Access OpenVPN from a client computer | Opensource.com

Access OpenVPN from a client computer

After building your own VPN on Linux, it's time to finally use it.

Woman programming
Image by : 
WOCinTech Chat. Modified by Opensource.com. CC BY-SA 4.0
x

Subscribe now

Get the highlights in your inbox every week.

OpenVPN creates an encrypted tunnel between two points, preventing a third party from accessing your network traffic. By setting up your virtual private network (VPN) server, you become your own VPN provider. Many popular VPN services already use OpenVPN, so why tie your connection to a specific provider when you can have complete control yourself?

The first article in this series set up a server for your VPN, the second article demonstrated how to install and configure the OpenVPN server software, while the third article explained how to configure your firewall and start the OpenVPN server software. This fourth and final article demonstrates how to use your OpenVPN server from client computers. This is the reason you did all the work in the previous three articles!

Create client certificates

Remember that the method of authentication for OpenVPN requires both the server and the client to have something (certificates) and to know something (a password). It's time to set that up.

First, create a client certificate and a private key for your client computer. On your OpenVPN server, generate a certificate request. It asks for a passphrase; make sure you remember it:

$ cd /etc/openvpn/ca
$ sudo /etc/openvpn/easy-rsa/easyrsa \
gen-req greglaptop

In this example, greglaptop is the client computer for which this certificate is being created.

There's no need to import the request into the certificate authority (CA) because it's already there. Review it to make sure:

$ cd /etc/openvpn/ca
$ /etc/openvpn/easy-rsa/easyrsa \
show-req greglaptop

You can sign as the client, too:

$ /etc/openvpn/easy-rsa/easyrsa \
sign-req client greglaptop

Install the OpenVPN client software

On Linux, Network Manager may already have an OpenVPN client included. If not, you can install the plugin:

$ sudo dnf install NetworkManager-openvpn

On Windows, you must download and install the OpenVPN client from the OpenVPN download site. Launch the installer and follow the prompts.

Copy certificates and private keys to the client

Now your client needs the authentication credentials you generated for it. You generated these on the server, so you must transport them over to your client. I tend to use SSH for this. On Linux, that's the scp command. On Windows, you can use WinSCP as administrator to pull the certificates and keys.

Assuming the client is named greglaptop, here are the file names and server locations:

/etc/openvpn/ca/pki/issued/greglaptop.crt
/etc/openvpn/ca/pki/private/greglaptop.key
/etc/openvpn/ca/pki/issued/ca.crt

On Linux, copy these to the /etc/pki/tls/certs/ directory. On Windows, copy them to the C:\Program Files\OpenVPN\config directory.

Copy and customize the client configuration file

On Linux, you can either copy the /etc/openvpn/client/OVPNclient2020.ovpn file on the server to /etc/NetworkManager/system-connections/, or you can navigate to Network Manager in System Settings and add a VPN connection. 

For the connection type, select Certificates. Point Network Manager to the certificates and keys you copied from the server.

On Windows, run WinSCP as administrator to copy the client configuration template /etc/openvpn/client/OVPNclient2020.ovpn on the server to C:\Program Files\OpenVPN\config on the client. Then:

  • Rename it to match the certificate above.
  • Change the names of the CA certificate, client certificate, and key to match the names copied above from the server.
  • Edit the IP information to match your network.

You need super administrative permissions to edit the client config files. The easiest way to get this might be to launch a CMD window as administrator and then launch Notepad from the administrator CMD window to edit the files.

Connect your client to the server

On Linux, Network manager displays your VPN. Select it to connect.

 

On Windows, start the OpenVPN graphical user interface (GUI). It produces a graphic in the Windows System Tray on the right side of the taskbar, usually in the lower-right corner of your Windows desktop. Right-click the graphic to connect, disconnect, or view the status.

For the first connection, edit the "remote" line of your client config file to use the inside IP address of your OpenVPN server. Connect to the server from inside your office network by right-clicking on the OpenVPN GUI in the Windows System Tray and clicking Connect. Debug this connection. This should find and fix problems without any firewall issues getting in the way because both the client and server are on the same side of the firewall.

Next, edit the "remote" line of your client config file to use the public IP address for your OpenVPN server. Bring the Windows client to an outside network and connect. Debug any issues.

Connect securely

Congratulations! You have an OpenVPN network ready for your other client systems. Repeat the setup steps for the rest of your clients. You might even use Ansible to distribute certs and keys and keep them up to date. 


This article is based on D. Greg Scott's blog and is reused with permission.

Person drinking a hot drink at the computer

The first step in building a VPN is setting up a VPN server.
Open ethernet cords.

After setting up a VPN server, the next step is installing and configuring OpenVPN.
Lock

After you install OpenVPN, it's time to configure it.

About the author

Greg Scott head shot
D. Greg Scott - After surviving multiple layoff rounds at Digital Equipment Corporation, a large computer company in its day, I started Scott Consulting in 1994. A larger firm bought Scott Consulting in 1999, just as the dot com bust devastated the IT Service industry. A glutton for punishment, I went out on my own again in late 1999 and started Infrasupport Corporation, this time with a laser focus on infrastructure and security. I accepted a job offer with Red Hat, Inc. in 2015 as a Senior Technical Account...