OpenVPN Setup Guide

This page contains a no-frills guide to getting OpenVPN up and running on a Windows server and client(s). For a more detailed understanding of setting up OpenVPN and its advanced features, see the HOWTO page.

Table of contents

1. Downloading and Installing OpenVPN

2. Certificates and Keys

2.1 Preparatory Steps

2.2 Building Certificates and Keys

3. Configuration Files

3.1 Server Config File

3.2 Client Config Files

4. Copying the Server and Client Files to Their Appropriate Directories

5. Starting OpenVPN

6. Further Considerations / Troubleshooting

6.1 Firewall Configuration

6.2 Port Forwarding

6.3 Static Internet IP

6.4 Running OpenVPN as a Service

6.5 Security Tips

Downloading and Installing OpenVPN

1. On the Admin system (for building certificates and keys):
   1. Download the installer from here and run it on your own PC.
   2. During setup, make sure all components are installed (tick all options)

2. On the Remote Server system (the target server):
   1. Download the installer and run it on the target system (to be managed)
   2. During setup, uncheck the OpenVPN GUI (we do not want a GUI on the server)

3. On each Client PC (used for connecting to the server):
   1. Install OpenVPN on each client with the default options (this step can be skipped for now and done at any convenient time).

Certificates and Keys

Preparatory Steps on the Admin system

1. Navigate to the C:\Program Files\OpenVPN\easy-rsa folder in the command prompt:
   1. Press Windows Key + R
   2. Type "cmd.exe" and press Enter.

      cmd.exe

   3. Navigate to the correct folder:

      cd "C:\Program Files\OpenVPN\easy-rsa"

2. Initialize the OpenVPN configuration:

   init-config.bat

   • NOTE: Only run init-config once, during installation.

3. Open the vars.bat file in a text editor:

   notepad vars.bat

4. Edit the following lines in vars.bat, replacing "US", "CA," etc. with your company's information:

   set HOME=%cd%
   set KEY_DIR=keys
   set KEY_SIZE=2048
   set KEY_COUNTRY=NZ
   set KEY_PROVINCE=NI
   set KEY_CITY=Auckland
   set KEY_ORG=Compucon
   set KEY_EMAIL= This e-mail address is being protected from spam bots, you need JavaScript enabled to view it
   set KEY_CN=Compucon-CA
   set KEY_NAME=Compucon-CA
   set KEY_OU=TSD

5. Save the file and exit notepad.

6. Copy the easy-rsa folder into C:\Program Files\OpenVPN\OpenVPN\SiteName (change SiteName to suit the IPVS project). From now on, work within this particular easy-rsa folder. The base easy-rsa folder at C:\Program Files\OpenVPN\easy-rsa is now a reference to make other projects.

7. Run the following commands:

   vars.bat

   clean-all.bat

Building Certificates and Keys

1. The certificate authority (CA) certificate and key:

   build-ca.bat

   • When prompted, press enter to accept the default values:

     Country Name (2 letter code) [NZ]:
     State or Province Name (full name) [NI]:
     Locality Name (eg, city) [Auckland]:
     Organization Name (eg, company) [Compucon]:
     Organizational Unit Name (eg, section) [TSD]:
     Common Name (eg, your name or your server's hostname) [Compucon-CA]:
     Email Address [ This e-mail address is being protected from spam bots, you need JavaScript enabled to view it ]:

2. The server certificate and key:

   build-key-server.bat server

   • When prompted, enter the "Common Name" as "server"
   • When prompted to sign the certificate, enter "y"
   • When prompted to commit, enter "y"

3. Client certificates and keys:

1. For each client, choose a name to identify that computer, such as "firstname-lastname":

   build-key.bat firstname-lastname

   • When prompted, enter the "Common Name" and "Name" as the name you have chosen (e.g. "edmond-chan")

2. Repeat this step for each client computer that will connect to the VPN.

4. Generate Diffie Hellman parameters (This is necessary to set up the encryption)

   build-dh

5. Generate a shared-secret key that is used in addition to the standard RSA certificate/key:

openvpn --genkey --secret ta.key

Configuration Files

1. Find the sample configuration files:

   Start Menu -> All Programs -> OpenVPN -> OpenVPN Sample Configuration Files

Server Config File

1. Open server.ovpn (rename to Compucon-IPVS-SiteName-NVRServer.ovpn)

2. Find the following lines:

   ca ca.crt
   cert server.crt
   key server.key
   dh dh2048.pem
   server 10.8.0.0  255.255.255.0

3. Edit them as follows:

   ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
   cert "C:\\Program Files\\OpenVPN\\config\\server.crt"
   key "C:\\Program Files\\OpenVPN\\config\\server.key"
   dh "C:\\Program Files\\OpenVPN\\config\\dh2048.pem"
   server 10.8.0.0 (change IP address to suit the receiving NIC) 255.255.255.0

4. Add the following line (if not already present):

   tls-auth ta.key 0
   proto udp

5. Save the file as C:\Program Files\OpenVPN\OpenVPN\SiteName\easy-rsa\Compucon-IPVS-SiteName-NVR.ovpn

Client Config Files

This is similar to the server configuration

1. Open client.ovpn

2. Find the following lines:

   ca ca.crt
   cert firstname-lastname.crt
   key firstname-lastname.key

3. Edit them as follows:

   ca "C:\\Program Files\\OpenVPN\\config\\Compucon-IPVS-SiteName-FirstName-LastName\\ca.crt"
   cert "C:\\Program Files\\OpenVPN\\config\\Compucon-IPVS-SiteName-FirstName-LastName\\firstname-lastname.crt"
   key "C:\\Program Files\\OpenVPN\\config\\Compucon-IPVS-SiteName-FirstName-LastName\\firstname-lastname.key"

   • Note that the name of the client certificate and key files depends upon the Common Name of each client.We will change these later for each client.

4. Edit the following line, replacing "my-server" with your server's public Internet IP Address or Domain Name. If you need help, see Static Internet IP below.

   remote my-server (change to Public Static IP) 1194

5. Add the following lines (if not already present):

   tls-auth ta.key 1
   proto udp

6. Save the file as C:\Program Files\OpenVPN\OpenVPN\SiteName\easy-rsa\Compucon-IPVS-SiteName-FirstName-LastName.ovpn (each client will need a different, but similar, config file depending upon that client's Common Name.)

Copying the Server and Client Files to Their Appropriate Directories

1. Copy these files from C:\Program Files\OpenVPN\OpenVPN\SiteName\easy-rsa\ to C:\Program Files\OpenVPN\config\ on the server:

   ca.crt
   dh2048.pem
   server.crt
   server.key
   ta.key
   server.ovpn

2. Copy these files from C:\Program Files\OpenVPN\OpenVPN\SiteName\easy-rsa\ on the server to C:\Program Files\OpenVPN\config\ on each client (edmond-chan, in this example):

   ca.crt
   edmond-chan.crt
   edmond-chan.key
   ta.key
   edmond-chan.ovpn

Starting OpenVPN

1. Transmit all needed files to the server and client computers accordingly using a secure means such as a USB drive (email is not always a secure means).
2. On the server, run the Windows Service administrative tool:
   1. Press Windows Key + R
   2. Type "services.msc" and press Enter.

      services.msc

3. Find the OpenVPN service, and set its Startup Type to "automatic."
4. Optionally, start the service now
5. On the client, run OpenVPN from:

   Start Menu -> All Programs -> OpenVPN -> OpenVPN GUI

6. Double click the icon which shows up in the system tray to initiate the connection. The resulting dialog should close upon a successful start.

 

Further Considerations / Troubleshooting

OpenVPN Server adapter name

In the server.ovpn file the following line needs to match the name of the OpenVPN virtual NIC:

dev-node "OpenVPN Server"

Therefore, if dev-node in the .ovpn file is "OpenVPN Server" or otherwise, please rename the virtual NIC interface under adapters on the server to match.

Use Fully Qualified Paths

These lines should exist in the server.opvn file:

ifconfig-pool-persist "C:\\Program Files\\OpenVPN\\log\\ipp.txt"

tls-auth "C:\\Program Files\\OpenVPN\\config\\ta.key" 0 # This file is secret

status "C:\\Program Files\\OpenVPN\\log\\openvpn-status.log"

log-append  "C:\\Program Files\\OpenVPN\\log\\openvpn.log"

Firewall Configuration

If you have connection problems, make sure to set a rule on your server's firewall allowing incoming traffic on UDP port 1194.

Port Forwarding

If your server is behind a router, you will need to forward the port chosen for OpenVPN (in this example UDP 1194) to the server. Consult your router's documentation for details on this.

To set up port forwarding, you will likely need to set up the server with a static local IP address instead of the default dynamic (changing) IP. Instructions for Windows XP may be found here. Make sure to choose a static IP address that is not in the range your router might assign as a dynamic IP, but is within the router's subnet (usually 192.168.0.xxx , 10.0.0.xxx , or similar).

Static Internet IP

Your server will need to have a static internet IP or Domain Name to be accessible over the long term. One solution is to sign up for an account with DynDNS and install the DynDNS Updater on your server. When signing up you will determine the static Domain Name of your server. (For example, "myserver.dyndns.org") You will use this Domain Name in the client configuration files as part of the "remote" directive.

Running OpenVPN as a Service

Running OpenVPN as a service will allow:

Security Tips

Cloning OpenVPN Servers

If including OpenVPN in a cloned server build you will find that all servers will have the same MAC address for the TAP device. This will cause packet loss across the network. Standard methods of changing the IP address from scripts do not work on the TAP device, to resolve this delete and recreate the TAP device using the scripts included with OpenVPN:

C:\Program Files\OpenVPN\bin\deltapall C:\Program Files\OpenVPN\bin\addtap

You will then have to rename the connection to match the entry in the config file.

 

Appendix: Hardening OpenVPN Security

One of the often-repeated maxims of network security is that one should never place so much trust in a single security component that its failure causes a catastrophic security breach. OpenVPN provides several mechanisms to add additional security layers to hedge against such an outcome.

tls-auth

The tls-auth directive adds an additional HMAC signature to all SSL/TLS handshake packets for integrity verification. Any UDP packet not bearing the correct HMAC signature can be dropped without further processing. The tls-auth HMAC signature provides an additional level of security above and beyond that provided by SSL/TLS. It can protect against:

Using tls-auth requires that you generate a shared-secret key that is used in addition to the standard RSA certificate/key:

openvpn --genkey --secret ta.key

This command will generate an OpenVPN static key and write it to the file ta.key. This key should be copied over a blockquote-existing secure channel to the server and all client machines. It can be placed in the same directory as the RSA .key and .crt files.

In the server configuration, add:

tls-auth ta.key 0

In the client configuration, add:

tls-auth ta.key 1

proto udp

While OpenVPN allows either the TCP or UDP protocol to be used as the VPN carrier connection, the UDP protocol will provide better protection against DoS attacks and port scanning than TCP:

proto udp  

Appendix: Unified File for iOS

# copy and paste the text below to replace all text between ca and tls-auth ta.key 1 in the .ovpm file # ca "C:\\Program Files\\OpenVPN\\config\\Compucon-IPVS-QIPS21-edmond-chan\\ca.crt"
# cert "C:\\Program Files\\OpenVPN\\config\\Compucon-IPVS-QIPS21-edmond-chan\\edmond-chan.crt"
# key "C:\\Program Files\\OpenVPN\\config\\Compucon-IPVS-QIPS21-edmond-chan\\edmond-chan.key"

<ca>
</ca>

<cert>
</cert>

<key>
</key>

# Verify server certificate by checking that the
# certicate has the correct key usage set.
# This is an important precaution to protect against
# a potential attack discussed here:
#  http://openvpn.net/howto.html#mitm
#
# To use this feature, you will need to generate
# your server certificates with the keyUsage set to
#   digitalSignature, keyEncipherment
# and the extendedKeyUsage to
#   serverAuth
# EasyRSA can do this for you.
remote-cert-tls server

# If a tls-auth key is used on the server
# then every client must also have the key.
# tls-auth ta.key 1

key-direction 1
<tls-auth>
</tls-auth>

 

Appendix: Revoking Certificates

https://openvpn.net/community-resources/revoking-certificates/

 

Revoking Certificates

Revoking a certificate means to invalidate a previously signed certificate so that it can no longer be used for authentication purposes.

Typical reasons for wanting to revoke a certificate include:

• The private key associated with the certificate is compromised or stolen.
• The user of an encrypted private key forgets the password on the key.
• You want to terminate a VPN user's access.

Example

As an example, we will revoke the client2 certificate, which we generated above in the "key generation" section of the HOW TO

First open up a shell or command prompt window and cd to the easy-rsa directory as you did in the "key generation" section above. On Linux/BSD/Unix:

		. ./vars
	./revoke-full client2
	
	

On Windows:

		vars
	revoke-full client2
	
	

You should see output similar to this:

		Using configuration from /root/openvpn/20/openvpn/tmp/easy-rsa/openssl.cnf
	DEBUG[load_index]: unique_subject = "yes"
	Revoking Certificate 04.
	Data Base Updated
	Using configuration from /root/openvpn/20/openvpn/tmp/easy-rsa/openssl.cnf
	DEBUG[load_index]: unique_subject = "yes"
	client2.crt: /C=KG/ST=NA/O=OpenVPN-TEST/CN=client2/emailAddress=
 This e-mail address is being protected from spam bots, you need JavaScript enabled to view it
 
	error 23 at 0 depth lookup:certificate revoked
	

Note the "error 23" in the last line. That is what you want to see, as it indicates that a certificate verification of the revoked certificate failed.

The revoke-full script will generate a CRL (certificate revocation list) file called crl.pem in the keyssubdirectory. The file should be copied to a directory where the OpenVPN server can access it, then CRL verification should be enabled in the server configuration:

		crl-verify crl.pem
	

Now all connecting clients will have their client certificates verified against the CRL, and any positive match will result in the connection being dropped.

CRL Notes

When the crl-verify option is used in OpenVPN, the CRL file will be re-read any time a new client connects or an existing client renegotiates the SSL/TLS connection (by default once per hour). This means that you can update the CRL file while the OpenVPN server daemon is running, and have the new CRL take effect immediately for newly connecting clients. If the client whose certificate you are revoking is already connected, you can restart the server via a signal (SIGUSR1 or SIGHUP) and flush all clients, or you can telnet to the management interface and explicitly kill the specific client instance object on the server without disturbing other clients.

While the crl-verify directive can be used on both the OpenVPN server and clients, it is generally unnecessary to distribute a CRL file to clients unless a server certificate has been revoked. Clients don't need to know about other client certificates which have been revoked because clients shouldn't be accepting direct connections from other clients in the first place.

The CRL file is not secret, and should be made world-readable so that the OpenVPN daemon can read it after root privileges have been dropped.

If you are using the chroot directive, make sure to put a copy of the CRL file in the chroot directory, since unlike most other files which OpenVPN reads, the CRL file will be read after the chroot call is executed, not before.

A common reason why certificates need to be revoked is that the user encrypts their private key with a password, then forgets the password. By revoking the original certificate, it is possible to generate a new certificate/key pair with the user's original common name.

 

Renewing expired CRL.pem file (for CRL has expired error)

if you extract the following command from the revoke-full.bat
$OPENSSL ca -gencrl -out "$CRL" -config "$KEY_CONFIG"
and rework it for your cwd
openssl ca -gencrl -out keys/crl.pem -config ./openssl.cnf
then that should work.

1. Run vars
2. run openssl ca -gencrl -out keys\crl.pem -config ./openssl-1.0.0.cnf

  Upload newly generated crl.pem file to OpenVPN\config folder on the server(or wherever it is located).