OpenVPN 2.x Community How-To: Complete Setup & Configuration Guide⁠

Introduction⁠

OpenVPN is a full-featured SSL VPN that implements OSI layer 2 or 3 secure network extension using the industry standard SSL/TLS protocol, supports flexible client authentication methods based on certificates, smart cards, and/or username/password credentials, and allows user or group-specific access control policies using firewall rules applied to the VPN virtual interface. OpenVPN is not a web application proxy and does not operate through a web browser.

OpenVPN 2.0 expands on the capabilities of OpenVPN 1.x by offering a scalable client/server mode, allowing multiple clients to connect to a single OpenVPN server process over a single TCP or UDP port. OpenVPN 2.3 includes many improvements, including complete IPv6 and PolarSSL support.

This topic provides step-by-step instructions for configuring an OpenVPN 2.x client/server VPN, including:

• OpenVPN Quickstart.

• Installing OpenVPN.

• Determining Whether To Use a Routed or Bridged VPN.

• Numbering Private Subnets.

• Setting Up Your Own Certificate Authority (CA) and Generating Certificates and Keys for an OpenVPN Server and Multiple Clients.

• Creating Configuration Files for Server and Clients.

• Starting Up the VPN and Testing for Initial Connectivity.

• Configuring OpenVPN To Run Automatically On System Startup.

• Controlling a Running OpenVPN Process.

• Expanding the Scope of the VPN to Include Additional Machines on Either the Client or Server Subnet.

• Pushing DHCP Options to Clients.

• Configuring Client-Specific Rules and Access Policies.

• Using Alternative Authentication Methods.

• How to Add Dual-Factor Authentication to an OpenVPN Configuration Using Client-Side Smart Cards.

• Routing All Client Traffic (Including Web Traffic) Through the VPN.

• Running an OpenVPN Server on a Dynamic IP Address.

• Connecting To an OpenVPN Server Via an HTTP Proxy.

• Connecting To a Samba Share Over OpenVPN.

• Implementing a Load-Balancing/Failover Configuration.

• Hardening OpenVPN Security.

• Revoking Certificates.

• Important Note On Possible "Man-in-the-Middle" Attack if Clients Do Not Verify the Certificate of the Server They Are Connecting To.

The impatient may wish to jump straight to the sample configuration files:

• Server configuration file.

• Client configuration file.

Intended Audience⁠

This HOWTO assumes that readers possess a prior understanding of basic networking concepts such as IP addresses, DNS names, netmasks, subnets, IP routing, routers, network interfaces, LANs, gateways, and firewall rules.

Additional Documentation⁠