Ubuntu 18.04 LTS Set Up OpenVPN Server In 5 Minutes

ADVERTISEMENTS



Procedure: Ubuntu 18.04 LTS Set Up OpenVPN Server In 5 Minutes

I am a new Ubuntu Linux 18.04 LTS server user. How do I set up an OpenVPN Server on Ubuntu Linux version 18.04 LTS server to shield my browsing activity from bad guys on public Wi-Fi, and more?OpenVPN is a full-featured SSL VPN (virtual private network). It implements OSI layer 2 or 3 secure network extension using the SSL/TLS protocol. It is an open source software and distributed under the GNU GPL. A VPN allows you to connect securely to an insecure public network such as wifi network at the airport or hotel. VPN is also required to access your corporate or enterprise or home server resources. You can bypass the geo-blocked site and increase your privacy or safety online. This tutorial provides step-by-step instructions for configuring an OpenVPN server on Ubuntu Linux 18.04 LTS server.

The steps are as follows:

Step 1 – Update your system

Run the apt command/apt-get command:

$ sudo apt update

$ sudo apt upgrade

Step 2 – Find and note down your IP address

Use the ip command as follows:

$ ip a

$ ip a show eth0



$ dig +short myip.opendns.com @resolver1.opendns.com

dig TXT +short o-o.myaddr.l.google.com @ns1.google.com | awk -F'"' '{ print $2}'

A note about IP address

Another option is to run the following dig command host command to find out your public IP address from Linux command line OR

Most cloud servers have two types of IP address:

Public static IP address directly assigned to your box and routed from the Internet. For example, Linode, Digital Ocean, and others gives you direct public IP address. Private static IP address directly attached to your server and your server is behind NAT with public IP address. For example, AWS EC2/Lightsail give you this kind of NAT public IP address.

The script will automatically detect your networking setup. All you have to do is provide correct IP address when asked for it.

Step 3 – Download and run openvpn-install.sh script

I am going to use the wget command:

$ wget https://git.io/vpn -O openvpn-install.sh



$ chmod +x openvpn-install.sh

$ vim openvpn-install.sh

Run openvpn-install.sh to install OpenVPN server

Setup permissions using the chmod command:One can view the script using a text editor such as nano/vim:

Now all you have to do is:

$ sudo ./openvpn-install.sh

Sample session from AWS/Lightsail where my cloud server is behind NAT:



direct public IPv4 address

How do I start/stop/restart OpenVPN server on Ubuntu 18.04 LTS?

Sample session fromTo avoid problem always choose DNS as 1.1.1.1 or Google DNS. Those are fast DNS server and reached from anywhere on the Internet.

We need to use the systemctl command:

$ sudo systemctl stop openvpn-server@server.service # <--- stop server

$ sudo systemctl start openvpn-server@server.service # <--- start server

$ sudo systemctl restart openvpn-server@server.service # <--- restart server

$ sudo systemctl status openvpn-server@server.service # <--- get server status

● openvpn@server.service - OpenVPN connection to server Loaded: loaded (/etc/systemd/system/openvpn@.service; enabled; vendor preset: enabled) Active: active (running) since Sat 2020-08-08 04:12:49 UTC; 1 weeks 0 days ago Docs: man:openvpn(8) https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage https://community.openvpn.net/openvpn/wiki/HOWTO Main PID: 2344 (openvpn) Status: "Initialization Sequence Completed" Tasks: 1 (limit: 2282) Memory: 1.7M CGroup: /system.slice/system-openvpn.slice/openvpn@server.service └─2344 /usr/sbin/openvpn --daemon ovpn-server --status /run/openvpn/server.status 10 --cd /etc/openvpn --script-security 2 --config /etc/openvpn/server.conf --writepid /run/openvpn/server.pid Aug 15 08:11:12 sg-vpn-1 ovpn-server[2344]: 13.x.yyy.zzz:47582 peer info: IV_TCPNL=1 Aug 15 08:11:12 sg-vpn-1 ovpn-server[2344]: 13.x.yyy.zzz:47582 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 256 bit EC, curve: prime256v1 Aug 15 08:11:12 sg-vpn-1 ovpn-server[2344]: 13.x.yyy.zzz:47582 [LinuxDesktopSG1] Peer Connection Initiated with [AF_INET]13.x.yyy.zzz:47582 Aug 15 08:11:12 sg-vpn-1 ovpn-server[2344]: LinuxDesktopSG1/13.x.yyy.zzz:47582 MULTI_sva: pool returned IPv4=10.8.0.3, IPv6=(Not enabled) Aug 15 08:11:12 sg-vpn-1 ovpn-server[2344]: LinuxDesktopSG1/13.x.yyy.zzz:47582 MULTI: Learn: 10.8.0.3 -> LinuxDesktopSG1/13.x.yyy.zzz:47582 Aug 15 08:11:12 sg-vpn-1 ovpn-server[2344]: LinuxDesktopSG1/13.x.yyy.zzz:47582 MULTI: primary virtual IP for LinuxDesktopSG1/13.x.yyy.zzz:47582: 10.8.0.3 Aug 15 08:11:13 sg-vpn-1 ovpn-server[2344]: LinuxDesktopSG1/13.x.yyy.zzz:47582 PUSH: Received control message: 'PUSH_REQUEST' Aug 15 08:11:13 sg-vpn-1 ovpn-server[2344]: LinuxDesktopSG1/13.x.yyy.zzz:47582 SENT CONTROL [LinuxDesktopSG1]: 'PUSH_REPLY,dhcp-option DNS 10.8.0.1,redirect-gateway def1 bypass-dhcp,route-gateway 10.8.0.1,topology subnet,pin> Aug 15 08:11:13 sg-vpn-1 ovpn-server[2344]: LinuxDesktopSG1/13.x.yyy.zzz:47582 Outgoing Data Channel: Cipher 'AES-128-GCM' initialized with 128 bit key Aug 15 08:11:13 sg-vpn-1 ovpn-server[2344]: LinuxDesktopSG1/13.x.yyy.zzz:47582 Incoming Data Channel: Cipher 'AES-128-GCM' initialized with 128 bit key

Step 4 – Connect an OpenVPN server using IOS/Android/Linux/Windows client

On server your will find a client configuration file called ~/desktop.ovpn. All you have to do is copy this file to your local desktop using the scp command:

$ scp vivek@104.20.187.5:~/deskcop.ovpn .

Next, provide this file to your OpenVPN client to connect:

Linux Desktop: OpenVPN client configuration

First, install the openvpn client for your desktop, enter:

$ sudo yum install openvpn

OR

$ sudo apt install openvpn

Next, copy desktop.ovpn as follows:

$ sudo cp desktop.ovpn /etc/openvpn/client.conf

Test connectivity from the CLI:

$ sudo openvpn --client --config /etc/openvpn/desktop.conf

Your Linux system will automatically connect when computer restart using openvpn script/service:

$ sudo systemctl start openvpn@client #

Step 5 - Verify/test the connectivity

Execute the following commands after connecting to OpenVPN server from your Linux desktop:

$ ping 10.8.0.1 #Ping to the OpenVPN server gateway

$ ip route #Make sure routing setup working

$ dig TXT +short o-o.myaddr.l.google.com @ns1.google.com #Must return public IP address of OpenVPN server

Step 6 - Adding or removing OpenVPN client

Log in to your server and run the script again:

$ sudo ./openvpn-install.sh

OpenVPN is already installed. Select an option: 1) Add a new client 2) Revoke an existing client 3) Remove OpenVPN 4) Exit Option:

Use option number 1 to add a new client and option number 2 to remove or revoke an existing OpenVPN client from the server.

A note about trouble shooting OpenVPN server and client issues

Check OpenVPN server for errors using the jourlctl command:

$ sudo journalctl --identifier openvpn

## OR filter it using the grep command/egrep command

$ sudo journalctl -x -e | grep -i 'error'

$ sudo journalctl -x -e | egrep -i 'error|warn|your_ip_here'

$ sudo journalctl -xe -u openvpn-server@server.service



$ cat /etc/systemd/system/openvpn-iptables.service

[ Unit ] Before =network.target [ Service ] Type =oneshot ExecStart = / sbin / iptables -t nat -A POSTROUTING -s 10.8.0.0 / 24 ! -d 10.8.0.0 / 24 -j SNAT --to 172 .xxx.yyy.zzz ExecStart = / sbin / iptables -I INPUT -p udp --dport 1194 -j ACCEPT ExecStart = / sbin / iptables -I FORWARD -s 10.8.0.0 / 24 -j ACCEPT ExecStart = / sbin / iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT ExecStop = / sbin / iptables -t nat -D POSTROUTING -s 10.8.0.0 / 24 ! -d 10.8.0.0 / 24 -j SNAT --to 172 .xxx.yyy.zzz ExecStop = / sbin / iptables -D INPUT -p udp --dport 1194 -j ACCEPT ExecStop = / sbin / iptables -D FORWARD -s 10.8.0.0 / 24 -j ACCEPT ExecStop = / sbin / iptables -D FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT ExecStart = / sbin / ip6tables -t nat -A POSTROUTING -s fddd: 1194 : 1194 : 1194 :: / 64 ! -d fddd: 1194 : 1194 : 1194 :: / 64 -j SNAT --to 2600 :xxxx::yyyy:zzzz:dddd:cccc ExecStart = / sbin / ip6tables -I FORWARD -s fddd: 1194 : 1194 : 1194 :: / 64 -j ACCEPT ExecStart = / sbin / ip6tables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT ExecStop = / sbin / ip6tables -t nat -D POSTROUTING -s fddd: 1194 : 1194 : 1194 :: / 64 ! -d fddd: 1194 : 1194 : 1194 :: / 64 -j SNAT --to 2600 :xxxx::yyyy:zzzz:dddd:cccc ExecStop = / sbin / ip6tables -D FORWARD -s fddd: 1194 : 1194 : 1194 :: / 64 -j ACCEPT ExecStop = / sbin / ip6tables -D FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT RemainAfterExit = yes [ Install ] WantedBy =multi-user.target [Unit] Before=network.target [Service] Type=oneshot ExecStart=/sbin/iptables -t nat -A POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to 172.xxx.yyy.zzz ExecStart=/sbin/iptables -I INPUT -p udp --dport 1194 -j ACCEPT ExecStart=/sbin/iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT ExecStart=/sbin/iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT ExecStop=/sbin/iptables -t nat -D POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to 172.xxx.yyy.zzz ExecStop=/sbin/iptables -D INPUT -p udp --dport 1194 -j ACCEPT ExecStop=/sbin/iptables -D FORWARD -s 10.8.0.0/24 -j ACCEPT ExecStop=/sbin/iptables -D FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT ExecStart=/sbin/ip6tables -t nat -A POSTROUTING -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to 2600:xxxx::yyyy:zzzz:dddd:cccc ExecStart=/sbin/ip6tables -I FORWARD -s fddd:1194:1194:1194::/64 -j ACCEPT ExecStart=/sbin/ip6tables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT ExecStop=/sbin/ip6tables -t nat -D POSTROUTING -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to 2600:xxxx::yyyy:zzzz:dddd:cccc ExecStop=/sbin/ip6tables -D FORWARD -s fddd:1194:1194:1194::/64 -j ACCEPT ExecStop=/sbin/ip6tables -D FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT RemainAfterExit=yes [Install] WantedBy=multi-user.target

Is firewall rule setup correctly on your server? Use the cat command to see rules:

Of course, we check status of the iptables rules that required for OpenVPN using the following command:

$ sudo systemctl status openvpn-iptables.service

If not running or failed start it:

$ sudo systemctl start openvpn-iptables.service

Another option is to run iptables command and sysctl command commands to verify NAT rule setup on your server:

$ sudo iptables -t nat -L -n -v

$ sysctl net.ipv4.ip_forward



$ sudo systemctl start openvpn-iptables.service

$ sudo sysctl -w net.ipv4.ip_forward=1

$ netstat -tulpn | grep :1194 ## 1194 is the openvpn server port ##

$ ss -tulpn | grep :1194 ## 1194 is the openvpn server port ##

$ ps aux | grep openvpn ## is the openvpn server running? ##

$ ps -C openvpn ## is the openvpn server running? ##

$ pidof openvpn ## find the openvpn server PID ##

$ sudo systemctl restart openvpn@server

$ sudo systemctl status openvpn@server

$ nc -vu 104.20.187.5 1194

Connection to 104.20.187.5 1194 port [udp/openvpn] succeeded!

Conclusion

Insert the rules if not inserted from /etc/rc.localIs OpenVPN server running and port is open? Use the ss command or netstat command and pidof command /ps command:If not running, restart the OpenVPN server:Look out for errors:Can the Linux desktop client connect to the OpenVPN server machine? First you need to run a simple test to see if the OpenVPN server port (UDP 1194) accepts connections:If not connected it means either a Linux desktop firewall or your router is blocking access to server. Make sure both client and server using same protocol and port, e.g. UDP port 1194.

Congratulations. You successfully set up an OpenVPN server on Ubuntu Linux 18.04 LTS server running in the cloud. See the OpenVPN website server, Github script page, and Ubuntu server/project for additional information.

