Open VPN Server Configuration on Linux

September 23, 2015 actsupp-r0cks

1. Install the OpenVPN RPM

Before installing OpenVPN, make sure that all necessary dependencies are installed.

Dependencies Required

  • openssl

  • lzo

  • pkcs11-helper

Once dependencies are ready, download the appropriate OpenVPN RPM package for your system:

# wget https://path/to/openvpn-<version>.rpm
# rpm -ivh openvpn-<version>.rpm

After the installation completes, two directories will be created automatically:

  • /etc/openvpn

  • /usr/share/doc/openvpn-<version>

2. Copy Configuration Files

Next, copy the required configuration templates to the OpenVPN directory:

# cp -r /usr/share/doc/openvpn-<version>/easy-rsa /etc/openvpn
# cp /usr/share/doc/openvpn-<version>/sample-config-files/server.conf /etc/openvpn

This step ensures that the easy-rsa scripts and the sample server.conf file are available in /etc/openvpn.

3. Set Up Easy-RSA

Now, navigate to the Easy-RSA directory to set up your Public Key Infrastructure (PKI):

# cd /etc/openvpn/easy-rsa/2.0

Edit the Vars File

Open the vars file and modify the last five lines with your organization’s details:

export KEY_COUNTRY="YOURCOUNTRY"
export KEY_PROVINCE="YOURSTATE"
export KEY_CITY="YOURCITY"
export KEY_ORG="YOURORG"
export KEY_EMAIL="exuser@host.yourdomain.com"

Save the file and run it to load the environment variables:

# . ./vars

Note: There are two dots in the command above.

4. Generate Keys and Certificates

To clear old keys (if any), run:

# ./clear-all

Then, build the Certificate Authority (CA) and Diffie-Hellman parameters:

# ./build-ca
# ./build-dh

These commands generate the following files inside the keys folder:

  • ca.crt

  • ca.key

  • dh1024.pem

Generate the Server Key

Next, create the server key:

# ./build-key-server <Server-Name>

During this process, press Enter for all prompts except Common Name, where you should enter your server’s hostname or any identifier.

This will generate:

  • <Server-Name>.crt

  • <Server-Name>.csr

  • <Server-Name>.key

5. Configure the Server

Return to the OpenVPN configuration directory:

# cd /etc/openvpn
# vi server.conf

Below is an example configuration file and explanation for each important directive:

local 192.168.1.101
port 1194
proto udp
dev tun
ca ca.crt
cert host.yourdomain.com.crt
key host.yourdomain.com.key
dh dh1024.pem
server 192.168.11.0 255.255.255.248
ifconfig-pool-persist ipp.txt
push "route 172.23.0.0 255.255.0.0"
client-config-dir ccd
route 192.168.12.0 255.255.255.0
client-to-client
keepalive 10 120
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
log-append openvpn.log
verb 3

6. Explanation of Key Configuration Lines

Line Directive Description
1 local 192.168.1.101 Specifies which local IP OpenVPN should bind to.
2 port 1194 Defines the port number for the VPN service.
3 proto udp Sets the protocol (UDP is recommended).
4 dev tun Uses the TUN virtual device for routing.
5–8 Certificates & Keys Ensure all certificate paths are correct and accessible.
9 server 192.168.11.0 255.255.255.248 Defines the VPN subnet for clients.
11 push "route 172.23.0.0 255.255.0.0" Routes the local network to clients.
12 client-config-dir ccd Enables per-client configuration.
14 client-to-client Allows clients to communicate with each other.
21–22 Logging Enables detailed status and log files.

7. Verify and Start the OpenVPN Service

Before starting the service, ensure that all required files exist in /etc/openvpn:

  • ca.crt

  • dh1024.pem

  • <Server-Name>.crt

  • <Server-Name>.csr

  • <Server-Name>.key

Then, start OpenVPN:

# service openvpn start

To enable automatic startup on boot:

# chkconfig openvpn on

Conclusion

In summary, installing and configuring OpenVPN on RHEL 7 or CentOS 7 involves several steps — from installing dependencies and copying sample files to setting up keys and configuring the server. Once complete, you’ll have a secure, fully functional VPN server ready for use.

Written by actsupp-r0cks