Easiest Way to Setup a VPN on CentOS Server for Ubuntu or Windows Clients

In this article, we will guide you through the process of setting up a VPN (Virtual Private Network) on a CentOS server, which can be used by Ubuntu or Windows clients. This will allow you to securely connect to your CentOS server from any location, and access resources on your local network as if you were physically present.

Prerequisites

Before we begin, there are a few things you will need:

• A CentOS server with a public IP address
• A non-root user with sudo privileges
• Ubuntu or Windows clients to connect to the VPN

Additionally, you will need to install the following software on your CentOS server:

• OpenSwan - an IPsec implementation for Linux
• Xsupplicant - a client-side supplicant for 802.1X-based networks

Installing OpenSwan and Xsupplicant

To install OpenSwan and Xsupplicant on your CentOS server, you can use the following commands:

sudo yum install openswan xsupplicant

Once the installation is complete, you can verify that the software is installed correctly by running the following commands:

pluto --version
xsupplicant --version

You should see the version number of each software displayed.

Configuring OpenSwan

Next, we need to configure OpenSwan to allow VPN connections. This can be done by editing the /etc/ipsec.conf file.

First, make a backup of the original file:

sudo cp /etc/ipsec.conf /etc/ipsec.conf.original

Then, open the file in a text editor:

sudo nano /etc/ipsec.conf

Replace the contents of the file with the following configuration:

version 2.0

config setup
	strictcrlpolicy=no
	uniqueids=yes

conn %default
	keyexchange=ike
	ike=aes256-sha1-modp1024!
	esp=aes256-sha1!
	dpdaction=clear
	dpddelay=300s
	dpdtimeout=1h
	rekey=no

conn myvpn
	left=1.2.3.4
	leftsourceip=10.0.0.1
	leftsubnet=10.0.0.0/24
	right=%any
	rightauth=eap-radius
	rightsourceip=10.0.1.0/24
	rightdns=8.8.8.8,8.8.4.4
	rightsubnet=0.0.0.0/0
	eap_identity=%identity
	auto=add

In this configuration, we have defined a VPN connection called myvpn. The left parameter specifies the public IP address of your CentOS server, and the leftsourceip parameter specifies the local IP address of the VPN connection. The leftsubnet parameter specifies the local subnet that will be accessible over the VPN.

The right parameter specifies that any client can connect to the VPN, and the rightauth parameter specifies that the client will be authenticated using RADIUS.

The rightsourceip parameter specifies the IP address range that will be assigned to connecting clients, and the rightdns parameter specifies the DNS servers that will be used by the clients. The rightsubnet parameter specifies that the clients will have access to the entire internet.

Save the file and exit the text editor.

Configuring RADIUS

Next, we need to configure RADIUS to authenticate VPN clients. This can be done using the FreeRADIUS server.

Install FreeRADIUS using the following command:

sudo yum install freeradius

Once the installation is complete, you can start the FreeRADIUS server using the following command:

sudo systemctl start freeradius

Next, we need to configure FreeRADIUS to use a RADIUS server. This can be done by editing the /etc/raddb/radiusd.conf file.

Open the file in a text editor:

sudo nano /etc/raddb/radiusd.conf

Find the radiusd.clients section, and add the following configuration:

client myradius {
	ipaddr = 10.0.0.2
	secret = myradiussecret
}

In this configuration, we have defined a RADIUS client with the IP address 10.0.0.2 and the secret myradiussecret. Replace these values with the IP address and secret of your RADIUS server.

Save the file and exit the text editor.

Next, we need to configure FreeRADIUS to use the RADIUS server for authentication. This can be done by editing the /etc/raddb/clients.conf file.

Open the file in a text editor:

sudo nano /etc/raddb/clients.conf

Add the following configuration:

client myradius {
	ipaddr = 10.0.0.2
	secret = myradiussecret
	nas\_type = other
}

Save the file and exit the text editor.

Finally, we need to configure FreeRADIUS to use the RADIUS server for authorization. This can be done by editing the /etc/raddb/users file.

Open the file in a text editor:

sudo nano /etc/raddb/users

Add the following configuration:

DEFAULT Auth-Type := EAP
	EAP {
		simultaneous := no
		default\_eap\_type := peap
		method peap {
			permit = *
			eap\_identity = %{User-Name}
			eap\_server\_validate = no
			phase1 {
				auth = MSCHAPV2
				ca\_certificate = /etc/pki/tls/certs/ca.crt
				use\_ticket\_auth = no
				server\_hostname = myradius
				proposed\_con\_id = 0
				use\_fast\_reconnect = yes
			}
			phase2 {
				auth = MSCHAPV2
				use\_ticket\_auth = no
				eap\_identity = %{User-Name}
			}
		}
	}

Save the file and exit the text editor.

Configuring Xsupplicant

Next, we need to configure Xsupplicant to connect to the VPN. This can be done by creating a configuration file for each client.

Create a new configuration file:

sudo nano /etc/xsupplicant/myvpn.conf

Add the following configuration:

config eap_identity "myvpn"
config eap_identity_type "0"

config eap_method "peap"
config eap_method_type "0"

config eap_inner_method "mschapv2"
config eap_inner_method_type "0"

config ca_cert "myradius"
config ca_cert_type "0"

config server_cert "myradius"
config server_cert_type "0"

config phase2_auth "mschapv2"
config phase2_auth_type "0"

config user_identity "myvpn"
config user_identity_type "0"

config password "mypassword"
config password_type "0"

In this configuration, we have defined a VPN connection called myvpn. The eap\_identity parameter specifies the identity of the client, and the eap\_identity\_type parameter specifies the type of identity.

The eap\_method parameter specifies the EAP method to use, and the eap\_method\_type parameter specifies the type of method.

The eap\_inner\_method parameter specifies the inner EAP method to use, and the eap\_inner\_method\_type parameter specifies the type of inner method.

The ca\_cert parameter specifies the CA certificate to use, and the ca\_cert\_type parameter specifies the type of certificate.

The server\_cert parameter specifies the server certificate to use, and the server\_cert\_type parameter specifies the type of certificate.

The phase2\_auth parameter specifies the phase 2 authentication method to use, and the phase2\_auth\_type parameter specifies the type of authentication method.

The user\_identity parameter specifies the user identity, and the user\_identity\_type parameter specifies the type of identity.

The password parameter specifies the password for the user, and the password\_type parameter specifies the type of password.

Save the file and exit the text editor.

Starting the VPN

Finally, we can start the VPN. This can be done using the following commands:

sudo ipsec start
sudo xsupplicant -c /etc/xsupplicant/myvpn.conf -N myvpn

The VPN should now be running, and you should be able to connect to it from your Ubuntu or Windows clients.

References