your network interface (`enp0s3` in this example):
```bash
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o enp0s3 -j MASQUERADE
iptables -A INPUT -i tun0 -j ACCEPT
iptables -A FORWARD -i enp0s3 -o tun0 -j ACCEPT
iptables -A FORWARD -i tun0 -o $NIC -j ACCEPT
iptables -A INPUT -i enp0s3 -p udp --dport 1194 -j ACCEPT
```
Enable IP forwarding:
```bash
vim /etc/sysctl.conf
# Uncomment or add the following line:
net.ipv4.ip_forward=1
sysctl -p
```
***
## **Start OpenVPN**
Create a systemd service file for OpenVPN:
```bash
vim /etc/systemd/system/openvpn-server-udp.service
```
Example configuration:
```ini
[Unit]
Description=OpenVPN Server (UDP)
After=network.target
[Service]
ExecStart=/usr/sbin/openvpn --config /etc/openvpn/server-udp.conf
Restart=on-failure
User=nobody
Group=nogroup
Environment=PATH=/usr/local/sbin:/usr/sbin:/sbin:/usr/local/bin:/usr/bin:/bin
[Install]
WantedBy=multi-user.target
```
Reload systemd and start the OpenVPN service:
```bash
systemctl daemon-reload
systemctl start openvpn@server-udp
systemctl enable openvpn@server-udp
```
***
### **Client Configuration**
Generate a client certificate:
```bash
cd /etc/openvpn/easy-rsa/
EASYRSA_CERT_EXPIRE=3650 ./easyrsa --batch build-client-full client1 nopass
```
Create the client configuration file (`client.ovpn`):
```bash
vim /etc/openvpn/client1.ovpn
```
Example configuration:
```ini
client
proto udp
explicit-exit-notify
remote {server-ip} 1194
dev tun
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
verify-x509-name ${SERVER_NAME} name
auth SHA256
auth-nocache
cipher AES-128-GCM
tls-client
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
ignore-unknown-option block-outside-dns
setenv opt block-outside-dns
verb 3
$(cat /etc/openvpn/easy-rsa/pki/ca.crt)
$(awk '/BEGIN/,/END CERTIFICATE/' "/etc/openvpn/easy-rsa/pki/issued/client1.crt")
$(cat /etc/openvpn/easy-rsa/pki/private/client1.key)
$(cat /etc/openvpn/tls-crypt.key)
```
***
Reference
{% embed url="" %}