How To Start A VPN Service With OpenVPN, WHMCS and Freeradius

In this tutorial, written for Linux - CentOS, we will be using OpenVPN, which, as many of you likely know, is an open source software application that implements virtual private network (VPN). Then,we will be setting up a WHMCS module to work with this configuration. The add-on we will be using is called FreeRadius by SafeSrv. You will need to purchase this add-on through WHMCS's website.

This tutorial will be in two parts:
Part One - Setting up OpenVPN
Part Two - Adding it to your WHMCS (assuming that WHMCS is already installed).
Grab your coffee and cigarettes, and follow the instructions below. If by chance you have any problems or questions, feel free to post them here and I will assist as much as I can.

[Image: 2jampnT.png]

PART ONE
Setting Up OpenVPN

1. Install the following dependencies:
yum install gcc make rpm-build autoconf.noarch openssl-devel pam-devel zlib-devel

2. Download the OpenVPN software (should be pretty quick downloads):
wget http://openvpn.net/release/lzo-1.08-4.rf.src.rpm
wget http://dag.wieers.com/rpm/packages/rpmforge-release/rpmforge-release-0.3.6-1.el5.rf.x86_64.rpm

3. Install the following files:
rpmbuild --rebuild lzo-1.08-4.rf.src.rpm
rpm -Uvh /usr/src/redhat/RPMS/x86_64/lzo-*.rpm
rpm -Uvh rpmforge-release-0.3.6-1.el5.rf.x86_64.rpm
yum install openvpn

4. Copy the OpenVPN files:
cp -r /usr/share/doc/openvpn-2.2.0/easy-rsa/ /etc/openvpn/

5. Now it is time to create your SSL keys. When asked for your key information, just press enter:
cd /etc/openvpn/easy-rsa/2.0
chmod 755 *
source ./vars
./vars
./clean-all
./build-ca
./build-key-server server
./build-dh

6. Now, we will create the OpenVPN configuration file. This is where most people mess up, so please pay close attention. Run the following commands:
cd /etc/openvpn
vi server.conf

7. Next, you will need to copy this basic sample configuration file into the server.conf. You then need to edit everything in CAPS. Edit the IP address and port to your main IP address and requested port. Press your escape key, then :wq, and finally press enter to save and exit the configuration file.
local YOUR SERVER IP ADDRESS HERE
port 4 DIGIT PORT NUMBER HERE
proto udp #- protocol can be tcp or udp
dev tun
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
plugin /usr/share/openvpn/plugin/lib/openvpn-auth-pam.so /etc/pam.d/login
client-cert-not-required
username-as-common-name
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 4.2.2.1"
keepalive 5 30
comp-lzo
persist-key
persist-tun
status server-tcp.log
verb 3

8. Now it's time to start OpenVPN. Run the command below to do so. If everything above was done correctly, your service will start without any errors. You are looking for a message saying "Initialization Sequence Completed." Once you see this message, go ahead and press Ctrl+C. If you don't see it, you will get an error message.
openvpn /etc/openvpn/server.conf

9. Setup your Network Allocation Table rules. Change "0.0.0.0" to your server's IP:
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to 0.0.0.0

10. Now we must add your user to the VPN service. To do this, please run the following two commands:
useradd username -s /bin/false
passwd username

11. Create an OpenVPN config file on your local machine with the name vpn1.ovpn. Copy the sample below and change it to your IP and port. Now place it in your OpenVPN configurations folder:
client
dev tun
proto udp
remote 123.123.123.123 4567 #- YOUR OPENVPN IP AND PORT
resolv-retry infinite
nobind
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
persist-key
persist-tun
ca ca.crt
auth-user-pass
comp-lzo
verb 3

12. Download the Security certificate we created in the beginning, ca.crt from /etc/openvpn/easy-rsa/2.0/keys, to the same OpenVPN configs folder.

13. Start the VPN on the VPS:
openvpn /etc/openvpn/server.conf

Now we should log in to the VPN from your local machine (using OpenVPN or another desktop client) with the username/password you created. If everything up to this point has worked, you are doing great so far. Take a bathroom break and come back for part two!

[Image: 2jampnT.png]

PART TWO
WHMCS and Freeradius

Okay, I hope you have your coffee and bathroom break out of the way because we're getting right back into it!

1. First off, you will need to do a few different things so that we don't run into any problems in the future. Fix it now, so it doesn't become a problem later. You need to go to SafeSRV's website and purchase/download Freeradius. We need to first install ioncube loader 4.4.1. To do this, please perform the following:
A. Make sure your PHP version, at minimum, is 5.4. If it isn't, update. If you are unsure, go through your control panel (WHM or whatever) to check.

B. Go ahead and upload the /modules/servers/Freeradius folder into modules/servers/. Now upload /modules/addons/Freeradius into modules/addons. Overwrite any files if prompted.

C. Go into your WHMCS admin. Go to Setup>Addon Modules and activate the Freeradius module.

D. Next, we need to upload the files that SafeSRV provided to your WHMCS site and then run the loader-wizard.php, which should already be included.

E. Now go ahead and replace the current ioncube loader line in your PHP.ini file to where your new loader is located. Upload your loader to usr/local/IonCube/ while writing over your current ioncube loader.

F. Restart Apache.

2. Now, we need to install telnet on your server that is running your WHMCS. If you have already have telnet installed, you may skip this step.
yum install telnet

3. On your VPN Servers OpenVPN config files, add the following (with different port numbers each time):
management localhost 7505

4. Activate the Client Config Directory, or CCD, on all of your OpenVPN servers by this command:
mkdir -m 777 /etc/openvpn/ccd
echo -e "\nclient-config-dir /etc/openvpn/ccd" >> /etc/openvpn/server.conf
service openvpn restart

5. Install MySQLi php extension in WHM - just enable the mysqli extension in PHP through EasyApache under the Exhaustive Options. If you do not have cPanel, you may use this command:
yum install php-mysqli

6. You will need to install PHP-SSH2 extension as well, same way as above for WHM users. Go to /etc/openvpn and find the file named radiusplug.cnf. Open this up and change overwriteccfiles=true to overwriteccfiles=false.

7. Restart OpenVPN by running the service command:
service openvpn restart

8. Everything should be ready now. You are now ready to setup products in your WHMCS. Go ahead and log in to your WHMCS admin again and go to Setup>Products>Products. Create a new product group as well as a new product. Find your module settings tab and enter in your license key from SafeSRV. You can play with the other settings as you please.

9. Now we will go ahead and add the Free Radius db connection. To do this, go to Setup>Product/Services>Servers. Under Server Details, select the type as Freeradius and use the following information:
Name: Name of your Freeradius Server
IP Address: The IP of your Freeradius Server or 127.0.0.1 for local Freeradius
Accounts: How many accounts you want to have on this Freeradius
Type: Select "Freeradius"
Username: Enter the username of the DB user who has permissions to access your Freeradius MySQL database remotely or locally.
Password: Enter the password of the DB user who has permissions to access your Freeradius MySQL database remotely or locally.
Access Hash: Enter the name of the DB on your Freeradius server.[/color][/font]

10. Lastly, you will need to create a cron job with the following command and set it to run around every 5-10 minutes:
php -q /home/user/public_html/whmcs/modules/servers/Freeradius/cron.php

11. Other than this, customize however you'd like. The rest is pretty self-explanatory. It's just like setting up normal packages in WHCMS.

You got through it! Give yourself a pat on the back! I took a good bit of time for this tutorial, so if you enjoyed it, please comment and such :)