OpenVPN

sudo apt update && sudo apt install openvpn easy-rsa # Verify openvpn --version

sudo dnf install epel-release sudo dnf install openvpn easy-rsa openvpn --version

sudo pacman -S openvpn easy-rsa

# Download the official installer from: https://openvpn.net/community-downloads/ # Run as Administrator — installs the TAP/TUN adapter and OpenVPN GUI # Import a .ovpn profile via the system tray icon → Import file

# Tunnelblick (free, open source) # https://tunnelblick.net # Double-click a .ovpn file to import it # Or via Homebrew brew install --cask tunnelblick

# Install "OpenVPN Connect" from the App Store or Google Play # Import the .ovpn profile file via AirDrop, email, or QR code

# Copy Easy-RSA to a working directory make-cadir ~/openvpn-ca cd ~/openvpn-ca # Initialise a fresh PKI ./easyrsa init-pki

# ~/openvpn-ca/vars — set your organisation details set_var EASYRSA_REQ_COUNTRY "PT" set_var EASYRSA_REQ_PROVINCE "Porto" set_var EASYRSA_REQ_CITY "Porto" set_var EASYRSA_REQ_ORG "MyOrg" set_var EASYRSA_REQ_EMAIL "admin@example.com" set_var EASYRSA_REQ_OU "VPN" set_var EASYRSA_KEY_SIZE 4096 # RSA key size set_var EASYRSA_ALGO ec # or "rsa" set_var EASYRSA_CURVE secp384r1 # EC curve set_var EASYRSA_CA_EXPIRE 3650 # CA validity: 10 years set_var EASYRSA_CERT_EXPIRE 825 # cert validity: ~2 years

# Build the Certificate Authority — set a strong passphrase when prompted ./easyrsa build-ca # Files created: # pki/ca.crt — CA certificate (distribute to all clients) # pki/private/ca.key — CA private key (NEVER share — keep offline)

# Generate server key + CSR, then sign it with the CA ./easyrsa gen-req server nopass ./easyrsa sign-req server server # Files created: # pki/issued/server.crt # pki/private/server.key

# DH params for key exchange (only needed if not using ECDH) ./easyrsa gen-dh # File created: pki/dh.pem # This takes a few minutes — grab a coffee

# A pre-shared key for authenticating the TLS handshake # Prevents DoS attacks and hides the server from port scanners openvpn --genkey secret ~/openvpn-ca/pki/ta.key

# Replace "client1" with the actual client name — use one cert per user/device ./easyrsa gen-req client1 nopass ./easyrsa sign-req client client1 # Files created: # pki/issued/client1.crt # pki/private/client1.key # Repeat for each additional client: ./easyrsa gen-req client2 nopass ./easyrsa sign-req client client2

# Revoke a client (e.g. lost device, terminated employee) ./easyrsa revoke client1 # Regenerate the Certificate Revocation List ./easyrsa gen-crl # Copy the updated CRL to the server and reload OpenVPN sudo cp pki/crl.pem /etc/openvpn/server/ sudo systemctl reload openvpn-server@server

sudo mkdir -p /etc/openvpn/server # From your PKI machine, copy to the VPN server: sudo cp pki/ca.crt /etc/openvpn/server/ sudo cp pki/issued/server.crt /etc/openvpn/server/ sudo cp pki/private/server.key /etc/openvpn/server/ sudo cp pki/dh.pem /etc/openvpn/server/ # if using RSA sudo cp pki/ta.key /etc/openvpn/server/ sudo cp pki/crl.pem /etc/openvpn/server/ # Lock down permissions sudo chmod 600 /etc/openvpn/server/server.key sudo chmod 600 /etc/openvpn/server/ta.key

# ── Network ──────────────────────────────────────────────────────────── # Listen on UDP 1194 (change port to avoid filters; use TCP 443 to bypass strict firewalls) port 1194 proto udp # udp is faster; use tcp if UDP is blocked dev tun # layer-3 routed tunnel # ── PKI ──────────────────────────────────────────────────────────────── ca /etc/openvpn/server/ca.crt cert /etc/openvpn/server/server.crt key /etc/openvpn/server/server.key dh /etc/openvpn/server/dh.pem # omit if using ECDH (ecdh-curve directive) crl-verify /etc/openvpn/server/crl.pem # TLS authentication key — must match direction on client (server=0, client=1) tls-crypt /etc/openvpn/server/ta.key # ── Tunnel addressing ────────────────────────────────────────────────── # VPN subnet — clients get IPs from this range server 10.8.0.0 255.255.255.0 # Persist IP assignments across reconnects ifconfig-pool-persist /var/log/openvpn/ipp.txt # ── Routing ──────────────────────────────────────────────────────────── # OPTION A — Full tunnel: route ALL client traffic through the VPN push "redirect-gateway def1 bypass-dhcp" push "dhcp-option DNS 1.1.1.1" push "dhcp-option DNS 8.8.8.8" # OPTION B — Split tunnel: only route specific subnets through the VPN # (comment out the redirect-gateway line above, uncomment these) # push "route 192.168.1.0 255.255.255.0" # push "route 10.0.0.0 255.255.0.0" # Allow clients to reach each other through the VPN client-to-client # ── Keepalive & reliability ──────────────────────────────────────────── keepalive 10 120 # ping every 10s, assume dead after 120s persist-key persist-tun # ── Security ─────────────────────────────────────────────────────────── cipher AES-256-GCM # modern AEAD cipher auth SHA256 # HMAC digest tls-version-min 1.2 # refuse TLS < 1.2 tls-cipher TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384:TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384 # Drop privileges after startup user nobody group nogroup # use "nobody" on RHEL/Fedora # ── Logging ──────────────────────────────────────────────────────────── status /var/log/openvpn/openvpn-status.log log-append /var/log/openvpn/openvpn.log verb 3 # verbosity: 0=silent, 3=normal, 6=debug mute 20 # suppress repeated log lines # ── Misc ─────────────────────────────────────────────────────────────── max-clients 100 # maximum simultaneous connections compress lz4-v2 # compression (disable if all traffic is already encrypted) push "compress lz4-v2"

# Enable IP forwarding permanently echo "net.ipv4.ip_forward = 1" | sudo tee /etc/sysctl.d/99-openvpn.conf sudo sysctl -p /etc/sysctl.d/99-openvpn.conf # NAT — masquerade VPN client traffic through the server's public interface # Replace eth0 with your actual internet-facing interface # iptables sudo iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE sudo iptables -A FORWARD -i tun0 -j ACCEPT sudo iptables -A FORWARD -o tun0 -j ACCEPT # Make iptables rules persistent sudo netfilter-persistent save # nftables equivalent sudo nft add table ip nat sudo nft add chain ip nat postrouting '{ type nat hook postrouting priority srcnat; }' sudo nft add rule ip nat postrouting ip saddr 10.8.0.0/24 oifname "eth0" masquerade

# ufw sudo ufw allow 1194/udp sudo ufw reload # firewalld sudo firewall-cmd --zone=public --add-service=openvpn --permanent sudo firewall-cmd --reload # iptables sudo iptables -A INPUT -p udp --dport 1194 -j ACCEPT

sudo mkdir -p /var/log/openvpn # Start and enable the server sudo systemctl enable --now openvpn-server@server # Check status sudo systemctl status openvpn-server@server # Follow the log sudo tail -f /var/log/openvpn/openvpn.log

client dev tun proto udp remote YOUR_SERVER_IP_OR_DOMAIN 1194 # ← replace with your server's public IP resolv-retry infinite nobind persist-key persist-tun # Security — must match server cipher AES-256-GCM auth SHA256 tls-version-min 1.2 # TLS key direction (client must use direction 1, server uses 0) key-direction 1 verb 3 # ── Inline certificates ───────────────────────────────────────────── # Paste the contents of each file between the tags below <ca> -----BEGIN CERTIFICATE----- (paste contents of ca.crt here) -----END CERTIFICATE----- </ca> <cert> -----BEGIN CERTIFICATE----- (paste contents of client1.crt here) -----END CERTIFICATE----- </cert> <key> -----BEGIN PRIVATE KEY----- (paste contents of client1.key here) -----END PRIVATE KEY----- </key> <tls-crypt> -----BEGIN OpenVPN Static key V1----- (paste contents of ta.key here) -----END OpenVPN Static key V1----- </tls-crypt>

#!/bin/bash # gen-client.sh — run from ~/openvpn-ca # Usage: ./gen-client.sh client1 CLIENT=$1 PKI=~/openvpn-ca/pki SERVER_IP="YOUR_SERVER_IP" SERVER_PORT="1194" PROTO="udp" OUTPUT=~/${CLIENT}.ovpn cat > "$OUTPUT" <<EOF client dev tun proto ${PROTO} remote ${SERVER_IP} ${SERVER_PORT} resolv-retry infinite nobind persist-key persist-tun cipher AES-256-GCM auth SHA256 tls-version-min 1.2 key-direction 1 verb 3 EOF echo "<ca>" >> "$OUTPUT" cat "$PKI/ca.crt" >> "$OUTPUT" echo "</ca>" >> "$OUTPUT" echo "<cert>" >> "$OUTPUT" # Extract only the certificate block sed -n '/-----BEGIN CERTIFICATE-----/,/-----END CERTIFICATE-----/p' \ "$PKI/issued/${CLIENT}.crt" >> "$OUTPUT" echo "</cert>" >> "$OUTPUT" echo "<key>" >> "$OUTPUT" cat "$PKI/private/${CLIENT}.key" >> "$OUTPUT" echo "</key>" >> "$OUTPUT" echo "<tls-crypt>" >> "$OUTPUT" cat "$PKI/ta.key" >> "$OUTPUT" echo "</tls-crypt>" >> "$OUTPUT" chmod 600 "$OUTPUT" echo "Profile written to $OUTPUT"

# Generate profiles for each client chmod +x gen-client.sh ./gen-client.sh client1 ./gen-client.sh client2

# Debian / Ubuntu sudo apt install openvpn # RHEL / Fedora sudo dnf install openvpn

# Connect using the .ovpn profile (runs in foreground) sudo openvpn --config client1.ovpn # Connect in the background sudo openvpn --config client1.ovpn --daemon # With verbose logging to see what's happening sudo openvpn --config client1.ovpn --verb 6

# Place the config in the OpenVPN client directory sudo cp client1.ovpn /etc/openvpn/client/client1.conf # Enable and start sudo systemctl enable --now openvpn-client@client1 # Check status sudo systemctl status openvpn-client@client1 # Follow the log sudo journalctl -u openvpn-client@client1 -f

# A tun0 interface should appear ip addr show tun0 # The VPN server's gateway should be in your routing table ip route show # Ping the VPN server's tunnel IP ping 10.8.0.1 # Full-tunnel: check your public IP has changed curl https://ifconfig.me # Split-tunnel: verify VPN routes are present ip route | grep 10.8

# If running in foreground — Ctrl+C # If running as a daemon sudo pkill openvpn # If running as a systemd service sudo systemctl stop openvpn-client@client1

# 1. Download OpenVPN GUI from https://openvpn.net/community-downloads/ # 2. Run the installer as Administrator # 3. Copy client1.ovpn to: # C:\Users\YourName\OpenVPN\config\client1.ovpn # (the GUI also accepts drag-and-drop import) # 4. Right-click the OpenVPN system tray icon → Connect

# Run PowerShell as Administrator cd "C:\Program Files\OpenVPN\bin" # Connect .\openvpn.exe --config "C:\Users\YourName\OpenVPN\config\client1.ovpn" # Connect in background (as a Windows service) # Use the GUI or: sc start OpenVPNService

# In PowerShell or cmd ipconfig # look for a "TAP-Windows Adapter" or "OpenVPN Wintun" # with a 10.8.0.x address route print # check routing table for VPN routes # Check public IP curl https://ifconfig.me

# 1. Install Tunnelblick from https://tunnelblick.net # 2. Double-click client1.ovpn — Tunnelblick imports it automatically # 3. Click the Tunnelblick menu bar icon → Connect client1 # 4. Verify: System Preferences → Network — a new VPN interface appears # Command line via Tunnelblick's openvpn binary: sudo /Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-*/openvpn \ --config ~/client1.ovpn

# 1. Install "OpenVPN Connect" from the App Store # 2. Transfer client1.ovpn to the device via: # - AirDrop from Mac # - Email attachment (open with OpenVPN Connect) # - Files app from a cloud storage folder # 3. Tap the imported profile → Add → Connect

# 1. Install "OpenVPN Connect" from Google Play # 2. Transfer client1.ovpn to the device via: # - USB file transfer # - Cloud storage (Google Drive, etc.) # 3. Open the app → + → File → select client1.ovpn → Import → Connect

# In server.conf — push these directives to clients: push "redirect-gateway def1 bypass-dhcp" push "dhcp-option DNS 1.1.1.1" push "dhcp-option DNS 8.8.8.8" # Effect: # Client default route → VPN → server → internet # All DNS queries resolve through the server's DNS # Client's real IP is hidden from the internet # All client traffic flows through your server (use for privacy, remote work)

# In server.conf — remove redirect-gateway, push specific routes: # push "redirect-gateway def1 bypass-dhcp" ← comment this out push "route 192.168.1.0 255.255.255.0" # reach the office LAN push "route 10.0.0.0 255.255.0.0" # reach internal servers push "dhcp-option DNS 192.168.1.1" # use internal DNS for VPN traffic # Effect: # Traffic to 192.168.1.x and 10.0.x.x → VPN # Everything else → client's normal internet connection # Lower load on the VPN server # Client retains local internet speed for browsing

# Push different routes to a specific client using a client config directory # In server.conf: client-config-dir /etc/openvpn/server/ccd # /etc/openvpn/server/ccd/client1 # Assign a fixed IP to client1 ifconfig-push 10.8.0.10 10.8.0.11 # Push an extra route only to client1 push "route 172.16.0.0 255.255.0.0" # /etc/openvpn/server/ccd/client2 ifconfig-push 10.8.0.20 10.8.0.21

# Read the status file (updates every 60s by default) sudo cat /var/log/openvpn/openvpn-status.log # Follow the main log sudo tail -f /var/log/openvpn/openvpn.log # Via systemd journal sudo journalctl -u openvpn-server@server -f # List active connections using the management interface (if enabled) # Add to server.conf: management localhost 7505 echo "status" | nc localhost 7505

# In server.conf — add: management localhost 7505 management-client-auth # optional: require client auth on management socket # Restart server to activate sudo systemctl restart openvpn-server@server # Connect and issue commands nc localhost 7505 # Commands: # status — list connected clients # kill client1 — forcibly disconnect a client # log 10 — show last 10 log lines # quit — exit

# Via management interface echo "kill client1" | nc localhost 7505 # Or by revoking their cert and reloading (permanent) cd ~/openvpn-ca ./easyrsa revoke client1 ./easyrsa gen-crl sudo cp pki/crl.pem /etc/openvpn/server/ sudo systemctl reload openvpn-server@server

# SIGHUP causes OpenVPN to re-read its config and CRL sudo systemctl reload openvpn-server@server # or: sudo kill -HUP $(pgrep -f "openvpn.*server")

# In server.conf: port 443 proto tcp # Note: TCP over TCP (VPN over TCP tunnel) can cause performance issues # under packet loss. Only use TCP 443 if UDP is blocked.

# Create a second config file sudo cp /etc/openvpn/server/server.conf /etc/openvpn/server/server-tcp.conf # Edit server-tcp.conf — change port and proto port 443 proto tcp server 10.9.0.0 255.255.255.0 # different VPN subnet status /var/log/openvpn/openvpn-tcp-status.log # Start second instance sudo systemctl enable --now openvpn-server@server-tcp

# In server.conf — replace "dh dh.pem" with: dh none ecdh-curve secp384r1 # No need to generate or distribute dh.pem # Perfect Forward Secrecy via ECDHE key exchange

# Install google-authenticator PAM module sudo apt install libpam-google-authenticator # In server.conf — add: plugin /usr/lib/openvpn/openvpn-plugin-auth-pam.so openvpn reneg-sec 0 # In client.ovpn — add: auth-user-pass # prompts for username + OTP as password # Configure PAM for OpenVPN: # /etc/pam.d/openvpn auth required pam_google_authenticator.so

# In server.conf — only allow certs with matching CN patterns: tls-verify "/etc/openvpn/server/verify-cn.sh" # /etc/openvpn/server/verify-cn.sh #!/bin/bash # $1 = depth, $2 = CN if [ "$1" = "0" ]; then case "$2" in client*) exit 0 ;; # allow any CN starting with "client" *) exit 1 ;; esac fi exit 0

# Allow OpenVPN UDP port sudo ufw allow 1194/udp # Allow forwarding — edit /etc/default/ufw: DEFAULT_FORWARD_POLICY="ACCEPT" # Add NAT rule at the top of /etc/ufw/before.rules (before *filter): *nat :POSTROUTING ACCEPT [0:0] -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE COMMIT # Enable ufw forwarding in /etc/ufw/sysctl.conf: net/ipv4/ip_forward=1 # Reload sudo ufw disable && sudo ufw enable

# Allow OpenVPN service sudo firewall-cmd --zone=public --add-service=openvpn --permanent # Enable masquerade on the external zone sudo firewall-cmd --zone=external --add-masquerade --permanent # Add VPN interface to the internal zone sudo firewall-cmd --zone=internal --add-interface=tun0 --permanent # Allow forwarding from VPN zone to external sudo firewall-cmd --new-policy=vpn-to-wan --permanent sudo firewall-cmd --policy=vpn-to-wan --add-ingress-zone=internal --permanent sudo firewall-cmd --policy=vpn-to-wan --add-egress-zone=external --permanent sudo firewall-cmd --policy=vpn-to-wan --set-target=ACCEPT --permanent sudo firewall-cmd --reload

table inet firewall { chain input { type filter hook input priority filter; policy drop; iifname "lo" accept ct state { established, related } accept udp dport 1194 accept # OpenVPN # SSH (adjust to your admin port) tcp dport 22 ct state new accept } chain forward { type filter hook forward priority filter; policy drop; # Allow forwarding between tun0 and eth0 iifname "tun0" oifname "eth0" accept iifname "eth0" oifname "tun0" ct state { established, related } accept } } table ip nat { chain postrouting { type nat hook postrouting priority srcnat; ip saddr 10.8.0.0/24 oifname "eth0" masquerade } }

# Run OpenVPN with maximum verbosity (run as test — not in production) sudo openvpn --config server.conf --verb 9 # Check TUN module is loaded lsmod | grep tun sudo modprobe tun # Verify server is listening sudo ss -ulnp | grep 1194 # UDP sudo ss -tlnp | grep 1194 # TCP # Check IP forwarding sysctl net.ipv4.ip_forward # View active NAT rules sudo iptables -t nat -L -v -n sudo nft list table ip nat # Trace a packet through the tunnel sudo tcpdump -i tun0 # Test UDP connectivity to the server from a client machine nc -u server-ip 1194