OpenVPN is an open-source virtual private network (VPN) server/client application which allows you to join a virtual network (similar to a LAN) securely.
This tutorial will explain how to install and configure an OpenVPN server on a FreeBSD 10.1 machine with IPv4 NAT and routing. It includes short explanations of various configuration options.
By the end of this tutorial you’ll be running your own OpenVPN server, and have a client configuration file ready to download to connect to this network.
Note: As of July 1, 2022, DigitalOcean no longer supports the creation of new FreeBSD Droplets through the Control Panel or API. However, you can still spin up FreeBSD Droplets using a custom image. Learn how to import a custom image to DigitalOcean by following our product documentation.
This tutorial requires root access. In this tutorial, the server we use refers to a default freebsd user, then access to the root shell:
Installing OpenVPN with the
pkg system is quite simple. Simply run these commands to update the package lists and install the VPN software:
pkg update pkg install openvpn
This should also install the
easy-rsa package, which will be used to generate the SSL key pairs.
For this tutorial we will base our configuration file on the sample one provided by OpenVPN. We’ll create a configuration folder for OpenVPN:
Copy the example
server.conf file to the new directory.
cp /usr/local/share/examples/openvpn/sample-config-files/server.conf /usr/local/etc/openvpn/server.conf
nano or your favorite text editor:
pkg install nano
Open the config file for editing:
Note: The OpenVPN configuration file format prefixes comments with semicolons (
;) or hashes (
#). In the example, semicolons are used to comment (disable) configuration options, and hashes are used for comments.
If you know what configuration options you want to modify you may do so at this point.
port: The default port is 1194, but you can change this to anything you like
proto: Choose either
udp; the default is fine
group: Set these to
nobodyby uncommenting the lines. This will make OpenVPN run with fewer privileges, for security
user nobody group nobody
Note: Each configuration can run only one port and protocol at once.
Finally, be sure to save your changes.
easy-rsa makes generating certs and keys simple.
First, copy the program to your configuration directory, since you will be modifying values.
cp -r /usr/local/share/easy-rsa /usr/local/etc/openvpn/easy-rsa
vars file for editing:
Change the key size by modifying this line:
These days the standard is 2048-bit keys, although you can also use 4096-bit, which is more secure but slows down negotiation.
If you like you can also set the default certificate and key values in this file so you don’t have to enter them later.
Since the shell we’re using is
export lines need to be replaced with
setenv. This is done with
sed before the
source. Move to our
easy-rsa directory (required).
Replace the lines:
cat ./vars | sed -e 's/export /setenv /g' -e 's/=/ /g' | source /dev/stdin
Still from our
/usr/local/etc/openvpn/easy-rsa/ directory, first clean the directory, then build the certificate authority (CA).
You will be prompted to set the CA options. Fill these in with your details:
Country Name (2 letter code) [US]:GB State or Province Name (full name) [CA]:Somerset Locality Name (eg, city) [SanFrancisco]:Bath Organization Name (eg, company) [Fort-Funston]:Callum Organizational Unit Name (eg, section) [changeme]:VPN Common Name (eg, your name or your server's hostname) [changeme]:vpn.example.com Name [changeme]:Callum's VPN CA Email Address [email@example.com]:firstname.lastname@example.org
Now build the server key:
Again, set the options. You do not need a password or an optional company name.
y to sign and commit the key:
Country Name (2 letter code) [US]:GB State or Province Name (full name) [CA]:Somerset Locality Name (eg, city) [SanFrancisco]:Bath Organization Name (eg, company) [Fort-Funston]:Callum Organizational Unit Name (eg, section) [changeme]:VPN Common Name (eg, your name or your server's hostname) [server]:vpn.example.com Name [changeme]:Callum's VPN Server Email Address [email@example.com]:firstname.lastname@example.org Please enter the following 'extra' attributes to be sent with your certificate request A challenge password : ENTER An optional company name : ENTER Certificate is to be certified until Feb 5 14:40:15 2025 GMT (3650 days) Sign the certificate? [y/n]: y 1 out of 1 certificate requests certified, commit? [y/n] y Write out database with 1 new entries Data Base Updated
Finally the Diffie-Hellman key must be generated. This can take some time depending on key size:
Now that all the server keys and certs are generated, they should be copied to our OpenVPN configuration directory.
cd /usr/local/etc/openvpn/easy-rsa/keys/ cp dh*.pem ca.crt server.crt server.key /usr/local/etc/openvpn/
You’re done with the server certificates! Now on to the client certificate.
Each client will also each need a certificate and key in order to authenticate and connect to the VPN. Make sure you’re in the
Run the following command, where
clientName is the name you want to use for this particular client certificate.
You will be prompted to enter the country name, city name, etc. again. The process is the same as for the server key generation. This is intended to be the information of the client but none of it really matters.
You don’t need a passphrase or company name. Enter
y to sign and commit the certificate.
Note: It is a good practice to use a different certificate for each client, and this is enforced by OpenVPN by default. However, if required, this can be disabled in the OpenVPN configuration (explained later).
If you used a key size different from
2048 you will need to modify the OpenVPN configuration to match the file name of the key size you used. If you don’t remember, you can view the correct file name of the
dh file with this command:
Replace the line
dh dh2048.pem with:
If you followed our recommendation for the 2048-bit key earlier, you don’t have to make any changes.
Repeat this section for each separate client certificate you want to create.
natd as part of the
ipfw firewall which allows for NAT routing and can be used for OpenVPN. In order to use this, edit
Add these contents at the bottom:
firewall_enable="YES" firewall_type="open" gateway_enable="YES" natd_enable="YES" natd_interface="vtnet0" natd_flags="-dynamic -m"
ipfwfirewall which is needed for
firewall_type="open"makes the firewall allow traffic as default
1which allows IPv4 routing on the system
natd_enableenables the actual NAT router
natd_interfaceis the external interface towards the Internet;
natd_flagsmakes the NAT dynamic and
-mpreserves port numbers
Now reboot your server to load
Log in again. After the reboot, remember to run
sudo tcsh again to become root if you aren’t already.
By default OpenVPN isn’t configured to tell the client to route Internet traffic through the VPN. We’ll make sure it does route traffic through OpenVPN by uncommenting some lines in
Locate and uncomment these three lines:
push "redirect-gateway def1 bypass-dhcp" push "dhcp-option DNS 126.96.36.199" push "dhcp-option DNS 188.8.131.52"
The preset DNS servers are for OpenDNS but you can set them to whatever DNS you like (such as Google DNS with
You may also allow clients to directly communicate with each other’s IPs by uncommenting:
If, as mentioned earlier, you want to use the same keys and certificates for multiple clients (which is slightly less secure) uncomment this line:
Compression can be enabled and disabled with this line:
Your cipher can be set manually by uncommenting one of these lines:
cipher BF-CBC # Blowfish (default) cipher AES-128-CBC # AES cipher DES-EDE3-CBC # Triple-DES
Note: Whichever cipher you use must also be defined in the client config file which we will create later.
Additional ciphers are also available, such as
Enable OpenVPN to load on boot and load with the
service command by adding the following line to
Add these lines at the bottom of the file:
The OpenVPN server is now fully configured and will load on boot.
Start the server manually with:
service openvpn start
add net 10.8.0.0: gateway 10.8.0.2
Your OpenVPN server is now running.
On the server we’ll create the configuration file for each client.
First, create a folder to work in:
mkdir -p /usr/local/etc/openvpn/clients/clientName
clientName the client name we set earlier while generating certificates. (It doesn’t matter precisely how you set this since it is only a working directory.)
Move to the new directory:
Copy in the client key and certificate we generated with
easy-rsa, and the sample
client.conf file. Make sure you replace the
clientName with the name you used earlier for the
cp /usr/local/etc/openvpn/easy-rsa/keys/clientName.crt /usr/local/etc/openvpn/easy-rsa/keys/clientName.key ./ cp /usr/local/share/examples/openvpn/sample-config-files/client.conf ./client.conf cp /usr/local/etc/openvpn/ca.crt ./
clientName was what we used earlier.
remote line to include your server’s IP address (which can be obtained with
ifconfig) and the port number;
1194 is the default:
remote your_server_ip 1194
Note: If you modified the server’s
comp-lzosettings, then this must be reflected in the
client.conffile. Use the same settings you did previously; for example:
cipher aes-256-cbc ;comp-lzo
This setting uses the
aes-256-cbccipher and disables compression.
If you changed the
protoline in the server configuration, then this also needs to be reflected in the client.
Make sure these lines match what you set earlier; if you didn’t change anything on the server side, don’t change them here.
Now a bit of housekeeping; we will be embedding the certificates and key in the single configuration file. This makes it easier to transfer to individual clients. Alternately, you can download the configuration file and the key and two certificate files to the client separately.
In the same
client.conf file, comment out the certificate and key file names:
;ca ca.crt ;cert client.crt ;key client.key
Save your changes.
Finally, we need to embed the
clientName.key files in the configuration file. You can copy and paste the contents in using
nano or whatever you’re most comfortable with, and the appropriate variables for OpenVPN, or you can use the one-line script shown below.
Run this script and enter your
clientName when prompted. The script appends your certificate and key files to the
client.conf file, with appropriate variable names and newlines that OpenVPN is expecting:
echo "Enter clientName:" && set CLIENTNAME = $< && printf "\n<ca>\n" >> ./client.conf && cat ./ca.crt >> ./client.conf && printf "</ca>\n" >> ./client.conf && printf "\n<cert>" >> ./client.conf && grep -v '^ ' ./$CLIENTNAME.crt | grep -v 'Certificate' >> ./client.conf && printf "</cert>\n" >> ./client.conf && printf "\n<key>\n" >> ./client.conf && cat ./$CLIENTNAME.key >> ./client.conf && printf "</key>\n" >> ./client.conf
Make sure you scroll all the way to the right, since this is a long command.
Take a look at the finished
client.conf file with
cat. You should see the key and certificates added to the file at the bottom.
You’re done! All that needs to be done now is to distribute the
client.conf file to your client. Most clients prefer the extension
.conf, so you will want to rename the file locally to
my_vpn.ovpn or something similar.
Repeat this section for each client. Use separate certificates by default, or use the same client certificate on each client if you prefer.
You should now have a working OpenVPN server!
Download the client configuration file you created in the last step (
/usr/local/etc/openvpn/clients/clientName/client.conf) to your local machine. Use a secure method to download the file, such as SCP or SFTP.
Make sure your client configuration file is named as expected; this is usually a name like
Double-click the file or move it to your client’s expected directory.
Start your client and connect to the appropriate OpenVPN server.
To ensure your VPN is working, use an IP address checker such as http://www.whatismyip.com/. Your IP shown should match your OpenVPN server’s IP.
Congratulations! You’ve connected to your new OpenVPN server.
Thanks for learning with the DigitalOcean Community. Check out our offerings for compute, storage, networking, and managed databases.
Click here to Sign up and get $200 of credit to try our products over 60 days!