Ubuntu 20.04 LTS Set Up OpenVPN Server In 5 Minutes

ADVERTISEMENTS



Procedure: Ubuntu 20.04 LTS Set Up OpenVPN Server In 5 Minutes

I am a new Ubuntu Linux 20.04 LTS server system administrator. How can I set up an OpenVPN Server on an Ubuntu Linux version 20.04 LTS server to shield my browsing activity from bad guys on public Wi-Fi, encrypt all traffic while connecting to 4G LTE network, and more?OpenVPN is extremely popular and a full-featured SSL VPN (Virtual Private Network) software. It implements OSI layer 2 or 3 secure network extension using the SSL/TLS protocol. Like much other popular software, it is open-source, free software and distributed under the GNU GPL. A VPN allows you to connect securely to an insecure public network such as wifi network at the airport or hotel. In many enterprises and government offices, VPN is needed to access your corporate server resources. Another widespread usage to bypass the geo-blocked sites/apps and increase your privacy or safety online. This tutorial provides step-by-step instructions for configuring an OpenVPN server on Ubuntu Linux 20.04 LTS server.

The steps are as follows:

Step 1 – Update your system

First, run the apt command to apply security updates:

sudo apt update

sudo apt upgrade



Step 2 – Find and note down your IP address

Use the ip command as follows:

ip a

ip a show eth0



dig +short myip.opendns.com @resolver1.opendns.com

## Get IPv4 ##

dig -4 +short myip.opendns.com @resolver1.opendns.com

## Find IPv6 ##

dig -6 +short myip.opendns.com @resolver1.opendns.com

## OR ##

dig TXT +short o-o.myaddr.l.google.com @ns1.google.com | awk -F'"' '{ print $2}'

A note about IP address assigned to your server

Alternatively we can run the following dig command host command to find out our public IP address from Linux command line itself:

Most cloud and bare-metal servers have two types of IP address provided by the ISP:

Public static IP address directly assigned to your box and routed from the Internet. For example, Linode, Digital Ocean, and others give you direct public IP address. Private static IP address directly attached to your server and your server is behind NAT with public IP address. For example, AWS EC2/Lightsail give you this kind of NAT public IP address.

The script will automatically detect your networking setup. All you have to do is provide a correct IP address when asked for it.

Step 3 – Download and run openvpn-install.sh script

I am going to use the wget command as follows:

wget https://git.io/vpn -O openvpn-ubuntu-install.sh



chmod -v +x openvpn-ubuntu-install.sh

mode of 'openvpn-ubuntu-install.sh' changed from 0644 (rw-r--r--) to 0755 (rwxr-xr-x)

nano openvpn-ubuntu-install.sh

Run openvpn-ubuntu-install.sh script to install OpenVPN server

Now we downloaded the script and it is time to make it executable. Hence, set up permissions using the chmod command:One can view the script using a text editor such as nano/vim:

Now all you have to do is:

sudo ./openvpn-ubuntu-install.sh

Sample session from AWS/Lightsail where my cloud server is behind NAT:



direct public IPv4 address

Your client configuration is available at: /root/linuxdesktop.ovpn

If you want to add more clients, just run this script again!

How do I start/stop/restart OpenVPN server on Ubuntu 20.04 LTS?

Sample session fromI strongly suggest that you always choose the DNS server option as 1.1.1.1 or Google DNS or any other DNS service provided that you trust as per your needs. Make sure you choose fast Geo-distributed DNS servers and reached from anywhere on the Internet. At the end we should see information as follows:

We need to use the systemctl command as follows:

Stop the OpenVPN server

sudo systemctl stop openvpn-server@server.service

Start the OpenVPN server

sudo systemctl start openvpn-server@server.service

Restart the OpenVPN server after changing configuration options

sudo systemctl restart openvpn-server@server.service

Show status of the OpenVPN server

sudo systemctl status openvpn-server@server.service

● openvpn-server@server.service - OpenVPN service for server Loaded: loaded (/lib/systemd/system/openvpn-server@.service; enabled; vendor preset: enabled) Active: active (running) since Tue 2020-06-16 09:01:19 UTC; 4min 39s ago Docs: man:openvpn(8) https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage https://community.openvpn.net/openvpn/wiki/HOWTO Main PID: 1982 (openvpn) Status: "Initialization Sequence Completed" Tasks: 1 (limit: 2282) Memory: 1.1M CGroup: /system.slice/system-openvpn\x2dserver.slice/openvpn-server@server.service └─1982 /usr/sbin/openvpn --status /run/openvpn-server/status-server.log --status-version 2 --suppress-timestamps --config server.conf Jun 16 09:01:19 sg-vpn-001 openvpn[1982]: Socket Buffers: R=[212992->212992] S=[212992->212992] Jun 16 09:01:19 sg-vpn-001 openvpn[1982]: UDPv4 link local (bound): [AF_INET]172.104.177.197:1194 Jun 16 09:01:19 sg-vpn-001 openvpn[1982]: UDPv4 link remote: [AF_UNSPEC] Jun 16 09:01:19 sg-vpn-001 openvpn[1982]: GID set to nogroup Jun 16 09:01:19 sg-vpn-001 openvpn[1982]: UID set to nobody Jun 16 09:01:19 sg-vpn-001 openvpn[1982]: MULTI: multi_init called, r=256 v=256 Jun 16 09:01:19 sg-vpn-001 openvpn[1982]: IFCONFIG POOL IPv6: (IPv4) size=252, size_ipv6=65536, netbits=64, base_ipv6=fddd:1194:1194:1194::1000 Jun 16 09:01:19 sg-vpn-001 openvpn[1982]: IFCONFIG POOL: base=10.8.0.2 size=252, ipv6=1 Jun 16 09:01:19 sg-vpn-001 openvpn[1982]: IFCONFIG POOL LIST Jun 16 09:01:19 sg-vpn-001 openvpn[1982]: Initialization Sequence Completed

Step 4 – Connect an OpenVPN server using iOS/Android/Linux/Windows desktop client

On server your will find a client configuration file called /root/linuxdesktop.ovpn. All you have to do is copy this file to your local desktop using the scp command:

scp root@172.104.177.197:/root/linuxdesktop.ovpn .

If root is not allowed to log in into the server, try the following scp command:

ssh vivek@172.104.177.197 "sudo -S cat /root/linuxdesktop.ovpn" > linuxdesktop.ovpn

Next, provide this file to your OpenVPN client to connect:

Linux Desktop: OpenVPN client configuration

First, install the openvpn client for your desktop using the yum command/dnf command/apt command:

sudo dnf install openvpn

OR

sudo apt install openvpn

Next, copy desktop.ovpn as follows:

sudo cp linuxdesktop.ovpn /etc/openvpn/client.conf

Test connectivity from the CLI:

sudo openvpn --client --config /etc/openvpn/client.conf

Your Linux system will automatically connect when computer restart using openvpn script/service:

sudo systemctl start openvpn@client # <--- start client service

Step 5 – Verify/test the connectivity

Simply visit this page to check your IP address and it much change to your VPN server IP address. Next, execute the following commands after connecting to OpenVPN server from your Linux desktop:

ping 10.8.0.1 #Ping to the OpenVPN server gateway

ip route #Make sure routing setup working

## the following must return public IP address of OpenVPN server ##

dig TXT +short o-o.myaddr.l.google.com @ns1.google.com



A note about trouble shooting OpenVPN server and client issues

Type the following commands on your Ubuntu 20.04 Linux LTS server. First, check OpenVPN server for errors:

sudo journalctl --identifier openvpn

-- Logs begin at Tue 2020 -06- 16 08: 53 : 36 UTC, end at Tue 2020 -06- 16 09:09: 57 UTC. -- Jun 16 09:01: 19 sg-vpn-001 openvpn [ 1982 ] : OpenVPN 2.4.7 x86_64-pc-linux-gnu [ SSL ( OpenSSL ) ] [ LZO ] [ LZ4 ] [ EPOLL ] [ PKCS11 ] [ MH/PKTINFO ] [ AEAD ] built on Sep 5 2019 Jun 16 09:01: 19 sg-vpn-001 openvpn [ 1982 ] : library versions: OpenSSL 1.1.1f 31 Mar 2020 , LZO 2.10 Jun 16 09:01: 19 sg-vpn-001 openvpn [ 1982 ] : Diffie-Hellman initialized with 2048 bit key Jun 16 09:01: 19 sg-vpn-001 openvpn [ 1982 ] : Outgoing Control Channel Encryption: Cipher 'AES- 256 -CTR' initialized with 256 bit key Jun 16 09:01: 19 sg-vpn-001 openvpn [ 1982 ] : Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication Jun 16 09:01: 19 sg-vpn-001 openvpn [ 1982 ] : Incoming Control Channel Encryption: Cipher 'AES- 256 -CTR' initialized with 256 bit key Jun 16 09:01: 19 sg-vpn-001 openvpn [ 1982 ] : Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication Jun 16 09:01: 19 sg-vpn-001 openvpn [ 1982 ] : TUN/TAP device tun0 opened Jun 16 09:01: 19 sg-vpn-001 openvpn [ 1982 ] : TUN/TAP TX queue length set to 100 Jun 16 09:01: 19 sg-vpn-001 openvpn [ 1982 ] : /sbin/ip link set dev tun0 up mtu 1500 Jun 16 09:01: 19 sg-vpn-001 openvpn [ 1982 ] : /sbin/ip addr add dev tun0 10.8.0.1/ 24 broadcast 10.8.0.255 Jun 16 09:01: 19 sg-vpn-001 openvpn [ 1982 ] : /sbin/ip - 6 addr add fddd: 1194 : 1194 : 1194 :: 1 / 64 dev tun0 Jun 16 09:01: 19 sg-vpn-001 openvpn [ 1982 ] : Could not determine IPv4/IPv6 protocol. Using AF_INET Jun 16 09:01: 19 sg-vpn-001 openvpn [ 1982 ] : Socket Buffers: R = [ 212992->212992 ] S = [ 212992->212992 ] Jun 16 09:01: 19 sg-vpn-001 openvpn [ 1982 ] : UDPv4 link local ( bound ) : [ AF_INET ] 45.79.125.234: 1194 Jun 16 09:01: 19 sg-vpn-001 openvpn [ 1982 ] : UDPv4 link remote: [ AF_UNSPEC ] Jun 16 09:01: 19 sg-vpn-001 openvpn [ 1982 ] : GID set to nogroup Jun 16 09:01: 19 sg-vpn-001 openvpn [ 1982 ] : UID set to nobody Jun 16 09:01: 19 sg-vpn-001 openvpn [ 1982 ] : MULTI: multi_init called, r = 256 v=256 Jun 16 09:01: 19 sg-vpn-001 openvpn [ 1982 ] : IFCONFIG POOL IPv6: ( IPv4 ) size = 252, size_ipv6=65536, netbits=64, base_ipv6=fddd:1194:1194:1194::1000 Jun 16 09:01: 19 sg-vpn-001 openvpn [ 1982 ] : IFCONFIG POOL: base = 10.8.0.2 size=252, ipv6=1 Jun 16 09:01: 19 sg-vpn-001 openvpn [ 1982 ] : IFCONFIG POOL LIST Jun 16 09:01: 19 sg-vpn-001 openvpn [ 1982 ] : Initialization Sequence Completed -- Logs begin at Tue 2020-06-16 08:53:36 UTC, end at Tue 2020-06-16 09:09:57 UTC. -- Jun 16 09:01:19 sg-vpn-001 openvpn[1982]: OpenVPN 2.4.7 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Sep 5 2019 Jun 16 09:01:19 sg-vpn-001 openvpn[1982]: library versions: OpenSSL 1.1.1f 31 Mar 2020, LZO 2.10 Jun 16 09:01:19 sg-vpn-001 openvpn[1982]: Diffie-Hellman initialized with 2048 bit key Jun 16 09:01:19 sg-vpn-001 openvpn[1982]: Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key Jun 16 09:01:19 sg-vpn-001 openvpn[1982]: Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication Jun 16 09:01:19 sg-vpn-001 openvpn[1982]: Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key Jun 16 09:01:19 sg-vpn-001 openvpn[1982]: Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication Jun 16 09:01:19 sg-vpn-001 openvpn[1982]: TUN/TAP device tun0 opened Jun 16 09:01:19 sg-vpn-001 openvpn[1982]: TUN/TAP TX queue length set to 100 Jun 16 09:01:19 sg-vpn-001 openvpn[1982]: /sbin/ip link set dev tun0 up mtu 1500 Jun 16 09:01:19 sg-vpn-001 openvpn[1982]: /sbin/ip addr add dev tun0 10.8.0.1/24 broadcast 10.8.0.255 Jun 16 09:01:19 sg-vpn-001 openvpn[1982]: /sbin/ip -6 addr add fddd:1194:1194:1194::1/64 dev tun0 Jun 16 09:01:19 sg-vpn-001 openvpn[1982]: Could not determine IPv4/IPv6 protocol. Using AF_INET Jun 16 09:01:19 sg-vpn-001 openvpn[1982]: Socket Buffers: R=[212992->212992] S=[212992->212992] Jun 16 09:01:19 sg-vpn-001 openvpn[1982]: UDPv4 link local (bound): [AF_INET]45.79.125.234:1194 Jun 16 09:01:19 sg-vpn-001 openvpn[1982]: UDPv4 link remote: [AF_UNSPEC] Jun 16 09:01:19 sg-vpn-001 openvpn[1982]: GID set to nogroup Jun 16 09:01:19 sg-vpn-001 openvpn[1982]: UID set to nobody Jun 16 09:01:19 sg-vpn-001 openvpn[1982]: MULTI: multi_init called, r=256 v=256 Jun 16 09:01:19 sg-vpn-001 openvpn[1982]: IFCONFIG POOL IPv6: (IPv4) size=252, size_ipv6=65536, netbits=64, base_ipv6=fddd:1194:1194:1194::1000 Jun 16 09:01:19 sg-vpn-001 openvpn[1982]: IFCONFIG POOL: base=10.8.0.2 size=252, ipv6=1 Jun 16 09:01:19 sg-vpn-001 openvpn[1982]: IFCONFIG POOL LIST Jun 16 09:01:19 sg-vpn-001 openvpn[1982]: Initialization Sequence Completed

Is firewall rule setup correctly on your server? Use the cat command to see rules:

sudo cat /etc/systemd/system/openvpn-iptables.service

Config:

[ Unit ] Before =network.target [ Service ] Type =oneshot ExecStart = / sbin / iptables -t nat -A POSTROUTING -s 10.8.0.0 / 24 ! -d 10.8.0.0 / 24 -j SNAT --to 172.104.177.197 ExecStart = / sbin / iptables -I INPUT -p udp --dport 1194 -j ACCEPT ExecStart = / sbin / iptables -I FORWARD -s 10.8.0.0 / 24 -j ACCEPT ExecStart = / sbin / iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT ExecStop = / sbin / iptables -t nat -D POSTROUTING -s 10.8.0.0 / 24 ! -d 10.8.0.0 / 24 -j SNAT --to 172.104.177.197 ExecStop = / sbin / iptables -D INPUT -p udp --dport 1194 -j ACCEPT ExecStop = / sbin / iptables -D FORWARD -s 10.8.0.0 / 24 -j ACCEPT ExecStop = / sbin / iptables -D FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT ExecStart = / sbin / ip6tables -t nat -A POSTROUTING -s fddd: 1194 : 1194 : 1194 :: / 64 ! -d fddd: 1194 : 1194 : 1194 :: / 64 -j SNAT --to 2400 : 8901 ::f03c:92ff:fe3e:cf92 ExecStart = / sbin / ip6tables -I FORWARD -s fddd: 1194 : 1194 : 1194 :: / 64 -j ACCEPT ExecStart = / sbin / ip6tables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT ExecStop = / sbin / ip6tables -t nat -D POSTROUTING -s fddd: 1194 : 1194 : 1194 :: / 64 ! -d fddd: 1194 : 1194 : 1194 :: / 64 -j SNAT --to 2400 : 8901 ::f03c:92ff:fe3e:cf92 ExecStop = / sbin / ip6tables -D FORWARD -s fddd: 1194 : 1194 : 1194 :: / 64 -j ACCEPT ExecStop = / sbin / ip6tables -D FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT RemainAfterExit = yes [ Install ] WantedBy =multi-user.target [Unit] Before=network.target [Service] Type=oneshot ExecStart=/sbin/iptables -t nat -A POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to 172.104.177.197 ExecStart=/sbin/iptables -I INPUT -p udp --dport 1194 -j ACCEPT ExecStart=/sbin/iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT ExecStart=/sbin/iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT ExecStop=/sbin/iptables -t nat -D POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to 172.104.177.197 ExecStop=/sbin/iptables -D INPUT -p udp --dport 1194 -j ACCEPT ExecStop=/sbin/iptables -D FORWARD -s 10.8.0.0/24 -j ACCEPT ExecStop=/sbin/iptables -D FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT ExecStart=/sbin/ip6tables -t nat -A POSTROUTING -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to 2400:8901::f03c:92ff:fe3e:cf92 ExecStart=/sbin/ip6tables -I FORWARD -s fddd:1194:1194:1194::/64 -j ACCEPT ExecStart=/sbin/ip6tables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT ExecStop=/sbin/ip6tables -t nat -D POSTROUTING -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to 2400:8901::f03c:92ff:fe3e:cf92 ExecStop=/sbin/ip6tables -D FORWARD -s fddd:1194:1194:1194::/64 -j ACCEPT ExecStop=/sbin/ip6tables -D FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT RemainAfterExit=yes [Install] WantedBy=multi-user.target

Another option is to run iptables command and sysctl command commands to verify NAT rule setup on your server:

sudo iptables -t nat -L -n -v

sysctl net.ipv4.ip_forward

sudo cat /etc/sysctl.d/30-openvpn-forward.conf



sudo systemctl start openvpn-iptables.service

sudo sysctl -w net.ipv4.ip_forward=1

sudo sysctl -p -f /etc/sysctl.d/30-openvpn-forward.conf

netstat -tulpn | grep :1194 ## 1194 is the openvpn server port ##

ss -tulpn | grep :1194 ## 1194 is the openvpn server port ##

ps aux | grep openvpn ## is the openvpn server running? ##

ps -C openvpn ## is the openvpn server running? ##

pidof openvpn ## find the openvpn server PID ##

sudo systemctl restart openvpn-server@server.service

sudo systemctl status openvpn-server@server.service

nc -vu 172.104.177.197 1194

Connection to 172.104.177.197 port [udp/openvpn] succeeded!

Conclusion

Insert the rules if not inserted using the following command:Is OpenVPN server running and port is open? Use the ss command or netstat command and pidof command /ps command:If not running, restart the OpenVPN server:Look out for errors:Can the Linux desktop client connect to the OpenVPN server machine? First you need to run a simple test to see if the OpenVPN server port (UDP 1194) accepts connections:If not connected it means either a Linux desktop firewall or your router is blocking access to server. Make sure both client and server using same protocol and port, e.g. UDP port 1194.

Congratulations. You successfully set up an OpenVPN server on Ubuntu Linux 20.04 LTS server running in the cloud. See the OpenVPN website here, Ubuntu page here and Github script page here for additional information.

