Pf: Created page with "This is how to install [https://openvpn.net/ OpenVPN] 2.4.7 server including a local CA on [https://releases.ubuntu.com/20.04/ Ubuntu 20.04.1 LTS (Focal Fossa)]. We will also..."

2021-01-02T16:37:11Z

Created page with "This is how to install [https://openvpn.net/ OpenVPN] 2.4.7 server including a local CA on [https://releases.ubuntu.com/20.04/ Ubuntu 20.04.1 LTS (Focal Fossa)]. We will also..."

New page

This is how to install [https://openvpn.net/ OpenVPN] 2.4.7 server including a local CA on [https://releases.ubuntu.com/20.04/ Ubuntu 20.04.1 LTS (Focal Fossa)].

We will also create client configurations for OpenVPN and OpenWRT.

Assumptions:
Login username is "ubuntu".
Working material saved under that users home directory
Editor used is "vi"
OpenVPN Server’s CommonName will be ov-server
Use OpenVPNs "tls-crypt" functionality
The default route interface is "eth0"
Use Layer 3 routing (tun interface and separate IP addresses)
IP address range for client is 10.88.0.0/16
Use NAT

Good references:
https://openvpn.net/
https://www.digitalocean.com/community/tutorials/how-to-set-up-and-configure-an-openvpn-server-on-ubuntu-20-04
https://www.digitalocean.com/community/tutorials/how-to-set-up-and-configure-a-certificate-authority-ca-on-ubuntu-20-04

Install needed packages:
<code>sudo apt update
sudo apt install openvpn easy-rsa</code>

Bootstrat Easy-RSA

mkdir ~/easy-rsa

cp -a /usr/share/easy-rsa/* ~/easy-rsa/

Creating PKI structure including local CA

sudo chown ubuntu ~/easy-rsa
chmod 700 ~/easy-rsa
cd ~/easy-rsa
./easyrsa init-pki

vi vars

set_var EASYRSA_REQ_COUNTRY "SE"
set_var EASYRSA_REQ_PROVINCE "VG"
set_var EASYRSA_REQ_CITY "Trollhattan"
set_var EASYRSA_REQ_ORG "Bask"
set_var EASYRSA_REQ_EMAIL "admin@bask.se"
set_var EASYRSA_REQ_OU "OPS"
set_var EASYRSA_ALGO "ec"
set_var EASYRSA_DIGEST "sha512"

Create the CA certificate without password. Remove "nopass" if you would like to enter a password for each use.
./easyrsa build-ca nopass

sudo cp pki/ca.crt /usr/local/share/ca-certificates/
sudo update-ca-certificates

Creating OpenVPN Server Certificate and Private Key

./easyrsa gen-req ov-server nopass

./easyrsa sign-req server ov-server

sudo cp pki/private/ov-server.key /etc/openvpn/server/
sudo cp pki/issued/ov-server.crt /etc/openvpn/server/
sudo cp pki/ca.crt /etc/openvpn/server/

openvpn --genkey --secret ta.key
sudo cp ta.key /etc/openvpn/server

mkdir -p ~/client-configs/keys
chmod -R 700 ~/client-configs
cp ~/easy-rsa/ta.key ~/client-configs/keys/

./easyrsa gen-req client1 nopass
./easyrsa sign-req client client1

cp pki/private/client1.key ~/client-configs/keys/
cp pki/issued/client1.crt ~/client-configs/keys/
sudo cp /etc/openvpn/server/ca.crt ~/client-configs/keys/
sudo chown ubuntu ~/client-configs/keys/*

Configure OpenVPN

sudo cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz /etc/openvpn/server/
sudo gunzip /etc/openvpn/server/server.conf.gz

sudo vi /etc/openvpn/server/server.conf

Add the following:
tls-crypt ta.key
cipher AES-256-GCM
auth SHA256
dh none
user nobody
group nogroup
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
cert ov-server.crt
key ov-server.key

sudo nano /etc/sysctl.conf
net.ipv4.ip_forward = 1
sudo sysctl -p

sudo nano /etc/ufw/before.rules

# START OPENVPN RULES
# NAT table rules
*nat
:POSTROUTING ACCEPT [0:0]
# Allow traffic from OpenVPN client to eth0 (change to the interface you discovered!)
-A POSTROUTING -s 10.88.0.0/16 -o eth0 -j MASQUERADE
COMMIT
# END OPENVPN RULES

sudo nano /etc/default/ufw
DEFAULT_FORWARD_POLICY="ACCEPT" (cahnge from DROP)

Update firewall to allow UDP port 1194
sudo ufw allow 1194/udp

sudo ufw disable
sudo ufw enable

sudo systemctl -f enable openvpn-server@server.service
sudo systemctl start openvpn-server@server.service
sudo systemctl status openvpn-server@server.service

mkdir -p ~/client-configs/files
cp /usr/share/doc/openvpn/examples/sample-config-files/client.conf ~/client-configs/base.conf

nano ~/client-configs/base.conf
user nobody
group nogroup

;ca ca.crt
;cert client.crt
;key client.key

;tls-auth ta.key 1

cipher AES-256-GCM
auth SHA256

key-direction 1

; script-security 2
; up /etc/openvpn/update-resolv-conf
; down /etc/openvpn/update-resolv-conf

; script-security 2
; up /etc/openvpn/update-systemd-resolved
; down /etc/openvpn/update-systemd-resolved
; down-pre
; dhcp-option DOMAIN-ROUTE .

nano ~/client-configs/make_config.sh

#!/bin/bash

# First argument: Client identifier

KEY_DIR=~/client-configs/keys
OUTPUT_DIR=~/client-configs/files
BASE_CONFIG=~/client-configs/base.conf

cat ${BASE_CONFIG} \
<(echo -e '<ca>') \
${KEY_DIR}/ca.crt \
<(echo -e '</ca>\n<cert>') \
${KEY_DIR}/${1}.crt \
<(echo -e '</cert>\n<key>') \
${KEY_DIR}/${1}.key \
<(echo -e '</key>\n<tls-crypt>') \
${KEY_DIR}/ta.key \
<(echo -e '</tls-crypt>') \
> ${OUTPUT_DIR}/${1}.ovpn

chmod 700 ~/client-configs/make_config.sh

cd ~/client-configs
./make_config.sh client1

Howto/OpenVPN - Revision history

Pf: Created page with "This is how to install [https://openvpn.net/ OpenVPN] 2.4.7 server including a local CA on [https://releases.ubuntu.com/20.04/ Ubuntu 20.04.1 LTS (Focal Fossa)]. We will also..."