Advice needed on setting up OpenVPN server on Raspberry Pi

doveman

I'm trying to setup an OpenVPN server and referred to a couple of tutorials:

A) http://raspberrypi-hacks.com/29/turn-your-raspberry-into-an-openvpn-vpn-server/
B) http://raspberrypihelp.net/tutorials/1-openvpn-server-tutorial

I followed guide B) and just referred to A) to confirm that it appeared to be correct. However, the two guides differ in some respects, such as at step eleven in B) it tells you to do some stuff with crontab, which A) doesn't refer to at all. Then A) tells you to add these lines to /etc/rc.local, which B) doesn't.

iptables -t nat -A INPUT -i eth0 -p udp -m udp --dport 1194 -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source RASPBERRY.PI.IP.ADRESS

and B) says to do this

sudo iptables -t nat -A POSTROUTING -s 10.0.0.0/8 ! -d 10.0.0.0/8 -o eth0 -j MASQUERADE

whereas A) says this

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to [ipadres rpi]

So I'm not really sure if I've got it setup right and I also need to make sure that it's purely for allowing remote clients to connect through to the Internet when using unsafe WiFi hotspots and that it doesn't allow access to any of my PCs on my LAN.

It also looks like these steps http://openvpn.net/index.php/open-source/faq/community-software-server/299-can-openvpn-handle-the-situation-where-both-ends-of-the-connection-are-dynamic.html are necessary for anyone using a Dynamic DNS service at the server end (the client end is always going to be a random IP address from the WiFi hotspot) but it's not really clear exactly which files need to be edited, so I wonder if there's a more complete guide than the ones I referred to, that clearly explains exactly what needs to be done to get the server setup completely? If not, I'd be grateful if anyone here could help me understand what I should do.

doveman

I've also run into another problem whilst trying to connect with the OpenVPN Windows client.

Fri Nov 29 21:19:44 2013 OpenVPN 2.3.2 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Aug 22 2013
Enter Management Password:
Fri Nov 29 21:19:44 2013 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Fri Nov 29 21:19:44 2013 Need hold release from management interface, waiting...
Fri Nov 29 21:19:44 2013 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Fri Nov 29 21:19:44 2013 MANAGEMENT: CMD 'state on'
Fri Nov 29 21:19:44 2013 MANAGEMENT: CMD 'log all on'
Fri Nov 29 21:19:44 2013 MANAGEMENT: CMD 'hold off'
Fri Nov 29 21:19:44 2013 MANAGEMENT: CMD 'hold release'
Fri Nov 29 21:19:44 2013 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Fri Nov 29 21:20:01 2013 MANAGEMENT: CMD 'password [...]'
Fri Nov 29 21:20:01 2013 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Fri Nov 29 21:20:01 2013 SIGUSR1[soft,private-key-password-failure] received, process restarting
Fri Nov 29 21:20:01 2013 MANAGEMENT: >STATE:1385760001,RECONNECTING,private-key-password-failure,,
Fri Nov 29 21:20:01 2013 Restart pause, 2 second(s)
Fri Nov 29 21:20:03 2013 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Fri Nov 29 21:20:09 2013 MANAGEMENT: CMD 'password [...]'
Fri Nov 29 21:20:09 2013 Socket Buffers: R=[8192->8192] S=[8192->8192]
Fri Nov 29 21:20:09 2013 UDPv4 link local: [undef]
Fri Nov 29 21:20:09 2013 UDPv4 link remote: [AF_INET]192.168.1.85:1194
Fri Nov 29 21:20:09 2013 MANAGEMENT: >STATE:1385760009,WAIT,,,
Fri Nov 29 21:20:09 2013 MANAGEMENT: >STATE:1385760009,AUTH,,,
Fri Nov 29 21:20:09 2013 TLS: Initial packet from [AF_INET]192.168.1.85:1194, sid=15567421 11095b98
Fri Nov 29 21:20:09 2013 VERIFY ERROR: depth=1, error=self signed certificate in certificate chain: C=GB, ST=London, L=London, O=Fort-Funston, OU=changeme, CN=doveman-VPN, name=doveman, emailAddress=name@domain.com
Fri Nov 29 21:20:09 2013 TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
Fri Nov 29 21:20:09 2013 TLS Error: TLS object -> incoming plaintext read error
Fri Nov 29 21:20:09 2013 TLS Error: TLS handshake failed
Fri Nov 29 21:20:09 2013 SIGUSR1[soft,tls-error] received, process restarting
Fri Nov 29 21:20:09 2013 MANAGEMENT: >STATE:1385760009,RECONNECTING,tls-error,,

The first time I entered the wrong password but the second time, after I entered the right one, the problem seems to be that it's referring to an old cert. I generated this on my first try but have since started again and generated new server and client keys/certs and didn't use the location/name/email details shown, so it must be finding this old cert somewhere.

It seems a bit weird that it warns that "No server certificate method has been enabled" but then fails the connection because it can't verify the cert though!

doveman

Anyone able to help?

doveman

Great, thanks. I'll refer to those resources and see how I get on.