OpenVPN is a popular open-source VPN (Virtual Private Network) software that allows you to securely connect your devices to a private network over the internet. In this article, we will guide you through the process of setting up OpenVPN on a Windows Server for Active Directory authentication.
Prerequisites
Before we begin, make sure you have the following prerequisites:
- A Windows Server with administrative access
- An Active Directory domain set up
- OpenVPN software installed on the server
- Client devices running Windows operating system
Step 1: Install OpenVPN on Windows Server
First, download the latest version of OpenVPN for Windows from the official website. Run the installer and follow the on-screen instructions to complete the installation.
Step 2: Generate Certificates and Keys
OpenVPN requires certificates and keys for secure authentication. To generate these, open the Command Prompt as an administrator and navigate to the OpenVPN installation directory.
cd C:\Program Files\OpenVPN\easy-rsa
Next, run the following command to initialize the necessary files:
init-config.bat
Then, generate the certificates and keys by running the following command:
vars.bat
clean-all.bat
build-ca.bat
build-key-server.bat server
build-dh.bat
This will create the necessary files in the "keys" directory within the OpenVPN installation directory.
Step 3: Configure OpenVPN Server
Now, let's configure the OpenVPN server. Open the file "server.ovpn" located in the "config" directory within the OpenVPN installation directory using a text editor.
notepad "C:\Program Files\OpenVPN\config\server.ovpn"
Replace the contents of the file with the following:
dev tun
proto udp
port 1194
ca "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\server.crt"
key "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\server.key"
dh "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\dh2048.pem"
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
keepalive 10 120
cipher AES-256-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3
Save and close the file.
Step 4: Configure Firewall
Open the Windows Firewall and allow incoming connections to UDP port 1194. This will ensure that the OpenVPN server can accept connections from client devices.
Step 5: Enable Routing
In order for the OpenVPN clients to access other devices on the network, routing needs to be enabled on the Windows Server. Open the Command Prompt as an administrator and run the following command:
net.ipv4.ip_forward=1
This will enable IP forwarding on the server.
Step 6: Start OpenVPN Service
Open the Services manager on the Windows Server and start the "OpenVPNService" service. This will start the OpenVPN server and make it ready to accept client connections.
Step 7: Create Client Configuration
Now, let's create a client configuration file that will be used to connect the client devices to the OpenVPN server. Open the file "client.ovpn" located in the "config" directory within the OpenVPN installation directory using a text editor.
notepad "C:\Program Files\OpenVPN\config\client.ovpn"
Replace the contents of the file with the following:
client
dev tun
proto udp
remote your_server_ip 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\client.crt"
key "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\client.key"
comp-lzo
verb 3
Replace "your_server_ip" with the actual IP address of your Windows Server.
Step 8: Distribute Client Configuration
Copy the "client.ovpn" file to the client devices. You can use a USB drive, email, or any other method to transfer the file.
Step 9: Connect Client Devices
On the client devices, install the OpenVPN software if it's not already installed. Then, copy the "client.ovpn" file to the "config" directory within the OpenVPN installation directory.
Finally, launch the OpenVPN GUI and click on the OpenVPN icon in the system tray. Select the "Connect" option to establish a connection to the OpenVPN server.
That's it! You have successfully set up OpenVPN on a Windows Server for Active Directory authentication. Now you can securely access your private network from anywhere using the OpenVPN client.
References
| Number | Source |
|---|---|
| 1 | OpenVPN Official Website |
| 2 | OpenVPN Documentation |