How To Configure and Connect to a Private OpenVPN Server on FreeBSD 10.1

• A FreeBSD 10.1 server. Server size depends on how many clients you intend to connect to the VPN; 519 MB is fine for a few clients
• Root access

This tutorial requires root access. In this tutorial, the server we use refers to a default freebsd user, then access to the root shell:

sudo tcsh

Installing OpenVPN with the pkg system is quite simple. Simply run these commands to update the package lists and install the VPN software:

pkg update
pkg install openvpn

This should also install the easy-rsa package, which will be used to generate the SSL key pairs.

For this tutorial we will base our configuration file on the sample one provided by OpenVPN. We’ll create a configuration folder for OpenVPN:

mkdir /usr/local/etc/openvpn

Copy the example server.conf file to the new directory.

cp /usr/local/share/examples/openvpn/sample-config-files/server.conf /usr/local/etc/openvpn/server.conf

Install nano or your favorite text editor:

pkg install nano

Open the config file for editing:

nano /usr/local/etc/openvpn/server.conf

Note: The OpenVPN configuration file format prefixes comments with semicolons (;) or hashes (#). In the example, semicolons are used to comment (disable) configuration options, and hashes are used for comments.

If you know what configuration options you want to modify you may do so at this point.

• Optional port: The default port is 1194, but you can change this to anything you like
• Optional proto: Choose either tcp or udp; the default is fine
• user and group: Set these to nobody by uncommenting the lines. This will make OpenVPN run with fewer privileges, for security

user nobody
group nobody

Note: Each configuration can run only one port and protocol at once.

Finally, be sure to save your changes.

easy-rsa makes generating certs and keys simple.

First, copy the program to your configuration directory, since you will be modifying values.

cp -r /usr/local/share/easy-rsa /usr/local/etc/openvpn/easy-rsa

Open the vars file for editing:

nano /usr/local/etc/openvpn/easy-rsa/vars

Change the key size by modifying this line:

export KEY_SIZE=2048

These days the standard is 2048-bit keys, although you can also use 4096-bit, which is more secure but slows down negotiation.

If you like you can also set the default certificate and key values in this file so you don’t have to enter them later.

Since the shell we’re using is tcsh, the export lines need to be replaced with setenv. This is done with sed before the source. Move to our easy-rsa directory (required).

cd /usr/local/etc/openvpn/easy-rsa/

Replace the lines:

cat ./vars | sed -e 's/export /setenv /g' -e 's/=/ /g' | source /dev/stdin

Still from our /usr/local/etc/openvpn/easy-rsa/ directory, first clean the directory, then build the certificate authority (CA).

./clean-all
./build-ca

You will be prompted to set the CA options. Fill these in with your details:

Country Name (2 letter code) [US]:GB
State or Province Name (full name) [CA]:Somerset
Locality Name (eg, city) [SanFrancisco]:Bath
Organization Name (eg, company) [Fort-Funston]:Callum
Organizational Unit Name (eg, section) [changeme]:VPN
Common Name (eg, your name or your server's hostname) [changeme]:vpn.example.com
Name [changeme]:Callum's VPN CA
Email Address [mail@host.domain]:callum@example.com

Now build the server key:

./build-key-server server

Again, set the options. You do not need a password or an optional company name.

Enter y to sign and commit the key:

Country Name (2 letter code) [US]:GB
State or Province Name (full name) [CA]:Somerset
Locality Name (eg, city) [SanFrancisco]:Bath
Organization Name (eg, company) [Fort-Funston]:Callum
Organizational Unit Name (eg, section) [changeme]:VPN
Common Name (eg, your name or your server's hostname) [server]:vpn.example.com
Name [changeme]:Callum's VPN Server
Email Address [mail@host.domain]:callum@example.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []: ENTER
An optional company name []: ENTER

Certificate is to be certified until Feb  5 14:40:15 2025 GMT (3650 days)
Sign the certificate? [y/n]: y

1 out of 1 certificate requests certified, commit? [y/n] y
Write out database with 1 new entries
Data Base Updated

Finally the Diffie-Hellman key must be generated. This can take some time depending on key size:

./build-dh

Now that all the server keys and certs are generated, they should be copied to our OpenVPN configuration directory.

cd /usr/local/etc/openvpn/easy-rsa/keys/
cp dh*.pem ca.crt server.crt server.key /usr/local/etc/openvpn/

You’re done with the server certificates! Now on to the client certificate.

Each client will also each need a certificate and key in order to authenticate and connect to the VPN. Make sure you’re in the /usr/local/etc/openvpn/easy-rsa/ directory.

cd /usr/local/etc/openvpn/easy-rsa/

Run the following command, where clientName is the name you want to use for this particular client certificate.

./build-key clientName

You will be prompted to enter the country name, city name, etc. again. The process is the same as for the server key generation. This is intended to be the information of the client but none of it really matters.

You don’t need a passphrase or company name. Enter y to sign and commit the certificate.

Note: It is a good practice to use a different certificate for each client, and this is enforced by OpenVPN by default. However, if required, this can be disabled in the OpenVPN configuration (explained later).

If you used a key size different from 2048 you will need to modify the OpenVPN configuration to match the file name of the key size you used. If you don’t remember, you can view the correct file name of the dh file with this command:

ls /usr/local/etc/openvpn/easy-rsa/keys/dh*.pem

Edit the server.conf:

nano /usr/local/etc/openvpn/server.conf

Replace the line dh dh2048.pem with:

dh dhSIZE.pem

If you followed our recommendation for the 2048-bit key earlier, you don’t have to make any changes.

Repeat this section for each separate client certificate you want to create.

FreeBSD includes natd as part of the ipfw firewall which allows for NAT routing and can be used for OpenVPN. In order to use this, edit /etc/rc.conf:

nano /etc/rc.conf

Add these contents at the bottom:

firewall_enable="YES"
firewall_type="open"

gateway_enable="YES"
natd_enable="YES"
natd_interface="vtnet0"
natd_flags="-dynamic -m"

• firewall_enable enables the ipfw firewall which is needed for natd
• firewall_type="open" makes the firewall allow traffic as default
• gateway_enable sets net.inet.ip.forwarding to 1 which allows IPv4 routing on the system
• natd_enable enables the actual NAT router
• natd_interface is the external interface towards the Internet;
• natd_flags makes the NAT dynamic and -m preserves port numbers

Now reboot your server to load ipfw and natd:

reboot

Log in again. After the reboot, remember to run sudo tcsh again to become root if you aren’t already.

By default OpenVPN isn’t configured to tell the client to route Internet traffic through the VPN. We’ll make sure it does route traffic through OpenVPN by uncommenting some lines in /usr/local/etc/openvpn/server.conf:

nano /usr/local/etc/openvpn/server.conf

Locate and uncomment these three lines:

push "redirect-gateway def1 bypass-dhcp"

push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"

The preset DNS servers are for OpenDNS but you can set them to whatever DNS you like (such as Google DNS with 8.8.8.8 and 8.8.4.4).

Optional settings:

You may also allow clients to directly communicate with each other’s IPs by uncommenting:

client-to-client

If, as mentioned earlier, you want to use the same keys and certificates for multiple clients (which is slightly less secure) uncomment this line:

duplicate-cn

Compression can be enabled and disabled with this line:

comp-lzo

Your cipher can be set manually by uncommenting one of these lines:

cipher BF-CBC        # Blowfish (default)
cipher AES-128-CBC   # AES
cipher DES-EDE3-CBC  # Triple-DES

Note: Whichever cipher you use must also be defined in the client config file which we will create later.

Additional ciphers are also available, such as aes-256-cbc.

Enable OpenVPN to load on boot and load with the service command by adding the following line to /etc/rc.conf:

nano /etc/rc.conf

Add these lines at the bottom of the file:

openvpn_enable="YES"
openvpn_configfile="/usr/local/etc/openvpn/server.conf"

The OpenVPN server is now fully configured and will load on boot.

Start the server manually with:

service openvpn start

Expected output:

add net 10.8.0.0: gateway 10.8.0.2

Your OpenVPN server is now running.

On the server we’ll create the configuration file for each client.

First, create a folder to work in:

mkdir -p /usr/local/etc/openvpn/clients/clientName

Make clientName the client name we set earlier while generating certificates. (It doesn’t matter precisely how you set this since it is only a working directory.)

Move to the new directory:

cd /usr/local/etc/openvpn/clients/clientName/

Copy in the client key and certificate we generated with easy-rsa, and the sample client.conf file. Make sure you replace the clientName with the name you used earlier for the .key and .crt files:

cp /usr/local/etc/openvpn/easy-rsa/keys/clientName.crt /usr/local/etc/openvpn/easy-rsa/keys/clientName.key ./
cp /usr/local/share/examples/openvpn/sample-config-files/client.conf ./client.conf
cp /usr/local/etc/openvpn/ca.crt ./

Again, clientName was what we used earlier.

Edit the client.conf file:

nano ./client.conf

Update the remote line to include your server’s IP address (which can be obtained with ifconfig) and the port number; 1194 is the default:

remote your_server_ip 1194

Note: If you modified the server’s cipher or comp-lzo settings, then this must be reflected in the client.conf file. Use the same settings you did previously; for example:

cipher aes-256-cbc
;comp-lzo

This setting uses the aes-256-cbc cipher and disables compression.

If you changed the proto line in the server configuration, then this also needs to be reflected in the client.

Make sure these lines match what you set earlier; if you didn’t change anything on the server side, don’t change them here.

Now a bit of housekeeping; we will be embedding the certificates and key in the single configuration file. This makes it easier to transfer to individual clients. Alternately, you can download the configuration file and the key and two certificate files to the client separately.

In the same client.conf file, comment out the certificate and key file names:

;ca ca.crt
;cert client.crt
;key client.key

Save your changes.

Finally, we need to embed the ca.crt, clientName.crt and clientName.key files in the configuration file. You can copy and paste the contents in using cat or nano or whatever you’re most comfortable with, and the appropriate variables for OpenVPN, or you can use the one-line script shown below.

Run this script and enter your clientName when prompted. The script appends your certificate and key files to the client.conf file, with appropriate variable names and newlines that OpenVPN is expecting:

echo "Enter clientName:" && set CLIENTNAME = $< && printf "\n<ca>\n" >> ./client.conf && cat ./ca.crt >> ./client.conf && printf "</ca>\n" >> ./client.conf && printf "\n<cert>" >> ./client.conf && grep -v '^ ' ./$CLIENTNAME.crt | grep -v 'Certificate' >> ./client.conf && printf "</cert>\n" >> ./client.conf && printf "\n<key>\n" >> ./client.conf && cat ./$CLIENTNAME.key >> ./client.conf && printf "</key>\n" >> ./client.conf

Make sure you scroll all the way to the right, since this is a long command.

Take a look at the finished client.conf file with nano or cat. You should see the key and certificates added to the file at the bottom.

You’re done! All that needs to be done now is to distribute the client.conf file to your client. Most clients prefer the extension .ovpn to .conf, so you will want to rename the file locally to my_vpn.ovpn or something similar.

Repeat this section for each client. Use separate certificates by default, or use the same client certificate on each client if you prefer.

Conclusion and Client Setup

You should now have a working OpenVPN server!

Download the client configuration file you created in the last step (/usr/local/etc/openvpn/clients/clientName/client.conf) to your local machine. Use a secure method to download the file, such as SCP or SFTP.

Also on your local machine, install an OpenVPN client. Tunnelblick works well on Mac OS X, and OpenVPN has a Windows client.

Make sure your client configuration file is named as expected; this is usually a name like my_vpn.ovpn.

Double-click the file or move it to your client’s expected directory.

Start your client and connect to the appropriate OpenVPN server.

To ensure your VPN is working, use an IP address checker such as http://www.whatismyip.com/. Your IP shown should match your OpenVPN server’s IP.

Congratulations! You’ve connected to your new OpenVPN server.