OpenVPN: Tutorial & Best Practices

OpenVPN is a robust and highly flexible VPN software that allows you to establish secure point-to-point or site-to-site connections. It's the go-to solution for creating encrypted tunnels between your Linux server and various devices, ensuring your data travels safely over the internet.

What is OpenVPN?

OpenVPN is an open-source software that implements virtual private network (VPN) techniques to create secure connections. It can be used to connect remote sites or users to a central network or to protect your internet traffic from prying eyes. Think of it as your personal digital bodyguard, keeping your data safe.

Installing OpenVPN

Typically, OpenVPN is not installed by default on Linux distributions. Here’s how you can install it on a Debian-based system like Ubuntu:

sudo apt update
sudo apt install openvpn easy-rsa

For Red Hat-based systems like CentOS:

sudo yum install epel-release
sudo yum install openvpn easy-rsa

Configuring OpenVPN

Setting Up the Certificate Authority (CA)

First, you'll need to set up a CA. This will sign the server and client certificates. Easy-RSA is a CLI utility to manage certificates and keys.

mkdir -p ~/openvpn-ca
cd ~/openvpn-ca
cp -r /usr/share/easy-rsa/* ./

Initialize the PKI directory:

./easyrsa init-pki

Build the CA:

./easyrsa build-ca

You'll be prompted to enter a password and some details. This will create the root certificate.

Generating Server and Client Certificates

Generate the server certificate and key:

./easyrsa gen-req server nopass
./easyrsa sign-req server server

Generate the client certificate and key:

./easyrsa gen-req client1 nopass
./easyrsa sign-req client client1

Configuring the OpenVPN Server

Create a server configuration file, usually located in the /etc directory:

sudo cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz /etc/openvpn/
sudo gunzip /etc/openvpn/server.conf.gz

Edit the /etc/openvpn/server.conf file to point to your generated certificates and keys.

ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key
dh /etc/openvpn/dh.pem

Start the OpenVPN service:

sudo systemctl start openvpn@server
sudo systemctl enable openvpn@server

Troubleshooting Common Issues

Network Failure

If you encounter network failure, ensure your server has the necessary IP forwarding enabled. Edit the /etc/sysctl.conf file:

net.ipv4.ip_forward = 1

Apply the changes:

sudo sysctl -p

High Load

If your server experiences high load, consider optimizing your OpenVPN configuration. For example, use UDP instead of TCP for better performance:

proto udp

Best Practices for OpenVPN

Regularly Update Your Software

Keep OpenVPN and your system packages up to date to avoid vulnerabilities.

sudo apt update && sudo apt upgrade

Use Strong Encryption

Ensure you're using strong encryption methods in your configuration file:

cipher AES-256-CBC
auth SHA256

Backup Your Keys and Certificates

Regularly backup your CA key, server, and client certificates to avoid data loss.

Conclusion

OpenVPN is a powerful tool for securing your network connections. With the right setup and best practices, you can ensure your data remains secure and private.