I'm using the script from this repo https://github.com/angristan/openvpn-install.
I would like to install openvpn on a CentOS 7 from the provider ovh.com. I tested other provider (scaleway, hetzner) with the script and everything is running.
I used these two commands before running the script :
curl -O https://raw.githubusercontent.com/Angristan/openvpn-install/master/openvpn-install.sh
chmod +x openvpn-install.sh
Here is the installation process, it seems like there is no error and everything is installed.
[root@test-vpn ~]# ./openvpn-install.sh
Welcome to the OpenVPN installer!
The git repository is available at: https://github.com/angristan/openvpn-install
I need to ask you a few questions before starting the setup.
You can leave the default options and just press enter if you are ok with them.
I need to know the IPv4 address of the network interface you want OpenVPN listening to.
Unless your server is behind NAT, it should be your public IPv4 address.
IP address: PUBLICIP
Checking for IPv6 connectivity...
Your host does not appear to have IPv6 connectivity.
Do you want to enable IPv6 support (NAT)? [y/n]: n
What port do you want OpenVPN to listen to?
1) Default: 1194
2) Custom
3) Random [49152-65535]
Port choice [1-3]: 1
What protocol do you want OpenVPN to use?
UDP is faster. Unless it is not available, you shouldn't use TCP.
1) UDP
2) TCP
Protocol [1-2]: 1
What DNS resolvers do you want to use with the VPN?
1) Current system resolvers (from /etc/resolv.conf)
2) Self-hosted DNS Resolver (Unbound)
3) Cloudflare (Anycast: worldwide)
4) Quad9 (Anycast: worldwide)
5) Quad9 uncensored (Anycast: worldwide)
6) FDN (France)
7) DNS.WATCH (Germany)
8) OpenDNS (Anycast: worldwide)
9) Google (Anycast: worldwide)
10) Yandex Basic (Russia)
11) AdGuard DNS (Russia)
DNS [1-10]: 3
Do you want to use compression? It is not recommended since the VORACLE attack make use of it.
Enable compression? [y/n]: n
Do you want to customize encryption settings?
Unless you know what you're doing, you should stick with the default parameters provided by the script.
Note that whatever you choose, all the choices presented in the script are safe. (Unlike OpenVPN's defaults)
See https://github.com/angristan/openvpn-install#security-and-encryption to learn more.
Customize encryption settings? [y/n]: n
Okay, that was all I needed. We are ready to setup your OpenVPN server now.
You will be able to generate a client at the end of the installation.
Press any key to continue...
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
* epel: ftp.icm.edu.pl
Package epel-release-7-11.noarch already installed and latest version
Nothing to do
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
* epel: ftp.icm.edu.pl
Package iptables-1.4.21-28.el7.x86_64 already installed and latest version
Package 1:openssl-1.0.2k-16.el7_6.1.x86_64 already installed and latest version
Package wget-1.14-18.el7.x86_64 already installed and latest version
Package ca-certificates-2018.2.22-70.0.el7_5.noarch already installed and latest version
Package curl-7.29.0-51.el7.x86_64 already installed and latest version
Resolving Dependencies
--> Running transaction check
---> Package openvpn.x86_64 0:2.4.7-1.el7 will be installed
--> Finished Dependency Resolution
Dependencies Resolved
=============================================================================================================================================================================================================================================
Package Arch Version Repository Size
=============================================================================================================================================================================================================================================
Installing:
openvpn x86_64 2.4.7-1.el7 epel 522 k
Transaction Summary
=============================================================================================================================================================================================================================================
Install 1 Package
Total download size: 522 k
Installed size: 1.2 M
Downloading packages:
openvpn-2.4.7-1.el7.x86_64.rpm | 522 kB 00:00:00
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
Installing : openvpn-2.4.7-1.el7.x86_64 1/1
Verifying : openvpn-2.4.7-1.el7.x86_64 1/1
Installed:
openvpn.x86_64 0:2.4.7-1.el7
Complete!
--2019-03-25 10:35:22-- https://github.com/OpenVPN/easy-rsa/releases/download/v3.0.6/EasyRSA-unix-v3.0.6.tgz
Resolving github.com (github.com)... 140.82.118.3, 140.82.118.4
Connecting to github.com (github.com)|140.82.118.3|:443... connected.
HTTP request sent, awaiting response... 302 Found
Location: https://github-production-release-asset-2e65be.s3.amazonaws.com/4519663/8d46db80-266e-11e9-85e3-7de4dbee40d9?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20190325%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20190325T093522Z&X-Amz-Expires=300&X-Amz-Signature=b5122b80fd88b4159ec31b5b475f0c894e179ef702b2a30f217e182a136a3ede&X-Amz-SignedHeaders=host&actor_id=0&response-content-disposition=attachment%3B%20filename%3DEasyRSA-unix-v3.0.6.tgz&response-content-type=application%2Foctet-stream [following]
--2019-03-25 10:35:22-- https://github-production-release-asset-2e65be.s3.amazonaws.com/4519663/8d46db80-266e-11e9-85e3-7de4dbee40d9?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20190325%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20190325T093522Z&X-Amz-Expires=300&X-Amz-Signature=b5122b80fd88b4159ec31b5b475f0c894e179ef702b2a30f217e182a136a3ede&X-Amz-SignedHeaders=host&actor_id=0&response-content-disposition=attachment%3B%20filename%3DEasyRSA-unix-v3.0.6.tgz&response-content-type=application%2Foctet-stream
Resolving github-production-release-asset-2e65be.s3.amazonaws.com (github-production-release-asset-2e65be.s3.amazonaws.com)... 52.216.236.139
Connecting to github-production-release-asset-2e65be.s3.amazonaws.com (github-production-release-asset-2e65be.s3.amazonaws.com)|52.216.236.139|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 40840 (40K) [application/octet-stream]
Saving to: ‘/root/EasyRSA-unix-v3.0.6.tgz’
100%[===================================================================================================================================================================================================>] 40,840 184KB/s in 0.2s
2019-03-25 10:35:24 (184 KB/s) - ‘/root/EasyRSA-unix-v3.0.6.tgz’ saved [40840/40840]
Note: using Easy-RSA configuration from: ./vars
init-pki complete; you may now create a CA or requests.
Your newly created PKI dir is: /etc/openvpn/easy-rsa/pki
read EC key
writing EC key
Note: using Easy-RSA configuration from: ./vars
Using SSL: openssl OpenSSL 1.0.2k-fips 26 Jan 2017
Generating a 256 bit EC private key
writing new private key to '/etc/openvpn/easy-rsa/pki/private/server_jmhEBa3QQB6084uZ.key.g9TJ0WqgEZ'
-----
Using configuration from /etc/openvpn/easy-rsa/pki/safessl-easyrsa.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName :ASN.1 12:'server_jmhEBa3QQB6084uZ'
Certificate is to be certified until Mar 9 09:35:24 2022 GMT (1080 days)
Write out database with 1 new entries
Data Base Updated
Note: using Easy-RSA configuration from: ./vars
Using SSL: openssl OpenSSL 1.0.2k-fips 26 Jan 2017
Using configuration from /etc/openvpn/easy-rsa/pki/safessl-easyrsa.cnf
An updated CRL has been created.
CRL file: /etc/openvpn/easy-rsa/pki/crl.pem
* Applying /usr/lib/sysctl.d/00-system.conf ...
* Applying /usr/lib/sysctl.d/10-default-yama-scope.conf ...
kernel.yama.ptrace_scope = 0
* Applying /etc/sysctl.d/20-openvpn.conf ...
net.ipv4.ip_forward = 1
* Applying /usr/lib/sysctl.d/50-default.conf ...
kernel.sysrq = 16
kernel.core_uses_pid = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.accept_source_route = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.promote_secondaries = 1
net.ipv4.conf.all.promote_secondaries = 1
fs.protected_hardlinks = 1
fs.protected_symlinks = 1
* Applying /etc/sysctl.d/99-sysctl.conf ...
* Applying /etc/sysctl.conf ...
Created symlink from /etc/systemd/system/multi-user.target.wants/openvpn@server.service to /etc/systemd/system/openvpn@.service.
mkdir: cannot create directory ‘/etc/iptables’: File exists
Created symlink from /etc/systemd/system/multi-user.target.wants/iptables-openvpn.service to /etc/systemd/system/iptables-openvpn.service.
Tell me a name for the client.
Use one word only, no special characters.
Client name: test
Do you want to protect the configuration file with a password?
(e.g. encrypt the private key with a password)
1) Add a passwordless client
2) Use a password for the client
Select an option [1-2]: 1
Note: using Easy-RSA configuration from: ./vars
Using SSL: openssl OpenSSL 1.0.2k-fips 26 Jan 2017
Generating a 256 bit EC private key
writing new private key to '/etc/openvpn/easy-rsa/pki/private/test.key.0GWBUmkgcA'
-----
Using configuration from /etc/openvpn/easy-rsa/pki/safessl-easyrsa.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName :ASN.1 12:'test'
Certificate is to be certified until Mar 9 09:35:28 2022 GMT (1080 days)
Write out database with 1 new entries
Data Base Updated
Client test added, the configuration file is available at /home/root/test.ovpn.
Download the .ovpn file and import it in your OpenVPN client.
TUN is also enabled :
[root@test-vpn ~]# lsmod | grep tun
tun 31740 2
[root@test-vpn ~]#
The status of the server :
[root@test-vpn ~]# systemctl status openvpn@server
openvpn@server.service - OpenVPN Robust And Highly Flexible Tunneling Application On server
Loaded: loaded (/etc/systemd/system/openvpn@.service; enabled; vendor preset: disabled)
Active: active (running) since Mon 2019-03-25 10:35:24 CET; 8min ago
Main PID: 26218 (openvpn)
Status: "Initialization Sequence Completed"
CGroup: /system.slice/system-openvpn.slice/openvpn@server.service
└─26218 /usr/sbin/openvpn --cd /etc/openvpn/ --config server.conf
Mar 25 10:35:24 test-vpn openvpn[26218]: Mon Mar 25 10:35:24 2019 Could not determine IPv4/IPv6 protocol. Using AF_INET
Mar 25 10:35:24 test-vpn openvpn[26218]: Mon Mar 25 10:35:24 2019 Socket Buffers: R=[212992->212992] S=[212992->212992]
Mar 25 10:35:24 test-vpn openvpn[26218]: Mon Mar 25 10:35:24 2019 UDPv4 link local (bound): [AF_INET][undef]:1194
Mar 25 10:35:24 test-vpn openvpn[26218]: Mon Mar 25 10:35:24 2019 UDPv4 link remote: [AF_UNSPEC]
Mar 25 10:35:24 test-vpn openvpn[26218]: Mon Mar 25 10:35:24 2019 GID set to nobody
Mar 25 10:35:24 test-vpn openvpn[26218]: Mon Mar 25 10:35:24 2019 UID set to nobody
Mar 25 10:35:24 test-vpn openvpn[26218]: Mon Mar 25 10:35:24 2019 MULTI: multi_init called, r=256 v=256
Mar 25 10:35:24 test-vpn openvpn[26218]: Mon Mar 25 10:35:24 2019 IFCONFIG POOL: base=10.8.0.2 size=252, ipv6=0
Mar 25 10:35:24 test-vpn openvpn[26218]: Mon Mar 25 10:35:24 2019 IFCONFIG POOL LIST
Mar 25 10:35:24 test-vpn openvpn[26218]: Mon Mar 25 10:35:24 2019 Initialization Sequence Completed
Here is my server.conf file :
port 1194
proto udp
dev tun
user nobody
group nobody
persist-key
persist-tun
keepalive 10 120
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 1.0.0.1"
push "dhcp-option DNS 1.1.1.1"
push "redirect-gateway def1 bypass-dhcp"
dh none
ecdh-curve prime256v1
tls-crypt tls-crypt.key 0
crl-verify crl.pem
ca ca.crt
cert server_jmhEBa3QQB6084uZ.crt
key server_jmhEBa3QQB6084uZ.key
auth SHA256
cipher AES-128-GCM
ncp-ciphers AES-128-GCM
tls-server
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
status /var/log/openvpn/status.log
verb 3
Client file :
client
proto udp
remote PUBLICIP 1194
dev tun
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
verify-x509-name server_jmhEBa3QQB6084uZ name
auth SHA256
auth-nocache
cipher AES-128-GCM
tls-client
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
setenv opt block-outside-dns # Prevent Windows 10 DNS leak
verb 3
<ca>
-----BEGIN CERTIFICATE-----
MIIBwjCCAWegAwIBAgIJAMuAkeZ9oSFPMAoGCCqGSM49BAMCMB4xHDAaBgNVBAMM
E2NuX2taNndyclc0TGpDUFlnUk4wHhcNMTkwMzI1MDkzNTI0WhcNMjkwMzIyMDkz
NTI0WjAeMRwwGgYDVQQDDBNjbl9rWjZ3cnJXNExqQ1BZZ1JOMFkwEwYHKoZIzj0C
AQYIKoZIzj0DAQcDQgAEhPvq6q4LYrDg6WBdCFnQ+MhobnsvKNMKtUXOHIdjhuOE
ZENn+3a6+ALbRFyH6SvbP315s5RkEo4ave4HozZCn6OBjTCBijAdBgNVHQ4EFgQU
8oRqpweWPSIpjwG2oux+3wy59iQwTgYDVR0jBEcwRYAU8oRqpweWPSIpjwG2oux+
3wy59iShIqQgMB4xHDAaBgNVBAMME2NuX2taNndyclc0TGpDUFlnUk6CCQDLgJHm
faEhTzAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBBjAKBggqhkjOPQQDAgNJADBG
AiEA2CvzcqEiMIa/IeXZiGxgui3Z2IiX/LXAmcPWMU08IusCIQDv91obVWSyZd2C
VI9ynvsvO/c55YQfu5DxfduCVbpdTQ==
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
MIIByjCCAXGgAwIBAgIQM3mCLn9Q/p3+/SsU+37WCTAKBggqhkjOPQQDAjAeMRww
GgYDVQQDDBNjbl9rWjZ3cnJXNExqQ1BZZ1JOMB4XDTE5MDMyNTA5MzUyOFoXDTIy
MDMwOTA5MzUyOFowDzENMAsGA1UEAwwEdGVzdDBZMBMGByqGSM49AgEGCCqGSM49
AwEHA0IABJO0H/FoPKmu9EfZsGDPFnqxWUzKQPh47Ce38S13yH/I+6f0XR5T/5La
9S3HcCad0IND2yG/5nGuY+7QE83KQ5WjgZ8wgZwwCQYDVR0TBAIwADAdBgNVHQ4E
FgQUcFWujiJUUTpdPfaLziAybRhICiUwTgYDVR0jBEcwRYAU8oRqpweWPSIpjwG2
oux+3wy59iShIqQgMB4xHSAaBgNVBAMME2NuX2taNndyclc0TGpDUFlnUk6CCQDL
gJHmfaEhTzATBgNVHSUEDDAKBggrBgEFBQcDAjALBgNVHQ8EBAMCB4AwCgYIKoZI
zj0EAwIDRwAwRAIgClLMYWPOZnFTX2jX0Nsv8mXhr2cpTSjGQOFtbIxj1PcCICXf
TLs/4fXhrGoVlqECdz3ADuwi0kDwz9nx+86yfodK
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgj/n5GG6IGO6M2jP9
zSmxFTKDyVWDmnRDEq24k7lqZIKhRANCAASTtB/xaDyprvRH2bBgzxZ6sVlMykD4
eOwnt/Etd8h/yPun9F0eU/+S2vUtx3AmndCDQ9shv+ZxrmPu0BPNykOV
-----END PRIVATE KEY-----
</key>
<tls-crypt>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
81aae2eaa47af6b29d6d3e8672c94daa
906a7aa960ca5af1ed581b58094cea8b
71e5d7a455b1e785f217a5b772129848
56a4bea69449479ac4b575d50f0e75c7
a8760909e660578ea9a56c9fdfa23725
06b17bdbc5ed200750331b0965e7192b
4e724652c1114536a39ee71d5e041110
f0ebe6889a55a8a9e6f21fc9b44d41ee
45b188b1178a2bf2030d911f63a86569
8b77ad481a6634d4e37dc2b461329737
207fd340d71eee0418ab633f027ea197
2c7976f3bf38b3a96b41bf5c08fb4f96
03ae3b4f94580f42b3fe1ac65fc31452
6f4af33d8c06a036d4caa4576e7f3116
0cf4c74739653a8ae17066f31b4e2522
633dc4d42c24804e3d42b7d59a5680e4
-----END OpenVPN Static key V1-----
</tls-crypt>
Client error :
Mon Mar 25 10:47:23 2019 OpenVPN 2.4.6 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Apr 26 2018
Mon Mar 25 10:47:23 2019 Windows version 6.1 (Windows 7) 64bit
Mon Mar 25 10:47:23 2019 library versions: OpenSSL 1.1.0h 27 Mar 2018, LZO 2.10
Mon Mar 25 10:47:23 2019 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Mon Mar 25 10:47:23 2019 Need hold release from management interface, waiting...
Mon Mar 25 10:47:24 2019 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Mon Mar 25 10:47:24 2019 MANAGEMENT: CMD 'state on'
Mon Mar 25 10:47:24 2019 MANAGEMENT: CMD 'log all on'
Mon Mar 25 10:47:24 2019 MANAGEMENT: CMD 'echo all on'
Mon Mar 25 10:47:24 2019 MANAGEMENT: CMD 'bytecount 5'
Mon Mar 25 10:47:24 2019 MANAGEMENT: CMD 'hold off'
Mon Mar 25 10:47:24 2019 MANAGEMENT: CMD 'hold release'
Mon Mar 25 10:47:24 2019 Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Mon Mar 25 10:47:24 2019 Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Mon Mar 25 10:47:24 2019 Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Mon Mar 25 10:47:24 2019 Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Mon Mar 25 10:47:24 2019 TCP/UDP: Preserving recently used remote address: [AF_INET]PUBLICIP:1194
Mon Mar 25 10:47:24 2019 Socket Buffers: R=[8192->8192] S=[8192->8192]
Mon Mar 25 10:47:24 2019 UDP link local: (not bound)
Mon Mar 25 10:47:24 2019 UDP link remote: [AF_INET]PUBLICIP:1194
Mon Mar 25 10:47:24 2019 MANAGEMENT: >STATE:1553507244,WAIT,,,,,,
Mon Mar 25 10:48:24 2019 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Mon Mar 25 10:48:24 2019 TLS Error: TLS handshake failed
Mon Mar 25 10:48:24 2019 SIGUSR1[soft,tls-error] received, process restarting
Mon Mar 25 10:48:24 2019 MANAGEMENT: >STATE:1553507304,RECONNECTING,tls-error,,,,,
And
ip a
output :
[root@test-vpn ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether fa:16:3e:18:a6:05 brd ff:ff:ff:ff:ff:ff
inet PUBLICIP/32 brd PUBLICIP scope global noprefixroute dynamic eth0
valid_lft 84380sec preferred_lft 84380sec
inet6 fe80::f816:3eff:fe18:a605/64 scope link
valid_lft forever preferred_lft forever
4: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 100
link/none
inet 10.8.0.1/24 brd 10.8.0.255 scope global tun0
valid_lft forever preferred_lft forever
inet6 fe80::cf7c:bda:767f:370d/64 scope link flags 800
valid_lft forever preferred_lft forever
Output of `sysctl --system`
[root@test-vpn mat]# sysctl --system
* Applying /usr/lib/sysctl.d/00-system.conf ...
* Applying /usr/lib/sysctl.d/10-default-yama-scope.conf ...
kernel.yama.ptrace_scope = 0
* Applying /etc/sysctl.d/20-openvpn.conf ...
net.ipv4.ip_forward = 1
* Applying /usr/lib/sysctl.d/50-default.conf ...
kernel.sysrq = 16
kernel.core_uses_pid = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.accept_source_route = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.promote_secondaries = 1
net.ipv4.conf.all.promote_secondaries = 1
fs.protected_hardlinks = 1
fs.protected_symlinks = 1
* Applying /etc/sysctl.d/99-sysctl.conf ...
* Applying /etc/sysctl.conf ...
What I got from the log server :
[root@test-vpn openvpn]# tail /var/log/openvpn.log
Mon Mar 25 11:46:13 2019 library versions: OpenSSL 1.0.2k-fips 26 Jan 2017, LZO 2.06
Mon Mar 25 11:46:13 2019 TUN/TAP device tun0 opened
Mon Mar 25 11:46:13 2019 /sbin/ip link set dev tun0 up mtu 1500
Mon Mar 25 11:46:13 2019 /sbin/ip addr add dev tun0 10.8.0.1/24 broadcast 10.8.0.255
Mon Mar 25 11:46:13 2019 Could not determine IPv4/IPv6 protocol. Using AF_INET
Mon Mar 25 11:46:13 2019 UDPv4 link local (bound): [AF_INET][undef]:1194
Mon Mar 25 11:46:13 2019 UDPv4 link remote: [AF_UNSPEC]
Mon Mar 25 11:46:13 2019 GID set to nobody
Mon Mar 25 11:46:13 2019 UID set to nobody
Mon Mar 25 11:46:13 2019 Initialization Sequence Completed
Thanks you for any advice
