I have generated the certificats by hand using EasyRSA and openSSL for server and client.
Then I have set up the server.conf and client.ovpn as follow:
Code: Select all
dev tun
proto udp
port 1194
ca ca.crt
cert server.crt
key server.key
dh dh.pem
topology subnet
server 10.8.0.0 255.255.255.0
# server and remote endpoints
ifconfig 10.8.0.1 10.8.0.2
# Add route to Client routing table for the OpenVPN Server
push "route 10.8.0.1 255.255.255.255"
# Add route to Client routing table for the OPenVPN Subnet
push "route 10.8.0.0 255.255.255.0"
# Push route in LAN to specific gateway and metric
push "route 192.168.100.0 255.255.255.0 192.168.100.1 1"
# Set your primary domin name server address for clients - Prevent DNS Leak
push "dhcp-option DNS 1.1.1.1"
push "dhcp-option DNS 1.0.0.1"
# Prevent DNS leaks on Windows
push "block-outside-dns"
# Network traffic between VPN clients
client-to-client
keepalive 1800 3600
remote-cert-tls client
tls-version-min 1.2
tls-auth ta.key 0
cipher AES-256-CBC
auth SHA256
comp-lzo # Deprecated from OpenVPN 2.5
user nobody
group nogroup
persist-key
persist-tun
crl-verify crl.pem
status-version 3
verb 1
For the VPN tunnel I used the standard OpenVPN IPv4 10.8.0.0/24.
In the follow my typical client.ovpn file:
Code: Select all
client
dev tun
proto udp
remote MY IP 1194
resolv-retry infinite
nobind
persist-key
persist-tun
key-direction 1
remote-cert-tls server
tls-version-min 1.2
cipher AES-256-CBC
auth SHA256
comp-lzo # Deprecated from OpenVPN 2.5
verb 3
<ca>
-----BEGIN CERTIFICATE-----
COPY YOUR ca.crt
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
COPY YOUR client.crt
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN RSA PRIVATE KEY-----
COPY YOUR client.key
-----END RSA PRIVATE KEY-----
</key>
<tls-auth>
-----BEGIN OpenVPN Static key V1-----
COPY YOUR ta.key
-----END OpenVPN Static key V1-----
</tls-auth>
Then I have studied some routing in macOS X ad in the following what I did.
I have modified the file /etc/pf.anchors/com.apple
I have added the following:
Code: Select all
nat-anchor "100.customNATRules/*"
rdr-anchor "100.customNATRules/*"
load anchor "100.customNATRules" from "/etc/pf.anchors/customNATRules"
Code: Select all
nat on en0 from 10.8.0.0/24 to any -> (en0)
pass from {lo0, 10.8.0.0/24} to any keep state
Code: Select all
echo 'net.inet.ip.forwarding=1' | sudo tee -a /etc/sysctl.conf
Code: Select all
sudo cp /System/Library/LaunchDaemons/com.apple.pfctl.plist /Library/LaunchDaemons/net.mylan.pfctl.plist
sudo sed -i '' 's/com.apple.pfctl/net.mylan.pfctl/' /Library/LaunchDaemons/net.mylan.pfctl.plist
sudo sed -i '' 's/>-f</>-e</' /Library/LaunchDaemons/net.mylan.pfctl.plist
sudo sed -i '' '/pf\.conf/d' /Library/LaunchDaemons/net.mylan.pfctl.plist
sudo launchctl load -w /Library/LaunchDaemons/net.mylan.pfctl.plist
Can someone help me?
In the end, if all works, I'd like post a complete guide on what I did to provide an OpenVPN server on macOS X.
Thanx.
PS: I have tried use oconf for writing the openvpn config, but don't works.