Ubuntu 12.04 - Set Up an OpenVPN Server

Introduction

This tutorial will show you how to set up an OpenVPN server on Ubuntu Server 12.04 LTS.

Alternatively, I have an installation script so that you don't have to manually go through these steps. However, you will still need to copy the files to your local machine and start your OpenVPN client.

Related Posts

• You could setup OpenVPN on CentOS 6.5 instead.
• Windows users may want to read this post about how to then connect to the server once they have transferred the configuration files from
  $HOME
  to their local computer.
• How to connect to the VPN server on android devices when you have completed this tutorial

Steps

Make sure your OS is up-to-date
sudo apt-get update && sudo apt-get dist-upgrade -y
sudo apt-get install openvpn openssl udev
cp -R /usr/share/doc/openvpn/examples/easy-rsa/ /etc/openvpn
cd /etc/openvpn/easy-rsa/2.0/
If you were to follow other tutorials and just source the vars at this point you would get the following error:
**************************************************************
No /etc/openvpn/easy-rsa/2.0/openssl.cnf file could be found
Further invocations will fail
**************************************************************
To fix this we need to edit the whichopensslcnf inside /etc/openvpn/easy-rsa/2.0
vi /etc/openvpn/easy-rsa/2.0/whichopensslcnf
And change
else
cnf="$1/openssl.cnf"
fi
to:
else
cnf="$1/openssl-1.0.0.cnf"
fi
. /etc/openvpn/easy-rsa/2.0/vars
. /etc/openvpn/easy-rsa/2.0/clean-all
. /etc/openvpn/easy-rsa/2.0/build-ca

Next we need to create Server Key using the Certificate Authority we built in the previou step. Use the following command and just keep hitting Enter button at prompts unless you want to change the defaults (you might want to change the email) :
./build-key-server server
We then need to do the same for the client key.
./build-key client1
If you get an error after running the previous command, it is probably because you entered the exact same details as you did with the server for every field. One of the fields needs to be different.
We need to generate Deffie Hellman Parameters which will be governing the key exchanges between the client and the server of Ubuntu OpenVPN. This is done with the following command:
./build-dh
We need to move the keys we just generated to the directory that actually runs the openvpn service (/etc/openvpn).
cd /etc/openvpn/easy-rsa/2.0/keys
cp ca.crt ca.key client1.key client1.crt dh1024.pem server.crt server.key /etc/openvpn
Copy the sample server configuration file to the directory that will run it. We will edit it later.
cd /usr/share/doc/openvpn/examples/sample-config-files
uncompress server.conf.gz
cp server.conf /etc/openvpn/
Copy the sample client configuration as we did with the server. We will edit it later.
cp client.conf /etc/openvpn/
cd /etc/openvpn/
Change the address of the server from my-server-1 to whatever the server's ip is as seen below:
vi client.conf


Now update text 'client' to 'client1' as shown below:
Now update the server's details
vi /etc/openvpn/server.conf
Uncomment the following line:
push "redirect-gateway def1 bypass-dhcp"

Add this line as the only push for dhcp-option (comment out others):
push "dhcp-option DNS 10.8.0.1"

vi /etc/sysctl.conf
uncomment the following line
net.ipv4.ip_forward=1

We also need to run the following command for packet forwarding to work
echo 1 > /proc/sys/net/ipv4/ip_forward
Set up firewall to forward packets for vpn. Dont forget to replace the 'YOUR_SERVERS_IP_HERE' text.
vi /etc/rc.local
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -s 10.8.0.0/24 -j ACCEPT
iptables -A FORWARD -j REJECT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to-source YOUR_SERVERS_IP_HERE

Alternatively, as lustrul pointed out in the comments, you may use MASQUERADE instead (which will automatically use the correct IP for that NIC):
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -s 10.8.0.0/24 -j ACCEPT
iptables -A FORWARD -j REJECT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
If managing firewall with ufw you will need to run these commands:
ufw allow 1194/udp
ufw allow 1194/tcp
/etc/init.d/openvpn restart
If at this point you get an error like shown below then it means that you are probably on an OpenVZ client vps and that your host has not yet set up the tun/tap for you:

The solution is to follow the instructions on the host (if you have acccess).
lsmod | grep tun
If nothing appears then run this:
modprobe tun
lsmod | grep tun

Then allow the container access to the tun (again from inside the host):
CTID=YOUR_CONTAINERS_ID_HERE
vzctl set $CTID --devnodes net/tun:rw --save
vzctl set $CTID --devices c:10:200:rw --save
vzctl set $CTID --capability net_admin:on --save
vzctl exec $CTID mkdir -p /dev/net
vzctl exec $CTID mknod /dev/net/tun c 10 200
vzctl exec $CTID chmod 600 /dev/net/tun
copy ca.crt client.conf client1.crt and client1.key to your client computer.
Edit the "ca", "cert", and "key" paths in the client.conf to be the full path to where you just copied the files as shown below (e.g. don't just copy the text below):

Remove client.conf from /etc/openvpn on the server now that you have copied it, and restart the openvpn service.
rm /etc/openvpn/client.conf
service openvpn restart
Run this command on your client computer:
sudo openvpn --config /location/of/your/copied/files/client.conf

Source / References

• TipUpdate How To Install OpenVPN on Ubuntu VPS
• Ask ubuntu - OpenVPN on Ubuntu OpenVZ
• Enabling iptables for a VPS
• Getting OpenVPN to work on an OpenVZ VPS
• How to Create a VPN Server on Ubuntu 12.04 (YouTube Video)
• Where I found how to fix OpenSSL error

---

An Update From The Community

If your running a windows client, try setting the encryption algorithm to BF-CBC 128 bit as this offers better compatibility. Another guide has been written, which uses Webmin + OpenVPN Module instead, in order to easily setup and manage your OpenVPN server.