Openvpn

Centos 7

Install ovpn

a)From epel repository for enterprise linux 7

we need to add epel repository if it was not done before [how to use yum]

wget https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
rpm -i epel-release-latest-7.noarch.rpm
yum install openvpn

b)Using package for enterprise linux 7 from fedoraproject.org

wget https://dl.fedoraproject.org/pub/epel/7/x86_64/o/openvpn-2.3.8-1.el7.x86_64.rpm
rpm -i openvpn-2.3.8-1.el7.x86_64.rpm

setting up server

generating server and client keys

preparing configs from samples

yum install easy-rsa
mkdir -p /etc/openvpn/easy-rsa/keys
cp -rf /usr/share/openvpn/easy-rsa/2.0/* /etc/openvpn/easy-rsa
cp /usr/share/doc/openvpn-*/sample/sample-config-files/server.conf /etc/openvpn

You can set export KEY_* in this file for not need to enter credentials for each key separately

vim /etc/openvpn/easy-rsa/vars

Sourcing defined values

cd /etc/openvpn/easy-rsa/
source ./vars

generating server ca,keys

cd /etc/openvpn/easy-rsa/
./clean-all
./build-ca
./build-key-server server
./build-dh
cd keys
cp dh2048.pem ca.crt server.crt server.key /etc/openvpn

generating client keys

cd /etc/openvpn/easy-rsa
./build-key client

note:When asked for 'common name' please fill in unique name for client (it will be listed in openvpn.log after login)

cd keys
mkdir client1
cp ca.crt client.key client.crt client1

configuring options in /etc/openvpn/server.conf

You need at least to configure following options:

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key  # This file should be kept secret
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 10 120
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
verb 4

optional but usefull options

push "route 192.168.2.0 255.255.255.0"
push "route 192.168.3.0 255.255.255.0"
client-config-dir ccd
client-to-client

example of file ccd/client1 when optional client-config-dir is enabled we suppose that in client's key is its common name defined 'client1'

iroute 192.168.2.0 255.255.255.0
ifconfig-push 10.8.0.13 10.8.0.14

openvpn by default push all subnets routing defined earlier in server.conf(192.168.2.0/24, 192.168.3.0/24) to all clients, but with this setting it will not push routing for 192.168.2.0/24 to this client and all packets arriving oVPNserver with destination address from 192.168.2.0/24 subnet will be redirected to this client. Additional we require to use vpn address 10.8.0.13 on this client.

configuring client.conf

we assume that previously created ca.crt, client.key and client.crt was upoaded to server to /etc/openvpn/key/client1/

client
dev tun
proto udp
remote here_address_of_a_vpn_server 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca key/client1/ca.crt
cert key/client1/client.crt
key key/client1/client.key
ns-cert-type server
comp-lzo
verb 3

enabling service

ln -s /lib/systemd/system/openvpn\@.service /etc/systemd/system/multi-user.target.wants/openvpn\@server.service
sytemctl start openvpn@server
sytemctl status openvpn@server
sytemctl stop openvpn@server