Как настроить сервер OpenVPN на Windows

OpenVPN позволяет настроить VPN-сервер как на платформе Windows Server, так и версии для рабочего компьютера (Windows 10, 8, 7).

Установка OpenVPN Server

Переходим на официальный сайт OpenVPN и скачиваем последнюю версию программы для соответствующей версии Windows:

Запускаем скачанный файл — нажимаем Next — I Agree — и выставляем галочку EasyRSA 2 Certificate Management Scripts (нужен для возможности сгенерировать сертификаты):

. снова Next и Install — начнется установка. В процессе мастер может выдать запрос на подтверждение установки виртуального сетевого адаптера — соглашаемся (Install/Установить).

После завершения нажимаем Next — снимаем галочку Show Readme — Finish.

Создание сертификатов

Переходим в папку установки OpenVPN (по умолчанию, C:\Program Files\OpenVPN) и создаем каталог ssl.

После переходим в папку C:\Program Files\OpenVPN\easy-rsa, создаем файл vars.bat, открываем его на редактирование и приводим к следующему виду:

set «PATH=%PATH%;%ProgramFiles%\OpenVPN\bin»
set HOME=%ProgramFiles%\OpenVPN\easy-rsa
set KEY_CONFIG=openssl-1.0.0.cnf
set KEY_DIR=keys
set KEY_SIZE=2048
set KEY_COUNTRY=RU
set KEY_PROVINCE=Sankt-Petersburg
set KEY_CITY=Sankt-Petersburg
set KEY_ORG=Organization
set KEY_EMAIL=master@dmosk.ru
set KEY_CN=DMOSK
set KEY_OU=DMOSK
set KEY_NAME=server.domain.ru
set PKCS11_MODULE_PATH=DMOSK
set PKCS11_PIN=12345678

* в каталоге easy-rsa уже есть файл vars.bat.sample — можно переименовать и использовать его.
** значение HOME не меняем, если оставили путь установки программы по умолчанию; KEY_DIR — каталог, куда будут генерироваться сертификаты; KEY_CONFIG может быть разным — его лучше посмотреть в файле vars.bat.sample или по названию соответствующего файла в папке easy-rsa; KEY_NAME желательно, чтобы соответствовал полному имени VPN-сервера; остальные опции можно заполнить произвольно.

Запускаем командную строку от имени администратора:

Переходим в каталог easy-rsa:

Чистим каталоги от устаревшей информации:

Снова запускаем vars.bat (после clean переопределяются некоторые переменные):

Теперь генерируем последовательность центра сертификации:

На все запросы нажимаем Enter.

Запускаем build-dh.bat (сертификат с использованием алгоритма Диффи-Хеллмана):

openssl dhparam -out keys\dh.pem 2048

* команда может выполняться долго — это нормально.

Генерируем сертификат для сервера:

* где cert — имя сертификата; на все запросы нажимаем Enter. В конце подтверждаем два раза корректность информации вводом y.

После переносим из папки C:\Program Files\OpenVPN\easy-rsa\keys в C:\Program Files\OpenVPN\ssl следующие файлы:

Настройка сервера

Переходим в папку C:\Program Files\OpenVPN\config и создаем файл server.ovpn. Открываем его на редактирование и приводим к следующему виду:

port 443
proto udp
dev tun
dev-node «VPN Server»
dh «C:\\Program Files\\OpenVPN\\ssl\\dh.pem»
ca «C:\\Program Files\\OpenVPN\\ssl\\ca.crt»
cert «C:\\Program Files\\OpenVPN\\ssl\\cert.crt»
key «C:\\Program Files\\OpenVPN\\ssl\\cert.key»
server 172.16.10.0 255.255.255.0
max-clients 32
keepalive 10 120
client-to-client
comp-lzo
persist-key
persist-tun
cipher DES-CBC
status «C:\\Program Files\\OpenVPN\\log\\status.log»
log «C:\\Program Files\\OpenVPN\\log\\openvpn.log»
verb 4
mute 20

* где port — сетевой порт (443 позволит избежать проблем при использовании Интернета в общественных местах, но может быть любым из свободных, например 1194, занятые порты в Windows можно посмотреть командой netstat -a); dev-node — название сетевого интерфейса; server — подсеть, в которой будут работать как сам сервер, так и подключенные к нему клиенты.
** так как в некоторых путях есть пробелы, параметр заносится в кавычках.
*** при использовании другого порта необходимо проверить, что он открыт в брандмауэре или на время тестирования отключить его.

В сетевых подключениях Windows открываем управление адаптерами — TAP-адаптер переименовываем в «VPN Server» (как у нас указано в конфигурационном файле, разделе dev-node):

Теперь открываем службы Windows и находим «OpenVpnService». Открываем ее, настраиваем на автозапуск и включаем:

Ранее переименованный сетевой интерфейс должен включиться:

VPN-сервер работает. Проверьте, что сетевой адаптер VPN Server получил IP 172.16.10.1. Если он получает что-то, на подобие, 169.254. выключаем сетевой адаптер — перезапускаем службу OpenVpnService и снова включаем сетевой адаптер.

Настройка клиента

На сервере:

На сервере генерируем сертификат для клиента. Для этого сначала чистим файл index.txt в папке C:\Program Files\OpenVPN\easy-rsa\keys.

Затем запускаем командную строку от имени администратора:

Ethernet Bridging

Ethernet bridging essentially involves combining an ethernet interface with one or more virtual TAP interfaces and bridging them together under the umbrella of a single bridge interface. Ethernet bridges represent the software analog to a physical ethernet switch. The ethernet bridge can be thought of as a kind of software switch which can be used to connect multiple ethernet interfaces (either physical or virtual) on a single machine while sharing a single IP subnet.

By bridging a physical ethernet NIC with an OpenVPN-driven TAP interface at two separate locations, it is possible to logically merge both ethernet networks, as if they were a single ethernet subnet.

Bridging Setup

This example will guide you in configuring an OpenVPN server-side ethernet bridge. Multiple clients will be able to connect to the bridge, and each client’s TAP interface will be assigned an IP address that is part of the server’s LAN.

There are two methods for handling client IP address allocation:

• Let OpenVPN manage its own client IP address pool using the server-bridge directive, or
• configure the DHCP server on the LAN to also grant IP address leases to VPN clients.

In this example, we will use the first method where the OpenVPN server manages its own IP address pool on the LAN subnet, separate from the pool used by the DHCP server (if one exists). Both methods are described more fully in this FAQ item.

For our example, we will use these bridge settings:

Setting	bridge-start parameter	Value
Ethernet Interface	eth	eth0
Local IP Address	ip	192.168.8.4
Local Netmask	eth_netmask	255.255.255.0
Local Broadcast Address	eth_broadcast	192.168.8.255
VPN client address pool	192.168.8.128 to 192.168.8.254
Virtual Bridge Interface	br	br0
Virtual TAP Interface	tap	tap0

The first step is to follow the HOWTO up to the “Starting up the VPN and testing for initial connectivity” section. Next, proceed below according to whether you are setting up the bridge on Linux or Windows.

Bridge Server on Linux

First, make sure you have the bridge-utils package installed.

Edit the bridge-start script below. Set the br, tap, eth, eth_ip, eth_netmask, and eth_broadcast parameters according to the physical ethernet interface you would like to bridge. Make sure to use an interface which is private and which is connected to a LAN which is protected from the internet by a firewall. You can use the Linux ifconfig command to get the necessary information about your network interfaces to fill in the bridge-start parameters.

Now run the bridge-start script. It will create a persistent tap0 interface and bridge it with the active ethernet interface.

Next, we will edit the OpenVPN server configuration file to enable a bridging configuration.

Comment out the line which says dev tun and replace it instead with:

Comment out the line that begins with server and replace it with:

Now set up the Linux firewall to permit packets to flow freely over the newly created tap0 and br0interfaces:

The OpenVPN bridge can now be started and stopped using this sequence::

• run bridge-start
• run openvpn
• stop openvpn
• run bridge-stop

At this point, the bridging-specific aspects of the configuration are complete, and you can continue where you left off in the HOWTO.

Bridge Server on Windows XP

This configuration requires Windows XP or higher on the bridge side. To my knowledge, Windows 2000 does not support bridging, however a Windows 2000 machine can be a client on a bridged network, where the other end of the OpenVPN connection where the bridging is occurring is a Linux or Windows XP machine.

When OpenVPN is installed on Windows, it automatically creates a single TAP-Win32 adapter which will be assigned a name like “Local Area Connection 2”. Go to the Network Connections control panel and rename it to “tap-bridge”.

Next select tap-bridge and your ethernet adapter with the mouse, right click, and select Bridge Connections. This will create a new bridge adapter icon in the control panel.

Set the TCP/IP properties on the bridge adapter to an IP of 192.168.8.4 and a subnet mask of 255.255.255.0.

Next, edit the OpenVPN server configuration file to enable a bridging configuration.

Comment out the line which says dev tun and replace it instead with:

Comment out the line that begins with server and replace it with:

If you are running XP SP2, go to the firewall control panel, and disable firewall filtering on the bridge and TAP adapters.

At this point, the bridging-specific aspects of the configuration are complete, and you can continue where you left off in the HOWTO.

Bridge Client configuration

Use the sample OpenVPN client configuration as a starting point. Comment out the line which says dev tun and replace it instead with:

Finally, ensure that the client configuration file is consistent with the directives used in the server configuration. The major thing to check for is that the proto (udp or tcp) directives are consistent. Also make sure that comp-lzo and fragment, if used, are present in both client and server config files.

Ethernet Bridging Notes

When using an ethernet bridging configuration, the first step is to construct the ethernet bridge — a kind of virtual network interface which is a container for other ethernet interfaces, either real as in physical NICs or virtual as in TAP interfaces. The ethernet bridge interface must be set up before OpenVPN is actually started.

There is no portable method for generating an ethernet bridge interface — each OS has its own method (see below for examples).

Once the bridge interface has been created, and appropriate ethernet interfaces have been added to it, OpenVPN may be started.

• A bridge interface is a kind of virtual network interface which is formed by combining one or more ethernet interfaces, each of which may be a physical NIC or a virtual TAP interface used for VPN tunneling.
• When you set up an ethernet bridge, you should manually set the IP address and subnet of the bridge interface and not use an ifconfig directive in the OpenVPN config. This is because unlike a TUN/TAP interface, OpenVPN cannot programmatically set the IP address and netmask of a bridge interface.
• The OpenVPN config should specify the TAP interface component of the bridge interface in its devdirective, not the name of the bridge interface itself.
• On Windows, use the dev-node directive to name the TAP-Win32 adapter which was added to the bridge (the dev-node name refers to the adapter name as shown in the Network Connections panel).
• On Linux/BSD/Unix, for the dev tap directive, use the explicit TUN/TAP unit number which you added to the bridge such as dev tap0.
• If you are running OpenVPN in point-to-point mode, omit an ifconfig directive, and if you are using client/server mode, use the server-bridge directive on the server.
• When bridging, you must manually set the TCP/IP settings on the bridge interface. For example on Linux, this can be done with an ifconfig command while on Windows XP it can be done by setting the TCP/IP properties of the bridge interface in the Network Connections panel (the Network Connections panel on Windows XP and higher allows for point-and-click bridging).
• Make sure to only bridge TAP interfaces with private ethernet interfaces which are protected behind a firewall. Never bridge a TAP interface with the same ethernet interface you use to connect to the internet, as that would create a potential security hole.
• The addresses used for local and remote should not be part of the bridged subnet — otherwise you will end up with a routing loop.
• An important point to understand with Ethernet bridging is that each network interface which is added to the bridge will lose its individual identity in terms of specific settings such as IP address and netmask. Only the TCP/IP settings of the bridge interface itself will be relevent.
• A common mistake that people make when manually configuring an Ethernet bridge is that they add their primary ethernet adapter to the bridge before they have set the IP and netmask of the bridge interface. The result is that the primary ethernet interface “loses” its settings, but the equivalent bridge interface settings have not yet been defined, so the net effect is a loss of connectivity on the ethernet interface.
• In most cases, it is possible to set up a usable bridge configuration with the ethernet-bridge itself only configured on the server side, not the client side. If this is done, the client machines will become multi-homed when they connect to the server, i.e. they will still have their regular ethernet interface, but upon connection to the OpenVPN server, they will now have a new TAP interface which is bridged with the server’s ethernet interface (and possibly all of the TAP interfaces of other connecting clients as well if the client-to-client directive is used on the server).

Notes — Ethernet Bridging on Windows

The Windows Notes page has additional information on ethernet bridging.

Notes — Ethernet Bridging on Linux, Setup Scripts

These scripts will handle bridge setup and shutdown on Linux. They are available in the sample-scripts subdirectory of the OpenVPN tarball.