How To Configure and Connect to a Private OpenVPN Server on FreeBSD 10.1
OpenVPN is an open-source virtual private network (VPN) server/client application which allows you to join a virtual network (similar to a LAN) securely.
This tutorial will explain how to install and configure an OpenVPN server on a FreeBSD 10.1 machine with IPv4 NAT and routing. It includes short explanations of various configuration options.
By the end of this tutorial you'll be running your own OpenVPN server, and have a client configuration file ready to download to connect to this network.
- A FreeBSD 10.1 Droplet. Droplet size depends on how many clients you intend to connect to the VPN; 519 MB is fine for a few clients
- Root access. sudo is pre-installed on DigitalOcean, so there's nothing extra to do
This tutorial requires root access. On DigitalOcean, access the server as the default freebsd user, then access the root shell:
Step 1 — Installing OpenVPN
Installing OpenVPN with the
pkg system is quite simple. Simply run these commands to update the package lists and install the VPN software:
pkg update pkg install openvpn
This should also install the
easy-rsa package, which will be used to generate the SSL key pairs.
Step 2 — Configuring the OpenVPN Server
For this tutorial we will base our configuration file on the sample one provided by OpenVPN. We'll create a configuration folder for OpenVPN:
Copy the example
server.conf file to the new directory.
cp /usr/local/share/examples/openvpn/sample-config-files/server.conf /usr/local/etc/openvpn/server.conf
nano or your favorite text editor:
pkg install nano
Open the config file for editing:
Note: The OpenVPN configuration file format prefixes comments with semicolons (
;) or hashes (
#). In the example, semicolons are used to comment (disable) configuration options, and hashes are used for comments.
If you know what configuration options you want to modify you may do so at this point.
port: The default port is 1194, but you can change this to anything you like
proto: Choose either
udp; the default is fine
group: Set these to
nobodyby uncommenting the lines. This will make OpenVPN run with fewer privileges, for security
user nobody group nobody
Note: Each configuration can run only one port and protocol at once.
Finally, be sure to save your changes.
Step 3 — Generating Server Certificates and Keys
easy-rsa makes generating certs and keys simple.
First, copy the program to your configuration directory, since you will be modifying values.
cp -r /usr/local/share/easy-rsa /usr/local/etc/openvpn/easy-rsa
vars file for editing:
Change the key size by modifying this line:
These days the standard is 2048-bit keys, although you can also use 4096-bit, which is more secure but slows down negotiation.
If you like you can also set the default certificate and key values in this file so you don't have to enter them later.
Since the shell we're using is
export lines need to be replaced with
setenv. This is done with
sed before the
source. Move to our
easy-rsa directory (required).
Replace the lines:
cat ./vars | sed -e 's/export /setenv /g' -e 's/=/ /g' | source /dev/stdin
Still from our
/usr/local/etc/openvpn/easy-rsa/ directory, first clean the directory, then build the certificate authority (CA).
You will be prompted to set the CA options. Fill these in with your details:
Country Name (2 letter code) [US]:GB State or Province Name (full name) [CA]:Somerset Locality Name (eg, city) [SanFrancisco]:Bath Organization Name (eg, company) [Fort-Funston]:Callum Organizational Unit Name (eg, section) [changeme]:VPN Common Name (eg, your name or your server's hostname) [changeme]:vpn.example.com Name [changeme]:Callum's VPN CA Email Address [email@example.com]:firstname.lastname@example.org
Now build the server key:
Again, set the options. You do not need a password or an optional company name.
y to sign and commit the key:
Country Name (2 letter code) [US]:GB State or Province Name (full name) [CA]:Somerset Locality Name (eg, city) [SanFrancisco]:Bath Organization Name (eg, company) [Fort-Funston]:Callum Organizational Unit Name (eg, section) [changeme]:VPN Common Name (eg, your name or your server's hostname) [server]:vpn.example.com Name [changeme]:Callum's VPN Server Email Address [email@example.com]:firstname.lastname@example.org Please enter the following 'extra' attributes to be sent with your certificate request A challenge password : ENTER An optional company name : ENTER Certificate is to be certified until Feb 5 14:40:15 2025 GMT (3650 days) Sign the certificate? [y/n]: y 1 out of 1 certificate requests certified, commit? [y/n] y Write out database with 1 new entries Data Base Updated
Finally the Diffie-Hellman key must be generated. This can take some time depending on key size:
Now that all the server keys and certs are generated, they should be copied to our OpenVPN configuration directory.
cd /usr/local/etc/openvpn/easy-rsa/keys/ cp dh*.pem ca.crt server.crt server.key /usr/local/etc/openvpn/
You're done with the server certificates! Now on to the client certificate.
Step 4 — Generating Client Certificates
Each client will also each need a certificate and key in order to authenticate and connect to the VPN. Make sure you're in the
Run the following command, where
clientName is the name you want to use for this particular client certificate.
You will be prompted to enter the country name, city name, etc. again. The process is the same as for the server key generation. This is intended to be the information of the client but none of it really matters.
You don't need a passphrase or company name. Enter
y to sign and commit the certificate.
Note: It is a good practice to use a different certificate for each client, and this is enforced by OpenVPN by default. However, if required, this can be disabled in the OpenVPN configuration (explained later).
If you used a key size different from
2048 you will need to modify the OpenVPN configuration to match the file name of the key size you used. If you don't remember, you can view the correct file name of the
dh file with this command:
Replace the line
dh dh2048.pem with:
If you followed our recommendation for the 2048-bit key earlier, you don't have to make any changes.
Repeat this section for each separate client certificate you want to create.
Step 5 — Configuring IPv4 NAT Routing
natd as part of the
ipfw firewall which allows for NAT routing and can be used for OpenVPN. In order to use this, edit
Add these contents at the bottom:
firewall_enable="YES" firewall_type="open" gateway_enable="YES" natd_enable="YES" natd_interface="vtnet0" natd_flags="-dynamic -m"
ipfwfirewall which is needed for
firewall_type="open"makes the firewall allow traffic as default
1which allows IPv4 routing on the system
natd_enableenables the actual NAT router
natd_interfaceis the external interface towards the Internet;
vtnet0is used for DigitalOcean
natd_flagsmakes the NAT dynamic and
-mpreserves port numbers
Now reboot your server to load
Log in again. After the reboot, remember to run
sudo tcsh again to become root if you aren't already.
Step 6 - Configuring OpenVPN Routing Config and DNS
By default OpenVPN isn't configured to tell the client to route Internet traffic through the VPN. We'll make sure it does route traffic through OpenVPN by uncommenting some lines in
Locate and uncomment these three lines:
push "redirect-gateway def1 bypass-dhcp" push "dhcp-option DNS 184.108.40.206" push "dhcp-option DNS 220.127.116.11"
The preset DNS servers are for OpenDNS but you can set them to whatever DNS you like (such as Google DNS with
You may also allow clients to directly communicate with each other's IPs by uncommenting:
If, as mentioned earlier, you want to use the same keys and certificates for multiple clients (which is slightly less secure) uncomment this line:
Compression can be enabled and disabled with this line:
Your cipher can be set manually by uncommenting one of these lines:
cipher BF-CBC # Blowfish (default) cipher AES-128-CBC # AES cipher DES-EDE3-CBC # Triple-DES
Note: Whichever cipher you use must also be defined in the client config file which we will create later.
Additional ciphers are also available, such as
Step 7 — Starting OpenVPN
Enable OpenVPN to load on boot and load with the
service command by adding the following line to
Add these lines at the bottom of the file:
The OpenVPN server is now fully configured and will load on boot.
Start the server manually with:
service openvpn start
add net 10.8.0.0: gateway 10.8.0.2
Your OpenVPN server is now running.
Step 8 — Configuring Client File
On the server we'll create the configuration file for each client.
First, create a folder to work in:
mkdir -p /usr/local/etc/openvpn/clients/clientName
clientName the client name we set earlier while generating certificates. (It doesn't matter precisely how you set this since it is only a working directory.)
Move to the new directory:
Copy in the client key and certificate we generated with
easy-rsa, and the sample
client.conf file. Make sure you replace the
clientName with the name you used earlier for the
cp /usr/local/etc/openvpn/easy-rsa/keys/clientName.crt /usr/local/etc/openvpn/easy-rsa/keys/clientName.key ./ cp /usr/local/share/examples/openvpn/sample-config-files/client.conf ./client.conf cp /usr/local/etc/openvpn/ca.crt ./
clientName was what we used earlier.
remote line to include your Droplet's IP address (which can be obtained with
ifconfig) and the port number;
1194 is the default:
remote your_server_ip 1194
Note: If you modified the server's
comp-lzosettings, then this must be reflected in the
client.conffile. Use the same settings you did previously; for example:
cipher aes-256-cbc ;comp-lzo
This setting uses the
aes-256-cbccipher and disables compression.
If you changed the
protoline in the server configuration, then this also needs to be reflected in the client.
Make sure these lines match what you set earlier; if you didn't change anything on the server side, don't change them here.
Now a bit of housekeeping; we will be embedding the certificates and key in the single configuration file. This makes it easier to transfer to individual clients. Alternately, you can download the configuration file and the key and two certificate files to the client separately.
In the same
client.conf file, comment out the certificate and key file names:
;ca ca.crt ;cert client.crt ;key client.key
Save your changes.
Finally, we need to embed the
clientName.key files in the configuration file. You can copy and paste the contents in using
nano or whatever you're most comfortable with, and the appropriate variables for OpenVPN, or you can use the one-line script shown below.
Run this script and enter your
clientName when prompted. The script appends your certificate and key files to the
client.conf file, with appropriate variable names and newlines that OpenVPN is expecting:
echo "Enter clientName:" && set CLIENTNAME = $< && printf "\n<ca>\n" >> ./client.conf && cat ./ca.crt >> ./client.conf && printf "</ca>\n" >> ./client.conf && printf "\n<cert>" >> ./client.conf && grep -v '^ ' ./$CLIENTNAME.crt | grep -v 'Certificate' >> ./client.conf && printf "</cert>\n" >> ./client.conf && printf "\n<key>\n" >> ./client.conf && cat ./$CLIENTNAME.key >> ./client.conf && printf "</key>\n" >> ./client.conf
Make sure you scroll all the way to the right, since this is a long command.
Take a look at the finished
client.conf file with
cat. You should see the key and certificates added to the file at the bottom.
You're done! All that needs to be done now is to distribute the
client.conf file to your client. Most clients prefer the extension
.conf, so you will want to rename the file locally to
my_digitalocean_vpn.ovpn or something similar.
Repeat this section for each client. Use separate certificates by default, or use the same client certificate on each client if you prefer.
Conclusion and Client Setup
You should now have a working OpenVPN server!
Download the client configuration file you created in the last step (
/usr/local/etc/openvpn/clients/clientName/client.conf) to your local machine. Use a secure method to download the file, such as SCP or SFTP.
Make sure your client configuration file is named as expected; this is usually a name like
Double-click the file or move it to your client's expected directory.
Start your client and connect to the appropriate OpenVPN server.
To ensure your VPN is working, use an IP address checker such as http://www.whatismyip.com/. Your IP shown should match your OpenVPN server's IP.
Congratulations! You've connected to your new OpenVPN server.