[Resolved] i want to open a VPN site via OpenVPN

dhruvpandit

hi there,,
i want to start a site for VPN .
i have configured VPN on my server, but now i dont know how to setup initially,
like , how to create new certificates without "clean-all" so when new customer is added, old customer's config is not damaged or changed.

also i want to know how to make config valid for 1 month only.

pls give me guideline or some "how-to" for it.

Mimiko

This is a how-to to read http://www.openvpn.net/index.php/open-source/documentation/howto.html.

dhruvpandit

Mimiko wroteThis is a how-to to read http://www.openvpn.net/index.php/open-source/documentation/howto.html.

thats good man,
but i think i have written in the post that what i need to know, you have given the standard how to link.

i need something more then that.

Mimiko

I'm a lady.

To create a new client key:
http://www.openvpn.net/index.php/open-source/documentation/howto.html#pki

build-key new_common_name

how to make config valid for 1 month only.

The client configuration is a text file and does not have a validation time. You can use certificate revoking for this purpose: http://www.openvpn.net/index.php/open-source/documentation/howto.html#revoke, manually or in a cron script.
The how-to has everything needed to a standart setup.

dhruvpandit

for example, i have created 5 users at the time of setup.

now i want to add 6th user after 10 days of setup, without effecting old user's certificates, how i can do it?

Mimiko

To add new certificates for new users, use:

./vars
./build-key client5
./build-key client6
./build-key client7

And so on.

dhruvpandit

Mimiko wroteTo add new certificates for new users, use:

./vars
./build-key client5
./build-key client6
./build-key client7

And so on.

thanks, it works fine now 🙂

delirium

Or simply use an interface wherein you can automatically suspend the user in a certain number of days.

well, at least it worked on my setup 🙂

dhruvpandit

delirium wroteOr simply use an interface wherein you can automatically suspend the user in a certain number of days.

well, at least it worked on my setup 🙂

where can i get interface like that?

do you have any GUI for OpenVPN certificates management?

also, i am curruntly giving UDP 53 port .

but now i also want to offer UDP 9200 port ( with lport 53) . what should i change in my server config and client configs?

dhruvpandit

also,
when i am trying to revoke the configs, then this error comes

Using configuration from /etc/openvpn/easy-rsa/2.0/openssl.cnf
CA certificate and CA private key do not match
19730:error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch:x509_cmp.c:398:
Using configuration from /etc/openvpn/easy-rsa/2.0/openssl.cnf
CA certificate and CA private key do not match
19731:error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch:x509_cmp.c:398:
demo20.crt: /C=US/ST=CA/L=SanFrancisco/O=Fort-Funston/CN=demo20/emailAddress=me@myhost.mydomain
error 20 at 0 depth lookup:unable to get local issuer certificate

delirium

I don't have GUI for certificates management. I just let my users run using a single certificate. I found it to be a tedious process to provide them with individual certificates.

Instead, I had them authenticated through username/password combo. Which is, then, managed with a GUI wherein I can control the authentication through - created /suspend/delete. And is also partially automated on monthly, quarterly, semi-annually, to annual subscriptions.

Through that, I don't have to revoke certificates every now and then.

dhruvpandit

delirium wroteI don't have GUI for certificates management. I just let my users run using a single certificate. I found it to be a tedious process to provide them with individual certificates.

Instead, I had them authenticated through username/password combo. Which is, then, managed with a GUI wherein I can control the authentication through - created /suspend/delete. And is also partially automated on monthly, quarterly, semi-annually, to annual subscriptions.

Through that, I don't have to revoke certificates every now and then.

thats a cool idea.

can you PM me your server / client configs??

and where to add pass/user?

delirium

The server and client configs I used are quite basic. You can find it here in the forums. Almost nothing was changed with those.

I can, maybe - and just for a note, I am not an expert - guide you through. If you have msn or yahoo messenger.

Mimiko

The GUI has OpenVPN AS. It's a good management on having one certificate and users authenticate with username and password.

dhruvpandit

but as per my knowledge, OpenVPN AS has only 2 certificates for free.
then can i give that certificates to my all clients??

also, can i run OpenVPN and OpenVPN AS on same server with same ports??

and is lport option is available in AS?

btw, thanks for support.

Mimiko

Yes, OpenVPN AS has only 2 free connection. The paying is for automation done by people.

You can't run to OpenVPN on same port and ip. OpenVPN AS generates certificates authomatically. "lport" is also available in AS.

dhruvpandit

i have taken another server now.

so how can i offer my customers two servers with same certificates??

can i copy whole " 2.0 " folder to my new server? will it work?
i just want to avoid new certificate distribution, i can distribute .opvn file easily.

Mimiko

Yes, you can duplicate the OpenVPN configuration with same certificates by copying them.

dhruvpandit

that works fine .
thanks a lot.

can we restrict users from downloading torrent via OpenVPN?
as i want to restrict them torrenting on one server.

dhruvpandit

also, when i do ./revoke-full client28.

it shows error 23 (means revoke done fine.)
but still they can use the same configs.

means, revoke of certificates are not being done.
pls help me for this problem.