OpenVPN Installation and Setup on a Linux machine
This guide walks through installing and setting up an OpenVPN server on a Linux machine.
Step 1: Update System Packages
Before installing OpenVPN, update your package list:
sudo apt update && sudo apt upgrade -y # For Debian/Ubuntu
sudo yum update -y # For CentOS/RHEL
Step 2: Install OpenVPN and Easy-RSA
Install OpenVPN and Easy-RSA (used for certificate management):
sudo apt install openvpn easy-rsa -y # For Debian/Ubuntu
sudo yum install epel-release -y && sudo yum install openvpn easy-rsa -y # For CentOS/RHEL
Step 3: Configure Easy-RSA and Generate Certificates
Create a directory for Easy-RSA and navigate into it:
make-cadir ~/openvpn-ca
cd ~/openvpn-ca
Initialize the Public Key Infrastructure (PKI):
./easyrsa init-pki
./easyrsa build-ca
Generate the server certificate and key:
./easyrsa gen-req server nopass
./easyrsa sign-req server server
Generate Diffie-Hellman parameters:
./easyrsa gen-dh
Copy the certificates and keys to the OpenVPN directory:
sudo cp pki/ca.crt pki/issued/server.crt pki/private/server.key pki/dh.pem /etc/openvpn/
Step 4: Configure the OpenVPN Server
Copy the example configuration file:
sudo cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf /etc/openvpn/
Edit the OpenVPN configuration file:
sudo nano /etc/openvpn/server.conf
Modify or ensure the following settings:
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
keepalive 10 120
comp-lzo
persist-key
persist-tun
status /var/log/openvpn-status.log
verb 3
Step 5: Enable and Start OpenVPN Service
Enable and start OpenVPN:
sudo systemctl enable openvpn@server
sudo systemctl start openvpn@server
Check the service status:
sudo systemctl status openvpn@server
Step 6: Configure Firewall Rules
Allow OpenVPN traffic and enable IP forwarding:
sudo ufw allow 1194/udp
sudo ufw enable
Edit the sysctl configuration:
sudo nano /etc/sysctl.conf
Uncomment or add:
net.ipv4.ip_forward = 1
Apply changes:
sudo sysctl -p
Step 7: Generate Client Certificates
Generate a client certificate:
cd ~/openvpn-ca
./easyrsa gen-req client1 nopass
./easyrsa sign-req client client1
Copy the client certificates:
sudo cp pki/ca.crt pki/issued/client1.crt pki/private/client1.key /etc/openvpn/client/
Step 8: Connect Clients
Download and configure the OpenVPN client on your local machine. Transfer the client certificates and connect using:
openvpn --config client.ovpn