Jul 12, 2018

How to Setup and Configure an OpenVPN Server on CentOS

Enabled Extra Packages for Enterprise Linux (EPEL) Repository:

$ sudo rpm -Uvh http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm

Install

$ sudo yum install openvpn -y

copy the configuration file to its destination:

$ sudo cp /usr/share/doc/openvpn-2.3.2/sample/sample-config-files/server.conf /etc/openvpn

uncomment the "push" parameter so traffic on our client systems to be routed through OpenVPN.

# If enabled, this directive will configure
# all clients to redirect their default
# network gateway through the VPN, causing
# all IP traffic such as web browsing and
# and DNS lookups to go through the VPN
# (The OpenVPN server machine may need to NAT
# or bridge the TUN/TAP interface to the internet
# in order for this to work properly).
push "redirect-gateway def1 bypass-dhcp"

route DNS queries to opendns.com and Google's Public DNS servers.

push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"

Let OpenVPN drop privileges after startup

user nobody
group nobody

Generating Keys and Certificates Using easy-rsa

$ sudo yum -y install easy-rsa

$ sudo cp -R /usr/share/easy-rsa/ /etc/openvpn/

$ cd /etc/openvpn/easy-rsa/2.0
$ sudo cp vars vars.bak

$ mkdir -p /etc/openvpn/easy-rsa/keys

Edit vars ( only need to change the 2 blue lines ) 

export KEY_COUNTRY="CA"
export KEY_PROVINCE="ON"
export KEY_CITY="Toronto"
export KEY_ORG="it.i88.ca"
export KEY_EMAIL="[email protected]"
export KEY_CN=it.i88.ca
export KEY_NAME=it
export KEY_OU=it
export PKCS11_MODULE_PATH=changeme
export PKCS11_PIN=1234

build Certificate Authority, or CA

# source ./vars
NOTE: If you run ./clean-all, I will be doing a rm -rf on /usr/share/easy-rsa/2.0/keys
[[email protected] 2.0]# ./clean-all 
[[email protected] 2.0]# ./build-ca 
Generating a 1024 bit RSA private key
............................++++++
..............++++++
writing new private key to 'ca.key'

create certificate for the OpenVPN server.
# ./build-key-server it
Generating a 1024 bit RSA private key
.................++++++
.................++++++
writing new private key to 'it.key'

Use any name you want instead of "it", but make sure that when asked for the Common Name that you enter the exact same name. When asked to sign and to commit the new certificate, answer "y" to both questions.

build one client key/certificate pair. Same procedure (and once again pay attention to the Common Name, which must match the name you are specifying here instead of vpn-client1):
# ./build-key vpn-client1
Generating a 1024 bit RSA private key
..............++++++
...++++++
writing new private key to 'vpn-client1.key'
-----

generate Diffie Hellman key exchange files using the build-dh script

# ./build-dh
Generating DH parameters, 1024 bit long safe prime, generator 2
This is going to take a long time
............................................................+..+..............................+.........................+..................+.................................................................................+..............................+...........................................+...................+.....................+.+...............+..............+......................+................................................................................+.+................................................+....................+.......+........................................+...............................++*++*++*

Create an iptables rule to allow proper routing of VPN subnet.
# iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
# service iptables save
iptables: Saving firewall rules to /etc/sysconfig/iptables:[  OK  ]

enable IP Forwarding in sysctl:
in /etc/sysctl.conf

# Controls IP packet forwarding
net.ipv4.ip_forward = 1

cp keys files to the same as server.conf
# cp easy-rsa/keys/* ./

apply new sysctl settings. Start the server and assure that it starts automatically on boot:
sysctl -p
service openvpn start
chkconfig openvpn on