msdosslave,

Pleased to hear it.

Here I am again

So after vi problem I faced another one:

The tut requires following action:

So my questions are:

1) ln -s /etc/openvpn/easy-rsa/keys /etc/openvpn/keys
When I'm trying to create this link it's nothing going on. It's not appearing at /etc/openvpn/
And /etc/openvpn/easy-rsa/keys is empty too. Does this command just creating a shortcut to the folder? If so may I make it manually as a shortcut. If not - what's my mistake?

2) cd easy-rsa

. ./vars
./clean-all
./build-ca
./build-key-server server
./build-dh
When I cd to easy-rsa it goes fine but what this mean?
Are this lines commands or output? Just don't understand.

. ./vars
./clean-all
./build-ca
./build-key-server server
./build-dh

3) openvpn --genkey --secret tls.key

./build-key client1

Again (command or line?) - the key seems generated normally but what's that?

./build-key client1

Be sure that you have a clear understanding, uhh, of how Linux commands work in general. When doing OpenVPN, it's really important that you clearly understand "the big picture." That you are not "merely reciting commands" without first understanding what they are and what they do. Believe me, I know how difficult it is! But you really want to be asking: "what" is this step doing, and "why" am I doing it? After each step, poke-around in the directory to see which files appeared. And, so on.

For instance, when using "ln -s" to create a symbolic link, the file that is the first argument should exist, and thence, should remain.

Each of the commands that begins with "./" is executing a command in the home directory at that time (easy-rsa). Unlike Windows, Linux does not assume that the mere mention of the name of an executable file in the current directory is your directive to execute that file. The "openvpn" command, on the other hand, is on the $PATH, so it will be found and executed.

Each of the "./" commands are scripts, and it might be useful to you to read them, using the "less" command.

Here is a play-by-play of each command you're executing:

. ./vars (or my preferred way to say the same thing: source ./vars ...)
Executes a series of "export" commands to define a set of environment-variables which provide configuration parameters to the remaining steps.

./clean-all
Wipes out everything! But, this is what you want if you're starting from scratch.

./build-ca
Builds a "self-signed Certifying Authority (CA)," which will be used to sign all of the keys that you generate. To cause a server to recognize and accept your keys as valid, you install the ca.crt (public) file that is generated in this step. Any key signed by that CA will be considered legitimate.

./build-key-server server
Builds the public and private keys for a server (coincidentally ...) named server, and marks those keys as "server keys." Clients can be instructed only to connect to a host which presents this type of key, so that another client can't impersonate the server and become a "man in the middle."

./build-dh
This startlingly time-consuming step (a 4096-bit key can take several hours ...) produces the Diffie-Hellman secrets ( "ook VPN voodoo no grok" ) that provide the basic security.

The next steps, not yet mentioned, will be to generate client keys for each unique party that is going to be authorized to connect to the server. The distinguishing feature is the CN = Common Name attribute. Each client should have a unique CN, hence a unique certificate, and OpenVPN should be instructed not to allow multiple simultaneous connections under the same CN name. This is what gives you uniquely revocable certificates.

One thing to remember about crypto is that it is specifically designed to be obtuse. Especially from the client's point-of-view. OpenVPN is much better than IPSec/raccoon (IMHO ...) in what it puts into its server side logs, but even then(!), crypto technologies are circumspect even in "what they log ... anywhere."

The entire point is to give a would-be intruder absolutely nothing to go on. No indication of what is wrong; of why it isn't working. (In the case of OpenVPN tls-auth, no indication that the server is even there!) When you present exactly the right (non-revoked) credentials in exactly the right way, the door opens, and data passes through unimpeded (unless the certificate is subsequently revoked, in which case the door slams shut). If anything is the slightest bit wrong, nothing happens, and there is purposely(!) "no suggestion as to why."

I feel your pain. I felt it, too. (Still do. We all do.)

2 members found this post helpful.

Thanks for so quick reply. Yes it's so hard to understand the logic. In process of reading. Will get back soon.

upd
to sundialsvcs

That was really helpful. Seems I finished 1st part of this. Trying to make it work.

I faced another problem, I cant zip a folder as it says no such file or directory. So I just saved it on my local disc, zipped and moved back . That's fine for now.

Regarding
I don't even hope to understand this next couple months. I learn in process with LQ help and seems it works.

Thanks again for your help everybody.
I don't close the topic as I feel I'll be back very very soon)

I got some free time and returned to these Ovpn dragon.

Still need some help. Please check this:

I got a server side Openvpn installed on ovz 1gb ram
Then generated sert for client

installed openvpn client on VM, inserted sert .ovpn and connected

It worked and tray openvpn icon got in green light. However the problem is: it's not working as it should work. No real connection going through it.

I got log:

Real working log should look like this I think:

I'm not even sure I see right errors. If you can see on 1st sight any problem just let me know.

Thank you very much.

UPD: Tried reinstall with different tutorial and stuck at another place:

Incoming packet rejected from [AF_INET]172.16.1.1:1194[2], expected peer address: [AF_INET]111.111.111.111:1194

Reading this 2 hours or more on boards and nothing.

Still need advices. Thanks