OpenConnect provides a robust, SSL-based VPN solution that is easy to configure on ArchLinux. By installing
ocserv, generating certificates, and configuring
ocserv.conf, you can establish secure remote access. This guide details the installation, certificate management, service configuration, and essential
iptables rules required for full internet connectivity through the tunnel.
Installing OpenConnect Server
The primary package for the OpenConnect server daemon on ArchLinux is
ocserv. You can install it using the standard package manager. It is also recommended to install
easy-rsa to handle the creation of Certificate Authority (CA) keys and client/server certificates securely without relying on external tools.
sudo pacman -S ocserv easy-rsa
Once installed, verify the installation by checking the version. The service will not start automatically until configured, so do not worry about starting it yet.
Generating Certificates
Security is paramount for any VPN setup. OpenConnect requires valid TLS certificates to encrypt traffic. While you can use self-signed certificates for testing, creating a proper CA structure ensures trust and easier client management.
Create a directory for your PKI infrastructure:
mkdir -p /etc/ocserv/certs
cd /etc/ocserv/certs
Initialize the Easy-RSA environment:
cp -r /usr/share/easy-rsa/3/* .
./easyrsa init-pki
Generate the Certificate Authority:
./easyrsa build-ca nopass
Next, generate the server certificate and key. Replace
your-server-name with your actual hostname or domain name. This step generates the server-specific credentials needed by
ocserv.
./easyrsa gen-req your-server-name nopass
./easyrsa sign-req server your-server-name
Copy the generated certificates to the OCServ configuration directory:
cp pki/ca.crt pki/private/your-server-name.key pki/issued/your-server-name.crt /etc/ocserv/certs/
Configuring OCServ
The main configuration file is located at
/etc/ocserv/ocserv.conf. Before editing, create a backup. The default configuration is heavily commented; you need to uncomment and adjust specific lines to enable functionality.
Key settings include:
- auth: Set to "plain[passwd=/etc/ocserv/ocpasswd]" to use local password authentication.
- certificate: Point to the server certificate and private key generated earlier.
- ca-cert: Point to the CA certificate so clients can verify the server's identity.
- tcp-port: Typically 443, which mimics HTTPS traffic to bypass firewalls.
- ipv4-network: Define the subnet for VPN clients (e.g., 10.10.10.0/24).
You must also create the user database for authentication. Use the
ocpasswd utility to add users:
sudo ocpasswd -c /etc/ocserv/ocpasswd username
Enter a strong password when prompted. Repeat this for each user who needs access. Ensure the file permissions are secure:
sudo chmod 640 /etc/ocserv/ocpasswd
sudo chown root:root /etc/ocserv/ocpasswd
For more advanced DNS configurations, refer to our guide on
Running OpenConnect VPN Server on Debian 11: Set Up Your Own DNS Server Machine, which covers similar principles applicable to ArchLinux environments.
Enabling IP Forwarding and NAT
A common mistake in VPN setups is allowing the tunnel to connect but failing to route traffic out to the internet. Clients will see the gateway IP but have no internet access unless Network Address Translation (NAT) is configured via
iptables.
First, enable IP forwarding in the kernel by adding or uncommenting the following line in
/etc/sysctl.d/99-sysctl.conf:
net.ipv4.ip_forward = 1
Apply the changes immediately:
sudo sysctl -p
Now, configure
iptables to masquerade outgoing traffic from the VPN subnet. Assuming your VPN network is
10.10.10.0/24 and your public interface is
eth0 (replace with your actual interface like
wlan0 or
ens33):
sudo iptables -t nat -A POSTROUTING -s 10.10.10.0/24 -o eth0 -j MASQUERADE
You may also need to allow forwarding between the tun interface and your LAN interface if you want internal LAN access:
sudo iptables -A FORWARD -i tun+ -j ACCEPT
sudo iptables -A FORWARD -i eth0 -o tun+ -m state --state RELATED,ESTABLISHED -j ACCEPT
Persist these rules across reboots. On ArchLinux, you can use the
iptables package's persistence mechanism or switch to
nftables if preferred. For stability, ensure the
iptables-services package is installed and enabled.
Starting and Verifying the Service
Enable and start the
ocserv service. Note that it is a service unit, not a socket unit, despite some older documentation suggesting otherwise.
sudo systemctl enable --now ocserv.service
Check the status to ensure it is running without errors:
systemctl status ocserv.service
If the service fails to start, check the logs using
journalctl -u ocserv.service. Common issues include incorrect file permissions on certificates or syntax errors in
ocserv.conf.
Test the connection from a client machine using the
openconnect command-line tool:
openconnect https://your-server-ip:443 --user=username
If the connection succeeds, verify internet access by pinging an external IP address. If you encounter routing issues where IPv4 routes are not respected, consult
IPv4 routes (added OpenConnect) not respected, race condition? for troubleshooting steps related to interface initialization order.
Frequently Asked Questions
Why can't my VPN clients access the internet?
This is almost always caused by missing NAT/Masquerade rules in
iptables. Ensure you have added a POSTROUTING rule that translates the VPN subnet source addresses to your server's public IP. Without this, return traffic has no valid source address to reply to.
How do I change the authentication method to LDAP?
Modify the
auth line in
ocserv.conf to use "ldap". You will need to provide LDAP server details, bind DN, and search base within the same configuration file. This requires additional dependencies like
libldap.
Can I use OpenConnect with WireGuard clients?
No, OpenConnect uses SSL/TLS and Cisco AnyConnect protocol compatibility, while WireGuard is a different kernel-level protocol. They are mutually exclusive technologies. If you need WireGuard, consider setting up a separate server as described in
Debian 12 Wireguard Client Connection to Fritzbox 7530 VPN Router/Server: How to Force Local Internet Connection.
Is it safe to use self-signed certificates?
Self-signed certificates work for personal use but will trigger security warnings in most clients. For production or team use, obtain a trusted certificate from a CA like Let's Encrypt to avoid manual trust establishment on every device.
How do I update the server certificate after rotation?
Regenerate the server cert and key using Easy-RSA, copy them to
/etc/ocserv/certs/, and restart the
ocserv.service. Clients will detect the change on their next connection attempt if they trust the CA.