How to install and configure OpenVPN Server on CentOS 7 Linux + OpenVPN GUI client on Windows

Server: Centos 7 Linux, 64 bit
Client: Windows 7/10, 64 bit

OpenVPN is a very powerful Open Source VPN tool.

There are many real world cases when you may want to go with the OpenVPN based solutions, including and not limited to:

Establishing a secure connection to office network Securing network data exchanges Masking online activities Anonymizing browsing sessions Bypassing censorship and firewalls Accessing ISP blocked content or services

Installation and configuration of OpenVPN server on CentOS 7 Linux VPS

Before installation of OpenVPN, my VPS server already had installed EPEL and iptables packages.

1. if not done before, install the required EPEL packages

# yum install epel-release

2. Install OpenVPN package

# yum install openvpn -y

3. Copy configuration file

# cp /usr/share/doc/openvpn-*/sample/sample-config-files/server.conf /etc/openvpn

4. Open server.conf configuration file for editing

# nano /etc/openvpn/server.conf

5. Uncomment line to redirect traffic through OpenVPN

push "redirect-gateway def1 bypass-dhcp"

6. Set preferred DNS. Linux server's DNS settings normally can be found at /etc/resolv.conf

push "dhcp-option DNS 139.162.139.5"
push "dhcp-option DNS 139.162.130.5"

Or, you may decide to use some of public DNS, for example Google's DNS

push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"

7. If you wish to allow your vpn clients sharing same keys, uncommented line

duplicate-cn

8. Set OpenVPN service privileges to run with. Uncomment following lines

user nobody
group nobody

9. Install Easy-RSA, a small RSA key management package.
More information about detailed usage of the Easy-RSA can be found here

# yum install easy-rsa -y

10. Create directory for storing keys

# mkdir -p /etc/openvpn/easy-rsa/keys

11. Copy Easy-RSA's key generation scripts into created directory

# cp -rf /usr/share/easy-rsa/2.0/* /etc/openvpn/easy-rsa

12. Edit fields in vars according to your server's data

# nano /etc/openvpn/easy-rsa/vars

The most important fields here to take an attention are: KEY_NAME and KEY_CN

export KEY_NAME="server"
export KEY_CN=openvpn.your_server.com

13. Go to the /etc/openvpn/easy-rsa directory, source in new variables and clean old keys

# cd /etc/openvpn/easy-rsa/
# source ./vars
NOTE: If you run ./clean-all, I will be doing a rm -rf on /etc/openvpn/easy-rsa/keys
# ./clean-all

14. Build the Certificate Authority (CA)

# ./build-ca

15. Generate OpenVPN server keys

# ./build-key-server server

16. Generate Diffie-Hellman Key Exchange parameters

# ./build-dh

17. Copy generated keys into /etc/openvpn/easy-rsa/keys

# cd /etc/openvpn/easy-rsa/keys
# cp ca.crt server.crt server.key dh2048.pem /etc/openvpn

18. Generate client keys

# cd /etc/openvpn/easy-rsa
# ./build-key client

19. Enable IP forwarding. Open /etc/sysctl.conf file for editing

nano /etc/sysctl.conf

Add to the /etc/sysctl.conf file

net.ipv4.ip_forward = 1

20. Restart network service

# systemctl restart network.service

CentOS 7 comes with firewalld firewall service by default, while previous distros used iptables. I prefer to use iptables instead of firewalld.

If you prefer to stay with firewalld, you can skip steps #21-#22 and make sure to set appropriate firewalld rules in steps #23-#27.

21. So, disable firewalld

# systemctl stop firewalld
# systemctl disable firewalld
# systemctl mask firewalld

22. Install, enable and start iptables

# yum install iptables-services -y
# systemctl enable iptables
# systemctl start iptables

23. Enable OpenVPN listening port on firewall. By default OpenVPN listens for UDP port 1194

# iptables -I INPUT -m state --state NEW -m udp -p udp --dport 1194 -j ACCEPT

24. Allow traffic initiated from VPN to access "the world"

# iptables -I FORWARD -i tun0 -o eth0 -s 10.8.0.0/24 -m conntrack --ctstate NEW -j ACCEPT

25. Allow established traffic to pass back and forth

# iptables -I FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

26. Allow NAT and masquerade traffic from VPN to "the world"

# iptables -t nat -I POSTROUTING -o eth0 -s 10.8.0.0/24 -j MASQUERADE

27. Save iptables rules

# service iptables save

28. Enable and start OpenVPN service

# systemctl -f enable openvpn@server.service
Created symlink from /etc/systemd/system/multi-user.target.wants/openvpn@server.service to /usr/lib/systemd/system/openvpn@.service.
# systemctl start openvpn@server.service

29. Check the service. By default it listens for incoming connections on UDP port 1194

# netstat -anp | grep 1194

udp  0  0 0.0.0.0:1194  0.0.0.0:*  1896/openvpn

30. Copy CA certificate and client keys to your client computer:

/etc/openvpn/easy-rsa/keys/ca.crt
/etc/openvpn/easy-rsa/keys/client.crt
/etc/openvpn/easy-rsa/keys/client.key

Installation and configuration of OpenVPN GUI client on Windows 7/10

1. Download and install OpenVPN-GUI client package appropriate to your platform from OpenVPN Community Downloads page. In my case it is openvpn-install-2.3.10-I602-x86_64.exe

2. Create client.ovpn file in your installation's config folder and open it for editing:

c:\Program Files\OpenVPN\config\client.ovpn

3. Put following text into client.ovpn file:

client
dev tun
proto udp
remote your_server_ip 1194
resolv-retry infinite
nobind
redirect-gateway def1
persist-key
persist-tun
comp-lzo
verb 3
<ca>
# put here text content taken from ca.crt file, started with 
# -----BEGIN CERTIFICATE-----
# and end with
# -----END CERTIFICATE-----  
</ca>
<cert>
# put here text content taken from client.crt file, started with 
# -----BEGIN CERTIFICATE-----
# and end with
# -----END CERTIFICATE-----  
</cert>
<key>
# put here text content taken from client.key file, started with 
# -----BEGIN PRIVATE KEY-----
# and end with
# -----END PRIVATE KEY----- 
</key>

Replace your_server_ip with the real IP or domain name of your server.

Fill values of ca, cert and key fields with a content, taken from files previously generated in server side:

/etc/openvpn/easy-rsa/keys/ca.crt
/etc/openvpn/easy-rsa/keys/client.crt
/etc/openvpn/easy-rsa/keys/client.key

For example, my client.ovpn's cert field looks as given below. For the reason you know actual characters replaced with (...)

<cert>
-----BEGIN CERTIFICATE-----
MII...
...
...
...
...
-----END CERTIFICATE----- 
</cert>

4. Run OpenVPN GUI with Run as administrator privilege OR configure it to Always Run as an Administrator:

- Right-click the OpenVPN GUI shortcut
- Click the Properties option
- Click the Compatibility tab
- Check the "Run this program as an administrator" checkbox

5. Connect OpenVPN client to the server. After establishing connection, check your public IP address. Open browser, go to google and put in search text: my ip

Browser should display your OpenVPN server's IP.

More detailed information about using OpenVPN GUI for Windows can be found here