Trace:

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
deb9:openvpn [2023/05/12 16:32] – [Links] Bernard Condraudeb9:openvpn [2026/08/14 20:13] (current) – Bernard Condrau
Line 1: Line 1:
 ====== OpenVPN ====== ====== OpenVPN ======
-Follow one of the excellent guides from DigitalOcean. Follow all the steps to the detail and everything will work, below are modifications I made for my personal requirements. Make sure you run commands as regular user and only elevate to root when told to do so. +Follow one of the excellent guides from DigitalOcean (see [[#links|Links]] below). Follow all the steps to the detail and everything will work, below are modifications I made for my personal requirements. Make sure you run commands as regular user and only elevate to root when told to do so. 
-  * [[https://www.digitalocean.com/community/tutorials/how-to-set-up-an-openvpn-server-on-debian-11|How To Set Up an OpenVPN Server on Debian 11]] +
-  * [[https://www.digitalocean.com/community/tutorials/how-to-set-up-an-openvpn-server-on-debian-10|How To Set Up an OpenVPN Server on Debian 10]] +
-  * [[https://www.digitalocean.com/community/tutorials/how-to-set-up-an-openvpn-server-on-debian-9|How To Set Up an OpenVPN Server on Debian 9]]+
 ===== Prerequisites ===== ===== Prerequisites =====
   - Make sure you followed [[https://www.digitalocean.com/community/tutorials/initial-server-setup-with-debian-9|Initial Server Setup with Debian 9]] before you setup the VPN Server   - Make sure you followed [[https://www.digitalocean.com/community/tutorials/initial-server-setup-with-debian-9|Initial Server Setup with Debian 9]] before you setup the VPN Server
Line 11: Line 9:
   - Install [[https://github.com/OpenVPN/easy-rsa/releases|EasyRSA]]   - Install [[https://github.com/OpenVPN/easy-rsa/releases|EasyRSA]]
  
 +===== Migrating server =====
 +If you resinstall OpenVPN on a new machine with existing client configurations do the following:
 +  - Copy ''/etc/openvpn/'' from the old server and copy to the new server
 +  - Follow [[https://www.digitalocean.com/community/tutorials/how-to-set-up-an-openvpn-server-on-debian-11#step-5-adjusting-the-server-networking-configuration|Adjusting the Server Networking Configuration]] (steps 5 and 6)
 +  - Check the VPN is running with<file>sudo systemctl status openvpn@server</file>
 ===== Adding Clients ===== ===== Adding Clients =====
 Setting up the environment (//VPN Server(s)// and //CA Server//) takes a while, the many steps are outlined clearly and in detail in the Original Article below in [[deb9:openvpn#original_article|my Wiki]] or on the [[https://www.digitalocean.com/community/tutorials/how-to-set-up-an-openvpn-server-on-debian-9|DigitalOcean]] website. In this paragraph I summarized the steps necessary to add clients to the VPN. Since both //VPN Servers// use the same credentials, the process is identical apart from using a different //base.conf// file which contains the server's IP address. Setting up the environment (//VPN Server(s)// and //CA Server//) takes a while, the many steps are outlined clearly and in detail in the Original Article below in [[deb9:openvpn#original_article|my Wiki]] or on the [[https://www.digitalocean.com/community/tutorials/how-to-set-up-an-openvpn-server-on-debian-9|DigitalOcean]] website. In this paragraph I summarized the steps necessary to add clients to the VPN. Since both //VPN Servers// use the same credentials, the process is identical apart from using a different //base.conf// file which contains the server's IP address.
Line 20: Line 23:
  
 === CA Server === === CA Server ===
-  * Log in to your //CA Server// and copy the client1.req file from the //VPN Server//:<code>$ resync -avz -e "ssh -p <port>" user@vpn.server.com:EasyRSA-3.0.4/pki/reqs/client1.req ~/EasyRSA-3.0.4/pki/reqs/.</code>+  * Log in to your //CA Server// and copy the client1.req file from the //VPN Server//:<code>$ rsync -avz -e "ssh -p <port>" user@vpn.server.com:EasyRSA-3.0.4/pki/reqs/client1.req ~/EasyRSA-3.0.4/pki/reqs/.</code>
   * Navigate to the EasyRSA directory and sign the request, be sure to specify the client request type:<file>$ ./easyrsa sign-req client client1</file>At the prompt, enter **yes** to confirm that you intend to sign the certificate request and that it came from a trusted source. This will create a client certificate file named client1.crt.   * Navigate to the EasyRSA directory and sign the request, be sure to specify the client request type:<file>$ ./easyrsa sign-req client client1</file>At the prompt, enter **yes** to confirm that you intend to sign the certificate request and that it came from a trusted source. This will create a client certificate file named client1.crt.
-  * Copy the signed client1.crt file back to the //VPN Server//:<code>$ resync -avz -e "ssh -p <port>" ~/EasyRSA-3.0.4/pki/issued/client1.crt user@vpn.server.com:client-configs/keys/</code>+  * Copy the signed client1.crt file back to the //VPN Server//:<code>$ rsync -avz -e "ssh -p <port>" ~/EasyRSA-3.0.4/pki/issued/client1.crt user@vpn.server.com:client-configs/keys/</code>
  
 === VPN Server === === VPN Server ===
Line 30: Line 33:
   * Install the //OpenVPN Client// for [[https://openvpn.net/community-downloads/|Windows]], [[https://play.google.com/store/apps/details?id=de.blinkt.openvpn&hl=en|Android]], or other platforms.   * Install the //OpenVPN Client// for [[https://openvpn.net/community-downloads/|Windows]], [[https://play.google.com/store/apps/details?id=de.blinkt.openvpn&hl=en|Android]], or other platforms.
   * On Android, open the app and select the import icon top right to import the config file.{{ :deb9:openvpn.png?200|}} You should now be able to open the VPN by selecting the profile created from the config file imported.   * On Android, open the app and select the import icon top right to import the config file.{{ :deb9:openvpn.png?200|}} You should now be able to open the VPN by selecting the profile created from the config file imported.
 +
 +===== Managing network =====
 +  * If you have more than one network adapter enabled you need to make sure that the OpenVPN settings match the default adapter. This can be necessary, when you have a virtual machine running on your main server, for example to host websites, and the virtual machine get's its IP address from a DHCP server in the system.
 +  * Check active adapters:<code>ip route show</code>
 +  * Disable the adapter (example IP and device enp47s0):<code>ip addr del 192.168.3.101/24 dev enp47s0</code>
 +  * To make it permanent for **NetworkManager**
 +    - Create a new connection profile<code>sudo nmcli connection add type ethernet con-name "MyConnection" ifname enp47s0</code>
 +    - Disable IP configurations<code>sudo nmcli connection modify "MyConnection" ipv4.method "disabled" ipv6.method "disabled"</code>
 +    - Bring the interface up<code>sudo nmcli connection up "MyConnection"</code>
  
 ===== Links ===== ===== Links =====
-  * [[https://easy-rsa.readthedocs.io/en/latest/Easy-RSA 3]]+  * [[https://www.digitalocean.com/community/tutorials/how-to-set-up-an-openvpn-server-on-debian-11|How To Set Up an OpenVPN Server on Debian 11]] 
 +  * [[https://www.digitalocean.com/community/tutorials/how-to-set-up-an-openvpn-server-on-debian-10|How To Set Up an OpenVPN Server on Debian 10]] 
 +  * [[https://www.digitalocean.com/community/tutorials/how-to-set-up-an-openvpn-server-on-debian-9|How To Set Up an OpenVPN Server on Debian 9]] 
 +  * [[https://easy-rsa.readthedocs.io/en/latest/|Easy-RSA 3]] 
 +  * [[https://github.com/OpenVPN/easy-rsa/releases|Github Easy-RSA]]
   * [[https://openvpn.net/community-resources/how-to/#scope|OpenVPN HowTo]]   * [[https://openvpn.net/community-resources/how-to/#scope|OpenVPN HowTo]]
   * [[https://forums.openvpn.net/viewtopic.php?t=19311|Problem connecting to local resources from a laptop]]   * [[https://forums.openvpn.net/viewtopic.php?t=19311|Problem connecting to local resources from a laptop]]

Know How

© 2007-2026 Bernard Condrau - Powered by DokuWiki