Linux OpenVPN Server

turiyain · 05-13-2010, 01:49 AM

Dear Experts,

I want to setup a openVPN Server for my Organisation. This is
a new area for me. We are having One Main Office and may Branch Offices in the country. I want to set up a server, through which all branch offices will able to connect to a database and web server (Not visible Publicaly). I have read a lot of on this, but it is confusing. Should I
follow Bridged or Routed VPN.

Kindly mention : Is there any specific step by step link to achieve this goal.

Vijay Thakur

catkin · 05-13-2010, 03:07 AM

The OpenVPN HOWTO is very good and includes a section on "Determining whether to use a routed or bridged VPN".

From what you have written about the very specific things you want to do and the "many" branch offices, "routed" is probably the way to go.

For SOHO systems where the remote user wants VPN to provide a connection exactly as if their computer were physically on the LAN (except slower!), "bridged" would be appropriate.

turiyain · 05-15-2010, 03:27 AM

Thanks for your kind reply. I want to generate the VPN Certificate per client. Is there any way to do this.

catkin · 05-15-2010, 04:49 AM

Quote:

Originally Posted by turiyain

Thanks for your kind reply. I want to generate the VPN Certificate per client. Is there any way to do this.

Yes -- as it says in the HOWTO. Most of the values are edited into the vars file so the actual certificate generation is relatively quick. Here is from my log, changes in red.

Code:

root@ps1:/etc/openvpn/easy-rsa# . ./vars  # Beware -- there  is a space between the dots
root@ps1:/etc/openvpn/easy-rsa# ./build-key some_user_name
Generating a 1024 bit RSA private key
...++++++
............++++++
writing new private key to 'some_user_name.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [country_configured_in_vars]:
State or Province Name (full name) [province_configured_in_vars]:
Locality Name (eg, city) [town_configured_in_vars]:
Organization Name (eg, company) [organisation_configured_in_vars]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:some_user_name
Email Address [email_address_configured_in_vars]:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
[only output from program, no input here]
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

turiyain · 05-15-2010, 05:06 AM

What is the hardware requirement. Does i need one NIC or two and why?
Because this type of novice information is not available anywhere.

catkin · 05-15-2010, 06:12 AM

Quote:

Originally Posted by turiyain

What is the hardware requirement. Does i need one NIC or two and why?
Because this type of novice information is not available anywhere.

The information is available, for example, on Linux Home Networking's VPN page where there is a nice diagram showing VPN servers with a single IP address and thus not needing more than one NIC.

Neither the VPN server nor the VPN client need more than one IP address in the usual scenario. Even if they did you can configure more than one IP on a single NIC.

Typically you will have an OpenVPN server at the main office and the main office's Internet facing router will be set up to port-forward incoming VPN packets to the OpenVPN server on its LAN address.

Alternatively, a more fully-featured Internet facing router may itself have a VPN facility; if you have that option it might be a better way to go than setting up an OpenVPN server.

turiyain · 05-15-2010, 07:23 AM

Is it possible that any client will connect without any private key in routed VPN.

turiyain · 05-20-2010, 11:00 PM

Thank you very much. As per your direction my VPN server (Centos 5.3) is working fine. I am able to connect my Servers behind VPN Server from remote location. Just need one more help.. I want to make a vpn client installer for winxp, vista and windows 7. There is no specific answer on the internet on this issue. Kindly share your experience.

Regards,

kurwongbah · 05-20-2010, 11:09 PM

Do a google for: openvpn gui

catkin · 05-20-2010, 11:44 PM

Quote:

Originally Posted by turiyain

Thank you very much. As per your direction my VPN server (Centos 5.3) is working fine. I am able to connect my Servers behind VPN Server from remote location. Just need one more help.. I want to make a vpn client installer for winxp, vista and windows 7. There is no specific answer on the internet on this issue. Kindly share your experience.

Glad you got it working

Here are my notes about installing on Windows clients. Some of the details may differ (need to match client config with server config) but it is a starting point.

Disable security suite, firewall etc. as required
As a member of the Administrators group ...
Run openvpn-2.0.9-gui-1.0.3-install.exe and take all the defaults.
Copy RSA key and certificate files to C:\Program Files\OpenVPN\config\
Copy C:\Program Files\OpenVPN\sample-config\client.ovpn to C:\Program Files\OpenVPN\config (with same name).

Edit C:\Program Files\OpenVPN\config\client.ovpn (using notepad) modifying:

Code:

dev tap
remote <your domain name> 1194
;persist-tun
ca ca.crt
cert <client name>.crt
key <client name>.key
;comp-lzo (commented out to match server – try enabling on both when tested OK)

# Local addition: enable the management interface
management localhost 7505

Test
Enable security suite, firewall etc., test and configure as required.

turiyain · 05-21-2010, 12:02 AM

Thanks.. This manual proccedure is working fine on all clients. But i have to implement VPN on Globally with 500 clients. Some vpn clients do not no more than click and play. So i want to make a automated installer with all the required setting at client OS. Please help.

catkin · 05-21-2010, 02:38 AM

Quote:

Originally Posted by turiyain

Thanks.. This manual proccedure is working fine on all clients. But i have to implement VPN on Globally with 500 clients. Some vpn clients do not no more than click and play. So i want to make a automated installer with all the required setting at client OS. Please help.

Not my area of expertise or in Linux Questions scope. If you are working for an organisation with so many WXP computers, is there not package/application rollout/deployment expertise within your organisation? There will be lots of information about how to do that on the Internet.