Hello everybody !
I'm new here so first of all I'd like to say hello 🙂.
For last few days I've been trying to set up my OpenVPN server (installed on RaspberryPi 2, Linux raspberrypi1 4.1.17-v7+ (Raspbian Jessie)). I'd like it to route all traffic to its destination. Generally my points is to bypass public networks' port blockades but of course it's for secure browsing as well. It's not like haven't read anything so far - I'm going to show everything I've done so far. So here it is:
1. VPN server installation
sudo apt-get install openvpn
2. VPN server configuration (/etc/opnevpn/server.conf)
redirect-gateway
dev tun => dev tun0
3. iptables configuration
configuration
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE[/list][/list]
3.2 save iptables' rules
sudo iptables-save > /etc/iptables.up.rules
sudo nano /etc/network/if-pre-up.d/iptables
#!/bin/bash
/sbin/iptables-restore < /etc/iptables.up.rules
chmod +x /etc/network/if-pre-up.d/iptables
3.3 enable forwarding
vim /etc/sysctl.conf
uncomment net.ipv4.ip_forward = 1
sysctl -p
4. certificates and keys generating (easyrsa3)
4.1 configuration files
vars.example => vars
vim vars
uncomment set_var EASYRSA "/etc/easy-rsa"
uncomment set_var EASYRSA_SSL_CONF "$EASYRSA/easyrsa3/openssl1-1.0.cnf
uncomment set_var EASYRSA_PKI "$EASYRSA/pki"
uncomment set_var EASYRSA_EXT_DIR "$EASYRSA_PKI/x509-types"
4.2 CA (CN: DANIEL_CA)
./easyrsa init-pki
./easyrsa build-ca
4.3 CN: SERVER
./easyrsa gen-req UNIQUE_SERVER_SHORT_NAME nopass
4.4 CN: CLIENT1
./easyrsa gen-req UNIQUE_CLIENT_SHORT_NAME
4.5 Diffie-Hellman
./easyrsa gen-dh
5. enable port forwarding
1194
My problem is I can't even get openvpn up. By trying
ps aux | grep vpn
I see there is no openvpn process running (I try to start it with sudo openvpn --config /etc/openvpn/server.conf). By the way - can you tell me if all options set in openvpn config file are correct?
In the end I'd like to say I spent a lot of time looking for some solutions, I read lots of howto's but I'm still unable to start my server. It's not first time I'm fighting with openvpn - I tried once and i gave up - this time I'm counting on your help! 🙂
openvpn (server.conf):
local 192.168.0.27 # SWAP THIS NUMBER WITH YOUR RASPBERRY PI IP ADDRESS
dev tun
proto udp #Some people prefer to use tcp. Don't change it if you don't know.
port 1194
ca /etc/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/SERVER.crt # SWAP WITH YOUR CRT NAME
key /etc/openvpn/easy-rsa/keys/SERVER.key # SWAP WITH YOUR KEY NAME
dh /etc/openvpn/easy-rsa/keys/dh.pem # If you changed to 2048, change that here!
server 10.8.0.0 255.255.255.0
# server and remote endpoints
ifconfig 10.8.0.1 10.8.0.2
# Add route to Client routing table for the OpenVPN Server
push "route 10.8.0.1 255.255.255.255"
# Add route to Client routing table for the OpenVPN Subnet
push "route 10.8.0.0 255.255.255.0"
# your local subnet
push "route 192.168.0.0 255.255.255.0" # SWAP THE IP NUMBER WITH YOUR RASPBERRY PI IP ADDRESS
# Set primary domain name server address to the SOHO Router
# If your router does not do DNS, you can use Google DNS 8.8.8.8
push "dhcp-option DNS 192.168.0.1" # This should already match your router address and not need to be changed.
# Override the Client default gateway by using 0.0.0.0/1 and
# 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of
# overriding but not wiping out the original default gateway.
push "redirect-gateway def1"
client-to-client
duplicate-cn
keepalive 10 120
#tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
#cipher AES-128-CBC
#comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn-status.log 20
log /var/log/openvpn.log
verb 4
Daniel
