Instalasi OpenVPN

Membuat Server OpenVPN

Install openvpn di Ubuntu

# apt-get install openvpn
# cp -Rf /usr/share/doc/openvpn/examples/easy-rsa/* /etc/openvpn/

Alternatif lain yang lebih susah, compole openvpn dari source code

# cp openvpn-2.0.9.tar.gz /usr/local/src
# cd /usr/local/src
# tar zxvf openvpn-2.0.9.tar.gz
# cd openvpn-2.0.9
# ./configure
# make
# make install

Edit file vars di /etc/openvpn

# cd /etc/openvpn/
# vi vars
     #this is to ensure secure data
     export KEY_SIZE=1024
     # These are the default values for fields
     # which will be placed in the certificate.
     # Don't leave any of these fields blank.
     export KEY_COUNTRY=ID
     export KEY_PROVINCE=DKI
     export KEY_CITY=Jakarta
     export KEY_ORG="Kerm.IT"
     export KEY_EMAIL="onno@indo.net.id"

Buat Certificate Authority (CA)

# cd /etc/openvpn/
. ./vars
./clean-all
./build-ca
       Country Name (2 letter code) [ID]:
       State or Province Name (full name) [DKI]:
       Locality Name (eg, city) [Jakarta]:
       Organization Name (eg, company) [Kerm.IT]:
       Organizational Unit Name (eg, section) []:Kerm.IT
       Common Name (eg, your name or your server's hostname) []:yc0mlc.ampr.org
       Email Address [onno@indo.net.id]:

Lihat keys apakah sudah di generate

# ls -l /etc/openvpn/
# ls -l /etc/openvpn/keys
       ca.crt
       ca.key
       index.txt
       serial

Buat Server Key

# ./build-key-server server
       Country Name (2 letter code) [ID]:
       State or Province Name (full name) [DKI]:
       Locality Name (eg, city) [Jakarta]:
       Organization Name (eg, company) [Kerm.IT]:
       Organizational Unit Name (eg, section) []:Kerm.IT
       Common Name (eg, your name or your server's hostname) []:yc0mlc.ampr.org
       Email Address [onno@indo.net.id]:

       Please enter the following 'extra' attributes
       to be sent with your certificate request
       A challenge password []:123456
       An optional company name []:Kerm.IT
       Using configuration from /etc/openvpn/openssl.cnf
       Check that the request matches the signature
       Signature ok
       The Subject's Distinguished Name is as follows
       countryName           :PRINTABLE:'ID'
       stateOrProvinceName   :PRINTABLE:'DKI'
       localityName          :PRINTABLE:'Jakarta'
       organizationName      :PRINTABLE:'Kerm.IT'
       organizationalUnitName:PRINTABLE:'Kerm.IT'
       commonName            :PRINTABLE:'yc0mlc.ampr.org'
       emailAddress          :IA5STRING:'onno@indo.net.id'
       Certificate is to be certified until Jan 13 03:34:36 2018 GMT (3650 days)
       Sign the certificate? [y/n]:y

       1 out of 1 certificate requests certified, commit? [y/n]y
       Write out database with 1 new entries
       Data Base Updated

Buat key untuk user admin maupun user lainnya jika di perlukan

# ./build-key admin
       1 out of 1 certificate requests certified, commit? [y/n]y
       Write out database with 1 new entries
       Data Base Updated

./build-key-pass username ./build-key username

./build-dh openvpn --genkey --secret keys/ta.key

openvpn --genkey --secret keys/ca.key openvpn --genkey --secret keys/ta.key

test key

1. openvpn --genkey --secret key
2. openvpn --test-crypto --secret key

test di 2 windows

1. cd /etc/openvpn
2. cp -Rf /usr/share/doc/openvpn/examples/sample-config-files/ /etc/openvpn/
3. cp -Rf /usr/share/doc/openvpn/examples/sample-keys/ /etc/openvpn/
4. openvpn --config sample-config-files/loopback-client
5. openvpn --config sample-config-files/loopback-server

Example OpenVPN-Admin

1. apt-get install mono openvpn-admin

Operational Server server.conf (from www.openvpn.org)

1. openvpn --config /etc/openvpn/server.conf

Operational Client client.conf (from www.openvpn.org)

1. openvpn --config /etc/openvpn/client.conf

1. vi /etc/openvpn/server.conf

1. OpenVPN Server config file
2. Which local IP address should OpenVPN listen on? (optional)
3. local 10.1.1.2

local 192.168.0.2

1. Which TCP/UDP port should OpenVPN listen on?

port 1194

1. TCP or UDP server?

proto tcp

1. "dev tun" will create a routed IP tunnel, which is what we want

dev tun

1. Windows needs the TAP-Win32 adapter name
2. from the Network Connections panel if you
3. have more than one. On XP SP2 or higher,
4. you may need to selectively disable the
5. Windows firewall for the TAP adapter.
6. Non-Windows systems usually don't need this.

dev-node MyTap

1. SSL/TLS root certificate (ca), certificate
2. (cert), and private key (key). Each client
3. and the server must have their own cert and
4. key file. The server and all clients will
5. use the same ca file.

ca keys/ca.crt cert keys/server.crt key keys/server.key # This file should be kept secret

1. Diffie hellman parameters.

dh keys/dh1024.pem

1. Configure server mode and supply a VPN subnet

server 192.168.1.0 255.255.255.0

1. Maintain a record of client <-> virtual IP address
2. associations in this file.

ifconfig-pool-persist ipp.txt

1. Push routes to the client to allow it
2. to reach other private subnets behind
3. the server. Remember that these
4. private subnets will also need
5. to know to route the OpenVPN client
6. address pool (10.8.0.0/255.255.255.0)
7. back to the OpenVPN server.
8. push “route 172.10.1.0 255.255.255.0"
9. push “route 192.168.0.0 255.255.255.0"
10. If enabled, this directive will configure
11. all clients to redirect their default
12. network gateway through the VPN, causing
13. all IP traffic such as web browsing and
14. and DNS lookups to go through the VPN

push “redirect-gateway”

1. Certain Windows-specific network settings
2. can be pushed to clients, such as DNS
3. or WINS server addresses.

push “dhcp-option DNS 172.10.1.2′′

1. Uncomment this directive to allow different
2. clients to be able to “see” each other.

client-to-client

1. Ping every 10 seconds, assume that remote
2. peer is down if no ping received during
3. a 120 second time period.

keepalive 10 120

1. For extra security beyond that provided
2. by SSL/TLS, create an “HMAC firewall”
3. to help block DoS attacks and UDP port flooding.

tls-auth keys/ta.key 0 # This file is secret

1. Select a cryptographic cipher.
2. This config item must be copied to
3. the client config file as well.

cipher BF-CBC # Blowfish (default)

cipher AES-128-CBC # AES

cipher DES-EDE3-CBC # Triple-DES

1. Enable compression on the VPN link.
2. comp-lzo
3. The maximum number of concurrently connected
4. clients we want to allow.

max-clients 250

1. It’s a good idea to reduce the OpenVPN
2. daemon’s privileges after initialization.

user nobody group nogroup

1. The persist options will try to avoid
2. accessing certain resources on restart
3. that may no longer be accessible because
4. of the privilege downgrade.

persist-key persist-tun

1. Output a short status file showing

status openvpn-status.log log-append openvpn.log

1. Set the appropriate level of log
2. file verbosity.
4. 0 is silent, except for fatal errors
5. 4 is reasonable for general usage
6. 5 and 6 can help to debug connection problems
7. 9 is extremely verbose

verb 4

1. Silence repeating messages. At most 20
2. sequential messages of the same message
3. category will be output to the log.

mute 20

Setup Client OpenVPN di Linux

# apt-get install kvpnc
# apt-get install network-manager-openvpn openvpn

# cp -Rf /usr/share/doc/openvpn/examples/easy-rsa/* /etc/openvpn/
# cd /etc/openvpn
# mkdir /etc/openvpn/keys

# vi vars
# , ./vars
# ./clean-all

# scp -r root@192.168.0.2:/etc/openvpn/keys/ca.crt /etc/openvpn/keys
# scp -r root@192.168.0.2:/etc/openvpn/keys/user1.crt /etc/openvpn/keys
# scp -r root@192.168.0.2:/etc/openvpn/keys/user1.key /etc/openvpn/keys

Operational Client (client.conf from www.openvpn.org)

# openvpn --config /etc/openvpn/client.conf

# vi /etc/openvpn/client.conf

# Specify that we are a client and that we # will be pulling certain config file directives # from the server. client

# Use the same setting as you are using on # the server. # On most systems, the VPN will not function # unless you partially or fully disable # the firewall for the TUN/TAP interface. ;dev tap dev tun

# Windows needs the TAP-Win32 adapter name # from the Network Connections panel # if you have more than one. On XP SP2, # you may need to disable the firewall # for the TAP adapter. ;dev-node MyTap

# Are we connecting to a TCP or # UDP server? Use the same setting as # on the server. ;proto tcp proto udp

# The hostname/IP and port of the server. # You can have multiple remote entries # to load balance between the servers. ;remote my-server-1 1194 ;remote my-server-2 1194 remote 192.168.0.2 1194

# Choose a random host from the remote # list for load-balancing. Otherwise # try hosts in the order specified. ;remote-random

# Keep trying indefinitely to resolve the # host name of the OpenVPN server. Very useful # on machines which are not permanently connected # to the internet such as laptops. resolv-retry infinite

# Most clients don't need to bind to # a specific local port number. nobind

# Downgrade privileges after initialization (non-Windows only) user nobody group nogroup

# Try to preserve some state across restarts. persist-key persist-tun

# If you are connecting through an # HTTP proxy to reach the actual OpenVPN # server, put the proxy server/IP and # port number here. See the man page # if your proxy server requires # authentication. ;http-proxy-retry # retry on connection failures ;http-proxy [proxy server] [proxy port #]

# Wireless networks often produce a lot # of duplicate packets. Set this flag # to silence duplicate packet warnings. ;mute-replay-warnings

# SSL/TLS parms. # See the server config file for more # description. It's best to use # a separate .crt/.key file pair # for each client. A single ca # file can be used for all clients. ca keys/ca.crt cert keys/client.crt key keys/client.key

# Verify server certificate by checking # that the certicate has the nsCertType # field set to "server". This is an # important precaution to protect against # a potential attack discussed here: # http://openvpn.net/howto.html#mitm # # To use this feature, you will need to generate # your server certificates with the nsCertType # field set to "server". The build-key-server # script in the easy-rsa folder will do this. ;ns-cert-type server

# If a tls-auth key is used on the server # then every client must also have the key. ;tls-auth ta.key 1

# Select a cryptographic cipher. # If the cipher option is used on the server # then you must also specify it here. ;cipher x

# Enable compression on the VPN link. # Don't enable this unless it is also # enabled in the server config file. comp-lzo

# Set log file verbosity. verb 3

# Silence repeating messages ;mute 20