From ec2aa74d36670d74c153aa0022ab22e79502a061 Mon Sep 17 00:00:00 2001 From: David Luevano Alvarado Date: Tue, 2 May 2023 01:33:25 -0600 Subject: update to new version of pyssg --- live/blog/a/vpn_server_with_openvpn.html | 25 ++++++++++++------------- 1 file changed, 12 insertions(+), 13 deletions(-) (limited to 'live/blog/a/vpn_server_with_openvpn.html') diff --git a/live/blog/a/vpn_server_with_openvpn.html b/live/blog/a/vpn_server_with_openvpn.html index 205caec..de80c45 100644 --- a/live/blog/a/vpn_server_with_openvpn.html +++ b/live/blog/a/vpn_server_with_openvpn.html @@ -3,27 +3,26 @@ " prefix="og: https://ogp.me/ns#"> - - + Create a VPN server with OpenVPN (IPv4) -- Luevano's Blog - - - + + + - - + + - + - + @@ -79,13 +78,13 @@

I’ve been wanting to do this entry, but had no time to do it since I also have to set up the VPN service as well to make sure what I’m writing makes sense, today is the day.

Like with any other of my entries I based my setup on the Arch Wiki, this install script and this profile generator script.

This will be installed and working alongside the other stuff I’ve wrote about on other posts (see the server tag). All commands here are executes as root unless specified otherwise. Also, this is intended only for IPv4 (it’s not that hard to include IPv6, but meh).

-

Prerequisites

+

Prerequisites

Pretty simple:

-

Create PKI from scratch

+

Create PKI from scratch

PKI stands for Public Key Infrastructure and basically it’s required for certificates, private keys and more. This is supposed to work between two servers and one client: a server in charge of creating, signing and verifying the certificates, a server with the OpenVPN service running and the client making the request.

This is supposed to work something like: 1) a client wants to use the VPN service, so it creates a requests and sends it to the signing server, 2) this server checks the requests and signs the request, returning the certificates to both the VPN service and the client and 3) the client can now connect to the VPN service using the signed certificate which the OpenVPN server knows about. In a nutshell, I’m no expert.

… but, to be honest, all of this is a hassle and (in my case) I want something simple to use and manage. So I’m gonna do all on one server and then just give away the configuration file for the clients, effectively generating files that anyone can run and will work, meaning that you need to be careful who you give this files (it also comes with a revoking mechanism, so no worries).

@@ -129,7 +128,7 @@ openssl dhparam -out dh.pem 2048 openvpn --genkey secret ta.key

That’s it for the PKI stuff and general certificate configuration.

-

OpenVPN

+

OpenVPN

OpenVPN is a robust and highly flexible VPN daemon, that’s pretty complete feature wise.

Install the openvpn package:

pacman -S openvpn
@@ -277,7 +276,7 @@ ufw reload
 systemctl enable openvpn-server@server.service

Where the server after @ is the name of your configuration, server.conf without the .conf in my case.

-

Create client configurations

+

Create client configurations

You might notice that I didn’t specify how to actually connect to our server. For that we need to do a few more steps. We actually need a configuration file similar to the server.conf file that we created.

The real way of doing this would be to run similar steps as the ones with easy-rsa locally, send them to the server, sign them, and retrieve them. Nah, we’ll just create all configuration files on the server as I was mentioning earlier.

Also, the client configuration file has to match the server one (to some degree), to make this easier you can create a client-common file in /etc/openvpn/server with the following content:

-- cgit v1.2.3-70-g09d2