mirror of
https://github.com/pi-hole/docs.git
synced 2024-12-06 19:27:12 +01:00
Merge pull request #159 from spiltcoffee/openvpn-server-conf
Fix docs refer to OpenVPN files which have moved in newer versions
This commit is contained in:
@@ -21,7 +21,7 @@ Generating a 2048 bit RSA private key
|
||||
..................................+++
|
||||
writing new private key to '...'
|
||||
-----
|
||||
Using configuration from /etc/openvpn/easy-rsa/openssl-1.0.cnf
|
||||
Using configuration from /etc/openvpn/server/easy-rsa/openssl-1.0.cnf
|
||||
Check that the request matches the signature
|
||||
Signature ok
|
||||
The Subject's Distinguished Name is as follows
|
||||
|
||||
@@ -26,7 +26,7 @@ Please, use one word only, no special characters
|
||||
Client name: iphone7
|
||||
```
|
||||
|
||||
This will generate a `.ovpn` file, which needs to be copied to your client machine (often times using the OpenVPN app). This process also generates a few other files found in `/etc/openvpn/easy-rsa/pki/`, which make public key authentication possible; you only need to worry about the `.ovpn` file, though.
|
||||
This will generate a `.ovpn` file, which needs to be copied to your client machine (often times using the OpenVPN app). This process also generates a few other files found in `/etc/openvpn/server/easy-rsa/pki/`, which make public key authentication possible; you only need to worry about the `.ovpn` file, though.
|
||||
|
||||
## Connect a client using the `.ovpn` file
|
||||
|
||||
@@ -64,15 +64,15 @@ sudo apt-get install network-manager-openvpn network-manager-openvpn-gnome
|
||||
sudo service network-manager restart
|
||||
```
|
||||
|
||||
2. Securely copy the necessary certificates from your OpenVPN server to your client (e.g. using `sftp`). They are located in `/etc/openvpn/easy-rsa/pki`
|
||||
2. Securely copy the necessary certificates from your OpenVPN server to your client (e.g. using `sftp`). They are located in `/etc/openvpn/server/easy-rsa/pki`
|
||||
|
||||
You will need:
|
||||
|
||||
* User Certificate: `/etc/openvpn/easy-rsa/pki/issued/client.crt`
|
||||
* CA Certificate: `/etc/openvpn/easy-rsa/pki/ca.crt`
|
||||
* Private Key: `/etc/openvpn/easy-rsa/pki/private/client.key`
|
||||
* User Certificate: `/etc/openvpn/server/easy-rsa/pki/issued/client.crt`
|
||||
* CA Certificate: `/etc/openvpn/server/easy-rsa/pki/ca.crt`
|
||||
* Private Key: `/etc/openvpn/server/easy-rsa/pki/private/client.key`
|
||||
* Private Key Password: Depending on your settings (might even be empty)
|
||||
* TA Key: `/etc/openvpn/ta.key`
|
||||
* TA Key: `/etc/openvpn/server/ta.key`
|
||||
|
||||
Further details can be found in the screenshots provided below:
|
||||

|
||||
|
||||
@@ -2,18 +2,18 @@
|
||||
In order to separate VPN traffic from DNS queries you will need to run two VPN servers. One server routes the normal user traffic and the second routes only DNS requests. This can be done with two OpenVPN configurations.
|
||||
|
||||
#### Prerequisites and Configuration
|
||||
You should have an existing OpenVPN server configured and running. We are going to use the original configuration file located at `/etc/openvpn/server.conf`.
|
||||
You should have an existing OpenVPN server configured and running. We are going to use the original configuration file located at `/etc/openvpn/server/server.conf`.
|
||||
|
||||
First, copy the file:
|
||||
|
||||
```bash
|
||||
sudo cp /etc/openvpn/server.conf /etc/openvpn/server2.conf
|
||||
sudo cp /etc/openvpn/server/server.conf /etc/openvpn/server/server2.conf
|
||||
```
|
||||
|
||||
Next, exit the new copy of the configuration. We use the `nano` editor in this example, but any editor will work. Remember to edit under the root account via `sudo`.
|
||||
|
||||
```bash
|
||||
sudo nano /etc/openvpn/server2.conf
|
||||
sudo nano /etc/openvpn/server/server2.conf
|
||||
```
|
||||
|
||||
We will need to change the port to one different from the original, so that it does not conflict with the first instance of OpenVPN. Assuming you used the default port configuration, you should have 1194 as the port. You need to change this to a different value, making sure the port is available - 1195 should be.
|
||||
|
||||
@@ -9,7 +9,7 @@ This setup assumes that your local network is in the range **192.168.2.0** (i.e.
|
||||
- devices in 192.168.0.1 - 192.168.0.254 -> `route 192.168.0.0`
|
||||
- devices in 192.168.123.1 - 192.168.123.254 -> `route 192.168.123.0`
|
||||
|
||||
Edit your `/etc/openvpn/server.conf`:
|
||||
Edit your `/etc/openvpn/server/server.conf`:
|
||||
|
||||
```
|
||||
push "route 192.168.2.0 255.255.255.0"
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
If you operate your Pi-hole + OpenVPN at home, it is very likely that you are sitting behind a NAT / dynamically changing IP address. In this case, you should set up a dynamic DNS record, which allows you to reach your server. You can exchange the address that has been configured during the setup of OpenVPN like this:
|
||||
|
||||
```
|
||||
vim /etc/openvpn/client-common.txt
|
||||
vim /etc/openvpn/server/client-common.txt
|
||||
```
|
||||
|
||||
Look for the `remote` line and adjust it accordingly (remove IP address, add host name), e.g.
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
|
||||
With this setup, you will force connected clients to use **only the DNS provided by the VPN connection, i.e. the Pi-hole.** Do this only if you **don't** want to tunnel all traffic from the client through the VPN, but only its DNS queries.
|
||||
|
||||
Edit your `/etc/openvpn/server.conf` and remove (comment out) the following line:
|
||||
Edit your `/etc/openvpn/server/server.conf` and remove (comment out) the following line:
|
||||
|
||||
```
|
||||
# push "redirect-gateway def1 bypass-dhcp"
|
||||
|
||||
@@ -14,7 +14,7 @@ ip a
|
||||
Edit the OpenVPN config file:
|
||||
|
||||
```
|
||||
vim /etc/openvpn/server.conf
|
||||
vim /etc/openvpn/server/server.conf
|
||||
```
|
||||
|
||||
Set this line to use your Pi-hole's IP address, which you determined from the `ifconfig` command and comment out or remove the other line (if it exists):
|
||||
@@ -70,4 +70,4 @@ Please, use one word only, no special characters
|
||||
Client name: iphone7
|
||||
```
|
||||
|
||||
This will generate a `.ovpn` file, which needs to be copied to your client machine (often times using the OpenVPN app). This process also generates a few other files found in `/etc/openvpn/easy-rsa/pki/`, which make public key authentication possible; you only need to worry about the `.ovpn` file, though.
|
||||
This will generate a `.ovpn` file, which needs to be copied to your client machine (often times using the OpenVPN app). This process also generates a few other files found in `/etc/openvpn/server/easy-rsa/pki/`, which make public key authentication possible; you only need to worry about the `.ovpn` file, though.
|
||||
|
||||
Reference in New Issue
Block a user