2007 - Debian 4 - OpenVPN Howto

-----------------
 Install OpenVPN
-----------------

        # apt-get install liblzo1
        # apt-get install openvpn
        # apt-get install openssl

-----------------------------------
 Vytvorenie Certifikacnej Autority
-----------------------------------

        # cp -R /usr/share/doc/openvpn/examples/easy-rsa /etc/
        # cd /etc/easy-rsa

        # chmod 744 ./vars
        # gunzip openssl.cnf.gz
        # . ./vars
        # ./clean-all

        # ./build-ca
        ------------
        Country Name (2 letter code) [KG]:SK
        State or Province Name (full name) [NA]:Slovakia
        Locality Name (eg, city) [BISHKEK]:Mesto
        Organization Name (eg, company) [OpenVPN-TEST]:Firma
        Organizational Unit Name (eg, section) []:IT
        Common Name (eg, your name or your server's hostname) []:CA
        Email Address [me@myhost.mydomain]:mail@firma.sk

-----------------------------------
 Vytvorenie certifikatu pre server
-----------------------------------

        # ./build-key-server gw.client23.example
        ------------------------------------------
        Country Name (2 letter code) [KG]:SK
        State or Province Name (full name) [NA]:Slovakia
        Locality Name (eg, city) [BISHKEK]:Mesto
        Organization Name (eg, company) [OpenVPN-TEST]:Firma
        Organizational Unit Name (eg, section) []:IT
        Common Name (eg, your name or your server's hostname) []:gw.firma.sk
        Email Address [me@myhost.mydomain]:mail@firma.sk

------------------------------------
 Vytvorenie certifikatu pre klienta
------------------------------------

        # ./build-key klient1
        ---------------------
        Country Name (2 letter code) [KG]:SK
        State or Province Name (full name) [NA]:Slovakia
        Locality Name (eg, city) [BISHKEK]:Mesto
        Organization Name (eg, company) [OpenVPN-TEST]:Firma
        Organizational Unit Name (eg, section) []:IT
        Common Name (eg, your name or your server's hostname) []:klient1
        Email Address [me@myhost.mydomain]:mail@firma.sk

        # ./build-key klient2
        ---------------------
        Country Name (2 letter code) [KG]:SK
        State or Province Name (full name) [NA]:Slovakia
        Locality Name (eg, city) [BISHKEK]:Domica
        Organization Name (eg, company) [OpenVPN-TEST]:DomicaKomplex
        Organizational Unit Name (eg, section) []:IT
        Common Name (eg, your name or your server's hostname) []:klient2
        Email Address [me@myhost.mydomain]:mail@firma.sk

--------------------------------------
 Vytvorenie Diffie Hellman parametrov
--------------------------------------

        # ./build-dh

----------------------------------------
 Vytvorenie skupiny a uzivatela openvpn
----------------------------------------

        # groupadd openvpn
        # useradd -d /dev/null -g openvpn -s /bin/false openvpn

-------------------------------
 Konfiguracia OpenVPN - server
-------------------------------

        # nano /etc/openvpn/server.conf
        -------------------------------
        proto tcp                               # protokol
        dev tun                                 # zariadenie
        ca ca.crt                               # certifikat CA
        cert gw.firma.sk.crt                    # server certifikat
        key gw.firma.sk.key                     # server kluc
        dh dh1024.pem                           # DH parametre
        server 10.10.10.0 255.255.255.0         # server=10.10.10.1, klienti=10.10.10.0/24
        client-config-dir ccd
        push "route 192.168.1.0 255.255.255.0"  # klientovi povieme smer do siete
        keepalive 10 120
        comp-lzo                                # kompresia lzo
        user openvpn                            # uzivatel pod ktorym je spusteny proces openvpn
        group openvpn                           # skupina pod ktorou je spusteny proces openvpn
        persist-key                             # aby sme sa pri restarte vyhli pristupom k zdrojom ktore uz nemusia byt pristupne (napr. chroot alebo downgrade privilegii) pouzijeme staly kluc
        persist-tun                             # deto pre zariadenie
        status openvpn-status.log               # status hlasky loguj do openvpn-status.log
        log-append openvpn.log                  # hlavne hlasky loguj do openvpn.log
        verb 3                                  # nebude az taky ukecany (1..10)
        chroot /etc/openvpn/                    # chrootneme proces openvpn do adresara /etc/openvpn
        -------------------------------END->/etc/openvpn/server.conf

        Nastavime aby mal kazdy klient pridelenu stale rovnaku ip adresu
        ----------------------------------------------------------------

        # mkdir /etc/openvpn/ccd
        # nano /etc/openvpn/ccd/klient1
        -------------------------------
        ifconfig-push 10.10.10.5 10.10.10.6
        -------------------------------END->/etc/openvpn/ccd/klient1

        # mkdir /etc/openvpn/ccd
        # nano /etc/openvpn/ccd/klient2
        -------------------------------
        ifconfig-push 10.10.10.7 10.10.10.8
        -------------------------------END->/etc/openvpn/ccd/klient2

-------------------------------
 Konfiguracia OpenVPN - klient
-------------------------------

        # client.ovpn
        -------------------
        client                          # mod
        dev tun                         # zariadenie
        proto tcp                       # protocol
        remote 10.62.2.44 1194          # vzdialena strana
        resolv-retry infinite
        ns-cert-type server             # overime si server na zaklade certifikatu ( proti MITM )
        nobind                          # klienti zvycajne nepotrebuju bindnut specificky port
        persist-key                     # aby sme sa pri restarte vyhli pristupom k zdrojom ktore uz nemusia byt pristupne (napr. chroot alebo downgrade privilegii) pouzijeme staly kluc
        persist-tun                     # deto pre zariadenie
        route 192.168.1.0 255.255.255.0 # smer do vnutornej siete
        ca ca.crt                       # certifikat CA
        cert klient1.crt                # certifikat klienta
        key klient1.key                 # kluc klienta
        comp-lzo                        # pouzije sa komprimacia lzo
        verb 1                          # skoro mininum logov (1..10)
        -------------------END->client.ovpn