Introduction
We're going to install and configure OpenVPN on a CentOS 7 server. We'll also discuss how to connect a client to the server on Windows, OS X, and Linux.OpenVPN is an open-source VPN application that lets you create and join a private network securely over the public Internet.
Prerequisites
You should complete these prerequisites:- CentOS 7 Droplet
- root access to the server (several steps cannot be completed with just sudo access)
- Domain or subdomain that resolves to your server that you can use for the certificates
yum install epel-release
Step 1 — Installing OpenVPN
First we need to install OpenVPN. We'll also install Easy RSA for generating our SSL key pairs, which will secure our VPN connections.yum install openvpn easy-rsa -y
Step 2 — Configuring OpenVPN
OpenVPN has example configuration files in its documentation directory. We're going to copy the sampleserver.conf file as a starting point for our own configuration file.cp /usr/share/doc/openvpn-*/sample/sample-config-files/server.conf /etc/openvpn
vi /etc/openvpn/server.conf
When we generate our keys later, the default Diffie-Hellman encryption length for Easy RSA will be 2048 bytes, so we need to change the
dh filename to dh2048.pem.dh dh2048.pem
push "redirect-gateway def1 bypass-dhcp" line, which tells the client to redirect all traffic through our OpenVPN.push "redirect-gateway def1 bypass-dhcp"
8.8.8.8 and 8.8.4.4.Do this by uncommenting the
push "dhcp-option DNS lines and updating the IP addresses.push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
nobody. To enable this you'll need to uncomment these lines:user nobody
group nobody
Step 3 — Generating Keys and Certificates
Now that the server is configured we'll need to generate our keys and certificates. Easy RSA installs some scripts to generate these keys and certificates.Let's create a directory for the keys to go in.
mkdir -p /etc/openvpn/easy-rsa/keys
cp -rf /usr/share/easy-rsa/2.0/* /etc/openvpn/easy-rsa
uses so we don't have to type our information in each time. This information is stored
in the
vars file so let's open this for editing.vi /etc/openvpn/easy-rsa/vars
KEY_. Update the following values to be accurate for your organization.The ones that matter the most are:
KEY_NAME: You should enterserverhere; you could enter something else, but then you would also have to update the configuration files that referenceserver.keyandserver.crtKEY_CN: Enter the domain or subdomain that resolves to your server
. . .
# These are the default values for fields
# which will be placed in the certificate.
# Don't leave any of these fields blank.
export KEY_COUNTRY="US"
export KEY_PROVINCE="NY"
export KEY_CITY="New York"
export KEY_ORG="DigitalOcean"
export KEY_EMAIL="sammy@example.com"
export KEY_OU="Community"
# X509 Subject Field
export KEY_NAME="server"
. . .
export KEY_CN=openvpn.example.com
. . .
cp /etc/openvpn/easy-rsa/openssl-1.0.0.cnf /etc/openvpn/easy-rsa/openssl.cnf
easy-rsa directory and source in our new variables.cd /etc/openvpn/easy-rsa
source ./vars
./clean-all
vars file, but you will see that your options are already set as the defaults. So, you can just press ENTER for each one../build-ca
./build-key-server server
./build-dh
cd /etc/openvpn/easy-rsa/keys
cp dh2048.pem ca.crt server.crt server.key /etc/openvpn
Make sure that if you do this you give them descriptive names, but for now we're going to have one client so we'll just call it
client.cd /etc/openvpn/easy-rsa
./build-key client
Step 4 — Routing
To keep things simple we're going to do our routing directly with iptables rather than the new firewalld.First, make sure the iptables service is installed and enabled.
yum install iptables-services -y
systemctl mask firewalld
systemctl enable iptables
systemctl stop firewalld
systemctl start iptables
iptables --flush
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
iptables-save > /etc/sysconfig/iptables
sysctl. Open sysctl.conf for editing.vi /etc/sysctl.conf
net.ipv4.ip_forward = 1
systemctl restart network.service
Step 5 — Starting OpenVPN
Now we're ready to run our OpenVPN service. So lets add it tosystemctl:systemctl -f enable openvpn@server.service
systemctl start openvpn@server.service
Next we'll talk about how to connect a client to the server.
Step 6 — Configuring a Client
Regardless of your client machine's operating system, you will definitely need a copy of the ca certificate from the server, along with the client key and certificate.Locate the following files on the server. If you generated multiple client keys with unique descriptive names, then the key and certificate names will be different. In this article we used
client./etc/openvpn/easy-rsa/keys/ca.crt
/etc/openvpn/easy-rsa/keys/client.crt
/etc/openvpn/easy-rsa/keys/client.key
Just make sure you make a note of where you save them.
We're going to create a file called
client.ovpn. This is a configuration file for an OpenVPN client, telling it how to connect to the server.- You'll need to change the first line to reflect the name you gave the client in your key and certificate; in our case, this is just
client - You also need to update the IP address from
your_server_ipto the IP address of your server; port1194can stay the same - Make sure the paths to your key and certificate files are correct
client
dev tun
proto udp
remote your_server_ip 1194
resolv-retry infinite
nobind
persist-key
persist-tun
comp-lzo
verb 3
ca /path/to/ca.crt
cert /path/to/client.crt
key /path/to/client.key
Windows:
On Windows, you will need the official OpenVPN Community Edition binaries which come with a GUI. Then, place your
.ovpn configuration file into the proper directory, C:\Program Files\OpenVPN\config, and click Connect in the GUI. OpenVPN GUI on Windows must be executed with administrative privileges.OS X:
On Mac OS X, the open source application Tunnelblick provides an interface similar to the OpenVPN GUI on Windows, and comes with OpenVPN and the required TUN/TAP drivers. As with Windows, the only step required is to place your
.ovpn configuration file into the ~/Library/Application
Support/Tunnelblick/Configurations directory. Or, you can double-click on your .ovpn file.Linux:
On Linux, you should install OpenVPN from your distribution's official repositories. You can then invoke OpenVPN by executing:
sudo openvpn --config ~/path/to/client.ovpn
Conclusion
Congratulations! You should now have a fully operational virtual private network running on your OpenVPN server.After you establish a successful client connection, you can verify that your traffic is being routed through the VPN by checking Google to reveal your public IP.
