206 lines
3.6 KiB
Markdown
206 lines
3.6 KiB
Markdown
# OpenVPN and CA install
|
|
|
|
### sources
|
|
- https://www.digitalocean.com/community/tutorials/how-to-set-up-and-configure-an-openvpn-server-on-ubuntu-20-04
|
|
- https://chatgpt.com/share/672b8e75-5a08-8009-9d13-f062d91bfac8
|
|
|
|
### Prereqs
|
|
|
|
ubunutu 24 with ufw configured
|
|
|
|
### Update/Upgrade
|
|
```
|
|
sudo apt update
|
|
sudo apt upgrade -y
|
|
```
|
|
|
|
### Install OpenVPN and Easy-RSA
|
|
|
|
|
|
`sudo apt install openvpn easy-rsa -y`
|
|
|
|
### Setup CA
|
|
```
|
|
make-cadir ~/openvpn-ca
|
|
cd ~/openvpn-ca
|
|
```
|
|
```
|
|
vi vars
|
|
```
|
|
```
|
|
set_var EASYRSA_REQ_COUNTRY "YourCountry"
|
|
set_var EASYRSA_REQ_PROVINCE "YourProvince"
|
|
set_var EASYRSA_REQ_CITY "YourCity"
|
|
set_var EASYRSA_REQ_ORG "YourOrganization"
|
|
set_var EASYRSA_REQ_EMAIL "email@example.com"
|
|
set_var EASYRSA_REQ_OU "YourOrganizationalUnit"
|
|
```
|
|
|
|
```
|
|
./easyrsa init-pki
|
|
./easyrsa build-ca
|
|
```
|
|
|
|
add password to ca
|
|
|
|
### Generate Certs and Keys
|
|
|
|
`./easyrsa gen-req server nopass`
|
|
|
|
`./easyrsa sign-req server server`
|
|
Type yes and enter ca password
|
|
|
|
`./easyrsa gen-dh`
|
|
|
|
`openvpn --genkey --secret ta.key` // this is deperacated need update
|
|
|
|
### Config OpenVPN Server
|
|
|
|
`sudo cp pki/ca.crt pki/private/server.key pki/issued/server.crt pki/dh.pem ta.key /etc/openvpn/`
|
|
|
|
`sudo vi /etc/openvpn/server.conf`
|
|
|
|
```
|
|
port 1194
|
|
proto udp
|
|
dev tun
|
|
|
|
ca ca.crt
|
|
cert server.crt
|
|
key server.key # This file should be kept secret
|
|
dh dh.pem
|
|
tls-auth ta.key 0 # This file should be kept secret
|
|
cipher AES-256-CBC
|
|
auth SHA256
|
|
|
|
server 10.8.0.0 255.255.255.0
|
|
ifconfig-pool-persist ipp.txt
|
|
|
|
push "route {ip.addr.ess.0 last byte is masked} 255.255.255.0" # Replace with masked ip address
|
|
|
|
keepalive 10 120
|
|
persist-key
|
|
persist-tun
|
|
|
|
user nobody
|
|
group nogroup
|
|
|
|
status openvpn-status.log
|
|
verb 3
|
|
```
|
|
|
|
### Enable IP Forwarding
|
|
|
|
`sudo vi /etc/sysctl.conf`
|
|
```
|
|
net.ipv4.ip_forward=1
|
|
```
|
|
|
|
`sudo sysctl -p`
|
|
|
|
### Config Firewall
|
|
|
|
`sudo vi /etc/default/ufw`
|
|
|
|
change: `DEFAULT_FORWARD_POLICY="ACCEPT"`
|
|
|
|
`sudo vi /etc/ufw/before.rules`
|
|
|
|
Replace IP Address:
|
|
```
|
|
# START OPENVPN RULES
|
|
*nat
|
|
:POSTROUTING ACCEPT [0:0]
|
|
-A POSTROUTING -s 10.8.0.0/8 -o {ADD IP ADDRESS} -j MASQUERADE
|
|
COMMIT
|
|
# END OPENVPN RULES
|
|
```
|
|
|
|
`sudo ufw allow 1194/udp`
|
|
`sudo ufw enable`
|
|
|
|
### Start OpenVPN
|
|
|
|
```
|
|
sudo systemctl start openvpn@server
|
|
sudo systemctl enable openvpn@server
|
|
sudo systemctl status openvpn@server
|
|
```
|
|
|
|
### Client Config
|
|
|
|
```
|
|
mkdir -p ~/client-configs/keys
|
|
mkdir -p ~/client-configs/files
|
|
```
|
|
|
|
`vi ~/client-configs/base.conf`
|
|
|
|
Rplace MY IP ADDRESS
|
|
```
|
|
client
|
|
dev tun
|
|
proto udp
|
|
remote {MY IP ADDRESS} 1194
|
|
resolv-retry infinite
|
|
nobind
|
|
|
|
user nobody
|
|
group nogroup
|
|
|
|
persist-key
|
|
persist-tun
|
|
|
|
remote-cert-tls server
|
|
cipher AES-256-CBC
|
|
auth SHA256
|
|
key-direction 1
|
|
verb 3
|
|
```
|
|
|
|
### Client Certificates and Keys
|
|
|
|
`cd ~/openvpn-ca`
|
|
|
|
Replace client1 with client_name
|
|
```
|
|
./easyrsa gen-req client1 nopass
|
|
./easyrsa sign-req client client1
|
|
```
|
|
|
|
`cp pki/ca.crt pki/issued/client1.crt pki/private/client1.key ta.key ~/client-configs/keys/`
|
|
|
|
`vi ~/client-configs/make_config.sh`
|
|
|
|
### Generate Client Keys
|
|
Replace client name
|
|
```
|
|
#!/bin/bash
|
|
|
|
CLIENT_NAME={client name}
|
|
|
|
KEY_DIR=~/client-configs/keys
|
|
OUTPUT_DIR=~/client-configs/files
|
|
BASE_CONFIG=~/client-configs/base.conf
|
|
|
|
mkdir -p $OUTPUT_DIR
|
|
|
|
cat ${BASE_CONFIG} \
|
|
<(echo -e '<ca>') \
|
|
${KEY_DIR}/ca.crt \
|
|
<(echo -e '</ca>\n<cert>') \
|
|
${KEY_DIR}/${CLIENT_NAME}.crt \
|
|
<(echo -e '</cert>\n<key>') \
|
|
${KEY_DIR}/${CLIENT_NAME}.key \
|
|
<(echo -e '</key>\n<tls-auth>') \
|
|
${KEY_DIR}/ta.key \
|
|
<(echo -e '</tls-auth>') \
|
|
> ${OUTPUT_DIR}/${CLIENT_NAME}.ovpn
|
|
```
|
|
|
|
`chmod 700 ~/client-configs/make_config.sh`
|
|
`./client-configs/make_config.sh`
|
|
|
|
### Distribute Client Config
|
|
{client name}.ovpn is now available in ~/client-configs/files/.
|