17 Configuring a VPN Server #
Today, Internet connections are cheap and available almost everywhere. However, not all connections are secure. Using a Virtual Private Network (VPN), you can create a secure network within an insecure network such as the Internet or Wi-Fi. It can be implemented in different ways and serves several purposes. In this chapter, we focus on the OpenVPN implementation to link branch offices via secure wide area networks (WANs).
17.1 Conceptual Overview #
This section defines some terms regarding VPN and gives a brief overview of some scenarios.
17.1.1 Terminology #
- Endpoint
The two “ends” of a tunnel, the source or destination client.
- Tap Device
A tap device simulates an Ethernet device (layer 2 packets in the OSI model, such as Ethernet frames). A tap device is used for creating a network bridge. It works with Ethernet frames.
- Tun Device
A tun device simulates a point-to-point network (layer 3 packets in the OSI model, such as IP packets). A tun device is used with routing and works with IP frames.
- Tunnel
Linking two locations through a primarily public network. From a more technical viewpoint, it is a connection between the client's device and the server's device. Usually a tunnel is encrypted, but it does need to be by definition.
17.1.2 VPN Scenarios #
Whenever you set up a VPN connection, your IP packets are transferred over a secured tunnel. A tunnel can use either a tun or tap device. They are virtual network kernel drivers which implement the transmission of Ethernet frames or IP frames/packets.
Any user space program, such as OpenVPN, can attach itself to a tun or tap device to receive packets sent by your operating system. The program is also able to write packets to the device.
There are many solutions to set up and build a VPN connection. This section focuses on the OpenVPN package. Compared to other VPN software, OpenVPN can be operated in two modes:
- Routed VPN
Routing is an easy solution to set up. It is more efficient and scales better than a bridged VPN. Furthermore, it allows the user to tune MTU (Maximum Transfer Unit) to raise efficiency. However, in a heterogeneous environment, if you do not have a Samba server on the gateway, NetBIOS broadcasts do not work. If you need IPv6, the drivers for the tun devices on both ends must support this protocol explicitly. This scenario is depicted in Figure 17.1, “Routed VPN”.
Figure 17.1: Routed VPN #- Bridged VPN
Bridging is a more complex solution. It is recommended when you need to browse Windows file shares across the VPN without setting up a Samba or WINS server. Bridged VPN is also needed to use non-IP protocols (such as IPX) or applications relying on network broadcasts. However, it is less efficient than routed VPN. Another disadvantage is that it does not scale well. This scenario is depicted in the following figures.
Figure 17.2: Bridged VPN - Scenario 1 #Figure 17.3: Bridged VPN - Scenario 2 #Figure 17.4: Bridged VPN - Scenario 3 #
The major difference between bridging and routing is that a routed VPN cannot IP-broadcast while a bridged VPN can.
17.2 Setting Up a Simple Test Scenario #
In the following example, we will create a point-to-point VPN tunnel. The
example demonstrates how to create a VPN tunnel between one client and a
server. It is assumed that your VPN server will use private IP addresses
like IP_OF_SERVER
and your client will use the IP address
IP_OF_CLIENT
.
Make sure you select addresses which do not conflict with other IP addresses.
This following scenario is provided as an example meant for familiarizing yourself with VPN technology. Do not use this as a real world scenario, as it can compromise the security and safety of your IT infrastructure!
To simplify working with OpenVPN configuration files, we recommend the following:
Place your OpenVPN configuration files in the directory
/etc/openvpn
.Name your configuration files
MY_CONFIGURATION.conf
.If there are multiple files that belong to the same configuration, place them in a subdirectory like
/etc/openvpn/MY_CONFIGURATION
.
17.2.1 Configuring the VPN Server #
To configure a VPN server, proceed as follows:
Install the package
openvpn
on the machine that will later become your VPN server.Open a shell, become
root
and create the VPN secret key:root #
openvpn --genkey --secret /etc/openvpn/secret.keyCopy the secret key to your client:
root #
scp /etc/openvpn/secret.key root@IP_OF_CLIENT:/etc/openvpn/Create the file
/etc/openvpn/server.conf
with the following content:dev tun ifconfig IP_OF_SERVER IP_OF_CLIENT secret secret.key
Set up a tun device configuration by creating a file called
/etc/sysconfig/network/ifcfg-tun0
with the following content:STARTMODE='manual' BOOTPROTO='static' TUNNEL='tun' TUNNEL_SET_OWNER='nobody' TUNNEL_SET_GROUP='nobody' LINK_REQUIRED=no PRE_UP_SCRIPT='systemd:openvpn@server' PRE_DOWN_SCRIPT='systemd:openvpn@service'
The notation
openvpn@server
points to the OpenVPN server configuration file located at/etc/openvpn/server.conf
. For more information, see/usr/share/doc/packages/openvpn/README.SUSE
.If you use a firewall, start YaST and open UDP port 1194 (
› › ).Start the OpenVPN server service by setting the tun device to
up
:tux >
sudo wicked ifup tun0
You should see the confirmation:
tun0 up
17.2.2 Configuring the VPN Clients #
To configure the VPN client, do the following:
Install the package
openvpn
on your client VPN machine.Create
/etc/openvpn/client.conf
with the following content:remote DOMAIN_OR_PUBLIC_IP_OF_SERVER dev tun ifconfig IP_OF_CLIENT IP_OF_SERVER secret secret.key
Replace the placeholder IP_OF_CLIENT in the first line with either the domain name, or the public IP address of your server.
Set up a tun device configuration by creating a file called
/etc/sysconfig/network/ifcfg-tun0
with the following content:STARTMODE='manual' BOOTPROTO='static' TUNNEL='tun' TUNNEL_SET_OWNER='nobody' TUNNEL_SET_GROUP='nobody' LINK_REQUIRED=no PRE_UP_SCRIPT='systemd:openvpn@client' PRE_DOWN_SCRIPT='systemd:openvpn@client'
If you use a firewall, start YaST and open UDP port 1194 as described in Step 6 of Procedure 17.1, “VPN Server Configuration”.
Start the OpenVPN server service by setting the tun device to
up
:tux >
sudo wicked ifup tun0
You should see the confirmation:
tun0 up
17.2.3 Testing the VPN Example Scenario #
After OpenVPN has successfully started, test the availability of the tun device with the following command:
ip addr show tun0
To verify the VPN connection, use ping
on both client
and server side to see if they can reach each other. Ping the server
from the client:
ping -I tun0 IP_OF_SERVER
Ping the client from the server:
ping -I tun0 IP_OF_CLIENT
17.3 Setting Up Your VPN Server Using a Certificate Authority #
The example in Section 17.2 is useful for testing, but not for daily work. This section explains how to build a VPN server that allows more than one connection at the same time. This is done with a public key infrastructure (PKI). A PKI consists of a pair of public and private keys for the server and each client, and a master certificate authority (CA), which is used to sign every server and client certificate.
This setup involves the following basic steps:
17.3.1 Creating Certificates #
Before a VPN connection can be established, the client must authenticate the server certificate. Conversely, the server must also authenticate the client certificate. This is called mutual authentication. To create such certificates, use the YaST CA module. See Chapter 18, Managing X.509 Certification for more details.
To create a VPN root, server, and client CA, proceed as follows:
Prepare a common VPN Certificate Authority (CA):
Start the YaST CA module.
Click
.Enter a
and a , for exampleVPN-Server-CA
.Fill out the other boxes like e-mail addresses, organization, etc. and proceed with
.Enter your password twice and proceed with
.Review the summary. YaST displays the current settings for confirmation. Click
. The root CA is created and displayed in the overview.
Create a VPN server certificate:
Select the root CA you created in Step 1 and click .
When prompted, enter the
.Click the
tab and click › .Specify a
, for example,openvpn.example.com
and proceed with .Specify your password and confirm it. Then click
.Switch to the
› list and check one of the following sets:digitalSignature
andkeyEncipherment
, or,digitalSignature
andkeyAgreement
Switch to the
› and typeserverAuth
for a server certificate.Important: Avoiding Man-in-the-Middle AttacksIf you are using the method
remote-cert-tls server
orremote-cert-tls client
to verify certificates, limit the number of times a key can be used. This mitigates man-in-the-middle attacks.For more information, see http://openvpn.net/index.php/open-source/documentation/howto.html#mitm.
Finish with
and proceed with .Review the summary. YaST displays the current settings for confirmation. Click
. When the VPN server certificate is created, it is displayed in the tab.
Create VPN client certificates:
Make sure you are on the
tab.Click
› .Enter a
, for example,client1.example.com
.Enter the e-mail addresses for your client, for example,
user1@client1.example.com
, and click . Proceed with .Enter your password twice and click
.Switch to
› list and check one of the following flags:digitalSignature
or,keyAgreement
or,digitalSignature
andkeyAgreement
.
Switch to the
› and typeclientAuth
for a server certificate.Review the summary. YaST displays the current settings for confirmation. Click
. The VPN client certificate is created and is displayed in the tab.If you need certificates for more clients, repeat Step 3.
After you have successfully finished Procedure 17.3, “Creating a VPN Server Certificate” you have a VPN root CA, a VPN server CA, and one or more VPN client CAs. To finish the task, proceed with the following procedure:
Choose the
tab.Export the VPN server certificate in two formats: PEM and unencrypted key in PEM.
Export the VPN client certificates and choose an export format, PEM or PKCS12 (preferred). For each client:
Select your VPN client certificate (
client1.example.com
in our example) and choose › .Select
, enter your VPN client certificate key password and provide a PKCS12 password. Enter a , click and save the file to/etc/openvpn/client1.p12
.
Copy the files to your client (in our example,
client1.example.com
).Export the VPN CA (in our example
VPN-Server-CA
):Switch to the
tab.Select
› .Mark
and save the file to/etc/openvpn/vpn_ca.pem
.
If desired, the client PKCS12 file can be converted into the PEM format using this command:
openssl pkcs12 -in client1.p12 -out client1.pem
Enter your client password to create the
client1.pem
file. The PEM file contains the client
certificate, client key, and the CA certificate. You can split this
combined file using a text editor and create three separate files. The
file names can be used for the ca
,
cert
, and key
options in the OpenVPN
configuration file (see Example 17.1, “VPN Server Configuration File”).
17.3.2 Configuring the VPN Server #
As the basis of your configuration file, copy
/usr/share/doc/packages/openvpn/sample-config-files/server.conf
to /etc/openvpn/
. Then customize it to your needs.
# /etc/openvpn/server.conf port 1194 1 proto udp 2 dev tun0 3 # Security 4 ca vpn_ca.pem cert server_crt.pem key server_key.pem # ns-cert-type server remote-cert-tls client 5 dh server/dh2048.pem 6 server 192.168.1.0 255.255.255.0 7 ifconfig-pool-persist /var/run/openvpn/ipp.txt 8 # Privileges 9 user nobody group nobody # Other configuration 10 keepalive 10 120 comp-lzo persist-key persist-tun # status /var/log/openvpn-status.tun0.log 11 # log-append /var/log/openvpn-server.log 12 verb 4
The TCP/UDP port on which OpenVPN listens. You need to open the port in the firewall, see Chapter 16, Masquerading and Firewalls. The standard port for VPN is 1194, so you can usually leave that as it is. | |
The protocol, either UDP or TCP. | |
The tun or tap device. For the difference between these, see Section 17.1.1, “Terminology”. | |
The following lines contain the relative or absolute path to the root
server CA certificate ( | |
Require that peer certificates have been signed with an explicit key usage and extended key usage based on RFC3280 TLS rules. There is a description of how to make a server use this explicit key in Procedure 17.3, “Creating a VPN Server Certificate”. | |
The Diffie-Hellman parameters. Create the required file with the following command: openssl dhparam -out /etc/openvpn/dh2048.pem 2048 | |
Supplies a VPN subnet. The server can be reached by
| |
Records a mapping of clients and its virtual IP address in the given file. Useful when the server goes down and (after the restart) the clients get their previously assigned IP address. | |
For security reasons, run the OpenVPN daemon with reduced privileges. To
do so, specify that it should use the group and user
| |
Several other configuration options—see the comment in the
example configuration file:
| |
Enable this option to write short status updates with statistical data (“operational status dump”) to the named file. By default, this is not enabled.
All output is written to syslog. If you have more than one
configuration file (for example, one for home and another for work), it
is recommended to include the device name into the file name. This
avoids overwriting output files accidentally. In this case,
it is | |
By default, log messages go to syslog. Overwrite this behavior by
removing the hash character. In that case, all messages go to
|
After having completed this configuration, you can see log messages of
your OpenVPN server under /var/log/openvpn.log
.
After having started it for the first time, it should finish with:
... Initialization Sequence Completed
If you do not see this message, check the log carefully for any hints of what is wrong in your configuration file.
17.3.3 Configuring the VPN Clients #
As the basis of your configuration file, copy
/usr/share/doc/packages/openvpn/sample-config-files/client.conf
to /etc/openvpn/
. Then customize it to your needs.
# /etc/openvpn/client.conf client 1 dev tun 2 proto udp 3 remote IP_OR_HOST_NAME 1194 4 resolv-retry infinite nobind remote-cert-tls server 5 # Privileges 6 user nobody group nobody # Try to preserve some state across restarts. persist-key persist-tun # Security 7 pkcs12 client1.p12 comp-lzo 8
Specifies that this machine is a client. | |
The network device. Both clients and server must use the same device. | |
The protocol. Use the same settings as on the server. | |
This is security option for clients which ensures that the host they connect to is a designated server. | |
Replace the placeholder IP_OR_HOST_NAME
with the respective host name or IP address of your VPN server. After
the host name, the port of the server is given. You can have multiple
lines of | |
For security reasons, run the OpenVPN daemon with reduced privileges. To
do so, specify that it should use the group and user
| |
Contains the client files. For security reasons, use a separate pair of files for each client. | |
Turn on compression. Only use this parameter if compression is enabled on the server as well. |
17.4 Setting Up a VPN Server or Client Using YaST #
You can also use YaST to set up a VPN server. However, the YaST module does not support OpenVPN. Instead, it provides support for the IPsec protocol (as implemented in the software StrongSwan). Like OpenVPN, IPsec is a widely supported VPN scheme.
To start the YaST VPN module, select
› .Under
, activate .To create a new VPN, click
, then enter a name for the connection.Under
, select .Then choose the scenario:
The scenarios
and are best suited to Linux client setups.The scenario
sets up a configuration that is natively supported by modern versions of Android, iOS, and macOS. It is based on a pre-shared key setup with an additional user name and password authentication.The scenario
is a configuration that is natively supported by Windows and BlackBerry devices. It is based on a certificate setup with an additional user name and password authentication.
For this example, choose
.To specify the key, click
. Activate , then type the secret key. Confirm with .Choose whether and how to limit access within your VPN under https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing.
. To enable only certain IP ranges, specify these in CIDR format, separated by commas in . For more information about the CIDR format, seeUnder
, specify the format of IP addresses your VPN should provide to its clients.To finish, click
. The YaST VPN module will now automatically add and enable firewall rules to allow clients to connect to the new VPN.To view the connection status, in the following confirmation window, click
. You will then see the output ofsystemctl status
for your VPN, which allows you to check if the VPN is running and configured correctly.
17.5 For More Information #
For more information on setting up a VPN connection using NetworkManager, see Section 38.3.5, “NetworkManager and VPN”.
For more information about VPN in general, see:
https://openvpn.net: the OpenVPN home page
man
openvpn
/usr/share/doc/packages/openvpn/sample-config-files/
: example configuration files for different scenarios./usr/src/linux/Documentation/networking/tuntap.txt
, to install thekernel-source
package.