{"id":1838,"date":"2018-12-31T13:45:43","date_gmt":"2018-12-31T10:45:43","guid":{"rendered":"http:\/\/kifarunix.com\/?p=1838"},"modified":"2020-04-14T21:04:06","modified_gmt":"2020-04-14T18:04:06","slug":"install-and-setup-openvpn-server-on-fedora-29-centos-7","status":"publish","type":"post","link":"https:\/\/kifarunix.com\/install-and-setup-openvpn-server-on-fedora-29-centos-7\/","title":{"rendered":"Install and Setup OpenVPN Server on Fedora 29\/CentOS 7"},"content":{"rendered":"

In this guide, we are going to learn how to Install and Setup OpenVPN Server on Fedora 29\/CentOS 7.
\nOpenVPN is an open-source VPN software that enables us to create an SSL-based VPN tunnel. Imagine you would like to connect to your co-oporate intranet from a remote location. Well worry not because if you have VPN server setup, this can be possible. Virtual Private Network (VPN) provides a secure tunnel that extends private network across a public network, i.e It helps create a Wide Area Network (WAN) from existing Local Area Networks (LAN). As a result, users can securely send data across public networks as if they were directly connected to their LAN.<\/p>\n

You can learn more about OpenVPN here<\/a>.<\/p>\n

Install and Setup OpenVPN Server on Fedora 29\/28\/CentOS 7<\/h2>\n

Without much theory, let’s have a look at a step by step procedure on how Install and Setup OpenVPN Server on Fedora 29\/28\/CentOS 7.<\/p>\n

Update your server.<\/p>\n

dnf update << Fedora\r\nyum update << Fedora\/CentOS<\/code><\/pre>\n
Install OpenVPN and Easy-RSA on Fedora 29\/28<\/h3>\n
OpenVPN provides a robust and a highly flexible VPN daemon while Easy-RSA package is used to generate SSL key-pairs that is used to secure VPN connections. Both OpenVPN and Easy-RSA packages are available on the default Fedora repos. Run the command below to install them.<\/p>\n
dnf install openvpn easy-rsa<\/code><\/pre>\n
Install OpenVPN and Easy-RSA on CentOS 7<\/h3>\n
OpenVPN isn’t available in the default CentOS repositories but it is available in EPEL hence you need to install EPEL repos before you can install OpenVPN.<\/p>\n
To add Extra Packages for Enterprise Linux (EPEL), run either of the following commands;<\/p>\n
yum install epel-release<\/code><\/pre>\n
or<\/p>\n
wget http:\/\/dl.fedoraproject.org\/pub\/epel\/epel-release-latest-7.noarch.rpm\r\nrpm -ivh epel-release-latest-7.noarch.rpm<\/code><\/pre>\n
Install OpenVPN and Easy-RSA<\/p>\n
yum install openvpn easy-rsa<\/code><\/pre>\n
Build the Local CA and generate Server Keys and Certificate file<\/h3>\n
Create a directory to store Server keys and Certificate files.<\/p>\n
mkdir \/etc\/openvpn\/easy-rsa<\/code><\/pre>\n
Copy the key\/certificate generation scripts installed by Easy-RSA from the default directory to the directory created above.<\/p>\n
cp -air \/usr\/share\/easy-rsa\/3\/* \/etc\/openvpn\/easy-rsa<\/code><\/pre>\n
Navigate to \/etc\/openvpn\/easy-rsa<\/code> directory and start new PKI.<\/p>\n
cd \/etc\/openvpn\/easy-rsa\r\n.\/easyrsa init-pki<\/code><\/pre>\n
Build the CA certificate. This will prompt you for the encryption password and the server common name.<\/p>\n
.\/easyrsa build-ca<\/code><\/pre>\n
...\r\nwriting new private key to '\/etc\/openvpn\/easy-rsa\/pki\/private\/ca.key.EajtR0SkLM'\r\nEnter PEM pass phrase: PASSWORD<\/strong>\r\nVerifying - Enter PEM pass phrase: PASSWORD<\/strong>\r\n-----\r\n...\r\n-----\r\nCommon Name (eg: your user, host, or server name) [Easy-RSA CA]:server<\/strong>\r\n\r\nCA creation complete and you may now import and sign cert requests.\r\nYour new CA certificate file for publishing is at:\r\n\/etc\/openvpn\/easy-rsa\/pki\/ca.crt<\/code><\/pre>\n
As stated, the CA certificate is stored at \/etc\/openvpn\/easy-rsa\/pki\/ca.crt<\/code>.<\/p>\n
Generate Diffie-Hellman key file that can be used during the TLS handshake with connecting clients.<\/p>\n
.\/easyrsa gen-dh<\/code><\/pre>\n
This will generate the DH key and store as \/etc\/openvpn\/easy-rsa\/pki\/dh.pem<\/code>.<\/p>\n
Generate a key and certificate file for the server.<\/p>\n
.\/easyrsa build-server-full server nopass<\/code><\/pre>\n
Generate a key and certificate file for the client.<\/p>\n
.\/easyrsa build-client-full client nopass<\/code><\/pre>\n
In case you need to invalidate a previously signed certificate, generate a revocation certificate.<\/p>\n
.\/easyrsa gen-crl<\/code><\/pre>\n
This stores the revocation certificate under \/etc\/openvpn\/easy-rsa\/pki\/crl.pem<\/code>.<\/p>\n
Generate TLS\/SSL pre-shared authentication key<\/p>\n
openvpn --genkey --secret \/etc\/openvpn\/easy-rsa\/pki\/ta.key<\/code><\/pre>\n
Copy generated Certificates\/Keys to server configuration directory.<\/p>\n
cp -rp \/etc\/openvpn\/easy-rsa\/pki\/{ca.crt,dh.pem,ta.key,issued,private} \/etc\/openvpn\/server\/<\/code><\/pre>\n
Configure OpenVPN Server<\/h2>\n
OpenVPN has a sample configuration file within its documentation directory and therefore to ease our life, we will copy the sample \/usr\/share\/doc\/openvpn{-2.4.6,}\/sample\/sample-config-files\/server.conf<\/code> file to \/etc\/openvpn<\/code> for modification.<\/p>\n
On Fedora<\/p>\n
cp \/usr\/share\/doc\/openvpn\/sample\/sample-config-files\/server.conf \/etc\/openvpn\/server\/<\/code><\/pre>\n
On CentOS 7<\/p>\n
cp \/usr\/share\/doc\/openvpn-2.4.6\/sample\/sample-config-files\/server.conf \/etc\/openvpn\/server\/<\/code><\/pre>\n
Edit the server.conf<\/code> file as follows;<\/p>\n
vim \/etc\/openvpn\/server\/server.conf<\/code><\/pre>\n
Modify the file such that it looks like the below;<\/p>\n
# Which TCP\/UDP port should OpenVPN listen on?\r\n# Change to match your port and open it in the firewall\r\nport 1194\r\n\r\n# TCP or UDP server?\r\nproto udp\r\n\r\n# \"dev tun\" will create a routed IP tunnel\r\ndev tun\r\n\r\n# Change path for certificates\r\nca ca.crt\r\ncert issued\/server.crt\r\nkey private\/server.key\r\n\r\n# Diffie hellman exchange key path\r\ndh dh.pem\r\n\r\n# Network topology\r\ntopology subnet\r\n\r\n# OpenVPN Network IP. For below, The server will take 10.8.0.1 for itself,\r\n# the rest will be made available to clients.\r\nserver 172.16.0.0 255.255.255.0\r\n\r\n# this directive will configure all clients to redirect their default\r\n# network gateway through the VPN\r\npush \"redirect-gateway def1 bypass-dhcp\"\r\n\r\n# DNS servers\r\npush \"dhcp-option DNS 208.67.222.222\"\r\npush \"dhcp-option DNS 208.67.220.220\"\r\n\r\n# For compression compatible with older clients use comp-lzo.\r\ncomp-lzo\r\n\r\n# Run VPN with limited privileges\r\nuser nobody\r\ngroup nobody\r\n\r\n# Status log file\r\nstatus \/var\/log\/openvpn\/openvpn-status.log\r\n\r\n# TLS\/SSL pre-shared authentication key\r\ntls-auth ta.key 0\r\n\r\n# Make VPN log directory and log file\r\nlog-append \/var\/log\/openvpn\/openvpn.log\r\n\r\n#Append this line to change authentication algorithm (HMAC) from SHA1 to SHA512\r\nauth SHA512<\/code><\/pre>\n
Create the log directory;<\/p>\n
mkdir \/var\/log\/openvpn\/<\/code><\/pre>\n
Save the configuration file<\/p>\n
Configure Routing<\/h3>\n
Enable IP forwarding<\/h4>\n
Enabling IP forwarding ensures that traffic from the client is routed through the servers IP address so that the client IP address is masked.<\/p>\n
echo \"net.ipv4.ip_forward = 1\" >> \/etc\/sysctl.conf<\/code><\/pre>\n
Run the command below to effect the changes;<\/p>\n
sysctl --system<\/code><\/pre>\n
Allow OpenVPN service port through firewall<\/p>\n
firewall-cmd --add-port=1194\/udp --permanent<\/code><\/pre>\n
Activate IP Masquerading<\/p>\n
firewall-cmd --add-masquerade --permanent<\/code><\/pre>\n
Forward traffic received on the specified OpenVPN subnet to an interface via which packets are going to be sent.<\/p>\n
Find the interface via which packets are sent through by running the command below;<\/p>\n
ip route get 8.8.8.8\r\n8.8.8.8 via 192.168.43.1 dev enp0s8<\/strong> src 192.168.43.23<\/code><\/pre>\n
The interface name maybe different for your case. Replace accordingly.<\/p>\n
firewall-cmd --permanent --direct --passthrough ipv4 -t nat -A POSTROUTING -s 172.16.0.0\/24 -o enp0s8<\/strong> -j MASQUERADE<\/code><\/pre>\n
Reload firewalld for the changes to take effect.<\/p>\n
firewall-cmd --reload<\/code><\/pre>\n
Start and set OpenVPN start on boot.<\/p>\n
systemctl start openvpn-server@server\r\nsystemctl enable openvpn-server@server<\/code><\/pre>\n
When OpenVPN service runs, it will create a tunnelling interface, tun0;<\/p>\n
ip add show tun0\r\n4: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 100\r\n    link\/none \r\n    inet 172.16.0.1\/24 brd 172.16.0.255 scope global tun0\r\n       valid_lft forever preferred_lft forever\r\n    inet6 fe80::1155:c60c:c009:48c9\/64 scope link stable-privacy \r\n       valid_lft forever preferred_lft forever<\/code><\/pre>\n
The VPN server is assigned the IP address, 172.16.0.1 while the first client will be assigned 172.16.0.2.<\/p>\n
Configure VPN Client<\/h3>\n
In order for the VPN client to connect to VPN server, a copy of CA certificate, client key, client certificate and TLS\/SSL authentication key generated above are required. Hence, copy these files to the target client and place them on a convenient directory.<\/p>\n
cd \/etc\/openvpn\/easy-rsa\/pki\/\r\nscp {ca.crt,issued\/client.crt,private\/client.key,ta.key} username@client-IP:~\/<\/code><\/pre>\n
Install OpenVPN client<\/h4>\n