Install Your Own VPN Server with OpenVPN on Ubuntu 10.04 Server

Install Your Own VPN Server with OpenVPN on Ubuntu 10.04 Server

ATTENTION

After a while without posting I bring you this guide of how to create your own VPN on Ubuntu Server, either to connect to the home PC or to use the internet safely in insecure Wi-Fi networks.

openvpn It is a Software that acts as a client and server according to how we configure it, I clarify that there are 2 versions of this:
* OpenVPN Community Software: It is the version that we will use and it is 100% Open Source
* OpenVPN AccessServer: It is the paid version, you can use for free only up to 2 users, the additional users are very cheap, it also has extras such as a web administration panel, it is super easy to configure and more.

Introduction

OpenVPN is a software product created by James Yonan in 2001 and has been improving since then.

No other solution offers such a blend of enterprise-grade security, security, ease-of-use, and rich features.

It is a multiplatform solution that has greatly simplified the configuration of VPNs, leaving behind the times of other difficult solutions to configure such as IPsec and making it more accessible for inexperienced people in this type of technology.

Suppose we need to communicate different branches of an organization. Below we will see some solutions that have been offered in response to these types of needs.

In the past, communications were made by mail, telephone or fax. Today there are factors that make it necessary to implement more sophisticated connectivity solutions between the offices of organizations throughout the world.

These factors are:

* The acceleration of business processes and its consequent increase in the need for flexible and rapid exchange of information.
* Many organizations have several branches in different locations as well as remote teleworkers from home, who need to exchange information without any delay, as if they were physically together.
* The need for computer networks to meet high security standards that ensure authenticity, integrity and availability.

Source: Wikipedia

The server:

This guide is for Ubuntu 10.04 Server, I imagine it works in other versions and distros, we have a ubuntu server already installed and working.
We install OpenVPN and also OpenSSL, since the security is based on ssl.

sudo apt-get -y install openvpn sudo apt-get -y install openssl

We configure the OpenVPN Daemon to Not Auto Start with the System
We comment everything by adding # to the beginning of each line.

sudo nano / etc / default / openvpn

also remove the startup script, to prevent it from starting if you configure

sudo update-rc.d -f /etc/init.d/openvpn remove

Now we create the file openvpn.conf in / etc / openvpn /

sudo nano /etc/openvpn/server.conf

and we put this configuration

dev tun proto tcp port 1194 ca /etc/openvpn/keys/ca.crt cert /etc/openvpn/keys/server.crt key /etc/openvpn/keys/server.key dh /etc/openvpn/keys/dh2048.pem user nobody group nogroup server 10.6.0.0 255.255.255.0 ifconfig-pool-persist /etc/openvpn/clients.txt status /etc/openvpn/status.txt persist-key persist-tun push "redirect-gateway def1" push "route 192.168.0.0 .255.255.255.0 10 "keepalive 120 3 verb 3 comp-lzo max-clients XNUMX

as you can see it can be customized, this is an example that was tested

If you do not want to use the vpn for secure internet, that is, do not surf the internet from the vpn, remove the line "redirect-gateway".

Other data that can be modified:
* ca, cert, key and dh = are the entity, the certificates, the key and the Diffie Hellman of the server, we will create them later.
* server 10.6.0.0 255.255.255.0 = is the IP range that the vpn will use, use another but, not use the same as the real network.
* ifconfig-pool-persist ipp.txt = save who was assigned each ip in the vpn
* proto and port = protocol and port, you can use tcp and utp, in utp it did not give me good results, the port is you can change it.
* duplicate-cn = allows the same certificate and key to be used in several clients at the same time, I recommend not activating it.
* up /etc/openvpn/openvpn.up = is a script that loads openvpn at startup, it is used for ROUTING and FORWARDING, we will create it later.
* client-to-client = is to prevent vpn users from seeing each other, depending on the case it is useful.
* comp-lzo = compression, compresses all VPN traffic.
* verb 3 = increases or decreases the error details on the server.
* max-clients 30 = maximum number of users simultaneously connected to the server, it can be increased or decreased.
* push route = allows you to see or be on the network behind the vpn server, be careful not to activate client-to-client.
* push «redirect = forces the client to use the VPN as a gateway.

now we create the script for it to configure and start the vpn server.

sudo nano /etc/init.d/vpnserver

and we paste this code, change the ip range according to the configuration of the previous step

#! / bin / sh # vpnserver_start () {echo "VPN Server [OK]" echo 1> / proc / sys / net / ipv4 / ip_forward /etc/init.d/networking restart> / dev / null / sbin / iptables -t nat -A POSTROUTING -s 10.6.0.0/24 -o eth0 -j MASQUERADE / usr / sbin / openvpn --config /etc/openvpn/server.conf 2 >> /etc/openvpn/error.txt 1 >> /etc/openvpn/normal.txt &} vpnserver_stop () {echo "VPN Server [NO]" / usr / bin / killall "openvpn" iptables -F iptables -X /etc/init.d/networking restart> / dev / null} vpnserver_restart () {vpnserver_stop sleep 1 vpnserver_start} # case "$ 1" in 'start') vpnserver_start ;; 'stop') vpnserver_stop ;; 'restart') vpnserver_restart ;; *) vpnserver_start ;; that C

now we assign executable permissions to it

sudo chmod + x /etc/init.d/vpnserver

also and what to configure to auto start with the system

sudo update-rc.d vpnserver defaults

Well, we already configured OpenVPN, now we have to activate the TUN module in the kernel, with these lines, we load it and that's it

sudo modprobe tun sudo echo "tun" >> / etc / modules

As you will see, the configuration was not so difficult, but now comes the slowest:

* Create 2048bit Diffie Hellman
* Create the Certification Authority.
* Create the Certificates and keys of the server.
* Create certificates and keys for each user.

We copy the easy-rsa examples to create the entity, the certificates, keys and encryption, which use OpenVPN,

sudo cp -R / usr / share / doc / openvpn / examples / easy-rsa / / etc / openvpn /

now you have to enter the folder where the utilities that we copied are located and create the keys folder

sudo cp -R / usr / share / doc / openvpn / examples / easy-rsa / / etc / openvpn / cd /etc/openvpn/easy-rsa/2.0 sudo mkdir keys

We only have to edit the vars file that is in /etc/openvpn/easy-rsa/2.0

sudo nano /etc/openvpn/easy-rsa/2.0/vars

and we modify these values

export KEY_DIR = "$ EASY_RSA / keys"

by

export KEY_DIR = "/ etc / openvpn / easy-rsa / 2.0 / keys"

is to generate yes or yes in /etc/openvpn/easy-rsa/2.0/keys
we continue, we also modify the parameters for Diffie Hellman of 2048bits

export KEY_SIZE = 1024

by

export KEY_SIZE = 2048

we are only missing the data for the issuing entity

export KEY_COUNTRY = "US" export KEY_PROVINCE = "CA" export KEY_CITY = "SanFrancisco" export KEY_ORG = "Fort-Funston" export KEY_EMAIL = "me@myhost.mydomain"

modify each value for those of your country, province, city, company and mail
An example

export KEY_COUNTRY = "AR" export KEY_PROVINCE = "SF" export KEY_CITY = "Armstrong" export KEY_ORG = "LAGA-Systems" export KEY_EMAIL = "info@lagasystems.com.ar"

As you see AR = Argentina, SF = Santa Fe (my province) and the others understand each other.
Well now we are ready to start, follow these steps to the letter, because a mistake and everything is ruined.

we execute

source ./vars

and asks us to clean in case there are entities, certificates and keys, we do it with pleasure

./clean-all

now we generate the Diffie Hellman security of 2048bits

./build-dh

now we generate the certification authority it will ask them for the same data as in the vars files, I recommend completing each one, although they are already there, it does not matter

./build-ca

We are now to be able to generate the certificates and keys first the server, change the server to the name that you like, it will ask for the same data as in the vars files, I recommend completing each one, although they are already there, it does not matter.

./build-key-server server

We already have the certificates and server keys, now the client, change the client to whatever name you like,
It will ask for the same data as in the vars files. I recommend completing each one, although they are already there, it does not matter.

./build-key client

This step must be repeated for each client or user who wants to connect to the VPN, we already have everything to work, no, we need to copy the files that we generate to the place that we configure in openvpn.conf
since copy the keys folder to / etc / openvpn /

sudo cp -R /etc/openvpn/easy-rsa/2.0/keys / etc / openvpn /

now we check that everything is in its place, we enter the / etc / openvpn / keys folder

cd / etc / openvpn / keys

and with a ls we check if the files are there
now we generate one more file, this is generated by openvpn

sudo openvpn --genkey --secret ta.key

You only need to copy the files ca.crt, client.crt, client.key, if you created more clients copy the crt and key of each a pendrive or other means, do not use email to send them, it is like giving your house key to a stranger .

Ready, everything is on the server, now we start it to test that everything is correct

sudo /etc/init.d/vpnserver start

If there are no errors, we already have our vpn running, only the client is missing.

The client:

This guide is for Ubuntu 10.04 Desktop, I imagine it works in other versions and distros, we have a ubuntu already installed and working.
We install OpenVPN and also OpenSSL, since the security is based on ssl
and as we will use the Ubuntu Network Manager, we must install the plugins for OpenVPN

sudo apt-get -y install openvpn sudo apt-get -y install openssl sudo aptitude -y install network-manager-openvpn

Now we are able to configure our client a configuration example:

With a text editor, gedit can be, paste this code

client dev tun proto tcp remote IP-OF-SERVER PORT resolv-retry infinite nobind #user nobody #group nobody persist-key persist-tun ca ca.crt client cert.crt key client.key comp-lzo tun-mtu 1500 keepalive 10 120 verb 4

They modify the data, IP-DEL-SERVER this is the public or internet IP of the server and PORT by which they assigned on the server, the files ca.crt, client.crt and client.key are the ones we generated and copied before in a pendrive or whatever.

If you have a dynamic public IP, I recommend using a DDNS service (DyDNS, NO-IP, CDMon), and don't forget to open and redirect port 1194 or the one you chose for the server.

They save the code with the name they want but with a .conf extension and in the same folder as the ca.crt, client.crt and client.key files

Now open the Ubuntu Network Manager and in the VPN tab there is an Import button, they look for the .conf file that we saved before and that's all.

I hope it helps you, since to make openvpn work I went through all the guides and manuals that I found.

Thank you for your Comments, If there is any ERROR it is the product of your imagination, hahaha