Introduction

This article provides a step-by-step guide on how to set up an offsite backup OpenVPN server for seamless site-to-site connections between two sites, with one site being a satellite office (Site B). We assume that the primary OpenVPN server (Site A) is hosted on-premises, and both sites are using OpenVPN for secure communication.

Prerequisites

Before proceeding with the setup, ensure that the following prerequisites are met:

• Both sites have a stable internet connection.
• Both sites have OpenVPN installed and configured.
• Both sites have the necessary certificates and keys.
• Both sites have the necessary firewall rules in place.

Configuring OpenVPN Server at Site A

To configure the OpenVPN server at Site A, follow these steps:

Creating Server Certificates and Keys

Use the OpenVPN EasyRSA tool to generate the server certificates and keys:

 
 # Navigate to the EasyRSA directory
 cd /etc/openvpn/easyrsa
Build the CA certificate
./easyrsa init-pki
./easyrsa build-ca
Generate the server certificate and key
./easyrsa gen -out server.crt server.key -days 3650 -nodes

Configuring OpenVPN Server Config

Create a new OpenVPN server configuration file:

 
 # Create a new file called server.conf
 nano /etc/openvpn/server.conf
 
 

Add the following lines to the server.conf file:

 
 # TUN/TAP device
 dev tun0
Protocols
proto udp
port 1194
cipher AES-256-CBC
auth SHA256
Server mode
server 10.0.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
Certificates
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
Logging
verb 3

Starting OpenVPN Server

Start the OpenVPN server:

 
 systemctl start openvpn@server
 systemctl enable openvpn@server
 
 

Configuring OpenVPN Client at Site B

To configure the OpenVPN client at Site B, follow these steps:

Creating Client Certificates and Keys

Use the OpenVPN EasyRSA tool to generate the client certificates and keys:

 
 # Navigate to the EasyRSA directory
 cd /etc/openvpn/easyrsa
Build the CA certificate
./easyrsa init-pki
./easyrsa build-ca
Generate the client certificate and key
./easyrsa gen -out client.crt client.key -days 3650 -nodes client

Configuring OpenVPN Client Config

Create a new OpenVPN client configuration file:

 
 # Create a new file called client.ovpn
 nano /etc/openvpn/client.ovpn
 
 

Add the following lines to the client.ovpn file:

 
 # TUN/TAP device
 dev tun0
Protocols
proto udp
remote  1194
cipher AES-256-CBC
auth SHA256
Certificates
ca ca.crt
cert client.crt
key client.key
Logging
verb 3

Replace with the IP address of Site A.

Starting OpenVPN Client

Start the OpenVPN client:

 
 systemctl start openvpn@client
 systemctl enable openvpn@client
 
 

Testing the Connection

Test the connection between Site A and Site B:

 
 # At Site A
 ping 
At Site B
ping 

If the pings are successful, the site-to-site connection is established.

Summary

In this article, we have learned how to set up an offsite backup OpenVPN server for seamless site-to-site connections between two sites using OpenVPN. We have covered the prerequisites, configuring the OpenVPN server at Site A, configuring the OpenVPN client at Site B, and testing the connection.