Product docs and API reference are now on Akamai TechDocs.
Search product docs.
Search for “” in product docs.
Search API reference.
Search for “” in API reference.
Search Results
 results matching 
 results
No Results
Filters
Secure Communications with OpenVPN on Debian 6 (Squeeze)
- Deprecated guides:
- Ubuntu 9.10
- Ubuntu 12.04
- Ubuntu 10.10
- Ubuntu 10.04
- Debian 5
- CentOS 6
Traducciones al EspañolEstamos traduciendo nuestros guías y tutoriales al Español. Es posible que usted esté viendo una traducción generada automáticamente. Estamos trabajando con traductores profesionales para verificar las traducciones de nuestro sitio web. Este proyecto es un trabajo en curso.
DeprecatedThis guide has been deprecated and is no longer being maintained.
OpenVPN, or Open Virtual Private Network, is a tool for creating networking “tunnels” between and among groups of computers that are not on the same local network. This is useful if you have services on a local network and need to access them remotely, but don’t want these services to be publicly accessible. By integrating with OpenSSL, OpenVPN can encrypt all VPN traffic to provide a secure connection between machines.
For many private networking tasks, we urge users to consider the many capabilities of the OpenSSH package, which can provide easier VPN and VPN-like services. OpenSSH is also installed and configured by default on all Linodes. Nevertheless, if your deployment requires a more traditional VPN solution like OpenVPN, this document covers the installation and configuration of the OpenVPN software.
Before installing OpenVPN, it is assumed that you have followed our Setting Up and Securing a Compute Instance . If you are new to Linux server administration, you may be interested in our introduction to Linux concepts guide , beginner’s guide and administration basics guide . If you’re concerned about securing and “hardening” the system on your Linode, you might be interested in our security basics article as well.
Install OpenVPN
Make sure your package repositories and installed programs are up to date by issuing the following commands:
apt-get update
apt-get upgrade --show-upgraded
Begin by installing the OpenVPN software and the udev
dependency with the following command:
apt-get install openvpn udev
The OpenVPN package provides a set of encryption-related tools called “easy-rsa”. These scripts are located by default in the /usr/share/doc/openvpn/examples/easy-rsa/
directory. However, in order to function properly, these scripts should be located in the /etc/openvpn
directory. Copy these files with the following command:
cp -R /usr/share/doc/openvpn/examples/easy-rsa/ /etc/openvpn
Most of the relevant configuration for the OpenVPN public key infrastructure is contained in /etc/openvpn/easy-rsa/2.0/
, and much of our configuration will be located in this directory.
Configure Public Key Infrastructure Variables
Before you can generate the public key infrastructure for OpenVPN, you must configure a few variables that the easy-rsa scripts will use to generate the scripts. These variables are set near the end of the /etc/openvpn/easy-rsa/2.0/vars
file. Here is an example of the relevant values:
- File: /etc/openvpn/easy-rsa/2.0/vars
1 2 3 4 5
export KEY_COUNTRY="US" export KEY_PROVINCE="OH" export KEY_CITY="Oxford" export KEY_ORG="My Company" export KEY_EMAIL="username@example.com"
Alter the examples to reflect your configuration. This information will be included in certificates you create and it is important that the information be accurate, particularly the KEY_ORG
and KEY_EMAIL
values.
Initialize the Public Key Infrastructure (PKI)
Issue the following three commands in sequence to initialize the certificate authority and the public key infrastructure:
cd /etc/openvpn/easy-rsa/2.0/
. /etc/openvpn/easy-rsa/2.0/vars
. /etc/openvpn/easy-rsa/2.0/clean-all
. /etc/openvpn/easy-rsa/2.0/build-ca
These scripts will prompt you to enter a number of values. If you set the correct values in vars
, you will be able to press return at each prompt.
Generate Certificates and Private Keys
With the certificate authority configured, you can generate the private key for the server. To accomplish this, issue the following command, changing “server” to the name of your OpenVPN server.
. /etc/openvpn/easy-rsa/2.0/build-key-server server
This script will also prompt you for additional information. By default, the Common Name
for this key will be “server”. You can change these values in cases where it makes sense to use alternate values. The challenge password and company names are optional and can be left blank. When you’ve completed the question section you can confirm the signing of the certificate and the “certificate requests certified” by answering “yes” to these questions.
With the private keys generated, we can create certificates for all of the VPN clients. Issue the following command, replacing “client1” with the name of your first OpenVPN client.
. /etc/openvpn/easy-rsa/2.0/build-key client1
Replace the client1
parameter with a relevant identifier for each client. You will want to generate a unique key for every user of the VPN. Each key should have it’s own unique identifier. All other information can remain the same. If you need to add users to your OpenVPN at any time, repeat this step to create additional keys.
Generate Diffie Hellman Parameters
The “Diffie Hellman Parameters” govern the method of key exchange and authentication used by the OpenVPN server. Issue the following command to generate these parameters:
. /etc/openvpn/easy-rsa/2.0/build-dh
This should produce the following output:
Generating DH parameters, 1024 bit long safe prime, generator 2
This is going to take a long time
This will be followed by a quantity of seemingly random output. The task has succeeded.
Relocate Secure Keys
The /etc/openvpn/easy-rsa/2.0/keys/
directory contains all of the keys that you have generated using the easy-rsa
tools.
In order to authenticate to the VPN, you’ll need to copy a number of certificate and key files to the remote client machines. They are:
ca.crt
client1.crt
client1.key
You can use the scp
tool, or any other means of transferring
. Be advised, these keys should transferred with the utmost attention to security. Anyone who has the key or is able to intercept an unencrypted copy of the key will be able to gain full access to your virtual private network. We recommend that you encrypt the keys for transfer, either by using a protocol like SSH, or by encrypting them with the GPG tool.
The keys and certificates for the server need to be relocated to the /etc/openvpn
directory so the OpenVPN server process can access them. These files are:
ca.crt
ca.key
dh1024.pem
server.crt
server.key
Issue the following commands, substituting your actual filenames for “server.crt” and “server.key.” :
cd /etc/openvpn/easy-rsa/2.0/keys
cp ca.crt ca.key dh1024.pem server.crt server.key /etc/openvpn
These files need not leave your server. Maintaining integrity and control over these files is of the utmost importance to the integrity of your server. If you ever need to move or back up these keys, ensure that they’re encrypted and secured. If these files are compromised, they will need to be recreated along with all client keys.
Revoking Client Certificates
If you need to remove a user’s access to the VPN server, issue the following command sequence.
. /etc/openvpn/easy-rsa/2.0/vars
. /etc/openvpn/easy-rsa/2.0/revoke-full client1
This will revoke the ability of users who have the client1
certificate to access the VPN. For this reason, keeping track of which users are in possession of which certificates is crucial.
Configure the Virtual Private Network
We’ll now need to configure our server file. There is an example file in /usr/share/doc/openvpn/examples/sample-config-files
. Issue the following sequence of commands to retrieve the example configuration file and move it to the /etc/openvpn
directory:
cd /usr/share/doc/openvpn/examples/sample-config-files
gunzip -d server.conf.gz
cp server.conf /etc/openvpn/
cp client.conf ~/
cd ~/
Modify the remote
line in your ~/client.conf
file to reflect the OpenVPN server’s name.
- File: ~/client.conf
1 2 3 4
# The hostname/IP and port of the server. # You can have multiple remote entries # to load balance between the servers. remote example.com 1194
Edit the client.conf
file to reflect the name of your key. In this example we use client1
for the file name.
- File: ~/client.conf
1 2 3 4 5 6 7 8 9
# SSL/TLS parms. # See the server config file for more # description. It's best to use # a separate .crt/.key file pair # for each client. A single ca # file can be used for all clients. ca ca.crt cert client1.crt key client1.key
Copy the ~/client1.conf
file to your client system. You’ll need to repeat the entire key generation and distribution process for every user and every key that will connect to your network.
Connect to the VPN
To initialize the OpenVPN server process, run the following command:
/etc/init.d/openvpn start
This will scan the /etc/openvpn
directory on the server for files with a .conf
extension. For every file that it finds, it will create and run a VPN daemon (server).
The process for connecting to the VPN varies depending on your specific operating system and distribution running on the client machine. You will need to install the OpenVPN package for your operating system if you have not already done so.
Most network management tools provide some facility for managing connections to a VPN. Configure connections to your OpenVPN through the same interface where you might configure wireless or Ethernet connections. If you choose to install and manage OpenVPN manually, you will need to place the client1.conf
file and the requisite certificate files in the local machine’s /etc/openvpn
directory or equivalent location.
If you use Mac OS X, we have found that the Tunnelblick tool provides an easy method for managing OpenVPN connections. If you use Windows, the OpenVPN GUI tool may be an effective tool for managing your connections too. Linux desktop users can install the OpenVPN package and use the network management tools that come with your desktop environment.
Using OpenVPN
Connect Remote Networks Securely With the VPN
Once configured, the OpenVPN server allows you to encrypt traffic between your local computer and your Linode’s local network. While all other traffic is handled in the conventional manner, the VPN allows traffic on non-public interfaces to be securely passed through your Linode. This will also allow you to connect to the local area network in your Linode’s data center if you are using the LAN to connect to multiple Linodes in the same data center. Using OpenVPN in this manner is supported by the default configuration, and if you connect to the OpenVPN you have configured at this point, you will have access to this functionality.
Tunnel All Connections through the VPN
By deploying the following configuration, you will be able to forward all traffic from client machines through your Linode, and encrypt it with transport layer security (TLS/SSL) between the client machine and the Linode. Begin by adding the following parameter to the /etc/openvpn/server.conf
file to enable “full tunneling”:
- File: /etc/openvpn/server.conf
1
push "redirect-gateway def1"
Now edit the /etc/sysctl.conf
file to uncomment or add the following line to ensure that your system is able to forward IPv4 traffic:
- File: /etc/sysctl.conf
1
net.ipv4.ip_forward=1
Issue the following command to set this variable for the current session:
echo 1 > /proc/sys/net/ipv4/ip_forward
Issue the following commands to configure iptables
to properly forward traffic through the VPN:
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -s 10.8.0.0/24 -j ACCEPT
iptables -A FORWARD -j REJECT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
Before continuing, insert these iptables
rules into your system’s /etc/rc.local
file to ensure that theses iptables
rules will be recreated following your next reboot cycle:
- File: /etc/rc.local
1 2 3 4 5 6 7 8 9 10
#!/bin/sh -e # # [...] # iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -A FORWARD -s 10.8.0.0/24 -j ACCEPT iptables -A FORWARD -j REJECT iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE exit 0
This will enable all client traffic except DNS queries to be forwarded through the VPN. To forward DNS traffic through the VPN you will need to install the dnsmasq
package and modify the /etc/opnevpn/server.conf
package. Begin by issuing the following command:
apt-get install dnsmasq
After completing the installation the configuration will need to be modified so that dnsmasq is not listening on a public interface. You will need to find the following lines in the configuration file and make sure the lines are uncommented and have the appropriate values:
- File: /etc/dnsmasq.conf
1 2 3
listen-address=127.0.0.1,10.8.0.1 bind-interfaces
This will configure dnsmasq to listen on localhost and the gateway IP address of your OpenVPN’s tun device.
When your system boots, dnsmasq will try to start prior to the OpenVPN tun device being enabled. This will cause dnsmasq to fail at boot. To ensure that dnsmasq is properly started at boot, you’ll need to modify your /etc/rc.local
file once again. By adding the following line, dnsmasq will start after all the init scripts have finished. You should place the restart command below your iptables rules:
- File: /etc/rc.local
1 2 3
/etc/init.d/dnsmasq restart exit 0
Add the following directive to the /etc/openvpn/server.conf
file:
- File: /etc/openvpn/server.conf
1
push "dhcp-option DNS 10.8.0.1"
Finally, before attempting to connect to the VPN in any configuration, restart the OpenVPN server and dnsmasq by issuing the following commands:
/etc/init.d/openvpn restart
/etc/init.d/dnsmasq restart
Once these configuration options have been implemented, you can test the VPN connection by connecting to the VPN from your local machine, and access one of the many websites that will display your IP address. If the IP address displayed matches the IP address of your Linode, all network traffic from your local machine will be filtered through your Linode and encrypted over the VPN between your Linode and your local machine. If, however, your apparent public IP address is different from your Linode’s IP address, your traffic is not being filtered through your Linode or encrypted by the VPN.
More Information
You may wish to consult the following resources for additional information on this topic. While these are provided in the hope that they will be useful, please note that we cannot vouch for the accuracy or timeliness of externally hosted materials.
This page was originally published on