OpenVPN Summary + Amazon Linux2

Overview#

--OpenVPN encapsulates L2 and L3 protocols such as IP / TCP with SSL / TLS and securely connects between the OpenVPN server and the OpenVPN client.

--OpenVPN uses PKI.

--Files required for OpenVPN --CA (Certificate Authority): CA certificate, CA private key --OpenVPN server: CA certificate, server certificate, server private key, DH parameters --OpenVPN client: CA certificate, client certificate, client private key

--Connection type

OpenVPN server side

Create a certificate authority etc. using the ** easy-rsa ** package

# /usr/share/easy-rsa/3/easy-rsa init-pki
# /usr/share/easy-rsa/3/easy-rsa build-ca

Create a server certificate

# /usr/share/easy-rsa/3/easy-rsa build-ca build-server-full vpnsrv nopass

Create client certificate

# /usr/share/easy-rsa/3/easy-rsa build-ca build-client-full vpncli nopass

Create DH parameters.

# /usr/share/easy-rsa/3/easy-rsa gen-dh

Copy the created certificate file to ** etc / openvpn / server **.

# cp -r /usr/share/easy-rsa/3/pki etc/openvpn/server

Create a TLS key.

# openvpn --genkey --secret /etc/openvpn/server/pki/ta.key

Settings in /etc/openvpn/server/server.conf. Copy the sample from /usr/share/doc/openvpn/2.4.9/sample/sample-config-files and use it.

/etc/openvpn/server/server.conf

#port number
port 1194

#protocol
proto udp

#Bridge connection
dev tap

#CA private key
ca ca.crt

#Server certificate
cert issued/vpnsrv.crt

#Server private key
key private/vpnsrv.key

#DH parameter
dh dh.pem

#Network used for VPN
server 192.168.250.0 255.255.255.0
push "route 192.168.250.0 255.255.255.0"

#TLS authentication key
tls-auth ta.key

#A file that outputs a list of connected clients
status /var/log/openvpn-status.log

#File to output log (output to syslog if not specified)
log /var/log/openvpn.log

Start OpenVPN.

# systemctl start openvpn-server@server
# systemctl -w net.ipv4.ip_forward=1

OpenVPN client side

Transfer the following files to the OpenVPN client side.

/etc/openvpn/client.conf

#Specifying to be a client.
client

#Bridge connection
dev tap

#protocol
proto udp

#Connection destination server, port
remoto server.naata.com 1194

#Certificate authority certificate file
ca     ca.crt
#Client certificate file
cert   issued/vpncli1.crt
#Client private key file
key    private/vpncli1.key

#tls authentication key
tls-auth ta.key

Start OpenVPN.

# /sbin/openvpn /etc/openvpn/client.conf

Build OpenVPN (Amazon Linux2)

1. Installation

Enable EPEL Repository (https://aws.amazon.com/jp/premiumsupport/knowledge-center/ec2-enable-epel/)

OpenVPN installation

sudo yum install openvpn -y 

Install easy-rsa

sudo yum install easy-rsa --enablerepo=epel -y

2. Certificate authority and key creation

Certificate Authority Initialization

sudo -s
cd /usr/share/easy-rsa/3
./easyrsa init-pki

init-pki complete; you may now create a CA or requests.
Your newly created PKI dir is: /usr/share/easy-rsa/3/pki

Creating a certificate authority

./easyrsa build-ca

Creating DH parameters

./easyrsa gen-dh

Creating a TLS authentication key

openvpn --genkey --secret /etc/openvpn/ta.key

Creating a server certificate and private key

./easyrsa build-server-full server nopass

Creating client certificate and private key

 ./easyrsa build-client-full client

3. Settings in /etc/openvpn/server.conf

Edit /etc/openvpn/server.conf

cp /usr/share/doc/openvpn-2.4.9/sample/sample-config-files/server.conf /etc/openvpn/

/etc/openvpn/server.conf

port 1194
proto udp
dev tun
ca /usr/share/easy-rsa/3/pki/ca.crt 
cert /usr/share/easy-rsa/3/pki/issued/server.crt
key /usr/share/easy-rsa/3/pki/private/server.key
dh /usr/share/easy-rsa/3/pki/dh.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 10.0.0.0 255.255.255.0"
keepalive 10 120
#tls-auth ta.key 0
cipher AES-256-CBC
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3
explicit-exit-notify 1

4. Start and confirm openVPN

Forwarding settings

/etc/sysctl.conf

net.ipv4.ip_forward = 1

network restart

systemctl restart network　

restart openvpn

systemctl start openvpn@server
systemctl enable openvpn@server

Check openvpn status

systemctl list-unit-files -t service | grep openvpn

5. AWS settings

--Allow port 1194 in the security group of the instance where OpenVPN is installed

--Private network --Route table: Set the routing from the segment on the VPN client side to the server on which OpenVPN is installed. --Security group: Allow packets coming from the VPN client side segment

--Disable the source / destination change check on the server on which OpenVPN is installed.

• What is sending / destination change check invalidation? EC2 instances have source / destination checking enabled by default. In other words, packets that are not addressed to the target EC2 instance are played by default. Since it is necessary to pass packets destined for the Internet via EC2 this time, it is necessary to disable this function and change it so that packets will not be bounced.

Reference: https://it.hirokun.net/entry/ec2-openvpn-easyrsa3#OpenVPN-6

6. Verify with Tunnelblick (MAC)

Connect with Tunnelbrick.

client
dev tun
proto udp
remote OpenVPN server IP address 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
cipher AES-256-CBC
keepalive 10 60
verb 3
mssfix 1280