Can I run OpenVPN server on a different port??

BobAGI

I have installed (about a year ago) an OpenVPN server on a RaspberryPi Model B and it has worked very well for most of that time.
However lately the Rpi unit has crashed randomly, probably because of some other software on that Pi. Maybe the printer server it also runs..

Since I have a spare RPi2B I have duplicated the original Pi by cloning the SDCard and then I have changed the IP address and name of this Pi. So the "same" OpenVPN server runs on both, but only one can be targeted for port forwarding by my Internet router (a D-Link 655).

I would like to be able to connect to VPN using any of these two RPi servers in order to create a better probability of connection.
To do so I have to run the server on a different port than 1194 so I can port forward two ports for OpenVPN on my router.

How do I configure the OpenVPN server to use another port, say 1197 or similar?

I have seen in the client ovpn file that there is a line like this:

remote myddnsdomain.com 1194

So it looks like the client side is really not a problem if I make a copy of the ovpn file and change the 1194 to something else.

But is there a way to make the server use a different port?

Right now I am away and the RPi has obviously crashed so I cannot VPN back home and SSH into a Pi and have a look at the configuration file...
Need to plan for a change when I get home.

Traffic

BobAGI wroteHow do I configure the OpenVPN server to use another port

See --port in The Manual v23x

BobAGI

Thanks for the reply!
I have now discovered that my Synology DS212j NAS has the capability to act as an OpenVPN server, so I am investigating the way that can be used.

When configuring it I get a possibility to "Export configuration" and this sends a zipfile containing the following files:
README.txt
ca.crt
openvpn.ovpn

In the README.txt they write:

To set up an OpenVPN client on Windows:

1. Install OpenVPN client on Windows
*An OpenVPN client on Windows is called OpenVPN GUI.
*Download it from http://openvpn.net/index.php/open-source/downloads.html and install the client.
*The default installation directory is C:\ProgramFiles\OpenVPN.

2. Run OpenVPN GUI as administrator.

3. Edit openvpn.ovpn and replace YOUR_SERVER_IP with public IP of your DiskStation.
*If your DiskStation is behind a router, replace YOUR_SERVER_IP with the router's IP.
*Remove # before "redirect-gateway" to route all client traffic (including web-traffic) through this VPN Server.

4. Put ca.crt and openvpn.ovpn into the config subdirectory under OpenVPN directory
(ie. C:\Program Files\OpenVPN\config\).

==============================================================================

To set up an OpenVPN client on Mac:

1. Install OpenVPN client on MAC
*An OpenVPN client on Mac OS X is called Tunnelblick.
*Download it from http://code.google.com/p/tunnelblick/ and install the client.

2. Launch Tunnelblick.

3. Click Create and open configuration folder button; a Finder window will appear with the configuration folder.

4. Edit openvpn.ovpn and replace YOUR_SERVER_IP with public IP of your DiskStation.
*If your DiskStation is behind a router, replace YOUR_SERVER_IP with the router's IP.
*Remove # before "redirect-gateway" to route all client traffic (including web-traffic) through this VPN Server.

5. Put the files of openvpn.ovpn and ca.crt into the configuration folder.

==============================================================================

To set up an OpenVPN client on Linux:

Please refer to the official documentation provided by
OpenVPN http://openvpn.net/index.php/open-source/documentation.html for more information.

And the supplied ovpn file looks like this:

dev tun
tls-client

remote YOUR_SERVER_IP 1194

# The "float" tells OpenVPN to accept authenticated packets from any address,
# not only the address which was specified in the --remote option.
# This is useful when you are connecting to a peer which holds a dynamic address
# such as a dial-in user or DHCP client.
# (Please refer to the manual of OpenVPN for more information.)

#float

# If redirect-gateway is enabled, the client will redirect it's
# default network gateway through the VPN.
# It means the VPN connection will firstly connect to the VPN Server
# and then to the internet.
# (Please refer to the manual of OpenVPN for more information.)

#redirect-gateway

# dhcp-option DNS: To set primary domain name server address.
# Repeat this option to set secondary DNS server addresses.

#dhcp-option DNS DNS_IP_ADDRESS

pull

# If you want to connect by Server's IPv6 address, you should use
# "proto udp6" in UDP mode or "proto tcp6-client" in TCP mode
proto udp

script-security 2

ca ca.crt

comp-lzo

reneg-sec 0

auth-user-pass

Now when I compare the ovpn file from Synology to the ones I have generated while setting up OpenVPN on the Raspberry Pi I am rather confused.
In my existing (and working) ovpn files I have this:

client 
dev tun 
proto udp 
remote homenetwork.com 1194 
resolv-retry infinite 
nobind 
persist-key 
persist-tun 
mute-replay-warnings 
ns-cert-type server 
key-direction 1 
cipher AES-128-CBC 
comp-lzo 
verb 1 
mute 20

<ca>
-----BEGIN CERTIFICATE-----
MIID0TCCAzqgAwIBAgIJAJiEeki3Je5sMA0GCSqGSIb3DQEBBQUAMIGiMQswCQYD
....
WUc0XNEKbJB8L0BJIg+bflWAKW6o
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
MIIEGDCCA4GgAwIBAgIBAjANBgkqhkiG9w0BAQUFADCBojELMAkGA1UEBhMCVVMx
...
cJH2VnyBL6yFUdv8mQRs1jeyegvNiEGMv8t9veuR1SeoQY4tcISEZwixRWs=
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,474F91F010934D36

4Foeg78GWojVicGmI+Iao1i2+YSGUlp7BIle9nn+Vcj0ziaSFZMJI+BHfTEZ+DFb
....
NVz/H6PvOCR8gV8usc4LWN7jURE3gudAiKNb1b59PM0=
-----END RSA PRIVATE KEY-----
</key>
<tls-auth>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
58df235853c9b76da1118fd850ee9d68
....
1b540af0749b1cb7c9118ffdc7de4e8c
-----END OpenVPN Static key V1-----
</tls-auth>

QUESTION:
How can I create ovpn files for Synology which will work on my Android devices as well as on Windows???
It seems like some info is missing from Synology, like:
<ca>
<cert>
<key>
<tls-auth>
From where can I get that (I guess that <ca> can be from the ca.crt file in the exported configuration, but from where do I get the other items?

Traffic

BobAGI wroteIt seems like some info is missing from Synology, like:
<ca>
<cert>
<key>
<tls-auth>

In your client config these options are called "inline certificates" .. they are embedded in the configuration file instead of being separate files.

On your server (Synology NAS) look in /etc/openvpn for your server config file .. it should have pointers to the files you need like "ca /etc/openvpn/ca.crt" for example.

I recommend you start reading the HOWTO as it will give you much of the information you need:
HOWTO: For OpenVPN Community Edition

BobAGI

Thanks again,
I know how to generate the client certificates and keys on the Raspberry Pi since I installed OpenVPN from scratch and made notes while doing that.
I used some script that was part of the installation sequence to do that.

But this is a different situation because the Synology OpenVPN is not installed by me except by installing a Synology provided package from the GUI with no configuration options.
It seems like their OpenVPN server solution is based on the premise of user/password login rather than certificate based login and I would rather like to use the certificates instead. Question is then how to generate the needed files....

I guess this is rather system specific so it may not belong here at all, but the reply rate over at the Synology forum on special stuff like this is not very high...
I will post a question there regarding the generation of inline certificates on the Synology OpenVPN. Hopefully I will get some response.

Traffic

Reading this:
https://help.synology.com/dsm/?section=VPNCenter&version=1.2&link=vpn_setup.html

I do not see many options for OpenVPN .. I can see no way to implement --port for example.

If the NAS has access to a console and the under lying Linux you may be able to customise it ..

Personally, I would use the NAS as pure NAS and the Pi(s) as full OpenVPN server(s).

BobAGI

I also thought that there was no easy way to change the port, but then I connected to my DiskStationManager, which recently was updated to the last version and in this version there actually are GUI settings for the port number and protocol! 🙂
You can also enable IPv6 mode.
I have yet to find how to create a ovpn file with included certificates.