WBITT

We Bring In Tomorrows Technology

  • Full Screen
  • Wide Screen
  • Narrow Screen
  • Increase font size
  • Default font size
  • Decrease font size

OpenVPN over Virtual Private Server (VPS)

E-mail Print PDF
User Rating: / 8
PoorBest 

I have been trying to learn Asterisk and as many of you know about that main Service Povider has blocked the voice ports in Pakistan. Therefore, we cannot connect to asterisk servers through xlite, 3cx or through any other softphone.

 

Since, I have done couple of very basic projects to setup asterisk servers for my clients. Therefore, I need to have some sort of setup to connect to their asterisk servers.

 

So, one theoretical concept that came in my mind that I can purchase a Virtual Private Server-VPS (Which obviously very cheap $20/month) and install a VPN server and connect to my machine (laptop) to that VPN server. Through that server, I will be the part of their network and then I would be to connect my softphone to any VoIP/Asterisk server

 

Environment:

Virtual Private Server (VPS)

  1. Purchased from: http://vpslink.com
  2. OS: CentOS
  3. IP Address: 64.79.205.xxx
  4. Virtualization Platform: OpenVZ
  5. VPN Server: OpenVPN

 

My fresh server ip configuration

# ifconfig

 

lo Link encap:Local Loopback

inet addr:127.0.0.1  Mask:255.0.0.0

inet6 addr: ::1/128 Scope:Host

UP LOOPBACK RUNNING  MTU:16436  Metric:1

RX packets:34 errors:0 dropped:0 overruns:0 frame:0

TX packets:34 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:0

RX bytes:3101 (3.0 KiB)  TX bytes:3101 (3.0 KiB)

 

venet0 Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-0000-00

inet addr:127.0.0.1  P-t-P:127.0.0.1  Bcast:0.0.0.0  Mask:255.255.255.255

UP BROADCAST POINTOPOINT RUNNING NOARP  MTU:1500  Metric:1

RX packets:30678 errors:0 dropped:0 overruns:0 frame:0

TX packets:29616 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:0

RX bytes:3556848 (3.3 MiB)  TX bytes:4822295 (4.5 MiB)

 

venet0:0 Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00

inet addr:64.79.205.xx P-t-P:64.79.205.xx Bcast:64.79.205.xx Mask:255.255.255.255

UP BROADCAST POINTOPOINT RUNNING NOARP  MTU:1500  Metric:1

 

Client Machine:

 

  1. Laptop
  2. OS: Windows Vista Business
  3. VPN Client: OpenVPN client for Windows

 

Scenario:

 

Server IP Address: 64.79.205.xxx

Server Network: 192.168.100.x/24

Client Network: 192.168.1.x/24

Tunnel: 10.8.0.0/30

 

 

Installation of OpenVPN server

 

# wget http://openvpn.net/release/openvpn-2.1_rc20.tar.gz

# tar xzf openvpn-2.1_rc20.tar.gz

# cd openvpn-2.1_rc20

# yum install openssl  ## Install openssl if it is not installes

# ./configure --disable-lzo

# make && make install

 

#cd openvpn

 

You will find easy-rsa in openvpn extracted distribution. What I did, I created a directory openvpn in /etc and copied all files from openvpn-[version]/easy-rsa to /etc/openvpn

 

# mkdir /etc/openvpn
# cp -r /[path]/openvpn-[version]/easy-rsa/* /etc/openvpn


then I executed following from /etc/openvpn

#cd /etc/openvpn
#. ./vars
#./clean-all
#./build-ca

Generating a 1024 bit RSA private key
............++++++
...........++++++
writing new private key to 'ca.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [KG]:
State or Province Name (full name) [NA]:
Locality Name (eg, city) [BISHKEK]:
Organization Name (eg, company) [OpenVPN-TEST]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:LINUX-ANGELS
Email Address [me@myhost.mydomain]: This e-mail address is being protected from spambots. You need JavaScript enabled to view it

Note that in the above sequence, most queried parameters were defaulted to the values set in the vars. The only parameter which must be explicitly entered is the Common Name. In the example above, I used "LINUX-ANGELS".


Generate certificate & key for server

Next, we will generate a certificate and private key for the server.

#./build-key-server server


As in the previous step, most parameters can be defaulted. When the Common Name is queried, enter "server".
Two other queries require positive responses,

"Sign the certificate? [y/n]"
and "1 out of 1 certificate requests certified, commit? [y/n]".


Generate certificates & keys for 3 clients

Generating client certificates is very similar to the previous step.

#./build-key client1
#./build-key client2
#./build-key client3

Remember that for each client, make sure to type the appropriate Common Name when prompted, i.e. "client1", "client2", or "client3". Always use a unique common name for each client.

Generate Diffie Hellman parameters

Diffie Hellman parameters must be generated for the OpenVPN server. On Linux/BSD/Unix:

#./build-dh

Output:

Generating DH parameters, 1024 bit long safe prime, generator 2
This is going to take a long time
.................+...........................................
...................+.............+.................+.........
......................................


Key Files

Now we will find our newly-generated keys and certificates in the /etc/openvpn/keys subdirectory. Here is an explanation of the relevant files:


ca.crt, ca.key, dh{n}.pem, server.crt, server.key, client1.crt,client1.key, client2.crt,
client2.key, client3.crt, client3.key


After key generation find sample-config-files in distribution files and copy server.conf to /etc/openvpn

 

Server Configuration File

 

#  grep -v \# /etc/openvpn/server.conf | grep -v ^$

port 1194

proto udp

dev tun

ca keys/ca.crt

cert keys/server.crt

dh keys/dh1024.pem

server 10.8.0.0 255.255.255.0

ifconfig-pool-persist ipp.txt

push "route 192.168.100.0 255.255.255.0"

client-config-dir ccd

push "redirect-gateway def1 bypass-dhcp"

push "dhcp-option DNS 64.79.200.111"

push "dhcp-option DNS 64.79.200.113"

client-to-client

keepalive 10 120

persist-key

persist-tun

status openvpn-status.log

verb 3

 

 

Client Configuration

Download openVPN client for windows through google search and install it on your vista machine. Suppose we are setting up client for client1 certificates.

Assume that we are on vista machine for client1

copy ca.crt, client1.crt, client1.csr, client1.key in [Drivr]:\Program Files\OpenVPN\config

And configure client.ovpn file. See sample file



client
dev tun
proto udp
remote VPN Server IP 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client1.crt
key client1.key
verb 3

 

FEW MORE THINGS ON SERVER:

  1. We have to create virtual interface for private IPs. In my case I assigned 192.168.100.100 IP to my server. And I have created a copy of ifcfg-venet0:0 as ifcfg-venet0:1,

    # cat /etc/sysconfig/network-scripts/ifcfg-venet0:1
    DEVICE=venet0:1

    IPADDR=192.168.100.100
    NETMASK=255.255.255.0

 

  1. When I tried to rung openvpn server on my openVZ platform then I got this error

 

Note: Cannot open TUN/TAP dev /dev/net/tun: Permission denied (errno=13)

Note: Attempting fallback to kernel 2.2 TUN/TAP interface

Cannot open TUN/TAP dev /dev/tun0: No such file or directory (errno=2)



Solution
  1. Enter mkdir -p /dev/net
  2. Enter mknod /dev/net/tun c 10 200
  3. Enter chmod 600 /dev/net/tun
  4. Enter cat /dev/net/tun to test whether the TUN/TAP device is available:
    1. If you receive the message cat: /dev/net/tun: File descriptor in bad state your TUN/TAP device is ready for use
    2. If you receive the message cat: /dev/net/tun: No such device the TUN/TAP device was not successfully created
    3. We have to enable ip_forwarding and enable NAT by the command below. Masquerade will not work in VPS

# iptables -t nat -A POSTROUTING -j SNAT --to 64.79.205.xx

 

Run OpenVPN server

# openvpn server.conf

 

Fri Nov 27 10:10:28 2009 OpenVPN 2.1_rc20 i686-pc-linux-gnu [SSL] [EPOLL] built on Nov 11 2009

Fri Nov 27 10:10:28 2009 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables

Fri Nov 27 10:10:31 2009 Diffie-Hellman initialized with 1024 bit key

Fri Nov 27 10:10:32 2009 TLS-Auth MTU parms [ L:1541 D:138 EF:38 EB:0 ET:0 EL:0 ]

Fri Nov 27 10:10:32 2009 ROUTE default_gateway=191.255.255.1

Fri Nov 27 10:10:32 2009 TUN/TAP device tun0 opened

Fri Nov 27 10:10:32 2009 Note: Cannot set tx queue length on tun0: Operation not permitted (errno=1)

Fri Nov 27 10:10:32 2009 /sbin/ifconfig tun0 10.8.0.1 pointopoint 10.8.0.2 mtu 1500

Fri Nov 27 10:10:32 2009 /sbin/route add -net 10.8.0.0 netmask 255.255.255.0 gw 10.8.0.2

Fri Nov 27 10:10:32 2009 Data Channel MTU parms [ L:1541 D:1450 EF:41 EB:4 ET:0 EL:0 ]

Fri Nov 27 10:10:32 2009 Socket Buffers: R=[135168->131072] S=[135168->131072]

Fri Nov 27 10:10:32 2009 UDPv4 link local (bound): [undef]:1194

Fri Nov 27 10:10:32 2009 UDPv4 link remote: [undef]

Fri Nov 27 10:10:32 2009 MULTI: multi_init called, r=256 v=256

Fri Nov 27 10:10:32 2009 IFCONFIG POOL: base=10.8.0.4 size=62

Fri Nov 27 10:10:32 2009 IFCONFIG POOL LIST

Fri Nov 27 10:10:32 2009 LINUX-ANGELS,10.8.0.4

Fri Nov 27 10:10:32 2009 LINUX-ANGELS,10.8.0.8

Fri Nov 27 10:10:32 2009 Initialization Sequence Completed

 

 

Run OpenVPN Client in windows Vista

  1. Execute openVPN GUI as administrator.
  2. You will see an icon on tray. Right click it and click Connect

 


Now observe client and server


See ifconfig at server

# ifconfig

lo Link encap:Local Loopback

inet addr:127.0.0.1  Mask:255.0.0.0

inet6 addr: ::1/128 Scope:Host

UP LOOPBACK RUNNING  MTU:16436  Metric:1

RX packets:34 errors:0 dropped:0 overruns:0 frame:0

TX packets:34 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:0

RX bytes:3101 (3.0 KiB)  TX bytes:3101 (3.0 KiB)


tun0 Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00

inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255

UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1

RX packets:11 errors:0 dropped:0 overruns:0 frame:0

TX packets:0 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:500

RX bytes:924 (924.0 b)  TX bytes:0 (0.0 b)


venet0 Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00

inet addr:127.0.0.1  P-t-P:127.0.0.1  Bcast:0.0.0.0  Mask:255.255.255.255

UP BROADCAST POINTOPOINT RUNNING NOARP  MTU:1500  Metric:1

RX packets:31319 errors:0 dropped:0 overruns:0 frame:0

TX packets:30110 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:0

RX bytes:3608634 (3.4 MiB)  TX bytes:4883925 (4.6 MiB)


venet0:0 Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00

inet addr:64.79.205.xx  P-t-P:64.79.205.xx  Bcast:64.79.205.xx  Mask:255.255.255.255

UP BROADCAST POINTOPOINT RUNNING NOARP  MTU:1500  Metric:1


venet0:1  Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00

inet addr:192.168.100.100  P-t-P:192.168.100.100  Bcast:192.168.100.255  Mask:255.255.255.0

UP BROADCAST POINTOPOINT RUNNING NOARP  MTU:1500  Metric:1


See different outputs at Client

Ping tun0


C:\Users\Admin>ping 10.8.0.1


Pinging 10.8.0.1 with 32 bytes of data:


Reply from 10.8.0.1: bytes=32 time=363ms TTL=64

Reply from 10.8.0.1: bytes=32 time=363ms TTL=64

Reply from 10.8.0.1: bytes=32 time=363ms TTL=64

Reply from 10.8.0.1: bytes=32 time=363ms TTL=64


Ping statistics for 10.8.0.1:

Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 363ms, Maximum = 363ms, Average = 363ms


Ping OpenVPN server private IP


C:\Users\Admin>ping 192.168.100.100


Pinging 192.168.100.100 with 32 bytes of data:


Reply from 192.168.100.100: bytes=32 time=363ms TTL=64

Reply from 192.168.100.100: bytes=32 time=362ms TTL=64

Reply from 192.168.100.100: bytes=32 time=366ms TTL=64

Reply from 192.168.100.100: bytes=32 time=364ms TTL=64


Ping statistics for 192.168.100.100:

Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 362ms, Maximum = 366ms, Average = 363ms



C:\Users\Admin>tracert yahoo.com


Tracing route to yahoo.com [69.147.114.224]

over a maximum of 30 hops:


1   331 ms   331 ms   330 ms  10.8.0.1

2   330 ms   330 ms   330 ms  vpsl1-026.vpslink.com [66.249.15.63]

3   331 ms   331 ms   331 ms  po1-br0-tuk.wa.spry.com [64.79.223.1]

4   332 ms   331 ms   331 ms  cr1-tuk-g1-24.bb.spectrumnet.us [216.243.28.129]


5   331 ms   331 ms   331 ms  cr2-sea-B-pc1.bb.spectrumnet.us [208.76.184.69]


6   331 ms   331 ms   331 ms  six.yahoo.com [206.81.80.98]

7   424 ms   423 ms   422 ms  so-2-1-0.pat1.dce.yahoo.com [216.115.96.29]

8   425 ms   459 ms   445 ms  ae2-p140.msr1.re1.yahoo.com [216.115.108.57]

9   425 ms   426 ms   431 ms  gi1-22.bas-a1.re3.yahoo.com [68.142.238.65]

10   423 ms   424 ms   423 ms  b1.www.vip.re3.yahoo.com [69.147.114.224]


Trace complete.


This output clearly shows that now my gateway is 10.8.0.1. After testing I have connected X-Lite for it gets connected through VPN which couldn’t connect without VPN.


May be this is helpful for you

Saif ur Rab(http://saifurab.blogspot.com)


You are here How To / Tutorials OpenVPN over Virtual Private Server (VPS)