Configuring OpenVPN with Public IP: Accessing Server from Local Network

Configuring OpenVPN Server with Public IP Address to Access Local Network

OpenVPN is an open-source virtual private network (VPN) software that allows you to create a secure and encrypted connection between a client and a server. In this article, we will discuss how to configure an OpenVPN server with a public IP address to allow users to access devices on the local network.

Prerequisites

• A server with a public IP address
• OpenVPN software installed on the server
• A client device to connect to the VPN server

Configuring the OpenVPN Server

The first step is to configure the OpenVPN server on the server with the public IP address. This involves creating a certificate authority (CA), generating server and client certificates, and configuring the OpenVPN server.

Creating a Certificate Authority

To create a certificate authority, run the following commands:

$ sudo openssl req \
  -x509 \
  -newkey rsa:4096 \
  -keyout ca.key \
  -out ca.crt \
  -days 3650 \
  -nodes \
  -subj "/CN=My CA"

This will create a new certificate authority with a validity period of 10 years. The private key will be stored in ca.key and the public certificate will be stored in ca.crt.

Generating Server and Client Certificates

Next, we need to generate server and client certificates. To generate a server certificate, run the following commands:

$ sudo openssl req \
  -newkey rsa:4096 \
  -keyout server.key \
  -out server.csr \
  -days 365 \
  -nodes \
  -subj "/CN=server"

$ sudo openssl x509 \
  -req \
  -in server.csr \
  -CA ca.crt \
  -CAkey ca.key \
  -CAcreateserial \
  -out server.crt \
  -days 365 \
  -extfile <(echo extendedKeyUsage=serverAuth)

This will create a new private key for the server in server.key and a certificate signing request in server.csr. The server certificate will be generated by signing the certificate signing request with the certificate authority's private key. The resulting certificate will be stored in server.crt.

To generate a client certificate, run the following commands:

$ sudo openssl req \
  -newkey rsa:4096 \
  -keyout client.key \
  -out client.csr \
  -days 365 \
  -nodes \
  -subj "/CN=client"

$ sudo openssl x509 \
  -req \
  -in client.csr \
  -CA ca.crt \
  -CAkey ca.key \
  -CAcreateserial \
  -out client.crt \
  -days 365 \
  -extfile <(echo extendedKeyUsage=clientAuth)

This will create a new private key for the client in client.key and a certificate signing request in client.csr. The client certificate will be generated by signing the certificate signing request with the certificate authority's private key. The resulting certificate will be stored in client.crt.

Configuring the OpenVPN Server

Finally, we need to configure the OpenVPN server. This involves creating a configuration file and starting the OpenVPN server.

Create a new file called server.conf with the following contents:

proto udp
port 1194
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 10 120
cipher AES-256-CBC
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3

This configuration file specifies the protocol, port, and device to use for the VPN connection. It also specifies the certificate and key files to use, as well as the Diffie-Hellman parameters to use for key exchange. The server's IP address range is specified with the server directive, and the DNS servers to use are specified with the push directive.

Start the OpenVPN server with the following command:

$ sudo systemctl start openvpn@server

Configuring the OpenVPN Client

The next step is to configure the OpenVPN client on the client device. This involves creating a configuration file and starting the OpenVPN client.

Create a new file called client.ovpn with the following contents:

client
dev tun
proto udp
remote  1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
tls-auth ta.key 1
cipher AES-256-CBC
verb 3

-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----


-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----


-----BEGIN PRIVATE KEY-----
...
-----END PRIVATE KEY-----


-----BEGIN OpenVPN Static key V1-----
...
-----END OpenVPN Static key V1-----

$ sudo openvpn --config client.ovpn