Hey guys! Today, we're diving into how to install OpenVPN on your Ubuntu Linux system. OpenVPN is a robust and highly flexible VPN (Virtual Private Network) solution that secures your network traffic, encrypts your data, and lets you bypass geographical restrictions. Whether you're a privacy enthusiast, a remote worker, or just someone who wants an extra layer of security while browsing, setting up OpenVPN on Ubuntu is a smart move. So, let's get started with this comprehensive guide to get you up and running.

Prerequisites

Before we jump into the installation process, let's make sure you have everything you need. Here’s a quick checklist:

• An Ubuntu Server: This guide assumes you have an Ubuntu server (e.g., 18.04, 20.04, or 22.04) up and running. You can use a cloud provider like AWS, Digital Ocean, or Vultr, or even a local virtual machine.
• A User with Sudo Privileges: You’ll need a user account with sudo privileges to install software and configure the system.
• Basic Command-Line Knowledge: Familiarity with basic Linux commands will be helpful.
• An Active Internet Connection: Obviously, you need an internet connection to download packages and configure OpenVPN.

Having these prerequisites sorted out will ensure a smooth and hassle-free installation. Now, let's move on to the actual installation steps.

Step-by-Step Installation Guide

Step 1: Update Your System

First things first, we need to ensure that your Ubuntu system is up-to-date. This will help prevent any compatibility issues and ensure you have the latest security patches. Open your terminal and run the following commands:

sudo apt update
sudo apt upgrade

The sudo apt update command refreshes the package lists, and sudo apt upgrade installs the latest versions of all packages currently installed on your system. It’s always a good practice to keep your system updated.

Step 2: Install the OpenVPN Package

Now, let's install the OpenVPN package. This is the core component that provides the VPN functionality. Run the following command in your terminal:

sudo apt install openvpn easy-rsa

This command installs both the openvpn package and easy-rsa. The openvpn package provides the OpenVPN server and client binaries, while easy-rsa is a utility for generating the necessary certificates and keys for secure communication. Certificates and keys are essential for authenticating clients and encrypting data, so make sure both packages are installed correctly.

Step 3: Set Up Easy-RSA

Easy-RSA simplifies the process of creating and managing the SSL certificates that OpenVPN uses for encryption and authentication. Let’s set it up:

mkdir ~/easy-rsa
cp -r /usr/share/easy-rsa/* ~/easy-rsa
cd ~/easy-rsa

These commands create a directory for Easy-RSA in your home directory, copy the Easy-RSA scripts into it, and then navigate into the directory. Now, you need to initialize the Public Key Infrastructure (PKI).

Step 4: Initialize the PKI

Before generating certificates, you need to initialize the PKI. This involves creating a vars file with default values and setting up the necessary directories. Run the following commands:

./easyrsa init-pki

This command initializes the PKI. Next, you need to create the vars file. This file contains default values for the certificate fields.

vi vars

In the vars file, add the following lines:

set_var EASYRSA_ALGO "ecdsa"
set_var EASYRSA_DIGEST "sha512"
set_var EASYRSA_CA_EXPIRE 3650
set_var EASYRSA_KEY_SIZE 2048
set_var EASYRSA_COUNTRY "US"
set_var EASYRSA_PROVINCE "CA"
set_var EASYRSA_CITY "SanFrancisco"
set_var EASYRSA_ORG "MyOrg"
set_var EASYRSA_EMAIL "admin@example.com"
set_var EASYRSA_OU "MyOrganizationalUnit"

Modify these values to match your organization's details. Save and close the file. Then, source the vars file:

source vars

Sourcing the vars file loads the variables into your current shell session.

Step 5: Build the Certificate Authority (CA)

Now that the PKI is initialized and the vars file is configured, you can build the Certificate Authority (CA). The CA is responsible for signing the server and client certificates. Run the following command:

./easyrsa build-ca

You’ll be prompted for a passphrase. Choose a strong passphrase and remember it, as you’ll need it later. This passphrase protects the CA key, so keep it safe. The CA certificate is now created and stored in the pki directory.

Step 6: Generate the Server Certificate and Key

Next, generate the server certificate and key. This certificate will be used by the OpenVPN server to identify itself to clients. Run the following command:

./easyrsa gen-req server nopass

This command generates a certificate request for the server. The nopass option skips the passphrase prompt, which is useful for automated setups. Now, sign the server certificate with the CA:

./easyrsa sign server server

You’ll be prompted to confirm that you want to sign the certificate request. Type yes and press Enter. The server certificate and key are now created and stored in the pki directory.

Step 7: Generate the Client Certificates and Keys

Now, generate the client certificates and keys. Each client that connects to the OpenVPN server needs its own certificate and key. Run the following command for each client:

./easyrsa gen-req client1 nopass
./easyrsa sign client client1

Replace client1 with the actual name of the client. You’ll be prompted to confirm that you want to sign the certificate request. Type yes and press Enter. Repeat this process for each client that will connect to the OpenVPN server.

Step 8: Generate Diffie-Hellman Parameters

Diffie-Hellman parameters are used for key exchange. Generate them using the following command:

./easyrsa gen-dh

This process may take a while, as it generates strong cryptographic parameters. Once it’s done, you’ll have the dh.pem file in the pki directory.

Step 9: Copy Certificates and Keys to the OpenVPN Directory

Now, copy the necessary certificates and keys to the OpenVPN directory. This is where OpenVPN expects to find them. Run the following commands:

cp pki/ca.crt /etc/openvpn/
cp pki/issued/server.crt /etc/openvpn/
cp pki/private/server.key /etc/openvpn/
cp pki/dh.pem /etc/openvpn/

These commands copy the CA certificate, server certificate, server key, and Diffie-Hellman parameters to the /etc/openvpn/ directory. Make sure the paths are correct, and that the files are copied successfully.

Step 10: Configure the OpenVPN Server

Now, let’s configure the OpenVPN server. Create a new configuration file in the /etc/openvpn/ directory. You can name it server.conf:

vi /etc/openvpn/server.conf

Add the following configuration to the server.conf file:

port 1194
proto udp
dev tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key  # This file should be kept secret
dh /etc/openvpn/dh.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3
explicit-exit-notify 1

Here’s a breakdown of the configuration options:

• port 1194: The port OpenVPN will listen on.
• proto udp: The protocol to use (UDP is generally faster).
• dev tun: The tunnel device to use.
• ca /etc/openvpn/ca.crt: The path to the CA certificate.
• cert /etc/openvpn/server.crt: The path to the server certificate.
• key /etc/openvpn/server.key: The path to the server key.
• dh /etc/openvpn/dh.pem: The path to the Diffie-Hellman parameters.
• server 10.8.0.0 255.255.255.0: The VPN subnet.
• push "redirect-gateway def1 bypass-dhcp": Redirect all client traffic through the VPN.
• push "dhcp-option DNS 8.8.8.8": Set the DNS server for clients.
• keepalive 10 120: Keepalive settings to detect dead connections.
• comp-lzo: Enable compression.
• persist-key: Persist the key after restarts.
• persist-tun: Persist the tunnel device after restarts.
• status openvpn-status.log: Log the status of the OpenVPN server.
• verb 3: Verbosity level for logging.
• explicit-exit-notify 1: Notify clients when the server exits.

Save and close the server.conf file. Now, let's enable IP forwarding.

Step 11: Enable IP Forwarding

IP forwarding allows the OpenVPN server to route traffic on behalf of the clients. To enable it, edit the /etc/sysctl.conf file:

vi /etc/sysctl.conf

Uncomment the following line:

net.ipv4.ip_forward=1

Save and close the file. Then, apply the changes:

sudo sysctl -p

This command applies the changes in the sysctl.conf file.

Step 12: Configure Firewall Rules

Next, configure the firewall rules to allow OpenVPN traffic. If you're using ufw, run the following commands:

sudo ufw allow 1194/udp
sudo ufw route allow in on tun0 out on eth0
sudo ufw enable

These commands allow UDP traffic on port 1194, allow routing through the tun0 interface, and enable the firewall. Adjust the interface names (tun0 and eth0) to match your system's configuration.

Step 13: Start the OpenVPN Server

Now, start the OpenVPN server:

sudo systemctl start openvpn@server

Check the status of the OpenVPN server:

sudo systemctl status openvpn@server

If the server is running without errors, you’re good to go. If there are errors, check the logs for more information.

Step 14: Create the Client Configuration File

To connect clients to the OpenVPN server, you need to create a client configuration file. Create a new file for each client. For example, for client1, create a file named client1.ovpn:

vi client1.ovpn

Add the following configuration to the client1.ovpn file:

client
dev tun
proto udp
remote your_server_ip 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client1.crt
key client1.key
remote-cert-tls server
comp-lzo
verb 3

Replace your_server_ip with the public IP address of your OpenVPN server. Also, copy the ca.crt, client1.crt, and client1.key files to the client machine. These files are located in the ~/easy-rsa/pki/ directory on the server.

Step 15: Transfer Client Configuration to Client Machine

Transfer the client1.ovpn file and the ca.crt, client1.crt, and client1.key files to the client machine. You can use scp, rsync, or any other file transfer method.

Step 16: Connect the Client to the OpenVPN Server

On the client machine, install the OpenVPN client. On Ubuntu, you can use the following command:

sudo apt install openvpn

Then, connect to the OpenVPN server using the following command:

sudo openvpn --config client1.ovpn

If everything is configured correctly, the client should connect to the OpenVPN server, and all traffic will be routed through the VPN.

Conclusion

And there you have it! You've successfully installed and configured OpenVPN on your Ubuntu system. This setup provides a secure and encrypted connection, ensuring your data is protected while you browse the internet. Remember to keep your server and client configurations secure, and regularly update your system to maintain optimal security. Happy browsing, and stay safe out there!