17 Configuring a VPN Server #

Install the package openvpn on the machine that will later become your VPN server.

Open a shell, become root and create the VPN secret key:

root # openvpn --genkey --secret /etc/openvpn/secret.key

Copy the secret key to your client:

root # scp /etc/openvpn/secret.key root@IP_OF_CLIENT:/etc/openvpn/

Create the file /etc/openvpn/server.conf with the following content:

dev tun
ifconfig IP_OF_SERVER IP_OF_CLIENT
secret secret.key

Set up a tun device configuration by creating a file called /etc/sysconfig/network/ifcfg-tun0 with the following content:

STARTMODE='manual'
BOOTPROTO='static'
TUNNEL='tun'
TUNNEL_SET_OWNER='nobody'
TUNNEL_SET_GROUP='nobody'
LINK_REQUIRED=no
PRE_UP_SCRIPT='systemd:openvpn@server'
PRE_DOWN_SCRIPT='systemd:openvpn@service'

The notation openvpn@server points to the OpenVPN server configuration file located at /etc/openvpn/server.conf. For more information, see /usr/share/doc/packages/openvpn/README.SUSE.

If you use a firewall, start YaST and open UDP port 1194 (Security and Users › Firewall › Allowed Services).

Start the OpenVPN server service by setting the tun device to up:

tux > sudo wicked ifup tun0

You should see the confirmation:

tun0            up

Install the package openvpn on your client VPN machine.

Create /etc/openvpn/client.conf with the following content:

remote DOMAIN_OR_PUBLIC_IP_OF_SERVER
dev tun
ifconfig IP_OF_CLIENT IP_OF_SERVER
secret secret.key

Replace the placeholder IP_OF_CLIENT in the first line with either the domain name, or the public IP address of your server.

Set up a tun device configuration by creating a file called /etc/sysconfig/network/ifcfg-tun0 with the following content:

STARTMODE='manual'
BOOTPROTO='static'
TUNNEL='tun'
TUNNEL_SET_OWNER='nobody'
TUNNEL_SET_GROUP='nobody'
LINK_REQUIRED=no
PRE_UP_SCRIPT='systemd:openvpn@client'
PRE_DOWN_SCRIPT='systemd:openvpn@client'

If you use a firewall, start YaST and open UDP port 1194 as described in Step 6 of Procedure 17.1, “VPN Server Configuration”.

Start the OpenVPN server service by setting the tun device to up:

tux > sudo wicked ifup tun0

You should see the confirmation:

tun0            up

Prepare a common VPN Certificate Authority (CA):

1. Start the YaST CA module.

2. Click Create Root CA.

3. Enter a CA Name and a Common Name, for example VPN-Server-CA.

4. Fill out the other boxes like e-mail addresses, organization, etc. and proceed with Next.

5. Enter your password twice and proceed with Next.

6. Review the summary. YaST displays the current settings for confirmation. Click Create. The root CA is created and displayed in the overview.

Create a VPN server certificate:

1. Select the root CA you created in Step 1 and click Enter CA.

2. When prompted, enter the CA Password.

3. Click the Certificate tab and click Add › Add Server Certificate.

4. Specify a Common Name, for example, openvpn.example.com and proceed with Next.

5. Specify your password and confirm it. Then click Advanced options.

   Switch to the Advanced Settings › Key Usage list and check one of the following sets:

   • digitalSignature and keyEncipherment, or,

   • digitalSignature and keyAgreement

   Switch to the Advanced Settings › extendedKeyUsage and type serverAuth for a server certificate.

   

   Important: Avoiding Man-in-the-Middle Attacks

   If you are using the method remote-cert-tls server or remote-cert-tls client to verify certificates, limit the number of times a key can be used. This mitigates man-in-the-middle attacks.

   For more information, see http://openvpn.net/index.php/open-source/documentation/howto.html#mitm.

   Finish with Ok and proceed with Next.

6. Review the summary. YaST displays the current settings for confirmation. Click Create. When the VPN server certificate is created, it is displayed in the Certificates tab.

Create VPN client certificates:

1. Make sure you are on the Certificates tab.

2. Click Add › Add Client Certificate.

3. Enter a Common Name, for example, client1.example.com.

4. Enter the e-mail addresses for your client, for example, user1@client1.example.com, and click Add. Proceed with Next.

5. Enter your password twice and click Advanced options.

   Switch to Advanced Settings › Key Usage list and check one of the following flags:

   • digitalSignature or,

   • keyAgreement or,

   • digitalSignature and keyAgreement.

   Switch to the Advanced Settings › extendedKeyUsage and type clientAuth for a server certificate.

6. Review the summary. YaST displays the current settings for confirmation. Click Create. The VPN client certificate is created and is displayed in the Certificates tab.

7. If you need certificates for more clients, repeat Step 3.

Choose the Certificates tab.

Export the VPN server certificate in two formats: PEM and unencrypted key in PEM.

1. Select your VPN server certificate (openvpn.example.com in our example) and choose Export › Export to File.

2. Select Only the Certificate in PEM Format, enter your VPN server certificate password and save the file to /etc/openvpn/server_crt.pem.

3. Repeat Step 2.a and Step 2.b, but choose the format Only the Key Unencrypted in PEM Format. Save the file to /etc/openvpn/server_key.pem.

Export the VPN client certificates and choose an export format, PEM or PKCS12 (preferred). For each client:

1. Select your VPN client certificate (client1.example.com in our example) and choose Export › Export to File.

2. Select Like PKCS12 and Include the CA Chain, enter your VPN client certificate key password and provide a PKCS12 password. Enter a File Name, click Browse and save the file to /etc/openvpn/client1.p12.

Copy the files to your client (in our example, client1.example.com).

Export the VPN CA (in our example VPN-Server-CA):

1. Switch to the Description tab.

2. Select Advanced › Export to File.

3. Mark Only the Certificate in PEM Format and save the file to /etc/openvpn/vpn_ca.pem.