Cet article est un copier d’un article de l’excellent blog de Toorop disponible ici : http://blog.toorop.fr/vpn-openvpn-cloud-ovh-ubuntu/

Installation de base du serveur

apt-get update
apt_get upgrade

Installation d’openvpn

apt-get install openvpn

Création de l’autorité de certification maître

cd /usr/share/doc/openvpn/examples/easy-rsa/2.0/

vi vars

# These are the default values for fields

# which will be placed in the certificate.
# Don't leave any of these fields blank.
export KEY_COUNTRY="US"
export KEY_PROVINCE="CA"
export KEY_CITY="SanFrancisco"
export KEY_ORG="Fort-Funston"
export KEY_EMAIL="me@myhost.mydomain"

On initialise ces variables

. ./vars

Puis un petit nettoyage

./clean-all

l’autorité de certification maitre :

./build-ca

Durant cette étape, répondez par defaut a toutes les questions posées sauf pour le FQN:

''Common Name (eg, your name or your server's hostname) []:''

Création du certificat serveur et de sa clé

./build-key-server vpn.hostname.fr

# ./build-key-server vpn.hostname.fr
Generating a 1024 bit RSA private key
.................................++++++
...............++++++
writing new private key to 'vpn.hostname.fr.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [FR]:
State or Province Name (full name) [IDF]:
Locality Name (eg, city) [Paris]:
Organization Name (eg, company) [Société Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) [vpn.hostname.fr]:
Name []:
Email Address [contact@hostname.fr]:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
Using configuration from /usr/share/doc/openvpn/examples/easy-rsa/2.0/openssl.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName RINTABLE:'FR'
stateOrProvinceName RINTABLE:'IDF'
localityName RINTABLE:'Paris'
organizationName RINTABLE:'Société Ltd'
commonName RINTABLE:'vpn.hostname.fr'
emailAddress :IA5STRING:'contact @ hostname. fr'
Certificate is to be certified until Jun 4 12:00:35 2020 GMT (3650 days)
Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

Création de la clé pour le client

Ici nous avons un seul client, évidement, l’opération est à répéter s’il faut plusieurs clients

./build-key christophe

# ./build-key christophe
Generating a 1024 bit RSA private key
................++++++
.....................................................++++++
writing new private key to 'christophe.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [FR]:
State or Province Name (full name) [IDF]:
Locality Name (eg, city) [Paris]:
Organization Name (eg, company) [Sociétép Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) [christophe]:
Name []:
Email Address [christophe@hostname.fr]:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
Using configuration from /usr/share/doc/openvpn/examples/easy-rsa/2.0/openssl.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName RINTABLE:'FR'
stateOrProvinceName RINTABLE:'IDF'
localityName RINTABLE:'Paris'
organizationName RINTABLE:'Société Ltd'
commonName RINTABLE:'christophe'
emailAddress :IA5STRING:'christophe@hostname.fr'
Certificate is to be certified until Jun 4 12:05:50 2020 GMT (3650 days)
Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

Création des paramètres Diffie-Hellman

une clé de « Diffie Hellman » sera utilisée pour sécuriser l’échange de clés SSL avant que la communication ne soit chiffrée.

./build-dh

Mise en place des certificats

Les certificats doivent être dans /etc/openvpn

cp dh*.pem ca.crt vpn.hostname.fr.crt vpn.hostname.fr.key /etc/openvpn/

Configuration du serveur

cd /usr/share/doc/openvpn/examples/sample-config-files
gunzip server.conf.gz
cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf /etc/openvpn/

vi /etc/openvpn/server.conf

# Which TCP/UDP port should OpenVPN listen on?
# If you want to run multiple OpenVPN instances
# on the same machine, use a different port
# number for each one. You will need to
# open up this port on your firewall.
port 443
.
.
# unless you partially or fully disable
# the firewall for the TUN/TAP interface.
dev tap
;dev tun
.
.
#
# Any X509 key management system can be used.
# OpenVPN can also use a PKCS #12 formatted key file
# (see "pkcs12" directive in man page).
ca ca.crt
cert vpn.hostname.fr.crt
key vpn.hstname.fr.key # This file should be kept secret
.
.
# network gateway through the VPN, causing
# all IP traffic such as web browsing and
# and DNS lookups to go through the VPN
# (The OpenVPN server machine may need to NAT
# or bridge the TUN/TAP interface to the internet
# in order for this to work properly).
;push "redirect-gateway def1 bypass-dhcp"
push "redirect-gateway def1"
.
.
push "dhcp-option DNS 213.186.33.99"

On stop le serveur OpenVPN, puis on test :

/etc/init.d/openvpn stop

cd /etc/openvpn

openvpn server.conf

.openvpn server.conf
Mon Jun 7 16:38:24 2010 OpenVPN 2.1.0 i486-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [MH] [PF_INET6] [eurephia] built on Jan 26 2010
Mon Jun 7 14:38:24 2010 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Mon Jun 7 14:38:24 2010 Diffie-Hellman initialized with 1024 bit key
Mon Jun 7 14:38:24 2010 /usr/bin/openssl-vulnkey -q -b 1024 -m
Mon Jun 7 14:38:25 2010 TLS-Auth MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mon Jun 7 14:38:25 2010 ROUTE default_gateway=192.168.253.126
Mon Jun 7 14:38:25 2010 TUN/TAP device tun0 opened
Mon Jun 7 14:38:25 2010 TUN/TAP TX queue length set to 100
Mon Jun 7 14:38:25 2010 /sbin/ifconfig tun0 10.8.0.1 pointopoint 10.8.0.2 mtu 1500
Mon Jun 7 14:38:25 2010 /sbin/route add -net 10.8.0.0 netmask 255.255.255.0 gw 10.8.0.2
Mon Jun 7 14:38:25 2010 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Mon Jun 7 14:38:25 2010 Socket Buffers: R=[112640->131072] S=[112640->131072]
Mon Jun 7 14:38:25 2010 UDPv4 link local (bound): [undef]
Mon Jun 7 14:38:25 2010 UDPv4 link remote: [undef]
Mon Jun 7 14:38:25 2010 MULTI: multi_init called, r=256 v=256
Mon Jun 7 14:38:25 2010 IFCONFIG POOL: base=10.8.0.4 size=62
Mon Jun 7 14:38:25 2010 IFCONFIG POOL LIST
Mon Jun 7 14:38:25 2010 Initialization Sequence Completed

Configuration du routage sur le serveur

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
echo 1 > /proc/sys/net/ipv4/ip_forward

Configuration du client

cat /etc/NetworkManager/dispatcher.d/01ifupdown

#!/bin/sh -e
# Script to dispatch NetworkManager events
#
# Runs ifupdown scripts when NetworkManager fiddles with interfaces.

if [ -z "$1" ]; then
echo "$0: called with no interface" 1>&2
exit 1;
fi

# Fake ifupdown environment
export IFACE="$1"
export LOGICAL="$1"
export ADDRFAM="NetworkManager"
export METHOD="NetworkManager"
export VERBOSITY="0"

# Run the right scripts
case "$2" in
up|vpn-up)
export MODE="start"
export PHASE="up"

if [ -d /var/run/network/ ] ; then
tmpfile=`mktemp -t`
if [ -e /var/run/network/ifstate ] ; then
cat /var/run/network/ifstate | grep -v ^$IFACE= > $tmpfile || true
fi
echo $IFACE=$IFACE >> $tmpfile
mv $tmpfile /var/run/network/ifstate
fi

exec run-parts /etc/network/if-up.d
;;
down|vpn-down)
export MODE="stop"
export PHASE="down"

if [ -e /var/run/network/ifstate ] ; then
tmpfile=`mktemp -t`
cat /var/run/network/ifstate | grep -v ^$IFACE= > $tmpfile || true
mv $tmpfile /var/run/network/ifstate
fi

exec run-parts /etc/network/if-down.d
;;
pre-up)
export MODE="start"
export PHASE="pre-up"
exec run-parts /etc/network/if-pre-up.d
;;
post-down)
export MODE="stop"
export PHASE="post-down"
exec run-parts /etc/network/if-post-down.d
;;
*)
echo "$0: called with unknown action \`$2'" 1>&2
exit 1
;;
esac

On telecharge donc tout ça dans ~/vpn/:

$ cd ~
$ mkdir vpn
$ cd vpn
$ scp root@IP_DU_SERVEUR:/usr/share/doc/openvpn/examples/easy-rsa/2.0/keys/ca.crt vpn/
$ scp root@IP_DU_SERVEUR:/usr/share/doc/openvpn/examples/easy-rsa/2.0/keys/mini.crt vpn/
$ scp root@IP_DU_SERVEUR:/usr/share/doc/openvpn/examples/easy-rsa/2.0/keys/mini.key vpn/

On lance le networkmanager: connection VPN nouvelle connexion.

Vous devez renseigner :

Passerelle: Nom d’hote du VPN, attention pensez a la configurer sinon utilisez l’IP

Certificat de l’utilisateur: dans mon cas christophe.crt
Certificat du CA: ca.crt
Clé privée: christophe.key

Dans l’onglet « avancé »:

Changez le port pour y mettre 443
Activez la compression LZO
Sélectionnez « Utilisez un peripherique TAP »

Enjoy!

Tags: OpenVPN
No Comments »