Pasul 1

Odata cu instalarea pachetului easy-rsa vom avea in directorul /usr/share/doc/easy-rsa sau /usr/share/doc/packeges/easy-rsa un Readme care prezinta pasii de generare chei server / client. Binarele sunt in directorul /usr/share/easy-rsa si in general se recomanda copierea lor in /etc/openvpn care este directorul principal de configurare openVPN

cp -r /usr/share/easy-rsa/ /etc/openvpn/easy-rsa

Se merge in directorul unde exista fisierul “vars” si se editeaza la sfarsitul lui variabilele: KEY_COUNTRY,

KEY_PROVINCE,

KEY_CITY, KEY_ORG

si

KEY_EMAIL

Fara a lasa vreuna neconfigurata.

# These are the default values for fields

# which will be placed in the certificate.

# Don’t leave any of these fields blank.

export KEY_COUNTRY=”RO”

export KEY_PROVINCE=”VL”

export KEY_CITY=”Rm.Valcea”

export KEY_ORG=”Home”

export KEY_EMAIL=”me@myhost.mydomain”

export KEY_OU=”OrganizatiaPreferata”

Succesiunea de comenzi ce urmaeza va genera setul de chei necesare:

** Cheile clientX.crt, clientX.key si ca.crt trebuie sa ajunga la client – de preferinta intr-o arhiva cu parola **

cd /usr/openvpn/easy-rsa – directorul care contine fisierul vars

source ./vars – se incarca setarile de variabile

./clean-all – se streg eventualale chei mai vechi

./build-ca – se genereaza Cert Authority (CA)

– Singurul parametru suplimentar necesar de introdus aici este “Common Name”

Ex: OpenVPN-CA

./build-key-server server – se genereaza certificatul si cheia privata pt server cu numele “server”

./build-dh – genereaza dh.pem

Urmeaza a se genera chei pentru clienti VPN – client1, client2, client3:

./build-key client1

./build-key client2

./build-key client3

Daca se doreste parola pentru fiecare client se utilizeaza build-key-pass in loc de build-key

Ulterior se pot genera alte chei din acelasi director cu comanda ./build-key <nume> dupa ce se executa source ./vars

Se copiaza cheile generate pe server – de exemplu – in directorul /etc/openvpn/keys

mkdir /etc/openvpn/keys

cp /etc/openvpn/easy-rsa/keys/ca.crt /etc/openvpn/keys

cp /etc/openvpn/easy-rsa/keys/server.crt /etc/openvpn/keys

cp /etc/openvpn/easy-rsa/keys/server.key /etc/openvpn/keys

cp /etc/openvpn/easy-rsa/keys/dh2048.pem /etc/openvpn/keys

Pasul 2 – fisierul .conf de pe server:

O configuratie simpla este data mai jos server.conf si trebuie creata in /etc/openvpn/server.conf

(Exemple de configurare incluse in pachetul openVPN sunt date in /usr/share/doc/openvpn/examples)

=============================================

#change with your port

#port 1194

port 1337

#You can use udp or tcp

proto udp

# “dev tun” will create a routed IP tunnel.

dev tun

#Certificate Configuration

#ca certificate

ca /etc/openvpn/keys/ca.crt

#Server Certificate

cert /etc/openvpn/keys/server.crt

#Server Key and keep this is secret

key /etc/openvpn/keys/server.key

#See the size a dh key in /etc/openvpn/keys/

dh /etc/openvpn/keys/dh2048.pem

#Internal IP will get when already connect

server 192.168.200.0 255.255.255.0

#this line will redirect all traffic through our OpenVPN

push “redirect-gateway def1”

#Provide DNS servers to the client, you can use goolge DNS

push “dhcp-option DNS 8.8.8.8”

push “dhcp-option DNS 8.8.4.4”

#Enable multiple client to connect with same key

duplicate-cn

keepalive 20 60

comp-lzo

persist-key

persist-tun

daemon

#enable log

log-append /var/log/myvpn/openvpn.log

#Log Level

verb 3

=============================================

Pentru a testa configuratia se poate lansa ca root

openvpn –config server.conf (sau openvpn /etc/openvpn/server.conf)

Si apoi opri cu

killall -9 openvpn

Sau se poate porni ca serviciu:

systemctl list-unit-files|grep enabled

systemctl enable openvpn, systemctl start openvpn, sau opri cu systemctl stop openvpn

sudo service openvpn start or stop or restart

…

Pentru ca traficul VPN ↔ LAN sa functioneze trebuie setate reguli de firewall:

iptables -I INPUT -i tun+ -j ACCEPT

iptables -I FORWARD -s <local_lan_ip/24> -d 192.168.200.0/24 -j ACCEPT

iptables -I FORWARD -d <local_lan_ip/24> -s 192.168.200.0/24 -j ACCEPT

Trebuie de asemenea sa permite accesul spre internet pentru ca in fisierul server.conf am setat routa default prin VPN

(echo 1 > /proc/sys/net/ipv4/ip_forward)

iptables -t nat -A POSTROUTING -s 192.168.200.0/24 -o eth0 -j MASQUERADE

Pasul 3

La client trebuie sa ajunga clientX.key, clientX.crt si ca.crt impreuna cu fisierul de configurare client.conf

Sub windows client.conf sa renumeste client.ovpn

La “remote” se trece adresa publica a serverului openVPN spatiu PORT:

========================================

client
dev tun
proto udp

#Server IP and Port
remote 192.168.1.104 1337

resolv-retry infinite
nobind
persist-key
persist-tun
mute-replay-warnings
ca ca.crt
cert clientX.crt
key clientX.key
ns-cert-type server
comp-lzo

========================================

Pentru windows trebuie ca fisierele sa fie copiate in c:ProgramFiles(86)openvpnconf si trebuie rulat ca administrator pentru ca trebuie sa aiba drepturi sa creeze interfata tun.

Pentru linux se copiaza in acelasi director cheile si client.conf si se lanseaza:

sudo openvpn –config client.conf &