{"id":1474,"date":"2022-02-20T21:58:16","date_gmt":"2022-02-20T21:58:16","guid":{"rendered":"https:\/\/tungle.ca\/?p=1474"},"modified":"2022-05-04T09:36:11","modified_gmt":"2022-05-04T17:36:11","slug":"implementing-openvpn-server-on-debian-10","status":"publish","type":"post","link":"https:\/\/tungle.ca\/?p=1474","title":{"rendered":"Implementing OpenVPN server on Debian 10"},"content":{"rendered":"\n

Below is a lab topology to use to implement the OpenVPN solution on Debian 10.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

In this lab, we need to make sure clients on the Internet are able to create secure OpenVPN connections to the OpenVPN server. Also, the OpenVPN client is able to access inside the network beside the VPN tunnel (LAMP subnet: 192.168.131.0\/24), and still access the Internet. Moreover, the Split tunneling feature should be used to make sure only traffic is related to accessing the LAMP subnet will be routed via the OpenVPN tunnel. All other traffic will use a public network adapter (Internet).<\/p>\n\n\n\n

IP addresses of Debian OpenVPN server.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Access SSH from LinuxMint to easy to copy and paste commands.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Upgrade Debian’s machine.<\/p>\n\n\n\n

apt-get update -y\napt-get upgrade -y<\/code><\/pre>\n\n\n\n
+ Enable IP Forwarding<\/p>\n\n\n\n
Edit the file \/etc\/sysctl.conf and add the line below at the end of the file.<\/p>\n\n\n\n
net.ipv4.ip_forward = 1<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
+ Enable proxy_arp for arp entry to appear on the OpenVPN server.<\/p>\n\n\n\n
echo 1 > \/proc\/sys\/net\/ipv4\/conf\/all\/proxy_arp<\/code><\/pre>\n\n\n\n
+ Add a line below into \/etc\/sysctl.conf to make it permanent.<\/p>\n\n\n\n
net.ipv4.conf.all.proxy_arp=1<\/code><\/pre>\n\n\n\n
Run the following command to make the changes work.<\/p>\n\n\n\n
sysctl -p<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
+ Install OpenVPN server.<\/p>\n\n\n\n
apt-get install openvpn -y<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Copy the easy-rsa directory from \/usr\/share directory to \/etc\/openvpn directory.for managing SSL certificates.<\/p>\n\n\n\n
cp -r \/usr\/share\/easy-rsa \/etc\/openvpn\/<\/code><\/pre>\n\n\n\n
+ Set up Certificate Authority (CA)<\/p>\n\n\n\n
cd \/etc\/openvpn\/easy-rsa\nnano vars\n#Add information below to the file.<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
set_var EASYRSA                 \"$PWD\"\nset_var EASYRSA_PKI             \"$EASYRSA\/pki\"\nset_var EASYRSA_DN              \"cn_only\"\nset_var EASYRSA_REQ_COUNTRY     \"CANADA\"\nset_var EASYRSA_REQ_PROVINCE    \"BC\"\nset_var EASYRSA_REQ_CITY        \"Vancouver\"\nset_var EASYRSA_REQ_ORG         \"BCIT Student\"\nset_var EASYRSA_REQ_EMAIL\t\"admin@newhorizon.ca\"\nset_var EASYRSA_REQ_OU          \"BCIT Student\"\nset_var EASYRSA_KEY_SIZE        2048\nset_var EASYRSA_ALGO            rsa\nset_var EASYRSA_CA_EXPIRE\t7500\nset_var EASYRSA_CERT_EXPIRE     365\nset_var EASYRSA_NS_SUPPORT\t\"no\"\nset_var EASYRSA_NS_COMMENT\t\"BCIT Student CERTIFICATE AUTHORITY\"\nset_var EASYRSA_EXT_DIR         \"$EASYRSA\/x509-types\"\nset_var EASYRSA_SSL_CONF        \"$EASYRSA\/openssl-easyrsa.cnf\"\nset_var EASYRSA_DIGEST          \"sha256\"\n<\/code><\/pre>\n\n\n\n
 Run the following command to initiate your own PKI.<\/p>\n\n\n\n
.\/easyrsa init-pki<\/pre>\n\n\n\n
Build the CA certificates.<\/p>\n\n\n\n
.\/easyrsa build-ca<\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
+ Generate Server Certificate Files.<\/p>\n\n\n\n
.\/easyrsa gen-req tung-server nopass<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
+ Sign the public key of the Server Using Root CA.<\/p>\n\n\n\n
.\/easyrsa sign-req server tung-server<\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Verify cert.<\/p>\n\n\n\n
openssl verify -CAfile pki\/ca.crt pki\/issued\/tung-server.crt <\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
+ Create  a strong Diffie-Hellman key to use for the key exchange<\/p>\n\n\n\n
.\/easyrsa gen-dh<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
After creating all certificate files, copy them to the \/etc\/openvpn\/server\/ directory.<\/p>\n\n\n\n
cp pki\/ca.crt \/etc\/openvpn\/server\/\ncp pki\/dh.pem \/etc\/openvpn\/server\/\ncp pki\/private\/tung-server.key \/etc\/openvpn\/server\/\ncp pki\/issued\/tung-server.crt \/etc\/openvpn\/server\/<\/code><\/pre>\n\n\n\n
+ Generate Client Certificate and Key File<\/p>\n\n\n\n
.\/easyrsa gen-req client nopass<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Next, sign the client key using your CA certificate.<\/p>\n\n\n\n
.\/easyrsa sign-req client client<\/code><\/pre>\n\n\n\n
Next, copy all client certificate and key file to the \/etc\/openvpn\/client\/ directory<\/p>\n\n\n\n
cp pki\/ca.crt \/etc\/openvpn\/client\/\ncp pki\/issued\/client.crt \/etc\/openvpn\/client\/\ncp pki\/private\/client.key \/etc\/openvpn\/client\/<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
+ Configure OpenVPN Server<\/p>\n\n\n\n
nano \/etc\/openvpn\/server.conf\n#---\nroot@debian10new:~# cat \/etc\/openvpn\/server.conf \nport 1194\nproto udp\n# USE TCP\n#port 4443\n#proto tcp-server\ndev tun\nca \/etc\/openvpn\/server\/ca.crt\ncert \/etc\/openvpn\/server\/tung-server.crt\nkey \/etc\/openvpn\/server\/tung-server.key\ndh \/etc\/openvpn\/server\/dh.pem\n# OpenVPN tunnel IP address range\nserver 172.16.1.0 255.255.255.0\n# server 192.168.131.0 255.255.255.0\n# route all traffic via OpenVPN\npush \"redirect-gateway def1\"\npush \"dhcp-option DNS 8.8.8.8\"\nduplicate-cn\ncipher AES-256-CBC\ntls-version-min 1.2\ntls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-256-CBC-SHA256:TLS-DHE-RSA-WITH-AES-128-GCM-SHA256:TLS-DHE-RSA-WITH-AES-128-CBC-SHA256\nauth SHA512\nauth-nocache\nkeepalive 20 60\npersist-key\npersist-tun\n#disable compress lz4 because of error on OpenVPN client\n#compress lz4\ndaemon\nuser nobody\ngroup nogroup\nlog-append \/var\/log\/openvpn.log\nverb 3\nroot@debian10new:~# \n#---<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
+ Start OpenVPN service.<\/p>\n\n\n\n
systemctl start openvpn@server\nsystemctl enable openvpn@server\nsystemctl status openvpn@server<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Show OpenVPN tunnel.<\/p>\n\n\n\n
ip a show tun0<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
+ Generate client configuration.<\/p>\n\n\n\n
nano \/etc\/openvpn\/client\/client.ovpn\n#---\nclient\ndev tun\n# USE UDP\nproto udp\nremote 10.0.0.52 1194\n\n# USE TCP\n#proto tcp-server\n# Public IP address on OpenVPN is 10.0.0.52\n#remote 10.0.0.52 4443\nca ca.crt\ncert client.crt\nkey client.key\n#remote-cert-tls server\ncipher AES-256-CBC\n# Below lines is important to allow OpenVPN is still accessing the Internet when making OpenVPN session.\n# Split tunneling on OpenVPN\n# https:\/\/forums.openvpn.net\/viewtopic.php?t=8229\nroute-nopull\n# the LAN subnet that you need to access via VPN tunnel\nroute 192.168.131.0 255.255.255.0 vpn_gateway\nauth SHA512\nauth-nocache\ntls-version-min 1.2\ntls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-256-CBC-SHA256:TLS-DHE-RSA-WITH-AES-128-GCM-SHA256:TLS-DHE-RSA-WITH-AES-128-CBC-SHA256\nresolv-retry infinite\n#compress lz4\nnobind\npersist-key\npersist-tun\nmute-replay-warnings\nverb 3\n#---<\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
+ Configure routing using UFW.<\/p>\n\n\n\n
By default, the UFW firewall is not installed in Debian 10.<\/p>\n\n\n\n
apt-get install ufw -y<\/code><\/pre>\n\n\n\n
Configure UFW to accept the forwarded packets.<\/p>\n\n\n\n
nano \/etc\/default\/ufw\n# Change the following line:\n\nDEFAULT_FORWARD_POLICY=\"ACCEPT\"<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
nano \/etc\/ufw\/before.rules<\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Note: Replace ens3 with the name of your public network interface in Debian OpenVPN server is ens35.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Allow the default OpenVPN port 1194 and OpenSSH. Then, reload the UFW firewall.<\/p>\n\n\n\n
ufw allow 1194\/udp\nufw allow OpenSSH\nufw disable\nufw enable<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
+ Connect OpenVPN from a client.<\/p>\n\n\n\n
Install OpenVPN from the Kali machine.<\/p>\n\n\n\n
apt-get install openvpn -y<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
On the client machine, run the command below to download all the client configuration files.<\/p>\n\n\n\n
# public-vpn-server-ip: is 10.0.0.52\nscp -r root@public-vpn-server-ip:\/etc\/openvpn\/client .<\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Check OpenVPN tunnel.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
On OpenVPN client.<\/p>\n\n\n\n
ping 8.8.8.8 (Internet)<\/p>\n\n\n\n
ping 192.168.131.134 (OpenVPN gw tunnel)<\/p>\n\n\n\n
ping 192.168.131.128 (LAMP server behind OpenVPN server)<\/p>\n\n\n\n
We can see split tunneling is working well on OpenVPN.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Access LAMP server.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
On Debian OpenVPN server.<\/p>\n\n\n\n
Check routing table on OpenVPN server.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Check OpenVPN logs on the OpenVPN server.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Monitor traffic on the OpenVPN server. OpenVPN traffic is using port 1194 UDP. OpenVPN traffic is encrypted using this tunnel.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
Below is a lab topology to use to implement the OpenVPN solution on Debian 10. In this lab, we need to make sure clients on the Internet are able to create secure OpenVPN connections to the OpenVPN server. Also, the OpenVPN client is able to access inside the network beside the VPN tunnel (LAMP subnet: […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6,11],"tags":[8,13],"class_list":["post-1474","post","type-post","status-publish","format-standard","hentry","category-linux","category-security","tag-linux","tag-security"],"_links":{"self":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts\/1474","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1474"}],"version-history":[{"count":9,"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts\/1474\/revisions"}],"predecessor-version":[{"id":3748,"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts\/1474\/revisions\/3748"}],"wp:attachment":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1474"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1474"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1474"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}