// Tutorial //

How to Set Up and Configure an OpenVPN Server on Debian 6

Published on May 3, 2013
Default avatar
By
How to Set Up and Configure an OpenVPN Server on Debian 6

Getting Started

You will need to open an SSH connection on your cloud server as the root user or an SSH connection to a user with sudo access. This guide assumes a user with sudo access. However you can set things up using root just by stripping the 'sudo' from the start of each command. If your system is running on Linux or Mac, you can use SSH with the Terminal program. If you are using Windows, you can use SSH with PuTTY. Once you have the Terminal opened, assuming you're using a Linux/Mac system, you can login by typing the following command:
ssh username@ipaddress

Enter the password when you’re asked to, and you’re ready to start setting up OpenVPN.

Install OpenVPN and generate necessary files


Before we start installing OpenVPN and its prerequisites, we should make sure all of the packages on our system are up to date. We can do that with the following command:

sudo apt-get update

This should have apt, Debian’s package manager. Download all the updates for any packages that have them.

sudo apt-get upgrade

After our system has downloaded all its updates, we can finally install OpenVPN.

sudo apt-get install openvpn udev

Once the installation is done, you are ready to begin configuring OpenVPN. To begin, you should copy all the files for encryption from their default directory into the directory they should be in for the cloud server to read them.

sudo cp -r /usr/share/doc/openvpn/examples/easy-rsa /etc/openvpn

Now that you’ve done that, you can begin generating the RSA algorithm files for your VPN. You will be asked to provide various values when you’re generating these keys. You can set these to whatever you would like to, but bear in mind that they will be included in the certificates you generate.

To begin, access into the following directory:

cd /etc/openvpn/easy-rsa/2.0/

Then generate the RSA files:

source ./vars
sudo ./clean-all
sudo ./build-ca

After the certificate is generated, you can make the private key for the server. To do this, type the following command, and change ‘server’ to what you’d like the name of your OpenVPN server to be. This script will also ask you for information.

sudo . /etc/openvpn/easy-rsa/2.0/build-key-server server

Generate the Diffie Hellman key exchange parameters.

sudo . /etc/openvpn/easy-rsa/2.0/build-dh

Now generate the keys for each client this installation of OpenVPN will host. You should do this step for each client this installation will host, making sure each client’s key identifier is unique.

sudo . /etc/openvpn/easy-rsa/2.0/build-key client

Move the files for the server certificates and keys to the /etc/openvpn directory now. Replace server.crt and server.key with the file names that you used.

sudo cp /etc/openvpn/easy-rsa/2.0/keys/ca.crt /etc/openvpn
sudo cp /etc/openvpn/easy-rsa/2.0/keys/ca.key /etc/openvpn
sudo cp /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem /etc/openvpn
sudo cp /etc/openvpn/easy-rsa/2.0/keys/server.crt /etc/openvpn
sudo cp /etc/openvpn/easy-rsa/2.0/keys/server.key /etc/openvpn

If you need to remove someone’s access to the VPN, just send the following two commands. Replacing ‘client’ with the name of the client to be removed.

sudo . /etc/openvpn/easy-rsa/2.0/vars
sudo . /etc/openvpn/easy-rsa/2.0/revoke-full client1

Configure OpenVPN


Now that you have generated the files for our configuration, you can go ahead and configure your OpenVPN server and client. To retrieve the files, execute the following commands:

sudo gunzip -d /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz
sudo cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf /etc/openvpn
sudo cp /usr/share/doc/openvpn/examples/sample-config-files/client.conf ~/
cd

You should modify the client configuration file to match what you’d like it to do. You can also modify several values in the following file to match what you’d like. In order to do this, you first change the ‘remote’ option so it can connect to your cloud server’s IP address on whichever port you configured your OpenVPN to run on. Then change the ‘cert’ and ‘key’ values to reflect the names of your own certificate and key. After these values have been edited you can save the file by typing in Ctrl+X, type ‘y’, then hit Enter.

Now copy the client configuration file, along with the client keys and certificates located in /etc/openvpn/easy-rsa/2.0/keys to the local machines of the clients.

nano ~/client.conf

After you’ve done this, you just need to make a few changes to your server configuration file before we finalize. Change the files that the ‘cert’ and ‘key’ options point to in the following file to match the certificate and key that your server is using.

sudo nano /etc/openvpn/server.conf

After that’s finished, you’re ready to go! Just restart OpenVPN and you’ve got a working OpenVPN installation on Debian 6!

sudo /etc/init.d/openvpn restart

Want to learn more? Join the DigitalOcean Community!

Join our DigitalOcean community of over a million developers for free! Get help and share knowledge in our Questions & Answers section, find tutorials and tools that will help you grow as a developer and scale your project or business, and subscribe to topics of interest.

Sign up
About the authors

Still looking for an answer?

Was this helpful?
10 Comments

This textbox defaults to using Markdown to format your answer.

You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

This comment has been deleted

all command work normally except “/etc/init.d/openvpn restart” I am using WD MyCloud EX2Ultra and try to install openvpn service on it. some command need to change like “apt-get” transfer to “opkg”.

cp: cannot stat ‘/usr/share/doc/openvpn/examples/easy-rsa’: No such file or directory

I’m getting this error. :/

To get this working with all my traffic (inc web browsing) I had to:

Edit my server.conf by uncommenting push “redirect-gateway def1 bypass-dhcp” as well as push “dhcp-option DNS <ip>” push “dhcp-option DNS <ip>”

Install dnsmasq change DEFAULT_FORWARD_POLICY to ACCEPT in /etc/default/ufw uncomment net.ipv4.ip_forward=1 in /etc/ufw/sysctl.conf


add

nat Table rules

*nat :POSTROUTING ACCEPT [0:0]

Forward traffic from wlan0 through eth0

-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

don’t delete the ‘COMMIT’ line or these nat table rules won’t be processed

COMMIT

to /etc/ufw/before.rules (very top of file)


allow 1194/udp in ufw.

restart firewall and networking and all worked finally :|

running Debian 7 x64

Hi, i’m getting this error when I try to start openvpn service:

root@VPN:~# service openvpn restart
[ ok ] Stopping virtual private network daemon:.
[....] Starting virtual private network daemon: serverSIOCSIFADDR: No such device
: ERROR while getting interface flags: No such device
SIOCSIFDSTADDR: No such device
: ERROR while getting interface flags: No such device
SIOCSIFMTU: No such device
 failed!

This might be relevant and helpful for those having issues loading the tun device / tun kernel module: modprobe tun - ERROR: could not insert ‘tun’: Unknown symbol in module

You may want to add to the guide that vars, clean-all and build-ca are not executable. Naturally you just have to run “sudo chmod +x vars clean-all build-ca” after cd’ing to /etc/openvpn/easy-rsa/2.0/.

For the ./vars issue, I found a solution here, and it also works in my case.

  1. Open the terminal and type sudo su to log in as root
  2. move to the easy-rsa directory (on mine, the files are in easy-rsa/2.0/)
  3. type mkdir keys
  4. type source ./vars
  5. type ./clean-all
  6. type ./build-ca …

I find this tutorial helpful, but there is a bit more details here: http://www.openlogic.com/wazi/bid/188052/From-Zero-to-OpenVPN-in-30-Minutes

My VPN clients are all gentoo based, here is how to make the VPN connection start on boot (gentoo specific): http://lpig.wordpress.com/2011/02/11/gentoo-as-a-openvpn-client/

I haven’t got this working for me when I hit the sudo ./vars step. It keeps asking for me to make sure I source the vars file first.