Ok, i bet some times you will want to setup OpenVPN real quick in less than 5 minutes but have to go through with a lot of instruction and it might not work! Especially if you are on a VPS! Now let me explain how i did it in 5 minutes thanks to Nyr. If you are installing this on an OpenVZ machine, please update your host file as instructed at the bottom of this article, if you are not, just continue reading by firing up a VPS machine or a physical machine and fire the following instruction.
wget git.io/vpn --no-check-certificate -O ~/openvpn-install.sh; bash openvpn-install.sh
regardless of Debian, Centos or Ubuntu, this will work fine! Now, the script will ask you a few questions and starts installing
Welcome to this quick OpenVPN "road warrior" installer I need to ask you a few questions before starting the setup You can leave the default options and just press enter if you are ok with them First I need to know the IPv4 address of the network interface you want OpenVPN listening to. IP address: 192.168.100.99 What port do you want for OpenVPN? Port: 1194 Do you want OpenVPN to be available at port 53 too? This can be useful to connect under restrictive networks Listen at port 53 [y/n]: y Do you want to enable internal networking for the VPN? This can allow VPN clients to communicate between them Allow internal networking [y/n]: y What DNS do you want to use with the VPN? 1) Current system resolvers 2) OpenDNS 3) Level 3 4) NTT 5) Hurricane Electric 6) Yandex DNS [1-6]: 2 Finally, tell me your name for the client cert Please, use one word only, no special characters Client name: example
I am installing OpenVPN in a OpenVZ machine. Therefore, i am throwing in the private ip of the machine instead of the public ones. Once the script finish installing and setup, it will ask you the following questions,
If your server is NATed (LowEndSpirit), I need to know the external IP If that's not the case, just ignore this and leave the next field blank External IP: 23.132.16.23 Finished! Your client config is available at ~/cluster.ovpn If you want to add more clients, you simply need to run this script another time!
And you will get a user ovpn file to install it into your computer! Now, if you would like to add more user, do the following
bash ~/openvpn-install.sh
and you will see the following screen.
Looks like OpenVPN is already installed What do you want to do? 1) Add a cert for a new user 2) Revoke existing user cert 3) Remove OpenVPN 4) Exit Select an option [1-4]:
This is specially easy for anyone to just setup your OpenVPN machine in less than 5 minutes and furthermore, you can easily config more users using the same old script. Pretty neat stuff if you asked me!
Installing OpenVPN in OpenVZ
Now, there are a few more things to do if you are in an OpenVZ, on the host machine, you might want to add the following criteria so that iptables is available and internet is forwarding to your client.
at the bottom of /etc/vz/vz.conf you will see the following configuration
## Defaults for containers VE_ROOT=/var/lib/vz/root/$VEID VE_PRIVATE=/var/lib/vz/private/$VEID ## Filesystem layout for new CTs: either simfs (default) or ploop #VE_LAYOUT=ploop ## Load vzwdog module VZWDOG="no" ## IPv4 iptables kernel modules to be enabled in CTs by default IPTABLES="ipt_REJECT ipt_tos ipt_limit ipt_multiport iptable_filter iptable_mangle ipt_TCPMSS ipt_tcpmss ipt_ttl ipt_length" ## IPv4 iptables kernel modules to be loaded by init.d/vz script IPTABLES_MODULES="$IPTABLES" ## Enable IPv6 IPV6="yes" ## IPv6 ip6tables kernel modules IP6TABLES="ip6_tables ip6table_filter ip6table_mangle ip6t_REJECT"
change it to the following
## Defaults for containers VE_ROOT=/var/lib/vz/root/$VEID VE_PRIVATE=/var/lib/vz/private/$VEID ## Filesystem layout for new CTs: either simfs (default) or ploop #VE_LAYOUT=ploop ## Load vzwdog module VZWDOG="no" ## IPv4 iptables kernel modules to be enabled in CTs by default #IPTABLES="ipt_REDIRECT ipt_LOG ipt_state ipt_recent xt_connlimit ipt_owner iptable_nat ipt_REJECT ipt_tos ipt_limit ipt_multiport iptable_filter iptable_mangle ipt_TCPMSS ipt_tcpmss ipt_ttl ipt_length" ## IPv4 iptables kernel modules to be loaded by init.d/vz script #IPTABLES_MODULES="$IPTABLES" ## Enable IPv6 #IPV6="yes" ## IPv6 ip6tables kernel modules #IP6TABLES="ip6t_REDIRECT ip6t_REJECT ip6t_tos ip6t_limit ip6t_multiport ip6t_TCPMSS ip6t_tcpmss ip6t_ttl ip6t_length ip6t_LOG ip6t_state ip6t_recent xt_connlimit ip6t_owner ip6table_nat ip6_tables ip6table_filter ip6table_mangle ip6t_REJECT" ## IPv4 iptables kernel modules to be enabled in CTs by default IPTABLES="ipt_REDIRECT ipt_owner ipt_recent iptable_filter iptable_mangle ipt_limit ipt_multiport ipt_tos ipt_TOS ipt_REJECT ipt_TCPMSS ipt_tcpmss ipt_ttl ipt_LOG ipt_length ip_conntrack ip_conntrack_ftp ip_conntrack_irc ipt_conntrack ipt_state ipt_helper iptable_nat ip_nat_ftp ip_nat_irc ipt_state iptable_nat" ## IPv4 iptables kernel modules to be loaded by init.d/vz script IPTABLES_MODULES="$IPTABLES" ## Enable IPv6 IPV6="yes" ## IPv6 ip6tables kernel modules IP6TABLES="ip6_tables ip6table_filter ip6table_mangle ip6t_REJECT" SKIP_SYSCTL_SETUP=yes
and make sure ip forward is enable by going to /etc/sysctl.conf and update the following to '1'
# Uncomment the next line to enable packet forwarding for IPv4 net.ipv4.ip_forward=1 net.ipv4.conf.default.forwarding=1 net.ipv4.conf.all.forwarding=1
and make sure Tun/TAP is enable for your VPS
# cat /dev/net/tun cat: /dev/net/tun: File descriptor in bad state
If you are not seeing the above, do the following on your host machine,
vzctl set 101 --devnodes net/tun:rw --save vzctl set 101 --devices c:10:200:rw --save vzctl stop 101 vzctl set 101 --capability net_admin:on --save vzctl start 101 vzctl exec 101 mkdir -p /dev/net vzctl exec 101 chmod 600 /dev/net/tun
Once you've done the above, then starts installing OpenVPN with the scripts by Nyr.
**UPDATE**
And remember to port forward port 1194 and 53!
-A PREROUTING -i vmbr1 -p tcp -m tcp --dport 53 -j DNAT --to-destination 192.168.100.2:53 -A PREROUTING -i vmbr1 -p udp -m udp --dport 1194 -j DNAT --to-destination 192.168.100.2:1194 -A PREROUTING -i vmbr1 -p tcp -m tcp --dport 1194 -j DNAT --to-destination 192.168.100.2:1194