This article presents a brief, step-by-step guide of setting up an VPN server which relays all your Internet traffic in a secure way so that you can surf the Internet as if you are at your server's location, with transmission between you and the server encrypted.
- A server running Ubuntu Server 14.04 LTS, which can be rent from a cloud service provider. Root access is required.
- Understanding private IP address range: 192.168.0.0/16, 10.0.0.0/8, etc.
- Knowing that a '
#' before a Linux command indicates running under root privilege, contrast to '
Instructions on the server side
Logging into the server
The typical way of administering remote server is through SSH. If you are running Windows on your own computer, PuTTY is one of the choice of SSH client. Note that you should download the Windows Installer on the PuTTY Download Page. After starting PuTTY, fill your host's IP address (or domain name if you have one) and click 'Open'.
Or if you are running Linux, just run ssh from your command line:
$ ssh <yourusername>@<yourserverIP>
Then you will be asked for password. Note that when you type the password, no feedback will show on your screen. This is a security feature of Linux. If there is a '
$' precedes the cursor, type this to obtain root privilege:
$ sudo -s [sudo] password for <yourusername> # <cursor>
Logging in public/private key pair is not covered in this article.
We will run OpenVPN on both client and server. As Ubuntu provides fairly old versions of OpenVPN, it's better to add OpenVPN's official repository to system:
# wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg|apt-key add - # echo "deb http://swupdate.openvpn.net/apt trusty main" > /etc/apt/sources.list.d/swupdate.openvpn.net.list
And install OpenVPN:
# apt-get update && apt-get install openvpn
Setting up PKI
PKI refers to public key infrastructure, which is responsible for authenticating both your computer and your VPN server, and encrypting the traffic between them. Easy RSA provides a simple way to set up PKI.
Download Easy RSA from GitHub and extract files:
:~# wget https://github.com/OpenVPN/easy-rsa/releases/download/3.0.1/EasyRSA-3.0.1.tgz :~# tar -xzvf EasyRSA-3.0.1.tgz :~# cd EasyRSA-3.0.1 :~/EasyRSA-3.0.1# <cursor>
vars and edit using nano:
:~/EasyRSA-3.0.1# mv vars.example vars :~/EasyRSA-3.0.1# nano vars
Find the line (use arrow keys on keyboard to move)
#set_var EASYRSA "$PWD"
and modify it to (or add this line below)
set_var EASYRSA "/usr/local/etc/easy-rsa"
Type Ctrl+O to save and Ctrl+X to exit nano.
Then copy some files to
:~/EasyRSA-3.0.1# mkdir -p /usr/local/etc/easy-rsa :~/EasyRSA-3.0.1# cp openssl-1.0.cnf /usr/local/etc/easy-rsa/ :~/EasyRSA-3.0.1# cp -R x509-types /usr/local/etc/easy-rsa/
Next, we will initialize PKI, build the CA, generate the CRL, create certificates for the server and your computer (i.e. the client):
:~/EasyRSA-3.0.1# ./easyrsa init-pki :~/EasyRSA-3.0.1# ./easyrsa build-ca nopass :~/EasyRSA-3.0.1# ./easyrsa gen-crl :~/EasyRSA-3.0.1# ./easyrsa build-server-full myvpn-server nopass :~/EasyRSA-3.0.1# ./easyrsa build-client-full myvpn-client1 nopass
Note that after running
./easyrsa build-ca nopass, you will be asked for Common Name of your CA. Type
MyVPN or whatever you like. Special care should be taken to protect the
Write OpenVPN server configuration file
Copy the PKI files for the server to OpenVPN working directory:
:~/EasyRSA-3.0.1# cd /etc/openvpn :/etc/openvpn# cp -a /usr/local/etc/easy-rsa/pki/ca.crt ca.crt :/etc/openvpn# cp -a /usr/local/etc/easy-rsa/pki/issued/myvpn-server.crt myvpn-server.crt :/etc/openvpn# cp -a /usr/local/etc/easy-rsa/pki/private/myvpn-server.key myvpn-server.key
Generate a Diffie-Hellman parameter:
:/etc/openvpn# openssl dhparam -out dh2048.pem 2048
Generate a tls-auth key:
:/etc/openvpn# openvpn --genkey --secret /etc/openvpn/ta.key
Create a client configuration file for all clients:
:/etc/openvpn# mkdir clients :/etc/openvpn# cd clients :/etc/openvpn/clients# nano DEFAULT
DEFAULT as follows:
push "redirect-gateway def1 bypass-dhcp" push "route-metric 0" push "dhcp-option DNS 126.96.36.199" iroute 10.0.0.0 255.0.0.0 iroute 192.168.0.0 255.255.0.0
:/etc/openvpn/clients# cd .. :/etc/openvpn# nano vpnserver.ovpn
Save it as follows:
proto udp port 1194 dev tun server 10.245.63.0 255.255.255.0 topology subnet persist-key persist-tun keepalive 10 60 remote-cert-tls client tls-auth /etc/openvpn/ta.key 0 dh /etc/openvpn/dh2048.pem ca /etc/openvpn/ca.crt cert /etc/openvpn/myvpn-server.crt key /etc/openvpn/myvpn-server.key user nobody group nogroup verb 3 daemon log-append /var/log/openvpn.log client-config-dir /etc/openvpn/clients
Finally we are able to run the server side instance:
:/etc/openvpn# openvpn vpnserver.ovpn
We had set the OpenVPN to run in daemon mode, so no output will be shown in the terminal. Use
tail command to check log:
:/etc/openvpn# tail -f /var/log/openvpn.log
If the log finishes with the following line, it means that the VPN server is successfully launched.
Fri Jan 15 14:31:27 2016 Initialization Sequence Completed
Configure packet forwarding
You will find that connecting to an OpenVPN server is like connecting to a WiFi router: You are assigned an private IP address and your requests/responses are passed through NAT. A 'router' will do this automatically while you must explicitly tell your server to forward your traffic.
:/etc/openvpn# sysctl -w net.ipv4.ip_forward=1 :/etc/openvpn# iptables -t nat -I POSTROUTING -o eth0 -s 10.245.63.0/24 -j MASQUERADE
Generate client configuration file
Switch to your home directory and create client configuration template:
:/etc/openvpn# cd ~ :~# nano client-config-template.ovpn
client-config-template.ovpn as follows, remember to replace
<yourserverIP> with your server's IP address or domain name.
client dev tun nobind float remote <yourserverIP> 1194 udp remote-cert-tls server key-direction 1 reneg-sec 0 # Uncomment these lines if using Linux and experiencing DNS cache poisoning # Make sure the script update-resolv-conf exists ;script-security 2 ;up /etc/openvpn/update-resolv-conf ;down /etc/openvpn/update-resolv-conf
Finally append key files to the client configuration file:
:~# cat client-config-template.ovpn > myvpn-client1.ovpn :~# echo -e '\n<cert>' >> myvpn-client1.ovpn :~# cat /usr/local/etc/easy-rsa/pki/issued/myvpn-client1.crt >> myvpn-client1.ovpn :~# echo -e '</cert>\n' >> myvpn-client1.ovpn :~# echo -e '<key>' >> myvpn-client1.ovpn :~# cat /usr/local/etc/easy-rsa/pki/private/myvpn-client1.key >> myvpn-client1.ovpn :~# echo -e '</key>\n' >> myvpn-client1.ovpn :~# echo -e '<ca>' >> myvpn-client1.ovpn :~# cat /usr/local/etc/easy-rsa/pki/ca.crt >> myvpn-client1.ovpn :~# echo -e '</ca>\n' >> myvpn-client1.ovpn :~# echo -e '<tls-auth>' >> myvpn-client1.ovpn :~# cat /etc/openvpn/ta.key >> myvpn-client1.ovpn :~# echo -e '</tls-auth>' >> myvpn-client1.ovpn
Instructions on your computer
The first step is to download
myvpn-client1.ovpn from the server. The simplest way is showing content of the file using
nano and copy-paste it into your local text editor, save.
Filezilla supports downloading via SSH by changing the port from 21 to 22. If you are running Linux on your computer, it's recommended to use
:~$ scp <yourusername>@<yourserverIP>:~/myvpn-client1.ovpn myvpn-client1.ovpn
- Go to OpenVPN Download Page and download an installer, install.
- Save your
- Run OpenVPN GUI as Administrator
- Right-click the OpenVPN icon on the system tray, choose myvpn-client1 and click 'Connect'.
- Install OpenVPN just like installing on the server.
- Save your
myvpn-client1.ovpnto wherever you like.
sudo openvpn myvpn-client1.ovpnto launch VPN client.
Crist, Eric F., and Jan Just Keijser. Mastering OpenVPN. Packt Publishing Ltd, 2015.