Configuring an OpenVPN Gateway Server for a Home Network Tunnel: Client to Gateway Server Setup
In this article, we will provide a detailed guide on how to configure an OpenVPN gateway server for a home network tunnel, focusing on the client to gateway server setup. This guide is specifically tailored for users running Ubuntu 20.04 server on their home network.
Prerequisites
Before we begin, it is assumed that you have already installed Ubuntu 20.04 server on your home network and have access to the terminal. Additionally, you will need to have OpenVPN installed on both the client and server machines. If you haven't already installed OpenVPN, you can do so by running the following command on both machines:
sudo apt-get install openvpnGenerating Certificates and Keys
The first step in setting up an OpenVPN gateway server is to generate the necessary certificates and keys. This can be done using the EasyRSA script that comes with OpenVPN. To begin, navigate to the EasyRSA directory:
cd /usr/share/easy-rsa/Next, initialize the PKI environment by running the following command:
./easyrsa init-pkiOnce the PKI environment has been initialized, you can begin generating the necessary certificates and keys. This can be done by running the following commands:
./easyrsa build-ca
./easyrsa gen-dhThese commands will generate the necessary certificate authority (CA) and Diffie-Hellman parameters. Next, you will need to generate a server certificate and key by running the following commands:
./easyrsa gen-req server nopass
./easyrsa sign-req server serverThese commands will generate a server certificate and key, signed by the CA you created earlier. Finally, you will need to generate a key for the TLS authentication:
openvpn --genkey --secret ta.keyConfiguring the OpenVPN Server
Now that you have generated the necessary certificates and keys, you can begin configuring the OpenVPN server. This can be done by creating a new configuration file, which we will call server.ovpn.
The server.ovpn file should contain the following configuration:
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 10 120
cipher AES-256-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3Once you have created the server.ovpn file, you can start the OpenVPN server by running the following command:
sudo openvpn --config server.ovpnConfiguring the OpenVPN Client
Now that you have configured the OpenVPN server, you can move on to configuring the OpenVPN client. This can be done by creating a new configuration file, which we will call client.ovpn.
The client.ovpn file should contain the following configuration:
client
dev tun
proto udp
remote your-server-ip 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
tls-auth ta.key 1
cipher AES-256-CBC
comp-lzo
verb 3
-----BEGIN CERTIFICATE-----
(CA certificate)
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
(Client certificate)
-----END CERTIFICATE-----
-----BEGIN PRIVATE KEY-----
(Client key)
-----END PRIVATE KEY-----
Once you have created the client.ovpn file, you can start the OpenVPN client by running the following command:
sudo openvpn --config client.ovpn- Install OpenVPN on both the client and server machines
- Generate the necessary certificates and keys using EasyRSA
- Configure the OpenVPN server by creating a
server.ovpnfile - Configure the OpenVPN client by creating a
client.ovpnfile - Start the OpenVPN server and client