{"id":169,"date":"2011-03-05T07:37:54","date_gmt":"2011-03-05T07:37:54","guid":{"rendered":"http:\/\/www.linuxmaster.tk\/?p=169"},"modified":"2011-03-05T07:37:54","modified_gmt":"2011-03-05T07:37:54","slug":"openvpn-on-centos-server","status":"publish","type":"post","link":"https:\/\/linuxmaster.in\/?p=169","title":{"rendered":"OPENVPN ON CENTOS SERVER"},"content":{"rendered":"

First thing you have to do is check whether tun\/tap is active or not by typing
\n#cat \/dev\/net\/tun<\/span><\/p>\n

\n
Code:<\/div>\n
cat: \/dev\/net\/tun: File descriptor in bad state<\/pre>\n<\/div>\n
take a look at the status above, “File descriptor in bad state<\/strong>” means tun\/tap is active, otherwise please ask your provider to activate it<\/p>\n
Install required modules
\n#yum install gcc make rpm-build autoconf.noarch zlib-devel pam-devel openssl-devel<\/span><\/p>\n
Download OPENVPN repo
\n#wget http:\/\/o<\/span>penvpn.net\/release\/lzo-1.08-4.rf.src.rpm<\/span><\/p>\n
for 32bit<\/strong>
\n#wget http:\/\/p<\/span>ackages.sw.be\/rpmforge-release\/rpmforge-release-0.5.2-2.el5.rf.i386.rpm<\/span><\/p>\n
for 64bit<\/strong>
\n#wget http:\/\/<\/span>packages.sw.be\/rpmforge-release\/rpmforge-release-0.5.2-2.el5.rf.x86_64.rpm<\/span><\/p>\n
Build the rpm packages
\n#rpmbuild –rebuild lzo-1.08-4.rf.src.rpm
\n#rpm -Uvh \/usr\/src\/redhat\/RPMS\/i386\/lzo-*.rpm
\n#rpm -Uvh rpmforge-release-0.5.2-2.el5.rf.i386.rpm<\/span><\/p>\n
*remember to change i386<\/span> to x86_64<\/span> if you’re using 64bit<\/em><\/p>\n
Install OPENVPN
\n#yum install openvpn<\/span><\/p>\n
Copy OPENVPN easy-rsa<\/strong> folder to \/etc\/openvpn\/<\/strong>
\n#cp -R \/usr\/share\/doc\/openvpn-2.1.4\/easy-rsa\/ \/etc\/openvpn\/<\/span><\/p>\n
Now let’s create the certificate
\n#cd \/etc\/openvpn\/easy-rsa\/2.0
\n#chmod 755 *
\n#source .\/vars
\n#.\/vars
\n#.\/clean-all<\/span><\/p>\n
Build CA
\n#.\/build-ca<\/span><\/p>\n
\n
Code:<\/div>\n
Country Name:<\/strong> may be filled or press enter\r\nState or Province Name:<\/strong> may be filled or press enter\r\nCity:<\/strong> may be filled or press enter\r\nOrg Name:<\/strong> may be filled or press enter\r\nOrg Unit Name:<\/strong> may be filled or press enter\r\nCommon Name:<\/strong> your server hostname\r\nEmail Address:<\/strong> may be filled or press enter<\/pre>\n<\/div>\n
Build key server
\n#.\/build-key-server server<\/span><\/p>\n
\n
Code:<\/div>\n
Almost the same with .\/build.ca but check the changes and additional\r\nCommon Name:<\/strong> server<\/span>\r\nA challenge password:<\/strong> leave\r\nOptional company name:<\/strong> fill or enter\r\nsign the certificate:<\/strong> y\r\n1 out of 1 certificate requests:<\/strong> y<\/pre>\n<\/div>\n
Build Diffie Hellman (wait a moment until the process finish)
\n#.\/build-dh<\/span><\/p>\n
Now i’m gonna create UDP port 1194 configuration for OPENVPN, use any text editor you like
\n#nano \/etc\/openvpn\/1194.conf<\/span><\/p>\n
\n
Code:<\/div>\n
local 123.123.123.123 #- your_server_ip\r\nport 1194 #- port\r\nproto udp #- protocol\r\ndev tun\r\ntun-mtu 1500\r\ntun-mtu-extra 32\r\nmssfix 1450\r\nca \/etc\/openvpn\/easy-rsa\/2.0\/keys\/ca.crt\r\ncert \/etc\/openvpn\/easy-rsa\/2.0\/keys\/server.crt\r\nkey \/etc\/openvpn\/easy-rsa\/2.0\/keys\/server.key\r\ndh \/etc\/openvpn\/easy-rsa\/2.0\/keys\/dh1024.pem\r\nplugin \/usr\/share\/openvpn\/plugin\/lib\/openvpn-auth-pam.so \/etc\/pam.d\/login<\/span>\r\nclient-cert-not-required\r\nusername-as-common-name\r\nserver 1.2.3.0 255.255.255.0\r\npush \"redirect-gateway def1\"\r\npush \"dhcp-option DNS 208.67.222.222\"\r\npush \"dhcp-option DNS 4.2.2.1\"\r\nkeepalive 5 30\r\ncomp-lzo\r\npersist-key\r\npersist-tun\r\nstatus 1194.log\r\nverb 3<\/pre>\n<\/div>\n
before you save the configuration, make sure that the “plugin \/usr\/share\/.. \/pam.d\/login<\/span>” is one line<\/p>\n
Start the OPENVPN with 1194.conf
\n#openvpn \/etc\/openvpn\/1194.conf &<\/span><\/p>\n
here’s the status if OPENVPN successfully started<\/p>\n
\n
Code:<\/div>\n
Mon Feb 21 02:23:20 2011 UDPv4 link remote: [undef]\r\nMon Feb 21 02:23:20 2011 MULTI: multi_init called, r=256 v=256\r\nMon Feb 21 02:23:20 2011 IFCONFIG POOL: base=1.2.3.4 size=62\r\nMon Feb 21 02:23:20 2011 Initialization Sequence Completed<\/pre>\n<\/div>\n
Make OPENVPN 1194.conf running in background
\n#bg<\/span><\/p>\n
Enable ipv4 forward
\n#echo 1 > \/proc\/sys\/net\/ipv4\/ip_forward<\/span><\/p>\n
Route iptables
\n#iptables -t nat -A POSTROUTING -s 1.2.3.0\/24 -j SNAT –to 123.123.123.123<\/span><\/p>\n
*1.2.3.0 is allocated ip for OPENVPN client
\n*123.123.123.123 is your server ip<\/em><\/p>\n
Now we create username and password for authorization
\n#useradd username -s \/bin\/false
\n#passwd username<\/span><\/p>\n
Download ca.crt<\/strong> file in \/etc\/openvpn\/easy-rsa\/2.0\/keys\/<\/strong> directory, you can use sftp client<\/p>\n
Download and install OPENVPN client for windows, download the latest stable release OPENVPN version 2.1.4 from here<\/a>

\nAfter you finished installing OPENVPN, move ca.crt<\/strong> (file that you previously downloaded from \/etc\/openvpn\/easy-rsa\/2.0\/keys\/) to OPENVPN config folder in your program files (\\Program Files\\OpenVPN\\config\\<\/strong>)<\/p>\n
Also create client configuration file in OPENVPN config directory, here’s the example:<\/p>\n
\n
Code:<\/div>\n
client\r\ndev tun\r\nproto udp #- protocol\r\nremote 123.123.123.123 1194 #- SERVER IP and OPENVPN Port\r\nresolv-retry infinite\r\nnobind\r\ntun-mtu 1500\r\ntun-mtu-extra 32\r\nmssfix 1450\r\npersist-key\r\npersist-tun\r\nca ca.crt\r\nauth-user-pass\r\ncomp-lzo\r\nverb 3<\/pre>\n<\/div>\n
save with anyname.ovpn<\/strong> or 1194.ovpn<\/strong><\/p>\n
http:\/\/i56.tinypic.com\/aktvet.jpg<\/a><\/p>\n
Run OPENVPN Client on your Windows, connect with your username and password.<\/p>\n
http:\/\/i55.tinypic.com\/2vwz9di.jpg<\/a>
\nhttp:\/\/i53.tinypic.com\/2883y0y.jpg<\/a><\/p>\n
Check your IP Address in browser and Voila!!! You’re IP is now changed to your server IP<\/p>\n
note:<\/span><\/strong>
\n– Never fails make OPENVPN on CentOS with this tutorial
\n– Those configurations above are basic configuration, you can check OPENVPN website for another configuration
\n– If you’re using Win 7, before installing OPENVPN client, right click  on the installer, properties, run as administrator and change  compatibility to Windows XP SP3
\n– If you wanna add another port, maybe TCP so you can run OPENVPN over  proxy, just create new configuration for server, adjust the following  lines:<\/p>\n
\n
Code:<\/div>\n
port:<\/strong> your preferred port\r\nprotocol:<\/strong> tcp or udp\r\nclient's ip:<\/strong> 1.2.4.0 or 1.2.5.0 ; 1.2.6.0 ; and so on<\/pre>\n<\/div>\n
also new configuration for client<\/p>\n
\n
Code:<\/div>\n
proto xxxx<\/strong> #- change xxxx to tcp or udp\r\nremote 123.123.123.123 yyyy<\/strong> #- change yyyy to OPENVPN port<\/pre>\n<\/div>\n
and then run the command
\n#iptables -t nat -A POSTROUTING -s 1.2.4.0\/24 -j SNAT –to 123.123.123.123<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"
First thing you have to do is check whether tun\/tap is active or not by typing #cat \/dev\/net\/tun Code: cat: \/dev\/net\/tun: File descriptor in bad state take a look at the status above, “File descriptor in bad state” means tun\/tap is active, otherwise please ask your provider to activate it Install required modules #yum install … Continue reading “OPENVPN ON CENTOS SERVER”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-169","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/linuxmaster.in\/index.php?rest_route=\/wp\/v2\/posts\/169","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/linuxmaster.in\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/linuxmaster.in\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/linuxmaster.in\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/linuxmaster.in\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=169"}],"version-history":[{"count":2,"href":"https:\/\/linuxmaster.in\/index.php?rest_route=\/wp\/v2\/posts\/169\/revisions"}],"predecessor-version":[{"id":171,"href":"https:\/\/linuxmaster.in\/index.php?rest_route=\/wp\/v2\/posts\/169\/revisions\/171"}],"wp:attachment":[{"href":"https:\/\/linuxmaster.in\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=169"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/linuxmaster.in\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=169"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/linuxmaster.in\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=169"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}