Create your own VPN

So this weeks video is how to turn your CentOS 6 VPS into a VPN Server. Why would you want to do this? Well the issue is that even if a hosting provider for VPN's say they do not keep logs, you can never be sure. If we create our own OpenVPN Server on our own VPS we are in control of everything. So below are all the commands you will need to do this tutorial.



I recommend copying and pasting commands, as one error may result in a non working VPN Server.

First things first lets update our CentOS VPS using this command:
yum update -y

First we need to check to make sure we have tun/tap enabled. If you do not, you will need to ask your VPS Host to enable it for you. You can check this using this command:
 cat /dev/net/tun
It should read 'cat: /dev/net/tun: File descriptor is in bad state'.

Now install openvpn and it's dependencies using each of these commands in order:
yum install gcc make rpm-build autoconf.noarch zlib-devel pam-devel openssl-devel iptables -y
rpmbuild --rebuild lzo-1.08-4.rf.src.rpm

wget http://pkgs.repoforge.org/rpmforge-release/rpmforge-release-0.5.2-2.el6.rf.x86_64.rpm
rpm -Uvh lzo-*.rpm
rpm -Uvh rpmforge-release-0.5.2-2.el6.rf.x86_64.rpm
yum install openvpn

Now we need to change some files, copy directories and generate the SSL keys for your server. Use these commands in order:
cp -r /usr/share/doc/openvpn-2.2.2/easy-rsa/ /etc/openvpn/
cp -irv /etc/openvpn/easy-rsa/2.0/openssl-1.0.0.cnf /etc/openvpn/easy-rsa/2.0/openssl.cnf
cd /etc/openvpn/easy-rsa/2.0
chmod 755 *
source ./vars
./vars
./clean-all

Now we need to enter the certificate details. Use these commands in order:
./build-ca
./build-key-server server

./build-dh

Now we need to create the openvpn server config file. Use these commands in order:
cd /etc/openvpn
nano server.conf

Paste in this configuration:

local x.x.x.x #- change it with your server ip address

port 1194 #Change to the PORT you would like
proto udp
dev tun
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
plugin /usr/share/openvpn/plugin/lib/openvpn-auth-pam.so /etc/pam.d/login
client-cert-not-required
username-as-common-name
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 5 30
comp-lzo
persist-key
persist-tun
status server-tcp.log
verb 3


Don't forget to replace x.x.x.x with your VPS IP Address. Use CTRL + X then press Y and then press S to save.

Now check your OpenVPN Server is working by using this command:
openvpn /etc/openvpn/server.conf

'Initialization Sequence Completed' means that your server is working fine so far.

Now enter these commands in order:
chkconfig openvpn on
chkconfig iptables on

Now we need to edit the sysctl.conf file by opening it up with this command:
nano /etc/sysctl.conf

Change the line: net.ipv4.ip_forward = 0 TO 1
Comment out this line: # net.ipv4.tcp_syncookies = 1

Then press CTRL + X, press Y and then press S to save

Now type:
sysctl -p

Now configure the IP Tables using these commands in order:

iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT


iptables -A FORWARD -s 10.8.0.0/24 -j ACCEPT

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to x.x.x.x


Replace x.x.x.x with your VPS IP Address.

Then save this by typing:
service iptables save

Now you need the client config that goes on the WINDOWS Machine:

client

dev tun
proto udp
remote x.x.x.x 1194 #- your OPENVPN server ip and port
resolv-retry infinite
nobind
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
persist-key
persist-tun
ca ca.crt
auth-user-pass
comp-lzo
verb 3


Make sure to change the IP and Port to match your VPS IP and Port

Now make sure your OpenVPN Server starts on startup on your VPS
echo openvpn /etc/openvpn/server.conf >> /etc/rc.d/rc.local

Then reboot your VPS by typing@
reboot

Log back in and add some users by typing:
useradd <username> -s /bin/false

You can change the password by doing:
 passwd <username>

Now stop the OpenVPN Service:
service openvpn stop

And then start it again by typing:
openvpn /etc/openvpn/server.conf

And you can login to your OpenVPN Client and surf the web through your own VPN!