Installing OpenVPN is easy but configuring it, is very challenging and that’s why OpenVPN org provide us with scripts and then we can go ahead and our special changes
Welcome to this OpenVPN road warrior installer!
Which IPv4 address should be used?
1) 192.168.1.5
2) 172.16.1.100
3) 10.1.0.3
IPv4 address [1]: 1
This server is behind NAT. What is the public IPv4 address or hostname?
Public IPv4 address / hostname [Your-Public-IP]: 192.168.1.5
Which protocol should OpenVPN use?
1) UDP (recommended)
2) TCP
Protocol [1]:
What port should OpenVPN listen to?
Port [1194]:
Select a DNS server for the clients:
1) Current system resolvers
2) Google
3) 1.1.1.1
4) OpenDNS
5) Quad9
6) AdGuard
DNS server [1]: 2
Enter a name for the first client:
Name [client]: touk
OpenVPN installation is ready to begin.
Press any key to continue...
If you want to add more users, you have to run the script again
The needed port 1194 is going to be added on iptables automatically, if you are running UFW you won’t see the rule there and even if you create one in UFW it won’t take precedence
touk@ubuntu-server:~$ sudo iptables-save
# Generated by iptables-save v1.8.7 on Sun Sep 3 15:12:53 2023
*filter
:INPUT ACCEPT [71668:7983516]
:FORWARD ACCEPT [12272:2751669]
:OUTPUT ACCEPT [106599:9084589]
-A INPUT -p udp -m udp --dport 1194 -j ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 10.8.0.0/24 -j ACCEPT
COMMIT
# Completed on Sun Sep 3 15:12:53 2023
# Generated by iptables-save v1.8.7 on Sun Sep 3 15:12:53 2023
*nat
:PREROUTING ACCEPT [2110:172636]
:INPUT ACCEPT [469:63316]
:OUTPUT ACCEPT [322:28589]
:POSTROUTING ACCEPT [232:22084]
-A POSTROUTING -o ens33 -j MASQUERADE
-A POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to-source 192.168.1.5
COMMIT
If you want to check for it’s status,
since OpenVPN package comes with the server and client package we will have to specify the service name like this:
sudo systelctl status openvpn-server@server
touk@ubuntu-server:~$ sudo systemctl status openvpn-server@server
● openvpn-server@server.service - OpenVPN service for server
Loaded: loaded (/lib/systemd/system/openvpn-server@.service; enabled; vendor preset: enabled)
Active: active (running) since Sun 2023-09-03 15:09:50 UTC; 5min ago
Docs: man:openvpn(8)
<https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage>
<https://community.openvpn.net/openvpn/wiki/HOWTO>
Main PID: 68439 (openvpn)
Status: "Initialization Sequence Completed"
Tasks: 1 (limit: 4516)
Memory: 1.8M
CPU: 21ms
CGroup: /system.slice/system-openvpn\\x2dserver.slice/openvpn-server@server.service
└─68439 /usr/sbin/openvpn --status /run/openvpn-server/status-server.log --status-version 2 --suppress-timestamps --config serve>
Sep 03 15:09:50 ubuntu-server openvpn[68439]: Could not determine IPv4/IPv6 protocol. Using AF_INET
Sep 03 15:09:50 ubuntu-server openvpn[68439]: Socket Buffers: R=[212992->212992] S=[212992->212992]
Sep 03 15:09:50 ubuntu-server openvpn[68439]: UDPv4 link local (bound): [AF_INET]192.168.1.5:1194
Sep 03 15:09:50 ubuntu-server openvpn[68439]: UDPv4 link remote: [AF_UNSPEC]
Sep 03 15:09:50 ubuntu-server openvpn[68439]: GID set to nogroup
Sep 03 15:09:50 ubuntu-server openvpn[68439]: UID set to nobody
Sep 03 15:09:50 ubuntu-server openvpn[68439]: MULTI: multi_init called, r=256 v=256
Sep 03 15:09:50 ubuntu-server openvpn[68439]: IFCONFIG POOL IPv4: base=10.8.0.2 size=253
Sep 03 15:09:50 ubuntu-server openvpn[68439]: IFCONFIG POOL LIST
Sep 03 15:09:50 ubuntu-server openvpn[68439]: Initialization Sequence Completed
Or you can spot it from the interfaces in your system: