OpenVPN

1. Install OpenVPN and Easy-RSA on the VPS

Ensure your VPS has OpenVPN and Easy-RSA installed.

On Debian/Ubuntu

apt update
sudo apt install openvpn easy-rsa -y

On CentOS/RHEL

 yum install epel-release -y
sudo yum install openvpn easy-rsa -y

---

2. Set Up the Easy-RSA Environment

1. Create a directory for Easy-RSA:

    codemake-cadir ~/openvpn-ca
   cd ~/openvpn-ca

2. Initialize the Public Key Infrastructure (PKI):

   ./easyrsa init-pki

3. Build the Certificate Authority (CA):

   ./easyrsa build-ca

   You’ll be prompted to set a password for the CA and enter a name (e.g., "VPN_CA").

4. Generate the server certificate and key:

   ./easyrsa build-server-full server nopass

5. Generate the Diffie-Hellman key exchange:

   ./easyrsa gen-dh

6. Generate the HMAC key for additional security:

   openvpn --genkey --secret ta.key

---

3. Configure OpenVPN Server

1. Copy the certificates and keys to the OpenVPN directory:

   sudo cp ~/openvpn-ca/pki/ca.crt /etc/openvpn/
   sudo cp ~/openvpn-ca/pki/private/server.key /etc/openvpn/
   sudo cp ~/openvpn-ca/pki/issued/server.crt /etc/openvpn/
   sudo cp ~/openvpn-ca/pki/dh.pem /etc/openvpn/
   sudo cp ~/openvpn-ca/ta.key /etc/openvpn/

2. Create the OpenVPN server configuration file:

   codesudo nano /etc/openvpn/server.conf

   Add the following content to the file:

    codeport 1194
   proto udp
   dev tun
   ca ca.crt
   cert server.crt
   key server.key
   dh dh.pem
   auth SHA256
   tls-auth ta.key 0
   topology subnet
   server 10.8.0.0 255.255.255.0
   ifconfig-pool-persist ipp.txt
   push "redirect-gateway def1 bypass-dhcp"
   push "dhcp-option DNS 8.8.8.8"
   push "dhcp-option DNS 8.8.4.4"
   keepalive 10 120
   cipher AES-256-CBC
   user nobody
   group nogroup
   persist-key
   persist-tun
   status openvpn-status.log
   verb 3

3. Enable IP forwarding:

    sysctl -w net.ipv4.ip_forward=1

   Persist the setting by editing /etc/sysctl.conf:

   codenet.ipv4.ip_forward=1

4. Configure firewall rules:

   sudo iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
   sudo iptables-save > /etc/iptables/rules.v4

---

4. Start the OpenVPN Server

Start and enable the OpenVPN service:

sudo systemctl start openvpn@server
sudo systemctl enable openvpn@server

Check the status:

sudo systemctl status openvpn@server

---

5. Generate Client Configuration

1. Generate a client certificate and key:

   cd ~/openvpn-ca
   ./easyrsa build-client-full client1 nopass

2. Create a client configuration file:

   nano ~/client1.ovpn

   Add the following content to the file:

   client
   dev tun
   proto udp
   remote <your-server-ip> 1194
   resolv-retry infinite
   nobind
   persist-key
   persist-tun
   remote-cert-tls server
   auth SHA256
   cipher AES-256-CBC
   verb 3
   <ca>
   [Paste the content of `ca.crt` here]
   </ca>
   <cert>
   [Paste the content of `client1.crt` here]
   </cert>
   <key>
   [Paste the content of `client1.key` here]
   </key>
   <tls-auth>
   [Paste the content of `ta.key` here]
   </tls-auth>
   

---

6. Transfer the Client Configuration

Transfer the client1.ovpn file to your device (PC, phone, or another client).

Example using scp:

bscp ~/client1.ovpn user@client-device:/path/to/destination

---

7. Connect Using the Client

On Linux

Install OpenVPN:

sudo apt install openvpn
sudo openvpn --config client1.ovpn

On Windows

• Download and install the OpenVPN client.

• Import the .ovpn file and connect.

On Android/iOS

• Download the OpenVPN Connect app.

• Import the .ovpn file and connect.

---

8. Verify Connection

Check your public IP to confirm traffic is routed through the VPN:

curl ifconfig.me

It should display the IP address of your VPS, not your local IP.

---

You now have a fully functional OpenVPN server on your VPS and can connect securely from client devices!