OpenVPN Server
- Openvpn is used to create secure ssl/tls vpn tunnels which provides secure access to remote servers and other programs running on those servers
- It largely reduces ssh brute broke attacks by dropping the connection request at initial phase
- Create own certificate authority using easy-rsa for issuing certs to clients and servers
- This note is for setting up Openvpn on bastion and access other servers via bastion. Tested on OCI vm’s
- As a best practice the CA is created and Openvpn server is created on different servers but for simplicity and lack of resource availability we create both on the same server
Openvpn tunnel formation
+------------+---------------+ +-----------------+-----------+
| |public ip | | Public ip of | |
| |of ovpn server | | openvpn client | |
| +---------------+------------------------------+-----------------+ |
| | | |
| Openvpn |+------------------------------------------------------+| Openvpn |
| server | Openvpn private tunnel | client |
| |+------------------------------------------------------+| |
| | | |
| +----------+------------------------------------+-------+| |
| | | Public vpn tunnel | | |
| | +------------------------------------+ | |
| | | |
+----------------+ +---------------+
Openvpn server and pki setup
This setup is tested on ubuntu 22.04, 20.04 and ubuntu based lxc containers
- Install Openvpn
1
apt install openvpn -y
- Download
easy-rsafrom github and place it in/etc/openvpn/folder1
- wget https://github.com/OpenVPN/easy-rsa/releases/download/v3.1.0/EasyRSA-3.1.0.tgz -O /tmp/easy-rsa; tar xzvf /tmp/easy-rsa; mv /tmp/EasyRSA-3.1.0 /etc/openvpn/easy-rsa
- Create pki using easy-rsa
1
./easyrsa init-pki
- Add the following to the pki/vars file.
1 2 3 4 5 6
- set_var EASYRSA_REQ_COUNTRY "INDIA" - set_var EASYRSA_REQ_PROVINCE "Tamilnadu" set_var EASYRSA_REQ_CITY "Tirupur" set_var EASYRSA_REQ_ORG "Smounesh" set_var EASYRSA_REQ_EMAIL "shankar@smounesh.in" set_var EASYRSA_REQ_OU "smounesh Infra Team"
- Build CA without paspharse
1
./easyrsa build-ca nopass
1
./easyrsa gen-dh
- Req key for a Openvpn server without passphrase
1
./easyrsa gen-req ovpn-server nopass
- Sign the key of Openvon server as a server with CA
1
./easyrsa sign-req server ovpn-server
- Request a key for a client without passphrase
1
./easyrsa gen-req mounesh-laptop nopass
- SIgn the key of clients as client with CA.
1
./easyrsa sign-req client mounesh-laptop
- Run the safe ssl cmd
1
./easyrsa make-safe-ssl
- Generate the ta.key file using the cmd which is essential to block brute-force attacks
1
openvpn --genkey secret ta.key Copy the ca.crt, dh.pem ovpn-server.crt and ovpn-server.key from /etc/openvpn-easy-rsa/pki to the /etc/openvpn folder. ovpn-server.key and ovpn-server.crt can be found inside the pki/issued and pki/private folder
- Stop the openvpn and create config file for Openvpn server
1
systemctl stop openvpn
```
OpenVPN config
Filename: /etc/openvpn/server.conf
Authentication is using client certs, user/pass and 2FA.
Further, certificate common_name and username are pinned, to prevent
users from sharing certificates.
Ubuntu systemd runs openvpn with restricted capabilities and cannot run
client connect/disconnect scripts to send email notifications. To fix:
in /lib/systemd/system/openvpn@.service uncomment the LimitNPROC line
and increase the default value from 10 to 100 processes
Run systemctl daemon-reload and service openvpn restart
port 1194 proto udp dev tun
dh dh.pem ca ca.crt tls-crypt ta.key cert ovpn-server.crt key ovpn-server.key
server 10.8.0.0 255.255.255.0 topology subnet
ifconfig-pool-persist ipp.txt
Route OCI-SF site-to-site via the tunnel
route 10.10.0.0 255.255.0.0
Route OCI-HYD site-to-site via the tunnel
route 10.20.0.0 255.255.0.0
Set this to internal network
#push “route 172.30.0.0 255.255.0.0” #push “route 10.20.0.0 255.255.0.0”
Set this if internal DNS is to be used
#push “dhcp-option DNS 10.10.4.51” #push “dhcp-option DNS 10.10.4.52”
Permit mutiple clients with same client cert
duplicate-cn
keepalive 10 120
Notify the client when the server restarts so it can auto reconnect
explicit-exit-notify 1
cipher AES-256-CBC data-ciphers ‘AES-256-CBC’ data-ciphers-fallback ‘AES-256-CBC’
auth SHA256
max-clients 100 user nobody group nogroup
persist-key persist-tun
status openvpn-status.log verb 3
client-config-dir ccd
Authentiate users with both password and google-authenticator 2FA
Clients have to enter password and 2fa token in the password prompt
#plugin /usr/lib/x86_64-linux-gnu/openvpn/plugins/openvpn-plugin-auth-pam.so openvpn
Email root on user connct/disconnect
#script-security 2 #client-connect /etc/openvpn/client-connect.sh #client-disconnect /etc/openvpn/client-disconnect.sh
Ensure username and certificate name are same, users cannot share certs
#auth-user-pass-verify /etc/openvpn/auth-cn-user.sh via-env
1
2
3
4
5
14. Allow ipv4 traffic forwarding
```sh
# Filename: /etc/sysctl.d/99-enable-ipv4.conf
# Purpose: enable ipv4 forwarding to access other servers routed via bastion
net.ipv4.ip_forward=1
Note:If you provisioned vm’s on OCI disable src/des check on bastion vnic and add a route to the subnet that you want to access via bastion using bastion vnic ip- Make a ipp.txt file which assigns static ip to the openvpn clients and servers
1 2
mounesh-laptop,10.8.0.2, pve,10.8.0.3,
- Create a ccd directory where we put the routes for other Openvpn servers
1 2
# Oracle Cloud Hyderabad VCN subnet iroute 10.20.0.0 255.255.0.0 - Sample client.conf.template file. Place this file in /etc/openvpn with corresponding values so can be used later when issuing certs to the clients. Windows clients uses a file extension client.ovpn ```sh ; Smounesh OpenVPN client config
client
dev tun proto udp
remote customs.smounesh.in
tls-crypt [inline]
resolv-retry infinite nobind
persist-key persist-tun
mute-replay-warnings
; auth-user-pass auth-nocache reneg-sec 0
remote-cert-tls server cipher AES-256-CBC data-ciphers ‘AES-256-CBC’ data-ciphers-fallback ‘AES-256-CBC’
auth SHA256
verb 3
1
2
3
4
5
19. Create a dns record for the public ip of your bastion for the value you put in the remote session of the client.ovpn or client.conf file
20. Start the OpenVPN and set to start on boot
```sh
systemctl enable --now openvpn
- If everything works well you will see a new bridge adapter in 10.8.0.1/24 segment
1
ip a
- Revoke a certificate and add to a certificate revocation list ```bash ./easyrsa revoke zz-test2 ./easyrsa gen-crl
cp pki/crl.pem /etc/openvpn vim /etc/openvpn/server.conf #add: crl-verify /etc/openvpn/crl.pem /etc/init.d/openvpn reload ```
References
- https://community.openvpn.net/openvpn/wiki/HOWTO#Linux
- https://github.com/OpenVPN/easy-rsa/blob/master/README.quickstart.md
TODO
- Check easy-rsa make-safe-ssl command