This shows you the differences between two versions of the page.
Both sides previous revisionPrevious revisionNext revision | Previous revisionLast revisionBoth sides next revision | ||
computing:vpnserver-debian [2023/05/21 20:35] – oemb1905 | computing:vpnserver-debian [2023/05/22 02:16] – removed oemb1905 | ||
---|---|---|---|
Line 1: | Line 1: | ||
- | ------------------------------------------- | ||
- | * **vpnserver-debian** | ||
- | * **Jonathan Haack** | ||
- | * **Haack' | ||
- | * **netcmnd@jonathanhaack.com** | ||
- | |||
- | ------------------------------------------- | ||
- | |||
- | // | ||
- | |||
- | ------------------------------------------- | ||
- | |||
- | This tutorial is for installing a simple openvpn server on a public facing VPS and/or self-hosted virtualization stack. In my case, I am using a slim Debian boot OS, with two zfs pools in RAID10 or two-way mirror setups. I use virsh primarily and/or virt-manager with qemu/kvm to manage the stack. The full setup can be found here [[https:// | ||
- | |||
- | sudo apt update | ||
- | sudo apt upgrade | ||
- | sudo apt install openvpn | ||
- | | ||
- | To keep easyrsa from writing over your configurations, | ||
- | |||
- | cp -r / | ||
- | | ||
- | Navigate inside of the easy-rsa directory (the one you just made by copying) and start building the server by initializing the pki tool, building your certificate authority, generating diffyhelmen for strong key exchange, and then building the openvpn server itself which will leverage these: | ||
- | |||
- | cd / | ||
- | ./easyrsa init-pki | ||
- | ./easyrsa build-ca nopass | ||
- | ./easyrsa gen-dh | ||
- | ./easyrsa build-server-full server nopass | ||
- | | ||
- | To help thwart DDOS and/or UDP flooding, build a HMAC key as follows. Also, make sure to generate a revocation certificate so you can properly revoke previously signed certificates. | ||
- | | ||
- | openvpn --genkey secret / | ||
- | ./easyrsa gen-crl | ||
- | | ||
- | Copy all the files and directories for keys/certs that you just generated into the openvpn server directory: | ||
- | |||
- | cp -p / | ||
- | cp -p / | ||
- | cp -p / | ||
- | cp -p / | ||
- | cp -rp / | ||
- | cp -rp / | ||
- | | ||
- | The server has everything it needs to operate, but you need to build a configuration file for it. The project provides a default template you can use as a starting point: | ||
- | |||
- | cp / | ||
- | | ||
- | Here's what my config looks like for comparison: | ||
- | |||
- | [[http:// | ||
- | |||
- | |||