Title: Configure OpenVPN
Course: CIS 208: Linux/UNIX III: Intermediate System Administration, Networking, and Security ~ For IGNITE Review > Section: Learning Modules

Configure OpenVPN

A Virtual Private Network (VPN) provides remote access to a protected network over untrusted networks.  OpenVPN is a stable open source VPN product which works well with both Linux and Windows.  We will look at setting up OpenVPN on a Linux jumpbox and configuring a single Linux client.  There are instructions for more complex installations at https://openvpn.net/index.php/open-source/documentation.html.

To install OpenVPN, start by ensuring that the EPEL repository is installed and enabled.  See https://fedoraproject.org/wiki/EPEL if needed.  On the server and the client, run "yum install openvpn".

On the server:

1. Create the file /etc/openvpn/vpn.conf, and paste in these contents.

ifconfig 192.168.254.1 192.168.254.2

route 172.18.1.0 255.255.255.0
dev tun
secret vpn.key
port 1194
proto udp
comp-lzo
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
user nobody
group nobody
daemon

1. Select a unique network if you want to replace the ifconfig addresses.
2. Also update the route to be the local subnet if it is not 172.18.1.0/24.
3. Next create the secret key and start the service.

openvpn -genkey -secret /etc/openvpn/vpn.key
service openvpn start
chkconfig openvpn on

1. On the client, create the file /etc/openvpn/vpn.conf and paste in these contents.

server jumpbox.domain.tld
ifconfig 192.168.254.2 192.168.254.1
dev tun
secret vpn. key
port 1194
proto udp
comp-lzo
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
user nobody
group nobody
daemon

1. Update the hostname of the server and the ifconfig addresses.
2. Next, copy the secret key and start the service.

scp user@jumpbox.domain.tld:/etc/openvpn/vpn.key /etc/openvpn
service openvpn start

The openvpn service can then be started any time that a VPN connection is required.  Notice that you may want to update your nameservers in /etc/resolv.conf while you are connected if you have issues resolving hostnames.