Merge pull request #159 from spiltcoffee/openvpn-server-conf

Fix docs refer to OpenVPN files which have moved in newer versions
This commit is contained in:
Mark Drobnak
2019-08-19 11:20:16 -04:00
committed by GitHub
7 changed files with 15 additions and 15 deletions
+1 -1
View File
@@ -21,7 +21,7 @@ Generating a 2048 bit RSA private key
..................................+++
writing new private key to '...'
-----
Using configuration from /etc/openvpn/easy-rsa/openssl-1.0.cnf
Using configuration from /etc/openvpn/server/easy-rsa/openssl-1.0.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
+6 -6
View File
@@ -26,7 +26,7 @@ Please, use one word only, no special characters
Client name: iphone7
```
This will generate a `.ovpn` file, which needs to be copied to your client machine (often times using the OpenVPN app). This process also generates a few other files found in `/etc/openvpn/easy-rsa/pki/`, which make public key authentication possible; you only need to worry about the `.ovpn` file, though.
This will generate a `.ovpn` file, which needs to be copied to your client machine (often times using the OpenVPN app). This process also generates a few other files found in `/etc/openvpn/server/easy-rsa/pki/`, which make public key authentication possible; you only need to worry about the `.ovpn` file, though.
## Connect a client using the `.ovpn` file
@@ -64,15 +64,15 @@ sudo apt-get install network-manager-openvpn network-manager-openvpn-gnome
sudo service network-manager restart
```
2. Securely copy the necessary certificates from your OpenVPN server to your client (e.g. using `sftp`). They are located in `/etc/openvpn/easy-rsa/pki`
2. Securely copy the necessary certificates from your OpenVPN server to your client (e.g. using `sftp`). They are located in `/etc/openvpn/server/easy-rsa/pki`
You will need:
* User Certificate: `/etc/openvpn/easy-rsa/pki/issued/client.crt`
* CA Certificate: `/etc/openvpn/easy-rsa/pki/ca.crt`
* Private Key: `/etc/openvpn/easy-rsa/pki/private/client.key`
* User Certificate: `/etc/openvpn/server/easy-rsa/pki/issued/client.crt`
* CA Certificate: `/etc/openvpn/server/easy-rsa/pki/ca.crt`
* Private Key: `/etc/openvpn/server/easy-rsa/pki/private/client.key`
* Private Key Password: Depending on your settings (might even be empty)
* TA Key: `/etc/openvpn/ta.key`
* TA Key: `/etc/openvpn/server/ta.key`
Further details can be found in the screenshots provided below:
![](NetworkManager3.png)
+3 -3
View File
@@ -2,18 +2,18 @@
In order to separate VPN traffic from DNS queries you will need to run two VPN servers. One server routes the normal user traffic and the second routes only DNS requests. This can be done with two OpenVPN configurations.
#### Prerequisites and Configuration
You should have an existing OpenVPN server configured and running. We are going to use the original configuration file located at `/etc/openvpn/server.conf`.
You should have an existing OpenVPN server configured and running. We are going to use the original configuration file located at `/etc/openvpn/server/server.conf`.
First, copy the file:
```bash
sudo cp /etc/openvpn/server.conf /etc/openvpn/server2.conf
sudo cp /etc/openvpn/server/server.conf /etc/openvpn/server/server2.conf
```
Next, exit the new copy of the configuration. We use the `nano` editor in this example, but any editor will work. Remember to edit under the root account via `sudo`.
```bash
sudo nano /etc/openvpn/server2.conf
sudo nano /etc/openvpn/server/server2.conf
```
We will need to change the port to one different from the original, so that it does not conflict with the first instance of OpenVPN. Assuming you used the default port configuration, you should have 1194 as the port. You need to change this to a different value, making sure the port is available - 1195 should be.
+1 -1
View File
@@ -9,7 +9,7 @@ This setup assumes that your local network is in the range **192.168.2.0** (i.e.
- devices in 192.168.0.1 - 192.168.0.254 -> `route 192.168.0.0`
- devices in 192.168.123.1 - 192.168.123.254 -> `route 192.168.123.0`
Edit your `/etc/openvpn/server.conf`:
Edit your `/etc/openvpn/server/server.conf`:
```
push "route 192.168.2.0 255.255.255.0"
+1 -1
View File
@@ -1,7 +1,7 @@
If you operate your Pi-hole + OpenVPN at home, it is very likely that you are sitting behind a NAT / dynamically changing IP address. In this case, you should set up a dynamic DNS record, which allows you to reach your server. You can exchange the address that has been configured during the setup of OpenVPN like this:
```
vim /etc/openvpn/client-common.txt
vim /etc/openvpn/server/client-common.txt
```
Look for the `remote` line and adjust it accordingly (remove IP address, add host name), e.g.
+1 -1
View File
@@ -2,7 +2,7 @@
With this setup, you will force connected clients to use **only the DNS provided by the VPN connection, i.e. the Pi-hole.** Do this only if you **don't** want to tunnel all traffic from the client through the VPN, but only its DNS queries.
Edit your `/etc/openvpn/server.conf` and remove (comment out) the following line:
Edit your `/etc/openvpn/server/server.conf` and remove (comment out) the following line:
```
# push "redirect-gateway def1 bypass-dhcp"
+2 -2
View File
@@ -14,7 +14,7 @@ ip a
Edit the OpenVPN config file:
```
vim /etc/openvpn/server.conf
vim /etc/openvpn/server/server.conf
```
Set this line to use your Pi-hole's IP address, which you determined from the `ifconfig` command and comment out or remove the other line (if it exists):
@@ -70,4 +70,4 @@ Please, use one word only, no special characters
Client name: iphone7
```
This will generate a `.ovpn` file, which needs to be copied to your client machine (often times using the OpenVPN app). This process also generates a few other files found in `/etc/openvpn/easy-rsa/pki/`, which make public key authentication possible; you only need to worry about the `.ovpn` file, though.
This will generate a `.ovpn` file, which needs to be copied to your client machine (often times using the OpenVPN app). This process also generates a few other files found in `/etc/openvpn/server/easy-rsa/pki/`, which make public key authentication possible; you only need to worry about the `.ovpn` file, though.