Install OpenVPN on Ubuntu

Install OpenVPN on Ubuntu Step by Step

Ok, we'll install OpenVPN on a client and a server, both running Ubuntu 7.10. I imagine the process is quite the same for other Linux distributions. Thanks to my buddies Javier Albarracín, Bruno Kamiche and César Villegas for the tips.

First let's make a few things clear:

• Server: the PC accepting connections of clients thru the VPN. For my examples the server will use the public IP x.y.z.w (replace with your own public IP) and will be named servo.
• Client: the PC connecting to the server thru the VPN. We'll call it cliento.
• Private network: it's the network we'll create for our VPN, we'll use 10.8.0.0 and our IP's will be like 10.8.0.1, 10.8.0.2, etc.
• All commands must be run under root or using sudo.
• What you must type appears in bold letters.
• To comment a line in your openvpn.conf file use # to start the line.

First let's install OpenVPN:

sudo apt-get install openvpn

OpenVPN must be installed in both client and server, the configuration file used for starting the service will define the role of each PC.

Comment all lines in /etc/default/openvpn and add:

AUTOSTART="openvpn"

This line tells OpenVPN which configuration file it should use by default when starting. Configuration files are in /etc/openvpn and use the .conf extension so the setting above points to/etc/openvpn/openvpn.conf, a file that still does not exist and we'll create.

Now we can start, stop or restart OpenVPN as usual, let's see:

Start OpenVPN:

/etc/init.d/openvpn start

Stop OpenVPN:
/etc/init.d/openvpn stop

Restart OpenVPN:
/etc/init.d/openvpn restart

Every time you change settings in /etc/openvpn/openvpn.conf you need to restart OpenVPN.

Create Keys and Certificates

Now we need to create security certificates and keys. We'll do all this in the server as root:

cd /etc/openvpn/

Copy the directory easy-rsa to /etc/openvpn:

cp -r /usr/share/doc/openvpn/examples/easy-rsa/ .

Remember we're still inside the /etc/openvpn directory. Now let's edit the file vars with our favorite editor (replace vi with yours):

vi easy-rsa/vars

Kaiman reported a change for this part after June 2008:

vi easy-rsa/2.0/vars

Comment this line:

#export D=pwd

Add this one:
export D=/etc/openvpn/easy-rsa

And modify as below:

export KEY_COUNTRY=PE
export KEY_PROVINCE=LI
export KEY_CITY=Lima
export KEY_ORG="Nombre-OpenVPN"
export KEY_EMAIL="tu-nombre@example.com"

Save and quit.

Now run:

. ./vars

Important: that's a period, a space and another period followed by /vars. This is a common confusion in many setups.

Now:
./clean-all

The next command creates your certificate authority (CA) using the parameters you just set, you should just add Common Name, I used OpenVPN-CA. For this step you'll need OpenSSL; if you don't have it in your server install it by running:

sudo apt-get install openssl

Ok, now we're ready:

./build-ca

Now let's create the keys, first the server:

./build-key-server server

This is important. When build-key-server asks for Common Name write server, the same parameter you provided to the command.

Also you'll need to answer yes to these two questions: Sign the certificate? [y/n] and 1 out of 1 certificate requests certified, commit? [y/n].

Now the key for the client:

./build-key client1

Use client1 as Common Name, the same parameter you used above for build-key.

You can repeat this step if you want to have more clients, just replace the parameter with client2,client3, etc.

Now let's create Diffie Hellman parameters:

./build-dh

There you are! Now you should have a new directory with your certificates and keys:/etc/openvpn/easy-rsa/keys. To configure your first client copy these files from servo to cliento:

ca.crt
client1.crt
client1.key

Ideally you should use a secure channel, I use scp with RSA authentication (topic for another article):dev tun

scp alexis@servo:ca.crt .
scp alexis@servo:client1.crt .
scp alexis@servo:client1.key .

These commands assume you've copied the files to the home of user alexis on the server and assigned read permissions. Then move the files to /etc/openvpn on the client.

The Configuration Files:openvpn.conf

Now go to your client and create openvpn.conf in /etc/openvpn. Write this inside:

dev tun
client
proto tcp
remote x.y.z.w 1194
resolv-retry infinite
nobind
user nobody
group nogroup

# Try to preserve some state across restarts.
persist-key
persist-tun
ca ca.crt
cert client1.crt
key client1.key
comp-lzo

# Set log file verbosity.
verb 3

Replace x.y.z.w with your server's public IP.

Now in the server: create openvpn.conf in /etc/openvpn and put this:

dev tun
proto tcp
port 1194

ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
dh /etc/openvpn/easy-rsa/keys/dh1024.pem

user nobody
group nogroup
server 10.8.0.0 255.255.255.0

persist-key
persist-tun

#status openvpn-status.log
#verb 3
client-to-client

push "redirect-gateway def1"

#log-append /var/log/openvpn
comp-lzo

My first connections were a little slow so I disabled compression with this:

#comp-lzo

Finally, configure IP forwarding and IPTables for doing NAT on the server:

echo 1 > /proc/sys/net/ipv4/ip_forward

sudo iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

You can verify the rule was written correctly with:

sudo iptables -L -t nat

If you have a firewall you should make sure your VPN traffic can be routed.

If you made a mistake and want to remove all rules from IPTables:

sudo iptables -F -t nat

Now restart OpenVPN in both client and server and you should be set.

Running ifconfig and route -n you should see a new interface, tun0, in both PC's.

Confirm you can connect with a ping to your new tun0 interfaces, for example:

ping 10.8.0.1

Now your client is connected to your server using OpenVPN, you can navigate secure using your server's IP and say hi to Hulu and Pandora.

Good luck!