Christoph’s OpenVPN Mini-FAQ

OpenVPN is an open-source SSL VPN software. It allows you to connect different (private) networks securely over the internet. It’s the perfect alternative to all the crappy SSL VPN appliances that the salesmen desperately try to sell. See my OpenVPN FAQ for additional questions and answers.

(This is not the official OpenVPN FAQ. It’s just my personal answers to my personal questions.)

IPs and routing

How do I assign my users fixed IP addresses?

Use ”client-config-dir” and push the IP addresses to a certain client using this line in the client-specific configuration file:

ifconfig-push 10.100.8.1 10.100.8.2

This will assign John_Doe the IP address 10.100.8.1. The other IP address is assigned to the OpenVPN server – you won’t see it there through ifconfig though.

The server also needs to route this IP (or a range) through the tunnel. So your server.conf needs to contain a route entry for all the static IPs that you will assign:

route 10.100.8.0 255.255.255.0

Which iptables rules are needed to allow OpenVPN connections?

First you need to allow UDP 1194 incoming and outgoing connections on your main interface: 

iptables -A INPUT -i eth0 -p udp --dport 1194 -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp --dport 1194 -j ACCEPT

Next you need to allow certain traffic going through the tunnel. If you don’t want any restrictions then use: 

iptables -A INPUT -i tun0 -j ACCEPT
iptables -A OUTPUT -o tun0 -j ACCEPT
iptables -A FORWARD -o tun0 -j ACCEPT 

How do I make a network on the remote side of the tunnel accessible?

You need both a route and an iroute configuration directive on your server. 

iroute 192.168.152.128 255.255.255.128
route 192.168.152.128 255.255.255.128

Note: the iroute statement best belongs in the ”client-config-dir” directory. The route statement needs to be in your global server configuration file.

Also don’t forget to route that network to your OpenVPN server. The route and iroute statements will just tell OpenVPN that this network is supposed to be reached through a VPN tunnel. 

How do I let remote Windows clients browse my network?

Network browsing requires WINS to function across a router even in a full AD network. You will need to configure a WINS server and point your remote users to it.

You will also need to prevent them from assuming responsibility for maintaining the browse list. This is done with a couple of registry changes:

HKLM\System\CurrentControlSet\Services\Browser\Parameters

Make sure that IsDomainMaster and MaintainServerList are both set to FALSE.

Of course, any firewalling you are doing in the tunnel will need to allow the underlying NetBIOS traffic.

John A. Sullivan III 

Certificates 

How do I revoke a certificate?

If you want to permanently revoke access for a certain user you need to revoke the certificate that you issued. Revoking means that you list that certificate in a certificate revocation list (CRL). Once your OpenVPN server has a crl-verify option set that points to your CRL the certificates of new incoming connections will be checked against that CRL. If a certificate is listed there the access is denied. See the make-crl and revoke-full commands as part of Easy-RSA. And don’t forget to copy the new CRL to the OpenVPN server. You do not need to restart the server since the CRL is considered automatically everytime a user connects. 

Why is it bad to use static keys?

  • anyone can create an OpenVPN server and fool users (man-in-the-middle-attack)
  • you cannot revoke access for one user but need to distribute a new static key to everyone else 

Which files do I need to keep secret?

The private keys (suffix ‘.key’) need to be kept secret. The certitifcates (suffix ‘.crt’) can be exchanged freely and even sent through unsecured channels like email.

Operation 

Who is currently connected to my OpenVPN server? 

TELNET interface

Use the TELNET interface and issue a status command. 

Status file

Add these lines to your server configuration file: 

status status.log 5
status-version 2

This will write the current status of the OpenVPN server to the given logfile every 5 seconds in the configuration directory. Lines starting with CLIENT_LIST show you the connected users.

If you like to collect statistics on how many users are online at a given time (MRTG creates nice graphs) you can use this one-liner: 

grep ^CLIENT_LIST /etc/openvpn/status.log | wc -l 

How can I disconnect a client from the OpenVPN server?

Use the TELNET interface and issue a kill command on the common name of the client. The client will be able to reconnect though unless you revoke its certificate. Killing a client may be useful if you have changed a configuration file in the client-config-dir.

Do I have to restart OpenVPN after every configuration change?

Changes to the global configuration file (e.g. /etc/openvpn/server.conf) require a restart of the OpenVPN service. Consider using the ”client-config-dir” option to set client-specific parameters. Such configuration files will be read when a client connects and do not require a restart.

From time to time you will need to restart the server e.g. if you need to add a route entry. Consider adding this lien to your server configuration though: 

keepalive 1 5
persist-tun
persist-key
persist-local-ip
persist-remote-ip
push "persist-key"
push "persist-tun"

It will make the client send a "ping" to the server every second. If there is no reply to that "ping" after 5 seconds then the connection will be re-initiated. The default connection timeout is very large and will surely annoy your users. If they get disconnected for less than 10 seconds they will complain less likely. The persist-* settings will make the client keep the tunnel device open so existing connections won’t be interrupted during the renegotiation. Otherwise permanent connections like shell sessions would be disconnected.

How do I use the ‘client-config-dir’ parameter?

The client config directory is a location where you put custom client-specific configuration files. Example in your global configuration (e.g. /etc/openvpn/server.conf):

client-config-dir /etc/openvpn/clients

Then put files with the common names of your users there. The common name must match the filename exactly. Let’s pretend you have a user with the common name "John_Doe" on his certificate. Create a file /etc/openvpn/clients/John_Doe and make it contain configuration directives that should only apply to John Doe. The following directives are allowed there:

  • push
  • push-reset
  • iroute
  • ifconfig-push
  • config

Example /etc/openvpn/clients/John_Doe:

iroute 112.12.58.128 255.255.255.240
ifconfig-push 10.100.8.1 10.100.8.2

This will assign John Doe the IP 10.100.8.1 on his side of the VPN tunnel. Also the server will learn that the network 112.12.58.128/28 is on John’s side of the VPN tunnel and route packets there. (Note that you also need to create a "route 112.12.58.128 255.255.255.240" in your global configuration to make the OpenVPN server learn this route. The "route" command does not work within a client-config-dir configuration file.)

The charming advantage of client-config-dir configurations is that you don’t need to restart your OpenVPN server to make changes to these files work. Every time a client connects the client-config-dir will be searched for an appropriate file and if one is found the configuration will be applied.

There is also a special DEFAULT file that contains settings in case there is no configuration file for a certain client.

How can I access the TELNET management console?

You need to start OpenVPN with the --management option. For example --management 127.0.0.1 12345 as a startup parameter will get you access to the TELNET console on port 12345 on localhost. Accessing the console then is as easy as telnet localhost 12345. This is what you get:

Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
>INFO:OpenVPN Management Interface Version 1 -- type 'help' for more info

This is a security risk though because everybody can access the console without any further authentication.

Interoperability

Does OpenVPN work with Juniper/Nortel/Checkpoint VPNs?

No. OpenVPN just works with other OpenVPN clients/servers. OpenVPN is not an IPSEC software. It uses SSL to create VPN tunnels instead.

21 thoughts on “Christoph’s OpenVPN Mini-FAQ”

  1. Christoph Haas

    I'd like you to remove the copy from your page. Usually it's nice to ask first and copy laster. Besides you are making money (Google Ads) with my work.

    Apparently you have improved the page (which I like of course) and I'd be happy to include your changes if you like.

    1. nice to know that you replied it..sorry for not asking for your permission first

      i don't use it for google ads FYI. at first i wanted to try your post for myself.but it seems that you do mind about it

       

      by the way..i have deleted my post that i copied from you.you can check it by urself

      1. Christoph Haas

        Thanks for your fairness. Could we perhaps add your improvements to this page (of course having your name mentioned)?

        Btw, I've checked your page (when it was still online) and found an "Ads by Google" section at the bottom. That made me wonder.

  2. Hi Christopher,

    Thank you very much for the mini-faq.

    I have a little question:

    is it possible to add auth-user-pass in a client's configuration file in the client-config-dir at the server?

    Some how

    config auth-user-pass 
    

    for example?

     

    Thank you very much one more time.

    1. Christoph Haas

      Glad you like the mini-FAQ. Puttiing the authentication for a client into its config file in the client-config-dir is not supported as far as I know. But I have an idea that you could try:

      You could put the username and passsword into comments of each CCD file. Like:

      ifconfig-push …
      further configuration stuff …
      # Username: john
      # Password: g4rdenp0nd

      And then you could write a shell script to use as an auth-user-pass-verify script that parses these comments and verifies the username and password. The "$common_name" environment variable is set to the certificate's common name which will help the shell script find the proper file, do a grep and awk and then you can check it.

      Not sure that's really a good idea security-wise though. I personally use a script to check the username and password against LDAP.

      1. Hi !

        glad to see this page, well i have question, as we using openvpn in windows 2003server, and when ever we connect with client its give different ip then last time thats means DHCP ip working but i want to use static ip insted of DHCP, in your FAQ you only mention about how to fix static ip in linux. Kindly guide us that how we fix this problem thanks

         

        Sheher yar Khan

        SITO oy 

  3. Hello and thanks for your great article, I didn't know about client-config-dir before and it seems very useful to my needs. I'm setting up a smallish OpenVPN server for my family, and it's working great. I was just wondering if you know of any way to let the clients themselves decide to use redirect-gateway or not.

    For instance, if I'm is sitting at a trusted high-speed network I don't need to surf through the secure channel. However, when sitting on a public hotspot, the VPN channel can be very useful and improves security. Do I need to comment/uncomment push-reset every time to change this? Do you know of any way to change this in a more GUI fashion? (Me and my family uses the Windows GUI).

    Thanks a bunch,

    Jonathan

  4. openVPN newbie

    hi,

    I have an openVPN environment set up I have one openVPN server and appromixately 100 openVPN clients. I would like to know if it is possible to have an access control list of such to control which client can connect to the openVPN server. I am looking at a scenario where I would like to deny access to some of the clients when needed? Is it possible to do so with openVPN?

    thank you.

    1. Christoph Haas

      There are several ways to do that. The simplest solution is using the client-config-dir. For example if you set

      client-config-dir user-configs
      ccd-exclusive

      in your OpenVPN's server configuration file then only users would be able to login who's certificate's common names match a file in that directory. Or in other words: a user having a client certificate with the common name (CN) "lars.mueller" could only log in if there exists a file called /etc/openvpn/user-configs/lars.mueller. That file can even be empty – but it has to exist. It also gives you additional features like assigning every user a fixed IP address so you can assign firewall rules e.g. using iptables.

      A more hardcore solution is a two factor authentication where you do the above and also use a script to run some kind of user authentication. For example we use LDAP lookups. Interesting configuration directives in this context are username-as-common-name, auth-user-pass-verify, client-connect and client-disconnect.

      Perhaps I should write a more detailed article about that. 🙂

  5. Hi Chris,

    I found your mini (not mini though) faq very elucidative and useful. thanks a lot for this. i’ve a question regarding the assignment of ip address for clients.

    I have a case where in 20+ clients connect to the server. By design we are allowing them to use either same certificate or a client specific certificate. In the case of same certificate usage, is there a way to make sure that each client gets fixed ( in otherwords static) ip address regardless of the client connect back order ?

    thanks
    Raj

    1. Hi Christoph – I was hoping you might be able to review an issue I have with a machine on the server end of the tunnel nopt being able to route back to the OpenVPN client machine on my side of the tunnel. I have posted all info up on the OpenVPN forums – If you have 5mins to review that would be greatly appreciateed !

      https://forums.openvpn.net/topic11877-15.html#p26662

  6. Hi Chris,

    Trust you’re well, thank you for sharing a very informative FAQs.

    I have a small requirement with my OpenVPN deployment and am unable to grab good info online about it. I’m using bridging and my client1 (10.8.1.2) and client2 (10.8.1.3) are able to talk to each other as if they were directly connected. Now what I want is to add a default route in client1 towards client2 so that all internet traffic of client1 gets routed via client2. Let me know if it is possible using push-route or push redirect-gateway in CCD or some other way ?

    Thanking you in anticipation for your help 🙂

    Regards,
    Nawab

    1. Dear Nawab, Have you try “client-to-client” in your openvpn.conf ? that might be what you need.

  7. Hans Linkels

    Thanks for this page as well. I was already using your directions for setting up my mail servers in Debian, but this page helped my with OpenVPN. Great, please continue the good work. 🙂

  8. dear Chris, this is very good and clear article. It is simple enough to understand without cutting too much of the needed information to make certain things work in openvpn. Big kudos for you!

    I have a question regarding your client-config-dir with John Doe’s certificate – in that section i copy your quote – “Then put files with the common names of your users there. The common name must match the filename exactly. Let’s pretend you have a user with the common name “John_Doe” on his certificate”

    I have setting similiar with your John Doe’s thing but without using “his certificate” and it works. I can have more than one client of openvpn being assign of static ip using client-config-dir – When you are talking about “his certificate” you are talking about private sign certificate right? Right now I am using public signed certificate to connect for openvpn thus I need to put duplicate-cn in openvpn.conf — I notice common name – I can’t put different common name in my public signed certificate right? do I get my understanding correct? If I can’t, that leaves me to use private certificate ? is it safe? thank you in advance

  9. Hi,
    I am using openVPN and able to connect to VPN automatically when the config installed using On Demand Rule – Connect. But when VPN server is down i want VPN to try until timeout and stop then my normal internet should start working. Instead VPN tries indefinitely to connect to VPN blocking normal internet to work.

    I also used resolv-retry set to 0 but yet failed to achieve my requirement.

    Any help to resolve this issue appreciated!!

  10. Hello,

    I´ve just installed openvpn in my little bussines. I have no much knowledge about openvpn.
    I want to create two groups of users and make that users can connect only to another user if they are in the same group. Is this possible?if it´s possible, how can I do that?

    Thanks for your attention,

    Juan

    1. Christoph Haas

      That's a tough job. And there is probably no simple solution. I would probably assign network ranges per group and use a firewall to only allow forwarding of packets within the same group. I'm using Shorewall to manage my firewall rules. So that doesn't require a lot of OpenVPN knowledge. But you should know your way around IP routing in Linux.

  11. Just want to leave you a “thank you” here for your good openvpn information. Was useful to me more than once.

  12. D'jems Markenzy Mortimer

    Can you elaborate on that? Does that mean if the OpenVPN server knows of network that the connecting clients will learn of that network as well even though the clients are not on the same network segment?

    “How do I make a network on the remote side of the tunnel accessible?

    You need both a route and an iroute configuration directive on your server.

    iroute 192.168.152.128 255.255.255.128
    route 192.168.152.128 255.255.255.128

  13. TYRA RAHMA

    Let me know if it is possible using push-route or push redirect-gateway in CCD or some other way ?

Leave a Reply

Your email address will not be published. Required fields are marked *

Scroll to Top