Ubuntu/OpenVPN Server - Revision history

Unknown user at 00:18, 19 August 2020

2020-08-19T00:18:14Z

← Older revision		Revision as of 00:18, 19 August 2020
Line 1:		Line 1:
	~~{{Main\|Ubuntu/Bespin}}~~

	This page gives an overview of how to install and set up an OpenVPN server on Ubuntu 18.04.		This page gives an overview of how to install and set up an OpenVPN server on Ubuntu 18.04.

Line 651:		Line 649:
	[[Category:Unix]]		[[Category:Unix]]
	[[Category:Ubuntu]]		[[Category:Ubuntu]]
			[[Category:VPN]]
	[[Category:OpenVPN]]		[[Category:OpenVPN]]
	~~[[Category:Bespin]]~~

2020-08-19T00:16:02Z

Configure iptables

← Older revision		Revision as of 00:16, 19 August 2020
Line 200:		Line 200:
	Just kidding, iptables doesn't require any configuration!		Just kidding, iptables doesn't require any configuration!

	This VPN tunnel will not share any traffic with other networks on ~~Bespin (the~~ server), so no need for packets on the OpenVPN tunnel to go to other devices.		This VPN tunnel will not share any traffic with other networks on this server, so no need for packets on the OpenVPN tunnel to go to other devices.

	===Side Note - DNS===		===Side Note - DNS===

	~~On the other hand, if~~ you ~~wanted~~ to provide DNS ~~for your hotspot using your local DNS server (and the spiffy PiHole we set up at [[Ubuntu/Bespin/PiHole]])~~, you can push a DNS rule to the VPN. This is useful even if clients aren't tunneling all their traffic through the VPN, because it replaces the DNS they are using.		If you want to provide DNS to VPN clients, you can push a DNS rule to the VPN. This is useful even if clients aren't tunneling all their traffic through the VPN, because it replaces the DNS they are using.

	You also need to use iptabels to allow packet traffic from the wifi network to the local DNS server(s). You should probably limit this to port 53 only, unless you're tunneling all traffic through the VPN.		You also need to use iptabels to allow packet traffic from the wifi network to the local DNS server(s). You should probably limit this to port 53 only, unless you're tunneling all traffic through the VPN.

2020-08-19T00:14:24Z

Configure VPN Server Startup Service

← Older revision		Revision as of 00:14, 19 August 2020
Line 184:		Line 184:
	</pre>		</pre>

	~~Recall that we also ran the following~~ command to force the OpenVPN startup service to use an .ovpn file instead of a .conf file ~~(see VPN tunnel setup for PIA on [[Ubuntu/Bespin]] page). Re-run it if you haven't already~~:		Run this command to force the OpenVPN startup service to use an .ovpn file instead of a .conf file:

	<pre>		<pre>

2020-08-19T00:13:51Z

← Older revision	Revision as of 00:13, 19 August 2020
(No difference)

2020-07-09T20:55:33Z

Generate OpenVPN Profile

← Older revision		Revision as of 20:55, 9 July 2020
Line 385:		Line 385:
	echo '</key>'		echo '</key>'
	echo '<tls-auth>'		echo '<tls-auth>'
	cat /opt/~~esay~~-rsa/keys/statictlssecret.key		cat /opt/easy-rsa/keys/statictlssecret.key
	echo '</tls-auth>'		echo '</tls-auth>'
	echo '<cert>'		echo '<cert>'

2020-07-09T20:52:58Z

Configure OpenVPN Client

← Older revision		Revision as of 20:52, 9 July 2020
Line 330:		Line 330:
	==Configure OpenVPN Client==		==Configure OpenVPN Client==

	Configure the OpenVPN client by creating a client config file. We create this in <code>/opt/openvpn</code>, and use it to create the OpenVPN profile in a few steps.		Configure the OpenVPN client by creating a client config file. We create this in <code>/opt/openvpn</code>, and use it to create the OpenVPN profile in <code>/etc/openvpn</code> a few steps.

	<code>/opt/openvpn/openvpn_client.conf</code>		<code>/opt/openvpn/openvpn_client.conf</code>

2020-07-09T20:52:36Z

Configure OpenVPN Client

← Older revision		Revision as of 20:52, 9 July 2020
Line 330:		Line 330:
	==Configure OpenVPN Client==		==Configure OpenVPN Client==

	Configure the OpenVPN client by creating a client config file. We create this in <code>/opt/openvpn</code> ~~first~~, ~~then copy~~ it to ~~<code>/etc/openvpn</code>~~.		Configure the OpenVPN client by creating a client config file. We create this in <code>/opt/openvpn</code>, and use it to create the OpenVPN profile in a few steps.

	<code>/opt/openvpn/openvpn_client.conf</code>		<code>/opt/openvpn/openvpn_client.conf</code>

2020-07-09T20:50:42Z

Adding MFA to VPN Access

← Older revision		Revision as of 20:50, 9 July 2020
Line 268:		Line 268:
	auth optional pam_unix.so		auth optional pam_unix.so
	auth optional /lib/x86_64-linux-gnu/security/pam_google_authenticator.so secret=/etc/openvpn/google-authenticator/${USER} user=gauth try_first_pass		auth optional /lib/x86_64-linux-gnu/security/pam_google_authenticator.so secret=/etc/openvpn/google-authenticator/${USER} user=gauth try_first_pass
			</pre>

			Set permissions:

			<pre>
			chmod 0644 /etc/pam.d/openvpn
			chown root:root /etc/pam.d/openvpn
	</pre>		</pre>

2020-07-09T20:42:30Z

Side Note - DNS

← Older revision		Revision as of 20:42, 9 July 2020
Line 219:		Line 219:
	push "dhcp-option DNS 192.168.20.1"		push "dhcp-option DNS 192.168.20.1"
	</pre>		</pre>

			and go through the steps listed above to re-create the OpenVPN server profile.

	==Configure PAM==		==Configure PAM==

2020-07-09T20:42:03Z

Side Note - DNS

← Older revision		Revision as of 20:42, 9 July 2020
Line 212:		Line 212:
	You should also modify the OpenVPN config file - either the server or the client - to use the VPN gateway for DNS.		You should also modify the OpenVPN config file - either the server or the client - to use the VPN gateway for DNS.

	To do that ~~from~~ the server ~~config~~ file~~, add this line~~:		To push that rule to clients, put this line in the OpenVPN server configuration file:

			<code>/opt/openvpn/server.conf</code>

	<pre>		<pre>