How To set up OpenVPN Server on Windows

Network diagram

Server configuration

• OpenVPN Server :
  • OS : Windows Server 2019
  • Role : OpenVPN Server
  • IP : 192.168.0.254

Prerequisites

In order to create the connection certificates, we will have to install OpenSSL software library. I personnaly use the slproweb.com packages.

Download OpenSSL

Download the latest OpenSSL Light version.

Install OpenSSL

• Accept the agreement :

• Select destination location :

• Select start menu folder :

• Select OpenSSL binaries directory :

• Click to install :

• Click Finish to exit (and make a donation if you can :)) :

Add OpenSSL in Environment Variables

We will add OpenSSL inside the environment variables.

• Run SystemPropertiesAdvanced to open System Properties :

• Click Environment Variables… :

• Edit Path :

• Click New and add %ProgramFiles%\OpenSSL-Win64\bin :

• Open a new Windows command and check that you can run openssl command :

Installing OpenVPN

Go to OpenVPN official website here to download last installer.

• As we want to install OpenVPN as server we will choose Customize :

• We enable OpenVPN Service in order to make it work at boot :

• And we install EasyRsa in order to be able to create server and clients certificates :

• Once done click Close :

Setting up Certificate Authority (CA) and generating certificates and keys for server and clients

Here we will set up a pki to be able to create our server and clients certificates.

• Open a Command Prompt :

• And type the following commands to enter inside EasyRSA shell :

• Remove existing configuration, just for good measure :

• Initialize pki, and type yes to confirm :

• Build certificate authority :

• Build server certificate and key :

• Generate Diffie Hellman parameters :

Create clients certificates

• If previously closed or to add new clients, open an EasyRSA shell :

• Generating client certificates :

Certificates

• Put this files (from C:\Program Files\OpenVPN\easy-rsa\pki, C:\Program Files\OpenVPN\easy-rsa\pki\issued and C:\Program Files\OpenVPN\easy-rsa\pki\private) :
  • ca.crt
  • dh.pem
  • server.crt
  • server.key
• To C:\Program Files\OpenVPN\config-auto and C:\Program Files\OpenVPN\config folders.

Add a Windows Firewall Rule

• We need to create two firewall rules :
  • One to open port 1194 in udp to allow OpenVPN clients connections
  • Another one to authorize the 10.50.8.0/24 network so that the clients can talk with the services present on the server (ping, file sharing etc…).

To do this, use the Windows Firewall Management Console or these two commands inside an Administrator's PowerShell console.

• Create the rule to allow incoming connections on port 1194 udp :

• Create the rule to allow all incoming connections from the 10.50.8.0/24 network :

The server.ovpn configuration file

As administrator, create the C:\Program Files\OpenVPN\config-auto\server.ovpn file :

Restart the OpenVPN service

Then, restart the OpenVPN service :

• From, services management console :

• Right click OpenVPNService then Restart :

• Or from an administrator Command Prompt :

• Or from PowerShell :

Client configuration

• OpenVPN Client :
  • OS : Windows 11
  • Role : OpenVPN Client

Installing OpenVPN

We will download the same package, and here install with default parameters.

Copy certificates from the Server

• From the Server get the following files (from C:\Program Files\OpenVPN\easy-rsa\pki, C:\Program Files\OpenVPN\easy-rsa\pki\issued and C:\Program Files\OpenVPN\easy-rsa\pki\private) :
  • ca.crt
  • client01.crt
  • client01.key
• And paste them to C:\Program Files\OpenVPN\config.

• C:\Program Files\OpenVPN\config\client.ovpn

Edit the client.ovpn file with administrator rights :

Establishing the connection

• Run as administrator

• Start the connection

• A pop-up will confim that we are connected

Server Access

To contact the server we will use the 10.50.8.1 IP Address

⚠️ Troubleshooting : After a Windows Update, I couldn't have access to the server share anymore (OpenVPN was able to connect though). To make it work again, I had to repair (available when relaunching setup program) the OpenVPN program on the server side.