Setting up a OpenVPN server: Difference between revisions

From Alpine Linux
No edit summary
(Tried to clarify cert handling)
Line 24: Line 24:
One of the first things that needs to be done is to make sure that you have secure keys to work with. Alpine makes this easy by having a web interface to manage the certificates. Documentation for it can be found here: [[Generating_SSL_certs_with_ACF]]. It is a best practice not to have your certificate server be on the same machine as the router being used for remote connectivity.
One of the first things that needs to be done is to make sure that you have secure keys to work with. Alpine makes this easy by having a web interface to manage the certificates. Documentation for it can be found here: [[Generating_SSL_certs_with_ACF]]. It is a best practice not to have your certificate server be on the same machine as the router being used for remote connectivity.


If you are setting up a client and need to figure out how to divide the cert (they gave you a .pfx file) use the following commands:
You will need to create a server (ssl_server_cert) certificate for the server and one client (ssl_client_cert) for each client. To use the certificates, you should download the .pfx file and extract it.
 
To extract the three parts of each .pfx file, use the following commands:
   
   
To get the ca cert out...
To get the ca cert out...
Line 32: Line 34:
  openssl pkcs12 -in PFXFILE -nokeys -clcerts -out cert.pem
  openssl pkcs12 -in PFXFILE -nokeys -clcerts -out cert.pem


To get the private key file out. May sure this stays private...
To get the private key file out. Make sure this stays private...
  openssl pkcs12 -in PFXFILE -nocerts -nodes -out key.pem
  openssl pkcs12 -in PFXFILE -nocerts -nodes -out key.pem
On the VPN server, you can also install the '''acf-openvpn''' package, which contains a web page to automatically upload and extract the server certificate. There is also a button to automatically generate the Diffie Hellman parameters.


If you would prefer to generate your certificates using OpenVPN utilities, see [[#Alternative Certificate Method]]
If you would prefer to generate your certificates using OpenVPN utilities, see [[#Alternative Certificate Method]]


= Configure OpenVPN-server =
= Configure OpenVPN-server =
Example configuration file for server:
Example configuration file for server. Place the following content in /etc/openvpn/openvpn.conf:
  local "Public Ip address"
  local "Public Ip address"
  port 1194
  port 1194
  proto udp
  proto udp
  dev tun
  dev tun
  ca ca.crt
  ca openvpn_certs/server-ca.pem
  cert server.crt
  cert openvpn_certs/server-cert.pem
  dh dh1024.pem #to generate by hand #openssl dhparam -out dh1024.pem 1024
  dh openvpn_certs/dh1024.pem #to generate by hand #openssl dhparam -out dh1024.pem 1024
  server 10.0.0.0 255.255.255.0
  server 10.0.0.0 255.255.255.0
  ifconfig-pool-persist ipp.txt
  ifconfig-pool-persist ipp.txt
Line 59: Line 63:
  log-append  /var/log/openvpn.log
  log-append  /var/log/openvpn.log
  verb 3
  verb 3
> These cert files don't match those listed above


(''Instructions are based on [http://openvpn.net/howto.html#server openvpn.net/howto.html#server]'')
(''Instructions are based on [http://openvpn.net/howto.html#server openvpn.net/howto.html#server]'')
Line 78: Line 81:
  persist-key
  persist-key
  persist-tun
  persist-tun
  ca ca.crt
  ca client-ca.pem
  cert client.crt
  cert client-cert.pem
  key client.key
  key client-key.pem
  comp-lzo
  comp-lzo
  verb 3
  verb 3
> These cert files don't match those listed above


(''Instructions are based on [http://openvpn.net/howto.html#client openvpn.net/howto.html#client]'')
(''Instructions are based on [http://openvpn.net/howto.html#client openvpn.net/howto.html#client]'')


= Save settings =
= Save settings =
Don't forget to save all your settings
Don't forget to save all your settings if you are running a RAM-based system.
  lbu commit
  lbu commit



Revision as of 13:57, 9 November 2010


This article describes how to set up an OpenVPN server with the Alpine distro. This is an ideal solution for allowing single users or devices to remotely connect to your network. To establish connectivity with a Remote Office or site, Racoon/Opennhrp would provide better functionality.

It is recommended that you have a publicly routable static IP address in order for this to work. This means that your IP address cannot be in the private IP address ranges described here: WikiPedia

If your Internet-connected machine doesn't have a static IP address, DynDNS can be used for resolving DNS names to IP addresses.

Setup Alpine

Initial Setup

Follow Installing_Alpine to setup Alpine Linux.

Install programs

Install openvpn

apk_add openvpn

Prepare autostart of OpenVPN

rc_add -s 40 -k openvpn            # for alpine 1.8
rc-update add openvpn              # for alpine 1.9
modprobe tun
echo "tun" >>/etc/modules

Certificates

One of the first things that needs to be done is to make sure that you have secure keys to work with. Alpine makes this easy by having a web interface to manage the certificates. Documentation for it can be found here: Generating_SSL_certs_with_ACF. It is a best practice not to have your certificate server be on the same machine as the router being used for remote connectivity.

You will need to create a server (ssl_server_cert) certificate for the server and one client (ssl_client_cert) for each client. To use the certificates, you should download the .pfx file and extract it.

To extract the three parts of each .pfx file, use the following commands:

To get the ca cert out...

openssl pkcs12 -in PFXFILE -cacerts -nokeys -out ca.pem

To get the cert file out...

openssl pkcs12 -in PFXFILE -nokeys -clcerts -out cert.pem

To get the private key file out. Make sure this stays private...

openssl pkcs12 -in PFXFILE -nocerts -nodes -out key.pem

On the VPN server, you can also install the acf-openvpn package, which contains a web page to automatically upload and extract the server certificate. There is also a button to automatically generate the Diffie Hellman parameters.

If you would prefer to generate your certificates using OpenVPN utilities, see #Alternative Certificate Method

Configure OpenVPN-server

Example configuration file for server. Place the following content in /etc/openvpn/openvpn.conf:

local "Public Ip address"
port 1194
proto udp
dev tun
ca openvpn_certs/server-ca.pem
cert openvpn_certs/server-cert.pem
dh openvpn_certs/dh1024.pem #to generate by hand #openssl dhparam -out dh1024.pem 1024
server 10.0.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 10.0.0.0 255.0.0.0"
push "dhcp-option DNS 10.0.0.1"
keepalive 10 120
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status /var/log/openvpn-status.log
log-append  /var/log/openvpn.log
verb 3

(Instructions are based on openvpn.net/howto.html#server)

Test your configuration

Test configuration and certificates

 openvpn --config /etc/openvpn/openvpn.conf

Configure OpenVPN-client

Example client.conf:

client
dev tun
proto udp
remote "public IP" 1194
resolv-retry infinite
nobind
ns-cert-type server # This means that the certificate on the openvpn server needs to have this field. Prevents MitM attacks
persist-key
persist-tun
ca client-ca.pem
cert client-cert.pem
key client-key.pem
comp-lzo
verb 3

(Instructions are based on openvpn.net/howto.html#client)

Save settings

Don't forget to save all your settings if you are running a RAM-based system.

lbu commit

Alternative Certificate Method

Manual Certificate Commands

(Instructions are based on openvpn.net/howto.html#pki)

Initial setup for administrating certificates

The following instructions assume that you want to save your configs, certs and keys in /etc/openvpn/keys.
Start by moving to the /usr/share/openvpn/easy-rsa folder to execute commands

cd /usr/share/openvpn/easy-rsa

If not already done then create a folder where you will save your certificates and save a copy of your /usr/share/openvpn/easy-rsa/vars for later use.
(All files in /usr/share/openvpn/easy-rsa are overwritten when the computer is restarted)

mkdir /etc/openvpn/keys
cp ./vars /etc/openvpn/keys

If not already done then edit /etc/openvpn/keys/vars
(This file is used for defining paths and other standard settings)

vim /etc/openvpn/keys/vars
* Change KEY_DIR= from "$EASY_RSA/keys" to "/etc/openvpn/keys"
* Change KEY_SIZE, CA_EXPIRE, KEY_EXPIRE, KEY_COUNTRY, KEY_PROVINCE, KEY_CITY, KEY_ORG, KEY_EMAIL to match your system.

source the vars to set properties

source /etc/openvpn/keys/vars

Set up a 'Certificate Authority' (CA)

Clean up the keys folder.

./clean-all

Generate Diffie Hellman parameters

./build-dh

Now lets make the CA certificates and keys

./build-ca

Set up a 'OpenVPN Server'

Create server certificates

./build-key-server {commonname}

Set up a 'OpenVPN Client'

Create client certificates

./build-key {commonname}

Revoke a certificate

To revoke a certificate...

./revoke-full {commonname}

The revoke-full script will generate a CRL (certificate revocation list) file called crl.pem in the keys subdirectory.
The file should be copied to a directory where the OpenVPN server can access it, then CRL verification should be enabled in the server configuration:
crl-verify crl.pem