openvpn installation on ubuntu

OpenVPN is a Virtual Private Networking (VPN) solution.  It is flexible, reliable and secure. It belongs to the family of SSL/TLSand not IPSec. It uses Public Key Infrastructure (PKI) to encrypt VPN traffic between nodes.

Here I am going to explain how we can install bridged and tunneled openvpn under ubuntu.

Open vpn server installation.
apt-get update

apt-get install openvpn

Now copy the easy-rsa directory to /etc/openvpn folder

mkdir /etc/openvpn/easy-rsa/
cd /usr/share/doc/openvpn/examples/easy-rsa/2.0/
cp -r * /etc/openvpn/easy-rsa/
chown -R root /etc/openvpn/easy-rsa/

Edit the file /etc/openvpn/easy-rsa/vars

export KEY_COUNTRY="US"
export KEY_PROVINCE="NC"
export KEY_CITY="Syracuse"
export KEY_ORG="Tech"
export KEY_EMAIL="rin@tech.com"


Now create the server crts ..

cd /etc/openvpn/easy-rsa/
source vars
./clean-all
./build-dh
./pkitool --initca
./pkitool --server server
cd keys
openvpn --genkey --secret ta.key
cp server.crt server.key ca.crt dh1024.pem ta.key /etc/openvpn/

Create the server configuration file.

Copy the file /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz /etc/openvpn/
gzip -d /etc/openvpn/server.conf.gz

server.conf is different for bridged and tunneled vpn services

Briged configuration

apt-get install bridge-utils

Now edit server.conf to the following ..

local 192.168.26.101
dev tap0
up "/etc/openvpn/up.sh br0"
down "/etc/openvpn/down.sh br0"
server-bridge 192.168.26.101 255.255.255.0 192.168.26.105 192.168.26.200
push "route 192.168.26.0 255.255.255.0"
push "dhcp-option DNS 192.168.26.101"
push "dhcp-option DOMAIN tech.com"
tls-auth ta.key 0
user nobody
group nogroup


vim /etc/openvpn/up.sh

#!/bin/sh
BR=$1
DEV=$2
MTU=$3
/sbin/ifconfig $DEV mtu $MTU promisc up
/usr/sbin/brctl addif $BR $DEV


vim /etc/openvpn/down.sh

#!/bin/sh
BR=$1
DEV=$2
/usr/sbin/brctl delif $BR $DEV
/sbin/ifconfig $DEV down

Now give them executable permission

chmod +x /etc/openvpn/down.sh
chmod +x /etc/openvpn/up.sh

Add a bridge interface
edit the file /etc/network/interfaces, and make changes like this ..

auto lo br0
iface lo inet loopback

iface br0 inet static
  address 192.168.26.53
  netmask 255.255.255.0
  gateway 192.168.26.254
  bridge_ports eth0

iface eth0 inet manual
  up ip link set $IFACE up promisc on
  down ip link set $IFACE down promisc off

/etc/init.d/networking restart

Or just issue the below command for adding temporarily,

/usr/sbin/brctl addbr br0

Now start the openvpn,

/etc/init.d/openvpn start

ifconfig output,

tap0      Link encap:Ethernet  HWaddr b6:39:1f:38:4a:c4
          inet6 addr: fe80::b439:1fff:fe38:4ac4/64 Scope:Link
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:3 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:0 (0.0 B)  TX bytes:238 (238.0 B)


Tunneled configuration

Edit server.conf to the following ..

local 192.168.26.53
dev tun0
server 172.23.0.0 255.255.255.0
push "route 172.23.0.0 255.255.255.0"
push "dhcp-option DNS 192.168.26.53"
push "dhcp-option DOMAIN tech.com"
tls-auth ta.key 0
user nobody
group nogroup


Note: 172.23.0.0 range is internal ip range that will be assigned to the vpn client.

Start the openvpn server by issuing the following command,

/etc/init.d/openvpn start

ifconfig output

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:172.23.0.1  P-t-P:172.23.0.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)



We also need to create client certificates to authenticate itself to the server. For that issue the following commands,

cd /etc/openvpn/easy-rsa
source vars
./pkitool client-hostname

then copy these files to the client,

/etc/openvpn/ca.crt /etc/openvpn/easy-rsa/keys/client-hostname.crt /etc/openvpn/easy-rsa/keys/client-hostname.key /etc/openvpn/ta.key

using any secure method.

Client Configuration

apt-get install openvpn

Place the above mentioned certificate files from the server to the folder /etc/openvpn/

Now, copy the config file,
cp /usr/share/doc/openvpn/examples/sample-config-files/client.conf /etc/openvpn

For bridge vpn set client.conf as,

dev tap
remote server-ip 1194
cert client-hostname.crt
key client-hostname.key
tls-auth ta.key 1
then,

/etc/init.d/openvpn restart

ifconfig output

tap0      Link encap:Ethernet  HWaddr ce:53:5e:51:e0:26
          inet addr:192.168.26.205  Bcast:192.168.26.255  Mask:255.255.255.0
          inet6 addr: fe80::cc53:5eff:fe51:e026/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:6 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:0 (0.0 B)  TX bytes:468 (468.0 B)


For tunneled vpn set client.conf as,

dev tun
remote server-ip 1194
cert client-hostname.crt
key client-hostname.key
tls-auth ta.key 1

then,

/etc/init.d/openvpn restart

ifconfig output

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:172.23.0.6  P-t-P:172.23.0.5  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

Now successfully installed openvpn server and client.

cheers /-