VPN server

Introduction

See VPN introduction

Server installation

Binary

Installation is easy. You just need “openvpn”.

apt-get update && apt-get upgrade
apt-get install openvpn easy-rsa

Logs

Create target files

touch /var/log/openvpn.log
touch /var/log/openvpn-status.log
chmod 777 /var/log/openvpn*

Create symlinks

ln -s /var/log/openvpn.log /etc/openvpn/openvpn.log
ln -s /var/log/openvpn-status.log /etc/openvpn/openvpn-status.log

Adjust '/etc/openvpn/server.conf' accordingly

/var/log/openvpn.log		=> 	real time log
/var/log/openvpn-status.log	=>	list of connected clients

Public Key Infrastructure

The OpenVPN package provides a set of encryption-related tools called "easy-rsa".

These scripts are located by default in the /usr/share/doc/openvpn/examples/easy-rsa/ directory.

However, in order to function properly, these scripts should be located in the /etc/openvpn directory.

Installation

Copy these files with the following command:

[Old Ubuntu - before 14.04]

cp -R /usr/share/doc/openvpn/examples/easy-rsa/ /etc/openvpn

[New Ubuntu distro - 14.04 and later]

cp -R /usr/share/easy-rsa/ /etc/openvpn

Configure Public Key Infrastructure Variables

Default values

Before you can generate the public key infrastructure for OpenVPN, you must configure a few variables that the easy-rsa scripts will use to generate the scripts.

These variables are set near the end of the /etc/openvpn/easy-rsa/2.0/vars file.

[Old Ubuntu]

Don't forget to add /etc/openvpn/easy-rsa/2.0/ everywhere !!

vim /etc/openvpn/easy-rsa/vars

Here is an example of the relevant values:

export KEY_COUNTRY="SE"
export KEY_PROVINCE="Västra Götaland"
export KEY_CITY="Goteborg"
export KEY_ORG="daxiongmao.eu"
export KEY_EMAIL="guillaume@qin-diaz.com"

>> Alter the examples to reflect your configuration.

This information will be included in certificates you create! That must be accurate, particularly the KEY_ORG and KEY_EMAIL values.

Initialize the Public Key Infrastructure (PKI)

Generate the Authority of Certification (AC):

cd /etc/openvpn/easy-rsa/
. /etc/openvpn/easy-rsa/vars
. /etc/openvpn/easy-rsa/clean-all
. /etc/openvpn/easy-rsa/build-ca

When asked, use your COMPANY name as "common name".

Generate OpenVPN Server Certificates and Private Key

cd /etc/openvpn/easy-rsa/
source /etc/openvpn/easy-rsa/vars
. /etc/openvpn/easy-rsa/build-key-server [server]

[server] replace server by your actual server name !

This script will also prompt you for additional information.

Common Name = Name of the current server (server DNS name)

Generate Clients certificates and private keys

cd /etc/openvpn/easy-rsa/
source /etc/openvpn/easy-rsa/vars
. /etc/openvpn/easy-rsa/build-key [clientName]

Replace the [clientName] parameter with a relevant identifier for each client.

• The client common name must be unique
• It helps you to identify each client. Don’t hesitate to use meaningful name.

The name is put inside the certificate.

All other information can remain the same

Generate Diffie Hellman Parameters

The "Diffie Hellman Parameters" govern the method of key exchange and authentication used by the OpenVPN server.

cd /etc/openvpn/easy-rsa/
. /etc/openvpn/easy-rsa/build-dh

Generate shared security key

NOT TESTED – July 2013

To increase security, you can use a share common key between server and clients. Each client will need the shared key + its own key to communicate.

 
openvpn --genkey --secret ./keys/ta.key

Distribute keys

Client files

In order to authenticate to the VPN, you'll need to copy a number of certificate and key files to the remote client machines. They are:

• Authority of certification ca.crt
• Client certificate [clientName].crt
• Client private key [clientName].key

!!! These keys should transferred with the utmost attention to security. Anyone who has the key is able to gain full access to your virtual private network !!!

Server files

The keys and certificates for the server need to be relocated to the /etc/openvpn directory so the OpenVPN server process can access them. These files are:

• Authority of certification ca.crt
• Authority private key ca.key
• Diffie Hellman props dh2048.pem  !! on new distro it might be higher by default !!
• Server certificate server.crt
• Server private key server.key

cd /etc/openvpn/
ln -s /etc/openvpn/easy-rsa/keys/ca.crt /etc/openvpn/ca.crt
ln -s /etc/openvpn/easy-rsa/keys/ca.key /etc/openvpn/ca.key
ln -s /etc/openvpn/easy-rsa/keys/dh2048.pem /etc/openvpn/dh2048.pem
ln -s /etc/openvpn/easy-rsa/keys/myServer.crt /etc/openvpn/server.crt
ln -s /etc/openvpn/easy-rsa/keys/myServer.key /etc/openvpn/server.key

!! Apart 'ca.crt', all these files mustn't leave your server!!

Revoking Client Certificates

How to remove a user's access to the VPN server?

cd /etc/openvpn/easy-rsa/
. /etc/openvpn/easy-rsa/vars
. /etc/openvpn/easy-rsa/evoke-full [clientName]

This will revoke the ability of users who have the [clientName] certificate to access the VPN.

For this reason, keeping track of which users are in possession of which certificates is crucial.

Server configuration

Configuration file

Basic setup

cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz /etc/openvpn
cd /etc/openvpn/
gzip -d server.conf.gz

Security algorithms and hash

Cryptographic algorithms

openvpn --show-ciphers

Search for: AES-128-CBC, AES-256-CBC

Hash algorithms

openvpn --show-digests

Search for: MD5

Handshake algorithms

openvpn --show-tls

Configuration example

This is how you configuration should look like:

#################################################
# OpenVPN 2.0 config file                       #
# --------------------------------------------- #
# version 1.0 - April 2011 - Guillaume Diaz
# version 1.2 - June 2013 - Guillaume Diaz
#                           conf update + chroot
#################################################


# OpenVPN configuration
##########################
# Which local IP address should OpenVPN listen on? (optional)
local 192.168.1.2

# VPN interface
# Which TCP/UDP port should OpenVPN listen on?
# TCP or UDP server?
dev tun
proto udp
port 8080


# SECURITY - Crypto
########################
# SSL/TLS root certificate (ca)
# Server certificate and private key
# Diffie hellman parameters
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key
dh /etc/openvpn/dh2048.pem

# Shared secret key by both server and clients
;tls-auth /etc/openvpn/ta.key 0

# Crypto settings
cipher AES-128-CBC
auth MD5

# Reduce OpenVPN daemon rights after application start
# To chroot OpenVPN to its own folder
user nobody
group nogroup
chroot /etc/openvpn/



# SERVER CONF
##########################
# Server mode and VPN subset
server 192.168.15.0 255.255.255.0
# Maintain a record of client <-> virtual IP address associations in this file.  
ifconfig-pool-persist ipp.txt
# Keepalive (ping-like) 
# 1 ping every 10s. 120s timeout = disconnect client
keepalive 10 120
# Keep server connection up and running
persist-key
persist-tun
# Compression of data exchange
comp-lzo




# CLIENTS CONF
##########################
# Maximum number of concurrently connected clients
;max-clients 100

# Allow different clients to be able to "see" each other.
client-to-client
# One certificate, multiple clients
#  Do not use 'duplicate-cn' with 'ifconfig-pool-persist'
;duplicate-cn
# Fix for Microsoft Windows clients
mssfix
# Server security level
script-security 2


# Push routes to the client
#  >> VPN route. required to allow connections
push "route 192.168.15.0 255.255.255.0"
#  >> Set the VPN server as global gateway
push "redirect-gateway def1"
#  >> set the DNS Server
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"




# LOGS
##########################
# Short status file showing current connections
# this is truncated and rewritten every minute.
status /etc/openvpn/openvpn-status.log

# Log in a dedicated file instead of /var/log/messages
log         /etc/openvpn/openvpn.log
log-append  /etc/openvpn/openvpn.log

# Log level
# 0 is silent, except for fatal errors
# 4 is reasonable for general usage
# 5 and 6 can help to debug connection problems
# 9 is extremely verbose
verb 6

# Silence repeating messages.  
# At most xx sequential same messages will be output to the log file.
mute 10

You can either use TCP or UDP. Performances are the same, UDP is a bit easier to install.

Be careful when you choose the port number! Common open ports:

• 80 (http)
• 443 (HTTPS)
• 8080 (Proxy / JEE servers)

Server security: Fail2ban

It's a good idea to protect your server against brute force attacks and intruders.

See Fail2ban#VPN rule

Access remote networks

source: http://blog.remibergsma.com/2013/01/13/howto-connect-to-hosts-on-a-remote-network-using-openvpn-and-some-routing/

For every network that you want to make it accessible through your VPN you have to adjust the other server to add a route to it.

VPN server configuration

Edit your VPN server configuration

vim /etc/openvpn/server.conf

Add all the sub-networks you'd like to connect:

...

# SERVER CONF
##########################
# Server mode and VPN subset
server 192.168.15.0 255.255.255.0

... 
# Push routes to the client
#  >> VPN route. clients to clients connections
push "route 192.168.15.0 255.255.255.0"
#  >> Remote network accessible through the VPN gateway
push "route 192.168.1.0 255.255.255.0"

Other servers configuration

On each server that will be reachable through the VPN (including your VPN gateway) you have to add a new route to the VPN network.

Create script

cd /etc/init.d
vim addRouteToVpn.sh

Put the following content

#!/bin/bash
# Add a new route to the VPN network

### BEGIN INIT INFO
# Provides:          vpn-route
# Required-Start:    $local_fs $remote_fs $network $syslog
# Required-Stop:     $local_fs $remote_fs $network $syslog
# Should-Start:      $named
# Should-Stop:       $named
# Default-Start:     2 3 4 5
# Default-Stop:      0 1 6
# Short-Description: VPN route
# Description:       This will add a route to the VPN
### END INIT INFO

VPN_NETWORK="192.168.15.0"
VPN_NETWORK_MASK="255.255.255.0"
## VPN gateway = IP @ of the VPN server in the remote [company] network
VPN_GATEWAY="192.168.1.45"

echo " "
echo "Adding route to the remote [company] network"
echo "   VPN network:  $VPN_NETWORK/ $VPN_NETWORK_MASK"
echo "   VPN gateway:  $VPN_GATEWAY"
echo " "

route add -net $VPN_NETWORK netmask $VPN_NETWORK_MASK gw $VPN_GATEWAY

Grant the execution rights

chmod 755 /etc/init.d/addRouteToVpn.sh

Register the script to run on boot && reboot

update-rc.d /etc/init.d/addRouteToVpn.sh defaults

Server: Advanced stuff

Logrotate http://guillaume.vaillant.me/?p=393

-- TO BE FINISHED --

Firewall

See Firewall VPN