Openvpn linux server ������� ���������

Connecting to Access Server with Linux

Client software choice

Connecting to OpenVPN Access Server from Linux requires a client program. It will capture the traffic you wish to send through the OpenVPN tunnel, encrypting it and passing it to the OpenVPN server. And of course, the reverse, to decrypt the return traffic.

Linux Packages Discussed

OpenVPN Access Server	openvpn-as
OpenVPN 3 Linux Client	openvpn3
OpenVPN open source	openvpn

OpenVPN 3 Linux Client

The OpenVPN 3 Linux project is a new client built on top of the OpenVPN 3 Core Library. This client is the official OpenVPN Linux Client program. You can find an overview of the features, frequently asked questions, and instructions on installing the openvpn3 package on our OpenVPN 3 for Linux site.

After following the instructions there to install the client, you’ll need a connection profile. This is a file generated by your OpenVPN Access Server installation for your specific user account. It contains the required certificates and connection settings. Go to the Client web interface of your Access Server (the main address, not the /admin portion). Log in with your user credentials. You will be shown a list of files available to download. Pick the user-locked profile or the auto-login profile, and you will be sent a client.ovpn file. Save this file to your Linux operating system.

Once you’ve moved the file to your Linux system, you can import it.

You can start a new VPN session:

You can manage a running VPN session:

And so on. More details can be found here: OpenVPN3Linux.

OpenVPN open source OpenVPN CLI program

The open source project client program can also connect to the Access Server. The package is available in most distributions and is known simply as openvpn. It supports the option to connect to multiple OpenVPN servers simultaneously, and it comes with a service component that can automatically and silently start any auto-login profiles it finds in the /etc/openvpn folder, even before a user has logged in. This service component can be set to automatically start at boot time with the tools available in your Linux distribution if supported. On Ubuntu and Debian, when you install the openvpn package, it is automatically configured to start at boot time.

To install the OpenVPN client on Linux, it is possible in many cases to just use the version that is in the software repository for the Linux distribution itself. If you run into any connectivity problems when using outdated software, it may be due to a possible lack of support for higher TLS versions in older versions of OpenVPN. Follow the instructions found on the open source openvpn community wiki if you wish to install the OpenVPN client on your Linux system.

After installing, you will need a connection profile. This is a file generated by your OpenVPN Access Server installation for your specific user account. It contains the required certificates and connection settings. Go to the Client web interface of your Access Server (the main address, not the /admin portion). Log in with your user credentials. You will be shown a list of files available to you for download. Pick the user-locked profile or the auto-login profile, and you will be sent a client.ovpn file. Save this file to your Linux operating system somewhere. OpenVPN Access Server supports server-locked, user-locked, and auto-login profiles, but the OpenVPN command line client is only able to connect with user-locked or auto-login connection profiles.

We are assuming you are going to start the connection through either the command line as a root user, or via the service daemon. If you want unprivileged users to be able to make a connection, take a look at the community wiki for more information on how to implement that. Here we are going to focus on the simplest implementation; run the connection as root user directly, or via the service daemon.

Start a connection with an auto-login profile manually:

Start a connection with a user-locked profile manually:

If you use Google Authenticator or another extra factor authentication, add the auth-retry parameter:

To start an auto-login connection via the service daemon, place client.ovpn in /etc/openvpn/ and rename the file. It must end with .conf as file extension. Ensure the service daemon is enabled to run after a reboot, and then simply reboot the system. The auto-login type profile will be picked up automatically and the connection will start itself. You can verify this by checking the output of the ifconfig command; you should see a tun0 network adapter in the list.

One major feature that is missing with the command line client is the ability to automatically implement DNS servers that are pushed by the VPN server. It is possible, but it requires you to install a DNS management program such as resolvconf or openresolv, and it may or may not clash with existing network management software in your OS. The idea here, however, is that you use a script that runs when the connection goes up, and when it goes down, that uses resolvconf or openresolv to implement the DNS servers for you. The reason why this client is not able to manage it completely by itself is mainly because in an operating system like Windows, Macintosh, Android, or iOS, there is already an established single method of handling DNS management. It is therefore easy for us to create a software client for those operating systems that already knows how to handle DNS. But Linux is available in so many variations and also supports different programs and methods of implementing DNS servers, and so it was only reasonable to leave built-in DNS support out of the OpenVPN program and instead to provide, where possible, a script that handles DNS implementation. Such a script could even be written by yourself to do whatever tasks are necessary to implement the DNS servers in your unique situation.

Fortunately on Ubuntu and Debian, for example, there is the /etc/openvpn/update-resolv-conf script that comes with the openvpn package that handles DNS implementation for these operating systems. You need only to activate the use of these by following the instructions:

Open your client.ovpn file in a text editor:

At the very bottom simply add these lines:

The first line enables the use of external scripts to handle the DNS implementation tasks. The up and down lines are there to implement DNS servers pushed by the VPN server when the connection goes up, and afterwards to undo it, when the connection goes down.

Ubuntu network management program

There is also the option of connecting through the GUI using the openvpn extension for the Gnome network manager plugin. But this is currently a bit tricky to set up. There is for example the incorrect assumption that all VPNs will be able to redirect Internet traffic, and older versions might not understand the .ovpn file format, requiring you to split up the certificate embedded in it into separate file. And you would likely have to dig into the options to ensure that a default Internet traffic route going through the VPN server is not always enabled by default, especially for servers where you only give access to some internal resources, and not the entire Internet. However the advantage of using the GUI component is that you can start/stop the connection from the desktop environment on Linux.

Источник

Installing OpenVPN Access Server on a Linux system

Operating systems supported

The OpenVPN Access Server is distributed via our software repository on a number of popular Linux distributions such as Ubuntu, Debian, CentOS, and Red Hat, and Amazon Linux 2. You can easily deploy Access Server on any x86-64 system that can run those operating systems using our software repository. To install the repository and install Access Server check the software repository download page on our website for instructions.

There are also options for installing Access Server using a prepared image containing the Ubuntu operating system and the OpenVPN Access Server program in it. These are available for Microsoft Hyper-V, VMWare ESXi, Amazon AWS, Microsoft Azure, Google Cloud Platform, and other virtualization solutions. We have a preference to use the latest Ubuntu 64 bits Long Term Support version for our prepared images.

Installation requirements and preparation

You will need to have access to a working supported Linux operating system installation that you have root level access to. It doesn’t matter if this is through the console directly or through an SSH session using for example a tool like PuTTY, and it doesn’t matter if you must log on as an unprivileged user first, and then can ‘sudo up’ to gain root privileges. As long as at the end you have root privileges, then you will be able to proceed.

It is important that the time and date on your server are accurate. This is necessary for both certificate generation and verification as well Google Authenticator multi-factor authentication which is time-based. If you are using a modern operating system like Ubuntu 18 or higher, it will usually already have time synchronization software built in. Usually you only need to worry about setting the timezone. You can use the ‘date’ command to see what the current time and date and timezone are.

The OpenVPN Access Server can function entirely within an environment where no Internet access is possible, but this does make licensing the server much more complicated and will require that you contact our support department. And if the Access Server doesn’t have Internet access it obviously can’t accept connections from clients from the Internet either of course.

It’s best to have the Access Server connected to the Internet, and we recommend doing this behind a firewall system with only ports TCP 443, TCP 943, TCP 945, and UDP 1194 forwarded from the public Internet to the private address of the Access Server behind the firewall. It is also important to check that DNS resolution is working as expected, so that pinging for example www.google.com will result in the server being able to resolve this to an IP address. If DNS resolution doesn’t work right it can slow down the web interface, cause problems with VPN clients that want to redirect their Internet traffic through the VPN server, and prevents successful licensing of the Access Server.

Access Server since version 2.7.5 gets distributed via a software repository now. So if your system is isolated from the Internet, it will be more work to install it without Internet access. We do still offer the option to download software packages separately, but Access Server now comes in 2 packages. The OpenVPN Connect client software bundle, and the OpenVPN Access Server. Both must be installed for Access Server to successfully install. On top of that, various dependencies are required which must be installed separately as well. You can find these instructions also on our software repository page by selecting the manual installation option.

Install repository, then upgrade

The upgrade procedure via repository is fairly simple. You need to first know which operating system you have. If you don’t know what it is, you can use the information below to determine this. Then you install the software repository and install Access Server using the instructions from our software repository page. So in short these are the steps that you need to take:

• Determine your operating system.
• Run the instructions for your OS from our website to install the repository.
• Those instructions will also install the latest version of OpenVPN Access Server.

To determine your operating system:

This should output some useful information. If you encounter some failure with some of these commands, that is not a problem. We provide these 3 commands and at least one of them should succeed and provide the necessary information. Below is an example of output from an older Access Server on Amazon AWS:

Now we know that we’re running Ubuntu 16.04.2 LTS on an x86_64 platform. With the information that we have now, we can determine the operating system name, version number, and whether it’s x86 (32 bits) or x86_64 (64 bits).

Based on those three things, look up the repository installation instructions on our software repository page on our website. Select the operating system that you use, which version of operating system from the choices, and a list of instructions will then be visible.

The instructions give you commands to run on your server’s command line. It will set up the software repository for you, download and install the latest Access Server version, and if there is an existing Access Server installation, it will upgrade it for you automatically while retaining your licensing information and your users and settings.

After adding the repository, when you run apt update and apt upgrade in the future to update packages on your operating system, it will also update Access Server at the same time.

For the final step, we recommend rebooting your server:

This completes the installation and upgrade process.

NOTE: If your operating system is so old that it isn’t even listed anymore, do not proceed. You may need to consider updating your whole system. For example, we no longer offer downloads for CentOS 5 as it could not handle functions we support today for IPv6. Trying to install the CentOS 7 version on it would not work. Installing OpenVPN Access Server on an older platform than it was designed for will result in failure.

Finishing configuration and using the product

Once the program is installed it will automatically configure itself with default settings unless it detected a previous installation — then it just keeps those settings from the existing installation. If you install fresh, the installation process will tell you where to find the client web service, which is the web based GUI that you can use to log on and connect to the Access Server, and where to find the admin web service, which is where you can log on as an administrative user and manage the configuration, certificate, users, etcetera, in the web based GUI.

Usually the client UI is at the address of your server, as an example it may be at https://192.168.70.222/.

The admin UI is usually at the /admin/ address, for example https://192.168.70.222/admin/.

Please note that the web services by default actually run on port TCP 943, so using our example IP address, you can add that to the end: https://192.168.70.222:943/. The OpenVPN TCP daemon that runs on TCP port 443 redirects incoming browser requests so that it is easier for users to open the web interface — they won’t have to specify that port number.

Initially a single administrative user is added to the system. But it has no password set and therefore cannot be used yet. To use it a password must be set first:

You can now point your web browser at the admin UI web interface. Because the Access Server comes with a self-signed SSL certificate to begin with, you will receive a warning in the browser like “Invalid certificate» or “Cannot verify identity of the server». You will have to confirm that you wish to continue to the web interface (these warnings may be a little scary but can be resolved later by installing a properly signed web SSL certificate in the Access Server). You will then see the login screen and you can then enter the username openvpn and the password you have just set with the “passwd openvpn» command.

Once you are logged in to the Admin UI you can select which authentication system to use. The available choices are LOCAL, PAM, RADIUS, and LDAP. The default is LOCAL which lets you manage the users directly from the web interface.

You can also use another external system like RADIUS or LDAP server, for example to connect to a Windows Server Active Directory using an LDAP or RADIUS connector. If you do connect to Windows AD, we recommend that you use LDAP for best results.

If you are managing only a limited amount of users and don’t want things to be too complicated you can just stay with LOCAL authentication mode. Almost everything can then be configured purely from the Admin UI, although some advanced options are only available in the command line tools. We recommend that if you choose to use PAM that you look at the command line authentication options documentation specifically to learn how to add/remove users and manage passwords.

Further documentation is available to configure specific functions and configuration options for the OpenVPN Access Server.

Limitations of an unlicensed OpenVPN Access Server

When the OpenVPN Access Server is installed without a license key it goes into a sort of demonstration mode. There is no time limit or functionality limit on this mode. The only difference between a licensed Access Server and an unlicensed one is the amount of simultaneous OpenVPN tunnel connections the Access Server allows. An unlicensed server will only ever allow 2 simultaneous connections and that’s it. To unlock more connections you can purchase a license key to unlock more connections. We suggest you read the licensing frequently asked questions page and the pricing overview page to learn more.

Источник