OpenVPN/Stunnel

Guide

Instructions

Link

Useful link here: http://kyl191.net/2012/12/tunneling-openvpn-through-stunnel/

See Stunnel page for the basics. Reviewing some of those steps here.

Create Stunnel Server SSL Certificate

Main article: Stunnel/Certificates

Start by creating an SSL certificate for the stunnel server:

openssl req -new -x509 -days 3650 -nodes -out /etc/stunnel/stunnel.pem -keyout /etc/stunnel/stunnel.pem

This puts the SSL certificate in the /etc/stunnel directory.

Configure OpenVPN

Barebones conf file:

cert = /etc/stunnel/stunnel.pem
pid = /var/run/stunnel.pid
output = /var/log/stunnel

[openvpn]
accept=9999
connect=ip.add.re.ss:1337

Here, we're using port 9999. This is a bad idea, since Stunnel normally uses 443. But this is just to illustrate how to set the port. More info here: [1]

Verify openvpn process is up and listening:

netstat -nlp | grep openvpn

Open Hole in Firewall

Now use iptables to open up the firewall. Assuming you're using port 9999:

iptables -A INPUT -p tcp --dport 9999 -j ACCEPT

Run Stunnel on Boot

Make stunnel run on boot by editing crontab crontab -e and adding:

@reboot stunnel /etc/stunnel/stunnel.conf

Configure Stunnel

Now we will edit stunnel.conf (ignore the .cnf file). Edit this file to include the following 4 lines:

[openvpn]
client = yes
accept = 127.0.0.1:31337
connect = ip.add.re.ss:9999

OpenVPN needs to be configured to use this port 9999. This means you can replace connection profiles with ports with "remote localhost 31337". (Assumes TCP not UDP.) <-- ?

References

Useful link: http://home.arcor.de/lightsky/docs/stunnel_openssl_synergy.pdf

Another useful link: http://kyl191.net/2012/12/tunneling-openvpn-through-stunnel/