2007 - Debian 4 - OpenVPN Howto

category: howtoz/archive · date: 2008-04-18 · source: old.linuxor.sk/VPN/BH_Debian4.0_OpenVPN.txt

The Slovak original of this document: 2007 - Debian 4 - OpenVPN Howto (slovensky).

Installing a VPN (OpenVPN)

asciiart

-----------------
 Install OpenVPN
-----------------

        # apt-get install liblzo1
        # apt-get install openvpn
        # apt-get install openssl

--------------------------------------
 Creating the Certification Authority
--------------------------------------

        # cp -R /usr/share/doc/openvpn/examples/easy-rsa /etc/
        # cd /etc/easy-rsa

        # chmod 744 ./vars
        # gunzip openssl.cnf.gz
        # . ./vars
        # ./clean-all

        # ./build-ca
        ------------
        Country Name (2 letter code) [KG]:SK
        State or Province Name (full name) [NA]:Slovakia
        Locality Name (eg, city) [BISHKEK]:Mesto
        Organization Name (eg, company) [OpenVPN-TEST]:Firma
        Organizational Unit Name (eg, section) []:IT
        Common Name (eg, your name or your server's hostname) []:CA
        Email Address [me@myhost.mydomain]:mail@firma.sk

-----------------------------------------
 Creating the certificate for the server
-----------------------------------------

        # ./build-key-server gw.firma.sk
        ------------------------------------------
        Country Name (2 letter code) [KG]:SK
        State or Province Name (full name) [NA]:Slovakia
        Locality Name (eg, city) [BISHKEK]:Mesto
        Organization Name (eg, company) [OpenVPN-TEST]:Firma
        Organizational Unit Name (eg, section) []:IT
        Common Name (eg, your name or your server's hostname) []:gw.firma.sk
        Email Address [me@myhost.mydomain]:mail@firma.sk

-----------------------------------------
 Creating the certificate for the client
-----------------------------------------

        # ./build-key klient1
        ---------------------
        Country Name (2 letter code) [KG]:SK
        State or Province Name (full name) [NA]:Slovakia
        Locality Name (eg, city) [BISHKEK]:Mesto
        Organization Name (eg, company) [OpenVPN-TEST]:Firma
        Organizational Unit Name (eg, section) []:IT
        Common Name (eg, your name or your server's hostname) []:klient1
        Email Address [me@myhost.mydomain]:mail@firma.sk

        # ./build-key klient2
        ---------------------
        Country Name (2 letter code) [KG]:SK
        State or Province Name (full name) [NA]:Slovakia
        Locality Name (eg, city) [BISHKEK]:Domica
        Organization Name (eg, company) [OpenVPN-TEST]:DomicaKomplex
        Organizational Unit Name (eg, section) []:IT
        Common Name (eg, your name or your server's hostname) []:klient2
        Email Address [me@myhost.mydomain]:mail@firma.sk

----------------------------------------
 Creating the Diffie Hellman parameters
----------------------------------------

        # ./build-dh

-----------------------------------------
 Creating the group and the user openvpn
-----------------------------------------

        # groupadd openvpn
        # useradd -d /dev/null -g openvpn -s /bin/false openvpn

--------------------------------
 OpenVPN configuration - server
--------------------------------

        # nano /etc/openvpn/server.conf
        -------------------------------
        proto tcp                               # protocol
        dev tun                                 # device
        ca ca.crt                               # CA certificate
        cert gw.firma.sk.crt                    # server certificate
        key gw.firma.sk.key                     # server key
        dh dh1024.pem                           # DH parameters
        server 10.10.10.0 255.255.255.0         # server=10.10.10.1, clients=10.10.10.0/24
        client-config-dir ccd
        push "route 192.168.1.0 255.255.255.0"  # tell the client the route into the network
        keepalive 10 120
        comp-lzo                                # lzo compression
        user openvpn                            # the user the openvpn process runs as
        group openvpn                           # the group the openvpn process runs as
        persist-key                             # to avoid accessing resources on restart that may no longer be accessible (e.g. chroot or a privilege downgrade), we use a persistent key
        persist-tun                             # ditto for the device
        status openvpn-status.log               # log the status messages to openvpn-status.log
        log-append openvpn.log                  # log the main messages to openvpn.log
        verb 3                                  # it won't be that chatty (1..10)
        chroot /etc/openvpn/                    # chroot the openvpn process into the directory /etc/openvpn
        -------------------------------END->/etc/openvpn/server.conf

        Set things up so that every client is always assigned the same IP address
        -------------------------------------------------------------------------

        # mkdir /etc/openvpn/ccd
        # nano /etc/openvpn/ccd/klient1
        -------------------------------
        ifconfig-push 10.10.10.5 10.10.10.6
        -------------------------------END->/etc/openvpn/ccd/klient1

        # nano /etc/openvpn/ccd/klient2
        -------------------------------
        ifconfig-push 10.10.10.7 10.10.10.8
        -------------------------------END->/etc/openvpn/ccd/klient2

--------------------------------
 OpenVPN configuration - client
--------------------------------

        # client.ovpn
        -------------------
        client                          # mode
        dev tun                         # device
        proto tcp                       # protocol
        remote 10.62.2.44 1194          # remote side
        resolv-retry infinite
        ns-cert-type server             # verify the server by its certificate ( against MITM )
        nobind                          # clients usually don't need to bind a specific port
        persist-key                     # to avoid accessing resources on restart that may no longer be accessible (e.g. chroot or a privilege downgrade), we use a persistent key
        persist-tun                     # ditto for the device
        route 192.168.1.0 255.255.255.0 # route into the internal network
        ca ca.crt                       # CA certificate
        cert klient1.crt                # client certificate
        key klient1.key                 # client key
        comp-lzo                        # lzo compression is used
        verb 1                          # almost the minimum of logs (1..10)
        -------------------END->client.ovpn

Current practice (checked 2026-10)

noteThe article above is kept as it was written in 2007. This section lists what has changed since and what to do instead today.

easy-rsa: . ./vars, ./clean-all, ./build-ca, ./build-key-server, ./build-key and ./build-dh are easy-rsa 2. easy-rsa 3 is a single easyrsa script (Debian package easy-rsa) and defaults to 2048-bit RSA keys signed with SHA-256; the equivalent commands are shown below.
Where the CA lives: the article builds the CA in /etc/easy-rsa on the VPN gateway itself. The easy-rsa documentation recommends a separate system for the CA: generate the request on the server or client, move only the .req file to the CA and sign it there, so the CA key never sits on the exposed host.
dh dh1024.pem: 1024-bit Diffie-Hellman parameters are too short today. Use dh none, which makes OpenVPN use ECDH only, or generate at least 2048-bit parameters with ./easyrsa gen-dh.
comp-lzo: deprecated. The OpenVPN manual says compression is generally not recommended because compressed tunnels are open to the VORACLE attack, and OpenVPN 2.6 refuses compression by default (allow-compression no). Remove comp-lzo from server and clients; for a gradual change the server can use compress migrate.
ns-cert-type server: deprecated, it relies on the old nsCertType certificate field. Use remote-cert-tls server on the client.
Data channel cipher: the configuration sets no cipher, which in 2007 meant the then default BF-CBC. OpenVPN 2.6 negotiates AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305 (data-ciphers) on its own, so run a current OpenVPN on both ends and do not add an old cipher line.
Control channel: the article uses neither tls-auth nor tls-crypt. Add tls-crypt shared.key on both sides (key from openvpn --genkey tls-crypt shared.key); it encrypts and authenticates the TLS handshake packets and drops anything from peers without the key.
proto tcp: UDP is OpenVPN's normal transport; a tunnel over TCP carrying TCP traffic retransmits twice and stalls on lossy links. Keep TCP only where UDP is blocked.
WireGuard: for a plain routed VPN like this one, WireGuard is the common choice today. It is part of the Linux kernel since 5.6 and needs no PKI, only a key pair per peer.

The certificate steps with easy-rsa 3:

bash

$ # ./easyrsa init-pki
$ # ./easyrsa build-ca
$ # ./easyrsa gen-req gw.firma.sk nopass
$ # ./easyrsa sign-req server gw.firma.sk
$ # ./easyrsa gen-req klient1 nopass
$ # ./easyrsa sign-req client klient1

Sources: