OpenVPN

http://library.linode.com/networking/openvpn/ubuntu-10.04-lucid

## Installing

$ sudo apt-get install openvpn udev network-manager-openvpn -y

$ cp -R /usr/share/doc/openvpn/examples/easy-rsa/ /etc/openvpn


## Configure Public Key Infrastructure Variables

$ sudo gedit /etc/openvpn/easy-rsa/vars
export KEY_COUNTRY="MNG"
export KEY_PROVINCE="UB"
export KEY_CITY="Ulanbator"
export KEY_ORG="aquaballoon"
export KEY_EMAIL="[email protected]"


## Initialize the Public Key Infrastructure (PKI)

$ cd /etc/openvpn/easy-rsa/2.0/
$ ./etc/openvpn/easy-rsa/2.0/vars
$ ./etc/openvpn/easy-rsa/2.0/clean-all
$ ./etc/openvpn/easy-rsa/2.0/build-ca


## Generate Certificates and Private Keys

$ ./etc/openvpn/easy-rsa/2.0/build-key-server server

$ ./etc/openvpn/easy-rsa/2.0/build-key client1


## Generate Diffie Hellman Parameters

$ ./etc/openvpn/easy-rsa/2.0/build-dh


## Relocate Secure Keys - Client1

/etc/openvpn/easy-rsa/2.0/keys/

In order to authenticate to the VPN, you will need to copy a number of certificate and key files to the remote client machines. They are:

ca.crt
client1.crt
client1.key


## Relocate Secure Keys - Server

$ cd /etc/openvpn/easy-rsa/2.0/keys
$ cp ca.crt ca.key dh1024.pem server.crt server.key /etc/openvpn


## Removing a user to the VPN server

$ ./etc/openvpn/easy-rsa/2.0/vars
$ ./etc/openvpn/easy-rsa/2.0/revoke-full client1


## Configuring server.conf file

$ cd /usr/share/doc/openvpn/examples/sample-config-files
$ gunzip -d server.conf.gz
$ cp server.conf /etc/openvpn/
$ cd /etc/openvpn

$ gedit server.conf
dev tun
proto tcp
port 1194

ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
dh /etc/openvpn/easy-rsa/keys/dh1024.pem

user nobody
group nogroup

server 10.8.0.0 255.255.255.0

persist-key
persist-tun

#status openvpn-status.log
#verb 3

client-to-client

push "redirect-gateway def1"

push "dhcp-option DNS 10.8.0.1"

#log-append /var/log/openvpn
comp-lzo


## Or,configuring openvpn.conf file

$ gedit /etc/openvpn/openvpn.conf
dev tun
proto tcp
port 1194

ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
dh /etc/openvpn/easy-rsa/keys/dh1024.pem

user nobody
group nogroup

server 10.8.0.0 255.255.255.0

persist-key
persist-tun

#status openvpn-status.log
#verb 3

client-to-client

push "redirect-gateway def1"

push "dhcp-option DNS 10.8.0.1"

#log-append /var/log/openvpn
comp-lzo


## Configuring client.conf file

$ cd /usr/share/doc/openvpn/examples/sample-config-files
$ cp client.conf /etc/openvpn/
$ cd /etc/openvpn

$ gedit /etc/openvpn/client.conf
;dev tap
dev tun

proto tcp
;proto udp

remote example.com 1194

ca ca.crt
cert client1.crt
key client1.key

/* Copy the ~/client.conf file to your client system */

$ /etc/init.d/openvpn start


## Tunnel All Connections

$ echo 1 > /proc/sys/net/ipv4/ip_forward

$ iptables -A INPUT -d 10.8.0.1/32 -i tun0 -j INBOUND          // 10.8.0.1 tunnel accessible
$ iptables -A INPUT -d 124.158.xx.xx/32 -i tun0 -j INBOUND   // 124.158.xx.xx tunnel accessible
$ iptables -A INPUT -d 192.168.2.0/24 -i tun0 -j INBOUND       // 192.168.2.0 subnet tunnel accessible

$ iptables -A FORWARD -d 10.8.0.0/24 -j ACCEPT                 // All ports available (DNS Service)

$ iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE


$ /etc/init.d/openvpn restart