Setting Up an OpenVPN Server

Remote access to services hosted on a home network is sometimes necessary, but exposing all services to the internet is not ideal from a security standpoint. OpenVPN can be used to establish a secure, encrypted connection between an external network and a home LAN, allowing clients such as iPhones or PCs to access private IP addresses as if they were within the home network.

For security reasons, the Certificate Authority (CA) server and the VPN server are separated. The system consists of:

• CA Server: Signs certificates for clients and the VPN server.
• VPN Server: Establishes a VPN tunnel with external clients.
• Clients: Devices connecting from external networks.

Setting Up the CA Server

#

Installing easy-rsa

#

# Arch Linux
sudo pacman -S easy-rsa

Initializing the CA

#

cd /etc/easy-rsa
# Arch Linux
sudo easyrsa init-pki
sudo easyrsa build-ca

A passphrase is required for the CA key. The Common Name can be left as default.

Setting Up the VPN Server

#

Installing OpenVPN and easy-rsa

#

# Arch Linux
sudo pacman -S openvpn easy-rsa

Copying the CA Certificate

#

The CA’s public key (/etc/easy-rsa/pki/ca.crt) must be copied to /etc/openvpn/server/ on the VPN server with root ownership.

# example
scp /etc/easy-rsa/pki/ca.crt vpn-server:/etc/openvpn/server/

Ensure the permissions of ca.crt are restricted to root.

Generating the Server Certificate

#

cd /etc/easy-rsa
sudo easyrsa init-pki
sudo easyrsa gen-req server nopass
sudo cp /etc/easy-rsa/pki/private/server.key /etc/openvpn/server/

Common Name can be left as default.

Generating Diffie-Hellman Parameters

#

sudo openssl dhparam -out /etc/openvpn/server/dh.pem 2048

Creating an HMAC Key

#

sudo openvpn --genkey --secret /etc/openvpn/server/ta.key

This enhances security by rejecting improperly signed packets.

Creating OpenVPN Client Certificates

#

Generating Client Certificates

#

cd /etc/easy-rsa
sudo easyrsa gen-req client1 nopass

Common Name can be left as default.

Copying Certificate Requests to the CA Server

#

scp /etc/easy-rsa/pki/reqs/{server,client1}.req ca-server:/tmp/

Signing Certificates on the CA Server

#

cd /etc/easy-rsa
sudo easyrsa import-req /tmp/server.req server
sudo easyrsa import-req /tmp/client1.req client1
sudo easyrsa sign-req server server
sudo easyrsa sign-req client client1

Enter the CA passphrase when prompted.

Copying Signed Certificates to the VPN Server

#

scp /etc/easy-rsa/pki/issued/server.crt vpn-server:/etc/openvpn/server/

Configuring OpenVPN

#

Copying Configuration Samples

#

sudo cp /usr/share/openvpn/examples/server.conf /etc/openvpn/server/

Updating server.conf

#

• Certificate and key settings:

  ca ca.crt
  cert server.crt
  key server.key
  dh dh.pem

• HMAC key:

  tls-auth ta.key 0

• Running OpenVPN as a non-root user:

  user nobody
  group nobody

• Port and protocol:

  port 1194
  proto udp

• Subnet:

  server 10.8.0.0 255.255.255.0

• Encryption settings:

  cipher AES-256-GCM
  auth SHA512
  tls-version-min 1.3

• Compression:

  compress lz4-v2a
  push "compress lz4-v2"

• Routing all traffic through VPN:

  push "redirect-gateway def1 bypass-dhcp"
  push "dhcp-option DNS 1.1.1.1"

Starting and Enabling OpenVPN Service

#

sudo systemctl start [email protected]
sudo systemctl enable [email protected]

Firewall Configuration

#

Allow UDP port 1194:

iptables -A INPUT -p udp --dport 1194 -j ACCEPT

Allow traffic from VPN clients:

iptables -A INPUT -p tcp -s 10.8.0.0/24 --dport 22 -j ACCEPT
iptables -t nat -A POSTROUTING -o ens192 -s 10.8.0.0/24 -j MASQUERADE
iptables -I FORWARD -o ens192 -s 10.8.0.0/24 -j ACCEPT

For further details, refer to: iptables Configuration.

Creating OpenVPN Client Profiles

#

Installing ovpngen

#

# Arch Linux
yay -S ovpngen

If not installed yay, refer to Installing yay on Arch Linux to install it.。

Generating Client Profile

#

ovpngen vpn.example.com /etc/openvpn/server/ca.crt \
  /etc/easy-rsa/pki/issued/client1.crt \
  /etc/easy-rsa/pki/private/client1.key \
  /etc/openvpn/server/ta.key > client.ovpn

Updating client.ovpn

#

Ensure the cipher and authentication settings match the server:

cipher AES-256-GCM
auth SHA512

Connecting from a Client

#

Transfer client.ovpn to the client device and import it into an OpenVPN client application.