There are various ways to set up a Virtual Private Network (VPN). With the various protocols available to use for VPN and all the software out there, it’s often a spider’s web when you just want to set up a VPN. Well, rest assured: it’s not that hard!

A VPN can be useful for various things, but it’s often used for one of these:

• Secure connection to an internal office network not accessible from the outside
• Secure connection to the internet on public wifi (although from the VPN server on it’s back to “default” security)
• Hiding your real IP/masking your location (for example: using Netflix outside the USA)

I’m going to show you how to set up OpenVPN using a ‘tap’ device. For this, you need a KVM or Xen VPS, or an OpenVZ VPS which supports TAP. If you use an OpenVZ VPS, be sure to enable TAP first from the control panel (it requires a reboot). Other than that, there’s no real system requirements. This guide works on both CentOS and Ubuntu.

I’ve chosen OpenVPN because it’s a well-established open source solution with good client software support. Alternatives I considered were PPTP, which has some security issues, and IPSec/L2TP, which has a more complicated setup and software that has some “quirks”.

Installing software

First of all, let’s install the software.

Ubuntu

sudo apt-get install openvpn

CentOS

sudo yum install openvpn

Enable IPv4 forwarding

IPv4 forwarding needs to be enabled, otherwise packets can’t go from the internet, via the VPS to you. To enable this, open up /etc/sysctl.conf and fine a line that looks like:

net.ipv4.ip_forward=1

The value for this option should be ‘1’. Sometimes it’s commented (Ubuntu) and sometimes it’s a ‘0’ (CentOS). Make sure it looks like the line above, save the file and:

sudo sysctl -p

Which reloads these settings. Alternatively, reboot.

Generating keys

Now the software is installed, let’s start by generating the keys used for encryption and authentication.

First, create directory that’s going to hold the keys and the scripts to generate these keys:

sudo mkdir /etc/openvpn/easy-rsa

Next, download the key generation software:

wget https://github.com/OpenVPN/easy-rsa/archive/v2.2.0.tar.gz -O easy-rsa.tar.gz

Ubuntu already has these scripts included, but CentOS hasn’t. For the sake of simplicity, downloading them from OpenVPN’s github is the best option.

Now, let’s extract the files to the proper directory:

sudo tar xvzf easy-rsa.tar.gz -C /etc/openvpn/easy-rsa –strip-components=3 easy-rsa-2.2.0/easy-rsa/2.0/

And go to that directory:

cd /etc/openvpn/easy-rsa/

OpenVPN uses SSL (certificates) for connection security and authentication. We’re going to generate the certificates required for this:

• Root key/certificate (ca.key/ca.crt)
• TLS key (ta.key)
• Server key/certificate (server.key/server.crt)
• Client key/certificate (client.key/client.crt)

The data being used for these keys (country, organisation, etc.) can be modified. It doesn’t make a real difference if you change these or not, but it does help recognizing the certificate. You could, optionally, require a certain certificate subject (not covered by this tutorial) for added security.

Open up /etc/openvpn/easy-rsa/vars and look for the following lines:

export KEY_COUNTRY=”US”
export KEY_PROVINCE=”CA”
export KEY_CITY=”SanFrancisco”
export KEY_ORG=”Fort-Funston”
export KEY_EMAIL=mail@host.domain
export KEY_CN=changeme
export KEY_NAME=changeme
export KEY_OU=changeme

You should change these all to reflect your situation. You can remove the duplicate KEY_EMAIL export, as the second one overwrites the first one anyway. You can safely ignore the PK11 variables listed below the above ones in the file.

To be sure we have proper permissions, let’s change the group of the easy-rsa directory to sudo:

sudo chown -R root:sudo .

And set group write permissions, so members of the sudo group can write to it:

sudo chmod g+w .

With these permissions set, we can generate certificates.

First, execute the vars file you’ve just edited to all the vars are available in the environment:

source ./vars

Next, clean all the keys:

./clean-all

Generate the Diffie-Hellman parameters for the server site TLS/SSL:

./build-dh

Generate the root key and certificate:

./pkitool –initca

And finally, generate the server private key and certificate:

./pkitool –server server

Now that all the keys are generated, let’s build a TLS key and put all keys into place. Go to the ‘keys’ directory inside the ‘easy-rsa’ directory where you currently are:

cd keys/

And generate the TLS key:

openvpn –genkey –secret ta.key

Finally, copy all these keys to the openvpn directory:

sudo cp server.crt server.key ca.crt dh1024.pem ta.key ../../

And we’re done with the server-side keys! Final keys to generate now, are the client-side keys. Make sure you are in /etc/openvpn/easy-rsa/vars again and edit the variables to reflect your client. Otherwise you get an error when generating the certificate because it’s not unique.

Initialize the new environment variables:

source ./vars

And generate the client-side keys:

./pkitool client

That’s it! Keys are ready.

Finally, set the proper ownership to the ‘keys’ directory, as it’s currently owned by your user:

sudo chown root:sudo keys

Now, let’s configure OpenVPN!

Configuring OpenVPN

OpenVPN has a lot of configuration options. I’m going to cover a basic configuration which uses a tap interface.

The server configuration file is /etc/openvpn/server.conf. The default configuration file has a lot of comments in it, so it’s a good starting point to discover more about the configuration of OpenVPN. I’m going to give you the configuration that I’ve tested:

local 192.0.2.15 # Server IP address through which you connect, replace this with yours
port 1194 # Port the server runs on (default)
proto udp # Protocol to use (default)
dev tap
ca ca.crt # Root certificate
cert server.crt # Server certificate
key server.key  # Server key file
dh dh1024.pem # DH file
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt # File that keeps track of IP leases
push “redirect-gateway def1 bypass-dhcp” # Push some options to the client
duplicate-cn
keepalive 10 120 # When should we disconnect a client?
tls-auth ta.key 0
comp-lzo # Enable compression
user nobody # Run as user nobody
group nogroup # Run as group nobody
persist-key # Avoid trying to access unavailable resources after a restart
persist-tun # Avoid trying to access unavailable resources after a restart
status openvpn-status.log # Status log for active connections
log-append  openvpn.log # Append the OpenVPN log rather then starting with a new one every time you restart
verb 3 # Log verbosity level
mute 20 # Limit the number of repeating messages
script-security 2 # Set the security level for the usage of external programs and scripts
link-mtu 1648

As you can see, I’ve added some inline comments. It would be good to read these. I’ll highlight the lines I would like to discuss in more detail, those are the most important options for you to know about.

dev tap

This line indicates we use a TAP tunnel, which is an ethernet tunnel rather than a routed IP tunnel. A TAP tunnel passes through all traffic rather than just HTTP and HTTPS. It’s the more “complete” tunnel when compared to TUN.

server 10.8.0.0 255.255.255.0

Set the internal IP range for the server and the clients. The server will get the IP 10.8.0.1 and the client IP addresses will start at 10.8.0.2. Change this to your liking or when it conflicts with other ranges on any of your clients.

duplicate-cn

This line allows multiple connections with the same client certificates. Leave this out to disable this option. If you edit the vars file for every client certificate you generate, this option can safely be disabled.

tls-auth ta.key 0

Name of the TLS key file and the “side” of the TLS connection. Since the server is 0, the client should be 1. This should be configured in you OpenVPN client software.

link-mtu 1648

This is the MTU for the VPN connection. The MTU (Maximal Tranmission Unit) is the maximum size in bytes of the largest piece of data that the link can transport. I’ve used this value because it worked for me. This will also need to be configured in your client. If you VPN doesn’t work, check the logs for MTU errors.

Once the configuration file is in place, restart OpenVPN:

sudo /etc/init.d/openvpn restart

And you should be good! Final step is adding three firewall rules to allow traffic to pass through your server:

sudo /sbin/iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
sudo /sbin/iptables -A FORWARD -i eth0 -o tap0 -m state –state RELATED,ESTABLISHED -j ACCEPT
sudo /sbin/iptables -A FORWARD -i tap0 -o eth0 -j ACCEPT

You should replace ‘eth0’ with the device name of your ethernet device. On most OpenVZ VPS this is venet0.

What these lines do, is the following (in order):

1. Allow transparent NAT traffic over eth0
2. Allow packets to be forwarded from eth0 to tap0 with certain connection states
3. Allow packets to be forwarded from tap0 to eth0 regardless of the connection state

Now, with the server up and running and your firewall configured, you need to configure your client. I will cover some clients in next week’s tutorial (it was too much to combine it all in here), but here’s something to get you started on your own. To connect with a client, you need to:

1. Have the client.crt, client.key, ca.crt and ta.key on your client
2. Enable LZO compression
3. Enable TAP
4. Set the link MTU to 1648
5. Set the TLS “side” to 1

If you’ve done that on you client, you should be able to connect!

Final notes

As you may have noticed, setting up OpenVPN isn’t hard but it isn’t very easy either. There’s a lot of steps to take, a lot of options available and a lot that can go wrong. I’ve tried to keep this guide concise and limited for the sake of clarity. If there is a clear demand for more explanation on certain subjects, please let me know. I’ll add more explanation/write a more detailed guide on a certain subject in that case.

Up next week: Getting started with OpenVPN (client)! Next week’s tutorial may be a bit later due to my supposed bachelor party. So if it’s not here on Saturday, it will be on Tuesday (latest).

• Author
• Recent Posts

mpkossen

Maarten Kossen was the administrator of LowEndBox from 2013 to 2015, and brought many ideas and improvements to the website during his leadership. Today he is member of our community and LowEndTalk.

Latest posts by mpkossen (see all)

• How to Rapidly Install Java, OpenJDK & Oracle JDK on your VPS - December 14, 2015
• It’s been a great ride - December 14, 2015
• Cheap Windows VPS – $21/quarter 1GB KVM-based Windows VPS in 11 worldwide locations - November 30, 2015