Step-by-Step Guide to Installing and Configuring OpenVPN on Linux

Before setting up a VPN for remote access to internal systems, the author experienced a security breach and decided to replace port forwarding with an OpenVPN server. OpenVPN Overview Official site: https://openvpn.net (may require proxy). References to OpenSSL and OpenVPN principles are provided. 1. Install OpenVPN Software Enable the EPEL repository and install OpenVPN: # rpm -ivh http://mirrors.zju.edu.cn/epel/6/i386/epel-release-6-8.noarch.rpm # yum -y install openvpn Download Easy‑RSA for certificate management: # wget https://github.com/OpenVPN/easy-rsa/archive/master.zip # unzip master.zip # mv easy-rsa-master/ /etc/openvpn 2. Generate Server Certificate Navigate to the Easy‑RSA directory and initialize the PKI: # cd /etc/openvpn/easy-rsa-master/easyrsa3 # ./easyrsa init-pki Create the root CA (password protected) and generate a server request: # ./easyrsa build-ca # ./easyrsa gen-req server nopass Sign the server request and generate Diffie‑Hellman parameters: # ./easyrsa sign-req server server # ./easyrsa gen-dh Copy the resulting certificates and keys to /etc/openvpn : 3. Configure the Server Copy the sample configuration and edit /etc/openvpn/server.conf : # cp /usr/share/doc/openvpn-2.3.6/sample/sample-config-files/server.conf /etc/openvpn # vim /etc/openvpn/server.conf Key settings include: local 192.168.18.42 port 2285 proto udp dev tun ca /etc/openvpn/ca.crt cert /etc/openvpn/server.crt key /etc/openvpn/server.key dh /etc/openvpn/dh.pem push "redirect-gateway def1 bypass-dhcp" push "route 192.168.0.0 255.255.0.0" push "dhcp-option DNS 114.114.114.114" keepalive 10 120 comp-lzo max-clients 100 persist-key persist-tun status /var/log/openvpn-status.log log /var/log/openvpn.log verb 3 Start the service: # service openvpn start 4. Enable IP Forwarding # sysctl -w net.ipv4.ip_forward=1 After starting, OpenVPN creates a virtual gateway (see screenshot). 5. Generate and Sign Client Certificate Copy the Easy‑RSA directory to a temporary location and generate a client request: # cp -r /etc/openvpn/easy-rsa-master/ /tmp # cd /tmp/easy-rsa-master/easyrsa3/ # ./easyrsa init-pki # ./easyrsa gen-req client1 nopass Import and sign the request on the server: # cd /etc/openvpn/easy-rsa-master/easyrsa3/ # ./easyrsa import-req /tmp/easy-rsa-master/easyrsa3/pki/reqs/client1.req client1 # ./easyrsa sign-req client client1 6. Client Configuration and Connection Download the OpenVPN client from the official site and place the CA, client certificate, and client key into C:\Program Files\OpenVPN\config : /etc/openvpn/easy-rsa-master/easyrsa3/pki/ca.crt /etc/openvpn/easy-rsa-master/easyrsa3/pki/issued/client1.crt /tmp/easy-rsa-master/easyrsa3/pki/private/client1.key Copy the sample client configuration file and edit it: client dev tun proto udp remote 192.168.18.42 2285 resolv-retry infinite nobind persist-key persist-tun ca ca.crt cert client1.crt key client1.key comp-lzo verb 3 After placing the certificates and configuration, launch the client, click “Connect”, and enter the client key password to establish the VPN connection. The guide is intentionally concise; feel free to adapt it to your environment.