hi
I am new to openvpn I install/configure one linux server as openvpn server
I generate the certificate as below mentioned link guide
http://openvpn.net/index.php/open-source/documentation/howto.html
the server.conf file is given below
[root@rashid openvpn]# cat server.conf
#################################################
# Sample OpenVPN 2.0 config file for #
# multi-client server. #
# Comments are preceded with '#' or ';' #
#################################################
port 1194
proto udp
dev tun
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key # This file should be kept secret
dh /etc/openvpn/keys/dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 10 120
script-security 3
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
verb 3
;mute 20
[root@rashid openvpn]#
*****************************************************************************
the server output is given below:
****************************************************
[root@rashid openvpn]# openvpn server.conf
Tue May 15 22:50:39 2012 OpenVPN 2.2.2 x86_64-unknown-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] built on May 13 2012
Tue May 15 22:50:39 2012 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Tue May 15 22:50:39 2012 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Tue May 15 22:50:39 2012 Diffie-Hellman initialized with 1024 bit key
Tue May 15 22:50:39 2012 TLS-Auth MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Tue May 15 22:50:39 2012 Socket Buffers: R=[212992->131072] S=[212992->131072]
Tue May 15 22:50:39 2012 ROUTE default_gateway=192.168.1.1
Tue May 15 22:50:39 2012 TUN/TAP device tun0 opened
Tue May 15 22:50:39 2012 TUN/TAP TX queue length set to 100
Tue May 15 22:50:39 2012 /sbin/ifconfig tun0 10.8.0.1 pointopoint 10.8.0.2 mtu 1500
Tue May 15 22:50:39 2012 /sbin/route add -net 10.8.0.0 netmask 255.255.255.0 gw 10.8.0.2
Tue May 15 22:50:39 2012 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Tue May 15 22:50:39 2012 GID set to nobody
Tue May 15 22:50:39 2012 UID set to nobody
Tue May 15 22:50:39 2012 UDPv4 link local (bound): [undef]:1194
Tue May 15 22:50:39 2012 UDPv4 link remote: [undef]
Tue May 15 22:50:39 2012 MULTI: multi_init called, r=256 v=256
Tue May 15 22:50:39 2012 IFCONFIG POOL: base=10.8.0.4 size=62
Tue May 15 22:50:39 2012 IFCONFIG POOL LIST
Tue May 15 22:50:39 2012 Initialization Sequence Completed
******************************************************************************************************
On client side I am little confuse about the certificates either I follow the same procedure as metioned in above link to create the ca certificated/server/client certificate OR need to copy from the remote server .
However below is my client.conf file
***************************
[root@rashid easy-rsa]# cat client.conf
##############################################
# Sample client-side OpenVPN 2.0 config file #
# for connecting to multi-client server. #
##############################################
client
dev tun
proto udp
remote 212.102.17.147 1194
resolv-retry infinite
nobind
user nobody
group nobody
persist-key
persist-tun
#
I am little confuse about below paramenters that should I copy the ca certificate/server/client certificate from my vpn server of agarin generate the ca certificate/server/client.
ca /etc/openvpn/easy-rsa/keys/ca.crt # this is self signed generated certificate locally created on client side
cert /etc/openvpn/easy-rsa/keys/client1.crt # I copied them from my openvpn server
key /etc/openvpn/easy-rsa/keys/client1.key # I copied them from my openvpn server
comp-lzo
verb 3
;mute 20
[root@rashid easy-rsa]#
*********************************************************************************************
NOW WHEN I RUN THE
[root@rashid easy-rsa]# openvpn client.conf
Tue May 15 23:26:17 2012 OpenVPN 2.0.9 x86_64-redhat-linux-gnu [SSL] [LZO] [EPOLL] built on May 15 2012
Tue May 15 23:26:17 2012 IMPORTANT: OpenVPN's default port number is now 1194, based on an official port number assignment by IANA. OpenVPN 2.0-beta16 and earlier used 5000 as the default port.
Tue May 15 23:26:17 2012 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Tue May 15 23:26:17 2012 LZO compression initialized
Tue May 15 23:26:17 2012 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Tue May 15 23:26:17 2012 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Tue May 15 23:26:17 2012 Local Options hash (VER=V4): '41690919'
Tue May 15 23:26:17 2012 Expected Remote Options hash (VER=V4): '530fdded'
Tue May 15 23:26:17 2012 NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
Tue May 15 23:26:17 2012 UDPv4 link local: [undef]
Tue May 15 23:26:17 2012 UDPv4 link remote: 212.102.17.147:1194
Tue May 15 23:26:17 2012 read UDPv4 [EHOSTUNREACH]: No route to host (code=113)
Tue May 15 23:26:19 2012 read UDPv4 [EHOSTUNREACH]: No route to host (code=113)
Tue May 15 23:26:21 2012 read UDPv4 [EHOSTUNREACH]: No route to host (code=113)
*****************************************************************
Please help me to solve this problem
Regards,
