OpenVPN my configuration notes

Last updated: Dec 07, 2020

Intro

OpenVPN as many parameters that we can play with.

I will put here some configuration tips that I've used. I traditionnaly use a Debian to set up my OpenVPN server.

Server or Client side?

We can choose to set configurations wherever we want. The main difference is that we need to add the push keyword on the server side, and it will of course be applied to all clients.

Example

Let's see the difference if we want to set a same configuration on each side. Exemple here with a DNS entry.

Client side :

dhcp-option DNS 192.168.0.200

Server side :

push "dhcp-option DNS 192.168.0.200"

DNS

Set dns configuration

If we want to define specific DNS server and DOMAIN :

dhcp-option DNS 192.168.0.200
dhcp-option DOMAIN domain.local

Filtering

It could be useful to only authorize some network flows on our VPN.

Netfilter - iptables

Accept RDP and dns traffic only :

root@host:~# iptables -A FORWARD -o enp4s0 -p tcp --dport 3389 -j ACCEPT
root@host:~# iptables -A FORWARD -i enp4s0 -p tcp --sport 3389 -j ACCEPT
root@host:~# iptables -A FORWARD -o enp4s0 -p tcp --dport 53 -j ACCEPT
root@host:~# iptables -A FORWARD -o enp4s0 -p udp --dport 53 -j ACCEPT
root@host:~# iptables -A FORWARD -i enp4s0 -p udp --sport 53 -j ACCEPT
root@host:~# iptables -A FORWARD -i enp4s0 -p tcp --sport 53 -j ACCEPT
root@host:~# iptables -A FORWARD -o enp4s0 -j DROP

Routing

Gateway mode

If we want to enable routing.

Edit /etc/sysctl.conf :

net.ipv4.ip_forward = 1

Run

root@host:~# sysctl -p /etc/sysctl.conf

Use iptables command to enable NAT and allow clients to reach internal network :

root@host:~# iptables -t nat -A POSTROUTING -s 10.50.8.0/24 -o ens192 -j MASQUERADE

Add a network route configuration

The 192.168.1.0/24 network will be reachable through the OpenVPN tunnel :

route 192.168.1.0 255.255.255.0

Excluding routes

Here a case where 192.168.0.251 and 192.168.0.250 will be reachable through the VPN, the rest of 192.168.0.0/24 network will reach via LAN default gateway. Particulary useful when the Client and the Server are on the same subnet.

route 192.168.0.251 255.255.255.255
route 192.168.0.250 255.255.255.255
route 192.168.0.0 255.255.255.0 net_gateway

Miscellaneous

Show current sessions

root@host:~# cat /etc/openvpn/openvpn-status.log

Computing

Music

Misc