Wiki

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== Ubuntu - VPN - OpenVPN - Setup an OpenVPN Server ======

===== Install OpenVPN server and openssl =====

<code bash>
apt install openvpn openssl easy-rsa
</code>

<WRAP info>
**NOTE:**  The **easy-rsa** will make the creation of certificates much easier.
</WRAP>


----

===== Change directory to the Easy-RSA directory =====

Change the directory to the easy-rsa directory in the OpenVPN directory:

<code bash>
cd /etc/openvpn/easy-rsa/
</code>

<WRAP info>
**NOTE:**  If the directory is not there, copy it over:

<code bash>
cp -R /usr/share/easy-rsa/* easy-rsa/
</code>

</WRAP>

----

===== Modify Easy-RSA Config file =====

Modify the vars file in the easy-rsa directory:

<code bash>
vi vars
</code>

Change the following lines to your needs:

<file bash /etc/openvpn/easy-rsa/vars>
export KEY_SIZE=2048
export KEY_COUNTRY="JE"
export KEY_PROVINCE="La Pouquelaye"
export KEY_CITY="St. Helier"
export KEY_ORG="local"
export KEY_EMAIL="openvpn@domain.local"
export KEY_OU="domain.local"
</file>

----

===== Export the Easy-RSA settings =====

<code bash>
./vars
</code>

----

===== Remove old certificates and configurations =====

<code bash>
./clean-all
</code>

----

===== Generate the CA =====

<WRAP alert>
**ALERT:**  Keep these secure!
</WRAP>


<code bash>
./build-ca
</code>

<WRAP info>
**NOTE:**  This will create the following files needed for the CA to sign certificates.

  * ca.crt
  * ca.key

</WRAP>

----

===== Create a certificate for the OpenVPN server =====

<code bash>
./build-key-server test.domain.local
</code>

<WRAP info>
**NOTE:**  This will generate the server certificate files which is used by the OpenVPN server.

  * test.domain.local.crt
  * test.domain.local.csr
  * test.domain.local.key

</WRAP>

----

===== Generate a Diffie-Hellman Parameter file =====

<code bash>
./build-dh
</code>

<WRAP info>
**NOTE:**  This will create this file:

  * dh2048.pem

</WRAP>

----

===== Create the certificates for the clients =====

<code bash>
./build-key client.domain.local
</code>

<WRAP info>
**NOTE:**  This needs to be done for every client and will create those files:

  * client.domain.local.crt
  * client.domain.local.csr
  * client.domain.local.key

</WRAP>

----

===== Copy files to the client =====

The following files need to be copied.

  * ca.crt
  * client.domain.local.crt
  * client.domain.local.key