Random tech notes and tutorials

Operating System: Debian Etch 4.0

Install and Key Generation

First we just need to grab the primary packages from the repos and install. Make sure you’re root.

Next find the easy-rsa directory, and copy those files over to the OpenVPN configuration directory so we can setup a certificate.

Now in the /etc/openvpn directory open up the vars file and make some edits that suit you. I only made changes to the very end of the file.

Save this file. Then run:

Yeah, there’s a dot, a space, and then another dot in there. Then these commands:

You’ll be asked the cert questions, but most of the defaults should be filled in for you since you manually entered them in the vars file. Now build the server key:

You’ll be asked the same type of questions, but for common name you need to enter something. “Server” is the default. Run this next command, which will take awhile.

Then generate your TLS-AUTH keys:

Now create a key directory closer to the root folder to stay organized and copy the necessary keys there:

Server Config File

My server configuration is located in /etc/openvpn/server.conf. It’s what worked for me. The 172.21.0.0 subnet is the virtual one used by the VPN. The 10.10.0.0 subnet is the LAN I’m trying to connect to.

More info on configuration options is here: http://openvpn.net/howto.html. You’ll also have to enable packet forwarding so packets can flow from the VPN interface to the ethernet interface. Open the file /etc/sysctl.confand uncomment this line:

Restart the server.

Setup the Revocation List

Now setup a revocation list so you can block certificates and users that you create. Execute your variables again.

I had to modify my openssl configuration and repoint to my openvpn directory.

Edit the config file openssl.cnf at the end and comment out the pkcs11 section if you’re not using it, otherwise it will throw errors. Then create your CRL:

User Configuration

Now create your first user:

Answer the same prompts and give it a password. If you don’t want to use a password, just use build-key instead. Restart the OpenVPN server for it to read the config:

Now, on the client machine run the same install commands (assuming you’re using an Ubuntu or Debain box) and create a keys directory:

Copy the keys ca.crt, user1.crt, user1.key, and ta.key into the keys directory and then create a file called client.conf in the /etc/openvpn directory. Be sure you restrict access and lock down the keys directory, since compromise of these files will give someone else access.

Here’s my config:

You can get more info on the configuration here: http://openvpn.net/howto.html. Now start up the VPN:

You can check the logs for errors, but in a few seconds, if you run an ifconfig, you can see a tun0 device has been created and has one of the virtual IP addresses. You can then ping the remote VPN server’s inside address for testing.

Routing Issues

In my situation, my VPN server was not the default gateway on my LAN, so I had to add some permantent routes to my clients so they could find their way back through the tunnel and to my remote client. For Linux boxes use:

And on Windows use:

Adding and Removing Other Users

When you need to add new users or client certificates, simply run:

This will generate the keys for the new client to copy down to their machine, just the same as the initial client.

Removing users is easy as well.

You may see a bunch of error 23′s at the end, but that’s normal and just testing that the certificate does not have access anymore.