Setting up a OpenVPN server - Revision history

Sertonix: use relative symlinks

2023-11-17T10:34:14Z

use relative symlinks

← Older revision		Revision as of 10:34, 17 November 2023
Line 109:		Line 109:
	* Create an approriate /etc/openvpn/openvpn.conf file, but name it "/etc/openvpn/AlphaBravo.conf"		* Create an approriate /etc/openvpn/openvpn.conf file, but name it "/etc/openvpn/AlphaBravo.conf"
	* create a new symlink of the init.d script:		* create a new symlink of the init.d script:
	{{Cmd\|ln -s ~~/etc/init.d/~~openvpn /etc/init.d/openvpn.AlphaBravo}}		{{Cmd\|ln -s openvpn /etc/init.d/openvpn.AlphaBravo}}
	* Have the new service start automatically		* Have the new service start automatically
	{{Cmd\|rc-update add openvpn.AlphaBravo}}		{{Cmd\|rc-update add openvpn.AlphaBravo}}

Zcrayfish: Changed "private IP address" to "bogon IP address" and changed the useless Wikipedia wall of text to actual list of unsuable IP addresses via Team Cymru.

2023-09-06T05:43:32Z

Changed "private IP address" to "bogon IP address" and changed the useless Wikipedia wall of text to actual list of unsuable IP addresses via Team Cymru.

← Older revision		Revision as of 05:43, 6 September 2023
Line 3:		Line 3:
	This article describes how to set up an OpenVPN server with the Alpine Linux.		This article describes how to set up an OpenVPN server with the Alpine Linux.
	This is an ideal solution for allowing single users or devices to remotely connect to your network. \\		This is an ideal solution for allowing single users or devices to remotely connect to your network. \\
	It is recommended you have a publicly routable static IP address in order for this to work. This means that your IP address cannot be ~~in the private~~ IP address ~~ranges described here~~: [https://~~en.wikipedia~~.org/~~wiki~~/~~IP_address#IPv4_private_addresses Wikipedia~~]		It is recommended you have a publicly routable static IP address in order for this to work. This means that your IP address cannot be a bogon IP address ([https://team-cymru.org/Services/Bogons/fullbogons-ipv4.txt list IPv4], [https://team-cymru.org/Services/Bogons/fullbogons-ipv6.txt list IPv6]).

	If your Internet-connected machine doesn't have a static IP address, [https://www.noip.com/ No-ip] can be used for resolving DNS names to IP addresses.		If your Internet-connected machine doesn't have a static IP address, [https://www.noip.com/ No-ip] can be used for resolving DNS names to IP addresses.

Zcrayfish: /* Certificates */ Wikilink cleanup.

2023-07-29T06:19:47Z

Certificates: Wikilink cleanup.

← Older revision		Revision as of 06:19, 29 July 2023
Line 28:		Line 28:

	= Certificates =		= Certificates =
	One of the first things that needs to be done is to make sure you have secure keys to work with. Alpine makes this easy by having a web interface to manage the certificates. Documentation for it can be found here: [[~~Generating_SSL_certs_with_ACF~~]]. It is a best practice not to have your certificate server be on the same machine as the router being used for remote connectivity.		One of the first things that needs to be done is to make sure you have secure keys to work with. Alpine makes this easy by having a web interface to manage the certificates. Documentation for it can be found here: [[Generating SSL certs with ACF]]. It is a best practice not to have your certificate server be on the same machine as the router being used for remote connectivity.

	You will need to create a server (ssl_server_cert) certificate for the server and one client certificate (ssl_client_cert) for each client. To use the certificates, you should download the .pfx file and extract it.		You will need to create a server (ssl_server_cert) certificate for the server and one client certificate (ssl_client_cert) for each client. To use the certificates, you should download the .pfx file and extract it.
Line 46:		Line 46:
	On the VPN server, you can also install the '''acf-openvpn''' package, which contains a web page to automatically upload and extract the server certificate. There is also a button to automatically generate the Diffie-Hellman parameters.		On the VPN server, you can also install the '''acf-openvpn''' package, which contains a web page to automatically upload and extract the server certificate. There is also a button to automatically generate the Diffie-Hellman parameters.

	If you would prefer to generate your certificates using OpenVPN utilities, see [[#~~Alternative~~ Certificate Method]]		If you would prefer to generate your certificates using OpenVPN utilities, see [[#Alternate Certificate Method]]

	= Configure OpenVPN server =		= Configure OpenVPN server =

Zcrayfish: /* Initial Set up */ Updated wikilink.

2023-07-29T06:18:34Z

Initial Set up: Updated wikilink.

← Older revision		Revision as of 06:18, 29 July 2023
Line 9:		Line 9:
	= Set up Alpine =		= Set up Alpine =
	== Initial Set up ==		== Initial Set up ==
	Follow [[~~Installing_Alpine~~]] to set up Alpine Linux.		Follow [[Installation]] to set up Alpine Linux.

	== Install programs ==		== Install programs ==

Zcrayfish: URL cleanup

2023-07-29T06:17:36Z

URL cleanup

← Older revision		Revision as of 06:17, 29 July 2023
Line 3:		Line 3:
	This article describes how to set up an OpenVPN server with the Alpine Linux.		This article describes how to set up an OpenVPN server with the Alpine Linux.
	This is an ideal solution for allowing single users or devices to remotely connect to your network. \\		This is an ideal solution for allowing single users or devices to remotely connect to your network. \\
	It is recommended you have a publicly routable static IP address in order for this to work. This means that your IP address cannot be in the private IP address ranges described here: [~~http~~://en.wikipedia.org/wiki/IP_address#IPv4_private_addresses ~~WikiPedia~~]		It is recommended you have a publicly routable static IP address in order for this to work. This means that your IP address cannot be in the private IP address ranges described here: [https://en.wikipedia.org/wiki/IP_address#IPv4_private_addresses Wikipedia]

	If your Internet-connected machine doesn't have a static IP address, [~~http~~://www.~~dyndns~~.com ~~DynDNS~~] can be used for resolving DNS names to IP addresses.		If your Internet-connected machine doesn't have a static IP address, [https://www.noip.com/ No-ip] can be used for resolving DNS names to IP addresses.

	= Set up Alpine =		= Set up Alpine =
Line 72:		Line 72:
	verb 3		verb 3

	(''Instructions are based on [~~http~~://openvpn.net/~~howto.html~~#server openvpn.net/howto.html#server]'')		(''Instructions are based on [https://openvpn.net/community-resources/how-to/#server openvpn.net/howto.html#server]'')

	== Test your configuration ==		== Test your configuration ==
Line 96:		Line 96:
	verb 3		verb 3

	(''Instructions are based on [~~http~~://openvpn.net/~~howto.html~~#client openvpn.net/howto.html#client]'')		(''Instructions are based on [https://openvpn.net/community-resources/how-to/#client openvpn.net/howto.html#client]'')

	= Save settings =		= Save settings =
Line 116:		Line 116:
	= Alternate Certificate Method =		= Alternate Certificate Method =
	== Manual Certificate Commands ==		== Manual Certificate Commands ==
	(''Instructions are based on [~~http~~://openvpn.net/~~howto.html~~#pki openvpn.net/howto.html#pki]'')		(''Instructions are based on [https://openvpn.net/community-resources/how-to/#pki openvpn.net/howto.html#pki]'')

	=== Initial setup for administrating certificates ===		=== Initial setup for administrating certificates ===

Zcrayfish: Removed reference to deleted article.

2023-07-29T06:13:18Z

Removed reference to deleted article.

← Older revision		Revision as of 06:13, 29 July 2023
Line 2:		Line 2:

	This article describes how to set up an OpenVPN server with the Alpine Linux.		This article describes how to set up an OpenVPN server with the Alpine Linux.
	This is an ideal solution for allowing single users or devices to remotely connect to your network. ~~To establish connectivity with a Remote Office or site, [http://wiki.alpinelinux.org/w/index.php?title=Using_Racoon_for_Remote_Sites Racoon/Opennhrp] would provide better functionality.~~		This is an ideal solution for allowing single users or devices to remotely connect to your network. \\

	It is recommended you have a publicly routable static IP address in order for this to work. This means that your IP address cannot be in the private IP address ranges described here: [http://en.wikipedia.org/wiki/IP_address#IPv4_private_addresses WikiPedia]		It is recommended you have a publicly routable static IP address in order for this to work. This means that your IP address cannot be in the private IP address ranges described here: [http://en.wikipedia.org/wiki/IP_address#IPv4_private_addresses WikiPedia]

Ckujau: use {{cmd}} template

2022-05-29T10:33:36Z

use {{cmd}} template

← Older revision		Revision as of 10:33, 29 May 2022
Line 25:		Line 25:
	Enable IP Forwarding		Enable IP Forwarding

	''echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.d/ipv4.conf''		{{Cmd\|echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.d/ipv4.conf}}

	{{Cmd\|sysctl -p /etc/sysctl.d/ipv4.conf}}		{{Cmd\|sysctl -p /etc/sysctl.d/ipv4.conf}}

Bt129: /* Alternative Certificate Method */

2021-07-25T09:53:59Z

Alternative Certificate Method

← Older revision		Revision as of 09:53, 25 July 2021
Line 116:		Line 116:
	{{Cmd\|rc-update add openvpn.AlphaBravo}}		{{Cmd\|rc-update add openvpn.AlphaBravo}}

	= ~~Alternative~~ Certificate Method =		= Alternate Certificate Method =
	== Manual Certificate Commands ==		== Manual Certificate Commands ==
	(''Instructions are based on [http://openvpn.net/howto.html#pki openvpn.net/howto.html#pki]'')		(''Instructions are based on [http://openvpn.net/howto.html#pki openvpn.net/howto.html#pki]'')

Bt129 at 09:53, 25 July 2021

2021-07-25T09:53:18Z

← Older revision		Revision as of 09:53, 25 July 2021
Line 4:		Line 4:
	This is an ideal solution for allowing single users or devices to remotely connect to your network. To establish connectivity with a Remote Office or site, [http://wiki.alpinelinux.org/w/index.php?title=Using_Racoon_for_Remote_Sites Racoon/Opennhrp] would provide better functionality.		This is an ideal solution for allowing single users or devices to remotely connect to your network. To establish connectivity with a Remote Office or site, [http://wiki.alpinelinux.org/w/index.php?title=Using_Racoon_for_Remote_Sites Racoon/Opennhrp] would provide better functionality.

	It is recommended ~~that~~ you have a publicly routable static IP address in order for this to work. This means that your IP address cannot be in the private IP address ranges described here: [http://en.wikipedia.org/wiki/IP_address#IPv4_private_addresses WikiPedia]		It is recommended you have a publicly routable static IP address in order for this to work. This means that your IP address cannot be in the private IP address ranges described here: [http://en.wikipedia.org/wiki/IP_address#IPv4_private_addresses WikiPedia]

	If your Internet-connected machine doesn't have a static IP address, [http://www.dyndns.com DynDNS] can be used for resolving DNS names to IP addresses.		If your Internet-connected machine doesn't have a static IP address, [http://www.dyndns.com DynDNS] can be used for resolving DNS names to IP addresses.

	= ~~Setup~~ Alpine =		= Set up Alpine =
	== Initial ~~Setup~~ ==		== Initial Set up ==
	Follow [[Installing_Alpine]] to ~~setup~~ Alpine Linux.		Follow [[Installing_Alpine]] to set up Alpine Linux.

	== Install programs ==		== Install programs ==
Line 30:		Line 30:

	= Certificates =		= Certificates =
	One of the first things that needs to be done is to make sure ~~that~~ you have secure keys to work with. Alpine makes this easy by having a web interface to manage the certificates. Documentation for it can be found here: [[Generating_SSL_certs_with_ACF]]. It is a best practice not to have your certificate server be on the same machine as the router being used for remote connectivity.		One of the first things that needs to be done is to make sure you have secure keys to work with. Alpine makes this easy by having a web interface to manage the certificates. Documentation for it can be found here: [[Generating_SSL_certs_with_ACF]]. It is a best practice not to have your certificate server be on the same machine as the router being used for remote connectivity.

	You will need to create a server (ssl_server_cert) certificate for the server and one client (ssl_client_cert) for each client. To use the certificates, you should download the .pfx file and extract it.		You will need to create a server (ssl_server_cert) certificate for the server and one client certificate (ssl_client_cert) for each client. To use the certificates, you should download the .pfx file and extract it.

	To extract the three parts of each .pfx file, use the following commands:		To extract the three parts of each .pfx file, use the following commands:

	To get the ca cert out~~...~~		To get the ca cert out:
	{{Cmd\|openssl pkcs12 -in PFXFILE -cacerts -nokeys -out ca.pem}}		{{Cmd\|openssl pkcs12 -in PFXFILE -cacerts -nokeys -out ca.pem}}

	To get the cert file out~~...~~		To get the cert file out:
	{{Cmd\|openssl pkcs12 -in PFXFILE -nokeys -clcerts -out cert.pem}}		{{Cmd\|openssl pkcs12 -in PFXFILE -nokeys -clcerts -out cert.pem}}

	To get the private key file out. Make sure ~~this~~ stays private.		To get the private key file out: (Make sure the key stays private)

	{{Cmd\|openssl pkcs12 -in PFXFILE -nocerts -nodes -out key.pem}}		{{Cmd\|openssl pkcs12 -in PFXFILE -nocerts -nodes -out key.pem}}

	On the VPN server, you can also install the '''acf-openvpn''' package, which contains a web page to automatically upload and extract the server certificate. There is also a button to automatically generate the Diffie Hellman parameters.		On the VPN server, you can also install the '''acf-openvpn''' package, which contains a web page to automatically upload and extract the server certificate. There is also a button to automatically generate the Diffie-Hellman parameters.

	If you would prefer to generate your certificates using OpenVPN utilities, see [[#Alternative Certificate Method]]		If you would prefer to generate your certificates using OpenVPN utilities, see [[#Alternative Certificate Method]]
Line 89:		Line 89:
	resolv-retry infinite		resolv-retry infinite
	nobind		nobind
	ns-cert-type server # This means ~~that~~ the certificate on the openvpn server needs to have this field. Prevents MitM attacks		ns-cert-type server # This means the certificate on the openvpn server needs to have this field. Prevents MitM attacks
	persist-key		persist-key
	persist-tun		persist-tun
Line 106:		Line 106:
	= More than one server or client =		= More than one server or client =

	If you want more than one server or client running on the same ~~alpine~~ box, use the standard [[Multiple Instances of Services]] process.		If you want more than one server or client running on the same Alpine box, use the standard [[Multiple Instances of Services]] process.

	For example, to create a config named "AlphaBravo":		For example, to create a config named "AlphaBravo":
Line 121:		Line 121:

	=== Initial setup for administrating certificates ===		=== Initial setup for administrating certificates ===
	The following instructions assume ~~that~~ you want to save your configs, certs and keys in '''/etc/openvpn/keys'''.<BR>		The following instructions assume you want to save your configs, certs and keys in '''/etc/openvpn/keys'''.<BR>
	Start by moving to the '''/usr/share/openvpn/easy-rsa''' folder to execute commands		Start by moving to the '''/usr/share/openvpn/easy-rsa''' folder to execute commands
	{{Cmd\|apk add easy-rsa # from the community repo		{{Cmd\|apk add easy-rsa # from the community repo
	cd /usr/share/easy-rsa}}		cd /usr/share/easy-rsa}}
	If not already done ~~then~~ create a folder where you will save your certificates and save a copy of your '''/usr/share/easy-rsa/vars''' for later use.<BR>		If not already done, create a folder where you will save your certificates and save a copy of your '''/usr/share/easy-rsa/vars''' for later use.<BR>
	{{Cmd\|mkdir /etc/openvpn/keys		{{Cmd\|mkdir /etc/openvpn/keys
	cp ./vars.example ./vars #easy-rsa v3		cp ./vars.example ./vars #easy-rsa v3
Line 134:		Line 134:
	The instructions below are for EasyRSA v2:		The instructions below are for EasyRSA v2:

	If not already done ~~then~~ edit '''/etc/openvpn/keys/vars'''<BR>		If not already done, edit '''/etc/openvpn/keys/vars'''<BR>
	(''This file is used for defining paths and other standard settings'')		(''This file is used for defining paths and other standard settings'')
	{{Cmd\|vim /etc/openvpn/keys/vars}}		{{Cmd\|vim /etc/openvpn/keys/vars}}
Line 149:		Line 149:
	{{Cmd\|./clean-all}}		{{Cmd\|./clean-all}}

	Generate Diffie Hellman parameters		Generate Diffie-Hellman parameters

	{{Cmd\|./build-dh}}		{{Cmd\|./build-dh}}

	~~Now lets~~ make the CA certificates and keys		To make the CA certificates and keys

	{{Cmd\|./build-ca}}		{{Cmd\|./build-ca}}

	=== Set up a 'OpenVPN Server' ===		=== Set up an 'OpenVPN Server' ===
	Create server certificates		Create server certificates

	{{Cmd\|./build-key-server <commonname>}}		{{Cmd\|./build-key-server <commonname>}}

	=== Set up a 'OpenVPN Client' ===		=== Set up an 'OpenVPN Client' ===
	Create client certificates		Create client certificates
	{{Cmd\|./build-key <commonname>}}		{{Cmd\|./build-key <commonname>}}
Line 190:		Line 190:
	</pre>		</pre>

	In the guest <pre>		On the guest <pre>
	apk add openvpn		apk add openvpn
	</pre> Then config as usual...		</pre> Then config as usual.

	This should work both as server and as client.		This should work both as server and as client.

	== persistent devices ==		== persistent devices ==
	lxc guest have their dev recreated on each restart in a tmpfs. This means all devices are reset and are not read from rootfs dev directory.		lxc guest have their dev recreated on each restart in a tmpfs. This means all devices are reset and are not read from the rootfs dev directory.
	To make it persistent you can use an autodev script by adding the following to your lxc guest config		To make it persistent you can use an autodev script by adding the following to your lxc guest config:

	<pre>		<pre>
Line 207:		Line 207:
	</pre>		</pre>

	The autodev script ~~would be as following~~:		The autodev script:

	<pre>		<pre>

Leo at 11:10, 12 February 2020

2020-02-12T11:10:39Z

← Older revision		Revision as of 11:10, 12 February 2020
Line 25:		Line 25:
	Enable IP Forwarding		Enable IP Forwarding

	~~{{Cmd\|~~echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.d/ipv4.conf		''echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.d/ipv4.conf''
	sysctl -p /etc/sysctl.d/ipv4.conf}}
			{{Cmd\|sysctl -p /etc/sysctl.d/ipv4.conf}}

	= Certificates =		= Certificates =