> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/linux-server-administrator/servers-configurations-debian/openvpn-2.x/openvpn-configuration-for-tcp.md).

# OpenVPN Configuration for TCP

This guide explains the process of installing and configuring an OpenVPN server for TCP communication, enabling both internet access and internal network access via the VPN.

### **Installation**

Follow the installation steps outlined in the guide.

{% content-ref url="/pages/n93TWj3X4tDKiLIrZBDt" %}
[OpenVPN 2.x](/infosec-notes/linux-server-administrator/servers-configurations-debian/openvpn-2.x.md)
{% endcontent-ref %}

***

### **Server Configuration**

**Create the TCP server configuration file:**

```bash
vim /etc/openvpn/server-tcp.conf
```

**Example `server-tcp.conf`:**

```ini
port 1194
proto tcp-client
dev tun
user nobody
group nogroup
persist-key
persist-tun
keepalive 10 120
topology subnet
server 10.9.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
push "redirect-gateway def1 bypass-dhcp"
dh none
ecdh-curve prime256v1
tls-crypt tls-crypt.key
crl-verify crl.pem
ca ca.crt
cert ${SERVER_NAME}.crt
key ${SERVER_NAME}.key
auth SHA256
cipher AES-128-GCM
ncp-ciphers AES-128-GCM
tls-server
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
client-config-dir /etc/openvpn/ccd
status /var/log/openvpn/status.log
verb 3
```

**Create required directories:**

```bash
mkdir -p /etc/openvpn/ccd
mkdir -p /var/log/openvpn
```

***

#### **Configure Firewall Rules for TCP**

Replace `enp0s3` with your network interface.

```bash
iptables -t nat -A POSTROUTING -s 10.9.0.0/24 -o enp0s3 -j MASQUERADE
iptables -A INPUT -i tun1 -j ACCEPT
iptables -A FORWARD -i enp0s3 -o tun1 -j ACCEPT
iptables -A FORWARD -i tun1 -o enp0s3 -j ACCEPT
iptables -A INPUT -i enp0s3 -p tcp --dport 1194 -j ACCEPT
```

***

#### **Client Configuration for TCP**

**Create a client configuration file:**

```bash
vim /etc/openvpn/client-tcp.ovpn
```

**Example `client-tcp.ovpn`:**

```ini
client
proto tcp
remote {server-ip} 1194
dev tun
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
verify-x509-name ${SERVER_NAME} name
auth SHA256
auth-nocache
cipher AES-128-GCM
tls-client
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
ignore-unknown-option block-outside-dns
setenv opt block-outside-dns
verb 3
<ca>
$(cat /etc/openvpn/ca.crt)
</ca>
<cert>
$(awk '/BEGIN/,/END CERTIFICATE/' "/etc/openvpn/easy-rsa/pki/issued/client1.crt")
</cert>
<key>
$(cat /etc/openvpn/easy-rsa/pki/private/client1.key)
</key>
<tls-crypt>
$(cat /etc/openvpn/tls-crypt.key)
</tls-crypt>
```

***

#### **Create a systemd Service for OpenVPN TCP**

Create a new service file for the OpenVPN TCP server:

```bash
vim /etc/systemd/system/openvpn-server-tcp.service
```

**Example service configuration:**

```ini
[Unit]
Description=OpenVPN server (TCP)
After=network.target

[Service]
ExecStart=/usr/sbin/openvpn --config /etc/openvpn/server-tcp.conf
Restart=on-failure
User=nobody
Group=nogroup
Environment=PATH=/usr/local/sbin:/usr/sbin:/sbin:/usr/local/bin:/usr/bin:/bin

[Install]
WantedBy=multi-user.target
```

***

#### **Start OpenVPN Service**

1. Reload systemd to apply the new service configuration:

   ```bash
   systemctl daemon-reload
   ```
2. Start the OpenVPN TCP service:

   ```bash
   systemctl start openvpn@server-tcp
   ```
3. Enable the service to start on boot:

   ```bash
   systemctl enable openvpn@server-tcp
   ```
4. Verify the service status:

   ```bash
   systemctl status openvpn@server-tcp
   ```

***

#### **Differences Between TCP and UDP Configuration**

* **Protocol:**
  * UDP: `proto udp`
  * TCP: `proto tcp`
* **Tunnel Network:**
  * UDP: `server 10.8.0.0 255.255.255.0`
  * TCP: `server 10.9.0.0 255.255.255.0`
* **Firewall Rules:**
  * UDP:

    ```bash
    iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o enp0s3 -j MASQUERADE
    iptables -A INPUT -i enp0s3 -p udp --dport 1194 -j ACCEPT
    ```
  * TCP:

    ```bash
    iptables -t nat -A POSTROUTING -s 10.9.0.0/24 -o enp0s3 -j MASQUERADE
    iptables -A INPUT -i enp0s3 -p tcp --dport 1194 -j ACCEPT
    ```