OpenVPN Installation, configuration and setup. CentOS 5 and 6 for 32 and 64bit and OpenVZ / XEN / KVM


First step is to check if tun/tap is active:
cat /dev/net/tun

If tun is active then you should see this:
cat: /dev/net/tun: File descriptor in bad state

If you see File not found you will need to enable tun/tap from the VPN control panel or ask your provider. All our VPNs come with tun/tap preinstalled.

Next is to ensure said packages are installed and setup:
yum install gcc make rpm-build autoconf.noarch zlib-devel pam-devel openssl-devel -y

Then Download LZO RPM and Configure RPMForge Repo:

Next we need to add the right repos. You can find out what version you use from using uname -a.
Linux 2.6.18-308.8.2.el5.028stab101.1 #1 SMP Sun Jun 24 20:25:35 MSD 2012 x86_64 x86_64 x86_64 GNU/Linux

x86_64 means 64 bit
x86 means 32 bit

The el5 means CentOS 5
el6 means CentOS 6

32bit Package:
CentOS 5:
CentOS 6:

64bit Package:
CentOS 5:
CentOS 6:

Build the rpm packages:
rpmbuild --rebuild lzo-1.08-4.rf.src.rpm
rpm -Uvh lzo-*.rpm
rpm -Uvh rpmforge-release*

Now we can start the fun

Install OpenVPN:
yum install openvpn -y
Copy the easy-rsa folder to /etc/openvpn/:
cp -R /usr/share/doc/openvpn-2.2.2/easy-rsa/ /etc/openvpn/

Please note on CentOS 6 we need to make a small change before you run the commands below, open up /etc/openvpn/easy-rsa/2.0/vars and edit the below line:

export KEY_CONFIG=`$EASY_RSA/whichopensslcnf $EASY_RSA`
export KEY_CONFIG=/etc/openvpn/easy-rsa/2.0/openssl-1.0.0.cnf

And save..

Now let’s create the certificate:
cd /etc/openvpn/easy-rsa/2.0
chmod 755 *
source ./vars

Build CA:
Country Name: may be filled or press enter
State or Province Name: may be filled or press enter
City: may be filled or press enter
Org Name: may be filled or press enter
Org Unit Name: may be filled or press enter
Common Name: your server hostname
Email Address: may be filled or press enter

Build key server:
./build-key-server server
Almost the same with ./ but check the changes and additional
Common Name: server
A challenge password: leave
Optional company name: fill or enter
sign the certificate: y
1 out of 1 certificate requests: y

Build Diffie Hellman (wait a moment until the process finish):
Now create your config file:
touch /etc/openvpn/server.conf

And enter the following:
port 1194 #- port
proto udp #- protocol
dev tun
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
reneg-sec 0
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
plugin /usr/share/openvpn/plugin/lib/ /etc/pam.d/login #- Comment this line if you are using FreeRADIUS
#plugin /etc/openvpn/ /etc/openvpn/radiusplugin.cnf #- Uncomment this line if you are using FreeRADIUS
push "redirect-gateway def1"
push "dhcp-option DNS"
push "dhcp-option DNS"
keepalive 5 30
status 1194.log
verb 3

Save it and start OpenVPN:
service openvpn start

Now we need to enable IP forwarding. So open the file /etc/sysctl.conf and set ‘net.ipv4.ip_forward’ to 1.
net.ipv4.ip_forward = 1

To make the changes to sysctl.conf take effect, use the following command.
sysctl -p

Route Iptables:
The rule below will work fine on xen and KVM based VPS’s but for OpenVZ use the OpenVZ iptable rule instead:
iptables -t nat -A POSTROUTING -s -o eth0 -j MASQUERADE

OpenVZ iptable rules:
iptables -t nat -A POSTROUTING -o venet0 -j SNAT --to-source
iptables -t nat -A POSTROUTING -s -j SNAT --to-source

Make sure you change to your server IP.

IF you have CSF on the same server you need to open your OpenVPN port (Usually 1194) through the firewall and run the below commands for CSF:
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -s -j ACCEPT
iptables -A FORWARD -j REJECT
iptables -t nat -A POSTROUTING -s -o eth0 -j MASQUERADE
iptables -t nat -A POSTROUTING -j SNAT --to-source

Once the rules are in place we need to save them.
service iptables save

Please note if you are using our FreeRADIUS module for WHMCS then you don’t have to do the below step for adding users just follow the link above to setup OpenVPN to auth off FreeRADIUS – otherwise you can create a user as follows:
useradd username -s /bin/false
passwd username

If you wanted to delete a user you would use:
userdel username

Now create a server.ovpn config file and enter the following:
dev tun
proto udp
remote 1194 # - Your server IP and OpenVPN Port
resolv-retry infinite
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
ca ca.crt
reneg-sec 0
verb 3

Make sure you change to your server IP.

And make sure OpenVPN starts at boot:
chkconfig openvpn on

Download ca.crt file in /etc/openvpn/easy-rsa/2.0/keys/ directory and place it in the same directory as your server.ovpn.

Now download a VPN client and import your config file and enter your username and password created above or if you have already configured OpeVPN Source with the FreeRADIUS plugin, use a username and password created in the radius database.

None found.
Share on Tumblr