• You have setup your server according to the setup guide
• This server is groundbreaking new with no software installed
• You are logged in as a non-privileged user with sudo privileges

Our initial design will consist of two different servers — we will call them ServerA and ServerB. The IP addresses for each server are defined not more than:
(Note that we are by the internal interface only)

The plot is to make a top-to-top VPN between ServerA and ServerB so they can communicate on their own private network. The following processes will walk you through making three different types of VPN relations:

• Simple VPN (no security or encryption)
• Static Key VPN (austerely 128-bit security)
• Full TLS VPN (rotating-key encryption)

We will build each type of VPN tunnel and then build on the one previously. For instance, if you would like a full TLS-enabled VPN delight run through all of the examples shown not more than.
The first VPN link that we will make is a simple top-to-top link with no encryption or security. This will literally form a virtual link between two servers for communication. This is the simplest form of VPN communication and is generally not recommended. The process will be the same for each server with server point changes being noted.

Update Your System

First we need to make sure that our system is up to date. Run the following command to update your system:

# sudo yum -u update

Add the DAG repository

By defaulting OpenVPN does not come as a pre-compiled binary; but, there are places where people have pre-compiled it for us. We will use the DAG repository which houses one of those pre-compiled versions but first we need to tell our server where it is located.
Let’s add the repository by adding an entry into YUM, the defaulting package administrator for CentOS.

# sudo nano -w /etc/yum.repos.d/dag.repo

You will need to add the following lines into this file.

[dag]
name=Dag RPM Repository for Red Hat endeavor Linux
baseurl=http://apt.sw.be/redhat/el$releasever/en/$basearch/dag
gpgcheck=1
enabled=1

Once you have pasted the lines press CTRL-X on your keyboard to exit the attention. You will be questioned if you want to save the file, austerely press Y and then press Enter to accept the defaulting file name. The program will now exit.
Next we need to add the GPG key that signs each of the packages in the DAG repository but first we need to download it.

# wget http://dag.wieers.com/packages/RPM-GPG-KEY.dag.txt

In this file there are a few lines that need to be removed before we can import it otherwise an error will result. Type the following line to open the editor.

# nano RPM-GPG-KEY.dag.txt

In this screen you will see several lines and a bunch of random letters and numbers. Delete the following lines:

The following public key can be used to verify RPM packages
downloaded from  http://dag.wieers.com/apt/  by 'rpm -K'
if you have the GNU GPG package.
Questions about this key should be sent to:
Dag Wieers @wieers.com>

Once you have those lines deleted austerely press CTRL-X to exit the program. It will prompt you to save the file, press Y and Enter.
Now we need to import the GPG key that we just modified otherwise the installation will fail. Type the following command:

# sudo rpm --import RPM-GPG-KEY.dag.txt

Install OpenVPN

We are now ready to install OpenVPN on our server. Type the following command to install OpenVPN:

# sudo yum -y install openvpn

Remove DAG repository

Now that we have added our software we need to remove the DAG repository to protect the integrity of your updates. Run the following command not more than:

# sudo rm /etc/yum.repos.d/dag.repo

Make Client Server

At this top delight proceed with performing the above actions on your second server. In our example we will perform the above actions on ServerB.

Make VPN Link

Now we are ready to make our VPN link between ServerA and ServerB.

ServerA Orders

To make the link on ServerA run the following command:

# sudo /usr/sbin/openvpn --remote 10.100.1.50 --dev tun1 --ifconfig 172.16.1.1 172.16.1.2

This command will make a VPN link with ServerB (10.100.1.50). It will also prepare a virtual interface called tun1 and will assign the IP 172.16.1.1 to it. The associated routes for this will be made as well.

ServerB Orders

To make the link on ServerB run the following command:

# sudo /usr/sbin/openvpn --remote 10.100.1.20 --dev tun1 --ifconfig 172.16.1.2 172.16.1.1

This command will make a VPN link with ServerA (10.100.1.20). It will also prepare a virtual interface called tun1 and will assign the IP 172.16.1.2 to it. The associated routes for this will be made as well.

Test VPN Link

Once you have executed the orders above on each server then the VPN link will be setup. Keep in mind that this is a clear text link and all traffic can be seen. You will see the following warning as the VPN link is established:

******* WARNING *******: all encryption and certification features
disabled -- all data will be tunnelled as cleartext

If the link has been established successfully you will see the following on each server:

Wed Aug  5 16:59:59 2009 Peer Connection Initiated with 10.100.1.50:1194
Wed Aug  5 17:00:01 2009 Initialization Sequence Completed

Note that the IP will vary depending on your setup
Open up two more relations to your servers via SSH and perform a ping test from each. In our test environment we will perform a test on ServerA and we will ping ServerB but we will use the VPN tunnel instead. To force traffic over the VPN tunnel austerely ping the VPN IP for ServerB which is 172.16.1.2.

# ping 172.16.1.2
PING 172.16.1.2 (172.16.1.2) 56(84) bytes of data.
64 bytes from 172.16.1.2: icmp_seq=1 ttl=64 time=4.00 ms
64 bytes from 172.16.1.2: icmp_seq=2 ttl=64 time=0.000 ms
64 bytes from 172.16.1.2: icmp_seq=3 ttl=64 time=0.000 ms

Do the same thing on ServerB. You should see similar consequences. If you see Request Timed Out then your VPN link force not be established. Delight check your IP addresses and attempt to set up the link again.
To end your hard and close the link austerely press Control-C on each server to close the VPN link.
Now that we have an established VPN link it is time to secure it a small bit. In this step we will make a 128-bit security key that will be stored on each server and used to encrypt our traffic over the VPN tunnel.

Making the Key

Making the VPN key is surprisingly simple. You will need to make the key on one server and then copy it to the other server. In our example we will use ServerA to make the key and use SCP to copy it to ServerB.
For this part of the setup we will need to exchange to super user mode. Type the following command:

# su

Enter your root password when prompted.
Now we need to go to the directory where we will store our static key.

# cd /usr/share/doc/openvpn-2.0.9/

Once there we will need to produce our static key. To produce it type the command not more than to make a static key file called key.

# openvpn --genkey --secret key

If you perform a directory listing (ls) you will see a file called key in the directory. We will use this when starting our VPN connection.
For now we will wait as the super user for the remainder of this article.

Copy the Key

We need to copy our static key over to ServerB so they are by the same credentials. If you do not perform this step then your VPN link will fail to set up. To copy the key we will use the SCP (Secure Copy) command to copy the file over SSH. Run the following command not more than to copy the key file over. Note that you will need to exchange the IP address in the example not more than to match your second server.

# scp key root@10.100.1.20:/usr/share/doc/openvpn-2.0.9/

The first prompt you will receive is asking you to accept the SSH fingerprint key… austerely type yes and press Enter. You will then be prompted for your root password — enter it here.
If the copy was successful you should see something like this:

key                                           100%  636     0.6KB/s   00:00

Making the VPN link

Now that we have our key made the key and hackneyed it to ServerB it is time to setup our link again. Type the command not more than to setup the VPN link. Be sure to note that the command is the same for each server but the key is appended to the command. Note that since we are by super user mode some directives will be different.

ServerA Orders

To make the link on ServerA run the following command:

# /usr/sbin/openvpn --remote 10.100.1.50 --dev tun1 --ifconfig 172.16.1.1 172.16.1.2 --secret key

This command will make a VPN link with ServerB (10.100.1.50). It will also prepare a virtual interface called tun1 and will assign the IP 172.16.1.1 to it. The associated routes for this will be made as well.

ServerB Orders

Before we can enter the command we will need to go to the right directory and enter super user mode as well as make the link. Run the following orders:

# su
# cd /usr/share/doc/openvpn-2.0.9
# /usr/sbin/openvpn --remote 10.100.1.20 --dev tun1 --ifconfig 172.16.1.2 172.16.1.1 --secret key

This command will make a VPN link with ServerA (10.100.1.20). It will also prepare a virtual interface called tun1 and will assign the IP 172.16.1.2 to it. The associated routes for this will be made as well.

Test the VPN link

As with the previous setup go ahead and test the link by pinging each side of your VPN tunnel.
Now that we have a functioning VPN connection and have proved that we can use 128-bit static keys it is now time to beef up our security a bit. The following steps will walk you through setting up TLS-based security with regenerative security on timed intervals. This process will involved making server and client certificates along with a certificate power to authenticate those certificates.
We will go ahead and tear down the existing VPN tunnel that we setup by pressing Control-C on each server. You should be returned back to the command prompt. You’ll notice that we are still logged in as the super user — this is okay.

Simple-RSA

To make our keys and certificates we will use three programs (build-ca, build-key, and build-key-server) that ship with OpenVPN. Follow the steps not more than to make the necessary items.

Setup

First we need to perform some additional setup functions for Simple-RSA on ServerA. The first thing we need to do is make sure that we are in the right directory:

# cd /etc/openvpn

You’ll notice that there is nothing in this directory if you ‘ls’ it. To prepare all of the files run the following orders not more than:

# mkdir simple-rsa
# cp -R /usr/share/doc/openvpn-2.0.9/simple-rsa/2.0/* simple-rsa/
# chmod -R 777 simple-rsa/
# cd simple-rsa/

Now we need to setup the right environment variables. Run the following command: (Note the double periods)

# . ./vars

Now clean up everything:

# ./clean-all

Make Certificate Power (CA)

We are now ready to build are certificate power (CA). To build this austerely run the following command:

# ./build-ca

You will be questioned a series of questions. You may choose to answer none or all of them. Keep in mind that these will show up on your certificate if it is inquired upon. The values we are by in our example are being shown:

• Country Name: US
• State or province: TX
• Locality Name: San Antonio
• Organization Name: Rackspace
• Organizational Unit Name:
• Common Name: OpenVPN-CA (you can choose what you’d like here)
• Email Address: support@rackspacecloud.com

Once you complete these items you will be taken back to your command prompt. Your ca.key and ca.crt files will be stored in the keys directory.

Make Server Certificate

Now we are ready to generate the certificate for the server’s side of the VPN tunnel. Run the following command:

# ./build-key-server ServerA

You’ll note that we used the server name of ServerA for the key. This will help us better identify that this is for ServerA which is the master VPN server.
You will be questioned the same questions again and a few additional questions. The answers we have used for our demonstration are listed here:

• Country Name: US
• State or province: TX
• Locality Name: San Antonio
• Organization Name: Rackspace
• Organizational Unit Name:
• Common Name: ServerA (note that we used our server name)
• Email Address: support@rackspacecloud.com
• A challenge password:
• An discretionary company name:
• Sign the certificate: Y
• Commit: Y

You will notice the two review questions at the end… austerely press Y to those questions.

Make Client Certificate

Now we are ready to build the client certificate for ServerB. Run the following command:

# ./build-key ServerB

Notice that we used ServerB for the certificate name. You will be presented with the same questions as above with the client certificate. The only difference is that we will use ServerB for the Common Name.
Once the certificate has been saved you will see them in /etc/openvpn/simple-rsa/keys.

Make Diffie Hellman Keys

The final step in making your TLS keys is producing the Diffie Hellman, or DH, keys. Run the following command to produce them:

# ./build-dh

You will see a series of characters run across the screen. This process may take up to 30 seconds or more to complete. Upon completion you will be returned to the command prompt.

Copy Keys

Now that we have the keys and certificates made it is time to place them in an appropriate spot.

Server A (TLS Server)

We will be storing our keys in /etc/openvpn/keys on both servers; but, we want to keep them in the original directory on ServerA for regeneration purposes. To do this we will make a symbolic link:

# ln -s /etc/openvpn/simple-rsa/keys /etc/openvpn/keys

Server B (TLS Client)

ServerB doesn’t now have any of the keys installed so we will need to copy the keys from ServerA to ServerB. Run the following orders on ServerA to copy them over:

# scp -r /etc/openvpn/keys root@10.100.1.50:/etc/openvpn/keys

Now we have the keys you need on each server. But we need to remove some files from ServerB as they really shouldn’t be there. To fix this we’ll log into ServerB through SSH and run the following orders:

# rm -f /etc/openvpn/keys/*.pem
# rm -f /etc/openvpn/keys/ServerA*
# rm -f /etc/openvpn/keys/index*
# rm -f /etc/openvpn/keys/serial*

You should be left with five (5) files remaining.

Make VPN Link

Now we are ready to set up our TLS-enabled VPN link between ServerA and ServerB.

Server A (TLS Server)

Run the following command in super user mode to set up the VPN tunnel:

# /usr/sbin/openvpn --remote 10.100.1.50 --dev tun1 --ifconfig 172.16.1.1 172.16.1.2 --tls-server
     --dh /etc/openvpn/keys/dh1024.pem --ca /etc/openvpn/keys/ca.crt
     --cert /etc/openvpn/keys/ServerA.crt --key /etc/openvpn/keys/ServerA.key
     --reneg-sec 60 --verb 5

Server B (TLS Client)

Run the following command in super user mode to set up the VPN tunnel:

# /usr/sbin/openvpn --remote 10.100.1.20 --dev tun1 --ifconfig 172.16.1.2 172.16.1.1 --tls-client
     --ca /etc/openvpn/keys/ca.crt --cert /etc/openvpn/keys/ServerB.crt --key /etc/openvpn/keys/ServerB.key
     --reneg-sec 60 --verb 5

Once you run the appropriate line on each server you will see a page or two of text scroll across the terminal. There are a few lines that we need to pay attention to:

Wed Aug  5 23:11:18 2009 us=378185 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA

This line above means that we are now by TLSv1 to encrypt our data channel. Fantastic!

Wed Aug  5 23:11:18 2009 us=378185 [ServerA] Peer Connection Initiated with 10.1001.1.20:1194

This line above means that our VPN tunnel has been established.

Test Your Link

With the VPN tunnel established you may open up new SSH relations to your server and perform connection tests by the 172.16.1.1 and 172.16.1.2 IP addresses. All traffic by these addresses will flow over the VPN tunnel. Once you are done hard you may bring down the tunnel by pressing Control-C on each server.

Logging

One thing to note is that on each of the openvpn orders we executed we used the command line argument –verb 5. This will raise the verbosity level of the attention, in other words, the attention logs more information. You will see reasonably a bit of information with this level including read and write activities across the VPN, key generation, and more. If you want to turn off verbosity austerely leave the –verb 5 off the command.
We’ve tested and proved that our VPN tunnel is working but setting up the tunnel manually is austerely not effectual. To accomplish this we will need to make a file in /etc/openvpn/ that our startup speech will load. The server and client configuration files will be different so delight be sure to use the right configuration.

Server Speech

To make a configuration for the file you will need to open your favorite text editor. For our example we will use nano:

# nano -w /etc/openvpn/server.conf

For the sake of simplicity we are only going to give the startup speech for a TLS-enabled VPN tunnel. This particular tunnel configuration will allow you to setup a 1024-bit encrypted VPN tunnel and the VPN network will be 172.16.1.0/24.

local 10.1.100.20                    # Replace with your internal (eth1) IP
port 1194
proto udp
dev tun
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/ServerA.crt   # Replace with the key/certificate pair you made
key /etc/openvpn/keys/ServerA.key    # Replace with the key/certificate pair you made
dh /etc/openvpn/keys/dh1024.pem
server 172.16.1.1 255.255.255.0      # This is the network range that your server will give out.  These MUST be non-routeable.
ifconfig-pool-persist ipp.txt
keepalive 10 120
comp-lzo
user nobody
assemble nobody
status openvpn-status.log
verb 3
client-to-client

After you have entered this information into the text editor austerely press Control-X to exit, then Y to save followed by the Enter key.

Client Speech

To make a configuration for the file you will need to open your favorite text editor. For our example we will use nano:

# nano -w /etc/openvpn/client.conf

For the sake of simplicity we are only going to give the startup speech for a TLS-enabled VPN tunnel. This particular tunnel configuration will allow you to setup a 1024-bit encrypted VPN tunnel that will pull an IP address from the VPN pool.

client
dev tun
local 10.1.100.50                   # Replace with your internal (eth1) IP
port 1194
proto udp
remote 10.1.100.20 1194             # Replace with your VPN server's IP
nobind
persist-key
persist-tun
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/ServerB.crt  # Replace with the key/certificate pair you made
key /etc/openvpn/keys/ServerB.key   # Replace with the key/certificate pair you made
comp-lzo
verb 3

After you have entered this information into the text editor austerely press Control-X to exit, then Y to save followed by the Enter key.

Final Steps

Once you have the files saved it is time to enable the OpenVPN service. Type the following orders on the client and server:

# /sbin/chkconfig openvpn on

You may also start the service by typing any of the following orders on the server and client:

# /etc/init.d/openvpn start

-OR-

# service openvpn start

You can verify that the service is running by typing:

# service openvpn status

You can see the interface information by typing the following:

# /sbin/ifconfig tun0

Hopefully this has given some insight on how to setup VPN tunneling with OpenVPN. These examples are just skimming the surface of the types of VPN configurations that are possible with OpenVPN.
–Kelly Koehn 00:02, 6 August 2009 (CDT)

REFERENCES

http://cloudservers.rackspacecloud.com/index.php/CentOS_-_VPN_tunneling_with_OpenVPN