{"id":650,"date":"2014-08-29T00:29:14","date_gmt":"2014-08-29T00:29:14","guid":{"rendered":"https:\/\/qbytes.cloud\/?p=650"},"modified":"2014-08-29T00:29:14","modified_gmt":"2014-08-29T00:29:14","slug":"openvpn","status":"publish","type":"post","link":"https:\/\/www.qbytes.cloud\/index.php\/2014\/08\/29\/openvpn\/","title":{"rendered":"Set up OpenVPN Server and Client on Windows 10"},"content":{"rendered":"

Need to setup a VPN? Here’s how to download and install OpenVPN.<\/p>\n

SERVER SETUP<\/h2>\n

Download the installer from https:\/\/openvpn.net\/index.php\/download\/community-downloads.html<\/a> and run it on the server computer.<\/p>\n

\"\"<\/a><\/p>\n

Open the installer file and start the installation.<\/p>\n

 <\/p>\n

\"\"<\/a><\/p>\n

    \n
  1. Remember to adjust the Windows firewall (open the 1194 UDP port).<\/li>\n
  2. Assign a static IP to the new created TAP interface (like 10.8.0.1).<\/li>\n
  3. Install OpenVPN on each client. (This step can be skipped for now and done at any convenient time)<\/li>\n
  4. Choose All check boxes for the install<\/li>\n<\/ol>\n

    Certificates and Keys<\/h3>\n

    Preparatory Steps<\/p>\n

    Navigate to the C:\\Program Files\\OpenVPN\\easy-rsa folder in the command prompt:<\/p>\n

    Press Windows Key + R
    \nType “cmd.exe” and press Enter.
    \ncmd.exe<\/p>\n

    Right click to run as administrator
    \nNavigate to the correct folder:<\/p>\n

    cd "C:\\Program Files\\OpenVPN\\easy-rsa"\n<a href="https:\/\/qbytes.cloud\/wp-content\/uploads\/2014\/08\/cmdcall.jpg"><img class="alignnone size-large wp-image-5187" src="https:\/\/qbytes.cloud\/wp-content\/uploads\/2014\/08\/cmdcall-1024x593.jpg" alt="" width="648" height="375" \/><\/a>\n<\/pre>\n
    Initialize the OpenVPN configuration:<\/p>\n
    init-config\n<a href="https:\/\/qbytes.cloud\/wp-content\/uploads\/2014\/08\/init.jpg"><img class="alignnone size-full wp-image-5188" src="https:\/\/qbytes.cloud\/wp-content\/uploads\/2014\/08\/init.jpg" alt="" width="597" height="133" \/><\/a>\n\n<\/pre>\n
    NOTE: Only run init-config once, during installation.
    \nOpen the vars.bat file in a text editor:<\/p>\n
    notepad vars.bat\n\n<\/pre>\n
    Edit the following lines in vars.bat, replacing “US”, “CA,” etc. with your company’s information:<\/p>\n
    set KEY_COUNTRY=US\nset KEY_PROVINCE=CA\nset KEY_CITY=SanFrancisco\nset KEY_ORG=OpenVPN\nset KEY_EMAIL=mail@host.domain\n\n<\/pre>\n
    Save the file and exit notepad.
    \nRun the following commands:<\/p>\n
    vars\n\n<\/pre>\n
    clean-all\n\n<\/pre>\n
    Building Certificates and Keys<\/h3>\n
    The certificate authority (CA) certificate and key:<\/p>\n
    build-ca\n\n<\/pre>\n
    When prompted, enter your country, etc. These will have default values, which appear in brackets. For your “Common Name,” a good choice is to pick a name to identify your company’s Certificate Authority. For example, “OpenVPN-CA”:<\/p>\n
    Country Name (2 letter code) [US]:\nState or Province Name (full name) [CA]:\nLocality Name (eg, city) [SanFrancisco]:\nOrganization Name (eg, company) [OpenVPN]:\nOrganizational Unit Name (eg, section) []:\nCommon Name (eg, your name or your server's hostname) []:OpenVPN-CA\nEmail Address [mail@host.domain]:\n\n* This builds the ca key in C:\\Program Files\\OpenVPN\\easy-rsa\\keys\n\n<\/pre>\n
    The server certificate and key:<\/strong><\/p>\n
    build-key-server server\n\n<\/pre>\n
    When prompted, enter the “Common Name” as “server”
    \nWhen prompted to sign the certificate, enter “y”
    \nWhen prompted to commit, enter “y”<\/p>\n
    Client certificates and keys:<\/strong><\/p>\n
    For each client, choose a name to identify that computer, such as “mike-laptop” in this example.<\/p>\n
    build-key mike-laptop\n\n<\/pre>\n
    When prompted, enter the “Common Name” as the name you have chosen (e.g. “mike-laptop”)
    \nRepeat this step for each client computer that will connect to the VPN.
    \nGenerate Diffie Hellman parameters (This is necessary to set up the encryption)<\/p>\n
    build-dh\n\n<\/pre>\n
    Set up the ta.key file.
    \nIn command prompt as administrator, go to cd “C:\\Program Files\\OpenVPN\\bin”<\/p>\n
    # openvpn --genkey --secret ta.key\n<\/pre>\n
    copy the file to the C:\\Program Files\\OpenVPN\\config directory and to your config directory on your local machine.<\/p>\n
    Configuration Files<\/h3>\n
    Find the sample configuration files:
    \nStart Menu > All Programs > OpenVPN > OpenVPN Sample Configuration Files<\/p>\n
    \"\"<\/a><\/p>\n
    Server Config File<\/h3>\n
    go to\u00a0C:\\Program Files\\OpenVPN\\sample-config<\/p>\n
    Open server.ovpn<\/p>\n
    Find the following lines:<\/p>\n
    ca ca.crt\ncert server.crt\nkey server.key\ndh dh2048.pem\n\n<\/pre>\n
    Edit them as follows:<\/p>\n
    ca "C:\\\\Program Files\\\\OpenVPN\\\\easy-rsa\\\\keys\\\\ca.crt"\ncert "C:\\\\Program Files\\\\OpenVPN\\\\easy-rsa\\\\keys\\\\server.crt"\nkey "C:\\\\Program Files\\\\OpenVPN\\\\easy-rsa\\\\keys\\\\server.key"\n<\/pre>\n
    Find the following line for the Diffie hellman parameters:<\/p>\n
    dh\n<\/pre>\n
    And edit as follows:<\/p>\n
    "C:\\\\Program Files\\\\OpenVPN\\\\easy-rsa\\\\keys\\\\dh2048.pem"\n<\/pre>\n
    Save the file as C:\\Program Files\\OpenVPN\\easy-rsa\\server.ovpn<\/p>\n
    Set up the ta.key file.<\/p>\n
    In the server configuration, add:
    \nSet the ta.key path to C:\\Program Files\\OpenVPN\\config\\ta.key<\/p>\n
    tls-auth “C:\\\\Program Files\\\\OpenVPN\\\\config\\\\ta.key” ta.key 0<\/p>\n
    Client Installation<\/h3>\n
    Download the installer to the client Windows 10 Machine and run the intsaller. Leave the defaults selected.<\/p>\n
    \"\"<\/a><\/p>\n
    Client Config Files<\/h3>\n
    This is similar to the server configuration.<\/p>\n
    Open client.ovpn ON THE SERVER MACHINE located at C:\\Program Files\\OpenVPN\\sample-config
    \nFind the following lines:<\/p>\n
    ca ca.crt\ncert client.crt\nkey client.key\n\n<\/pre>\n
    Edit them as follows:<\/p>\n
    ca "C:\\\\Program Files\\\\OpenVPN\\\\config\\\\ca.crt"\ncert "C:\\\\Program Files\\\\OpenVPN\\\\config\\\\mike-laptop.crt"\nkey "C:\\\\Program Files\\\\OpenVPN\\\\config\\\\mike-laptop.key"\n\n<\/pre>\n
    Notice that the name of the client certificate and key files depends upon the Common Name of each client.
    \nYou can also include the ca, cert and key content in the client file. You have to copy the file content inside the tag .<\/p>\n
    Edit the following line, replacing “my-server-1” with your server’s public Internet IP Address or Domain Name. If you need help, see Static Internet IP below.<\/p>\n
    remote my-server-1 1194\n\n<\/pre>\n
    Save the file as C:\\Program Files\\OpenVPN\\easy-rsa\\mike-laptop.ovpn (in this example. Each client will need a different, but similar, config file depending upon that client’s Common Name.)
    \nCopying the Server and Client Files to Their Appropriate Directories
    \nCopy these files from C:\\Program Files\\OpenVPN\\easy-rsa\\keys to C:\\Program Files\\OpenVPN\\config\\ on the server:<\/p>\n
    ca.crt\ndh1024.pem\nserver.crt\nserver.key\n\nCopy this file from C:\\Program Files\\OpenVPN\\easy-rsa\\ to C:\\Program Files\\OpenVPN\\config\\ on the server:\nserver.ovpn\n\n<\/pre>\n
    Copy these files from C:\\Program Files\\OpenVPN\\easy-rsa\\keys on the server to C:\\Program Files\\OpenVPN\\config\\ on each client (mike-laptop, in this example):<\/p>\n
    ca.crt\nmike-laptop.crt\nmike-laptop.key\n\nCopy these files from C:\\Program Files\\OpenVPN\\easy-rsa\\ on the server to C:\\Program Files\\OpenVPN\\config\\ on each client (mike-laptop, in this example):\n\nmike-laptop.ovpn\n\nCopy this file from C:\\Program Files\\OpenVPN\\config\\ on the server to C:\\Program Files\\OpenVPN\\config\\ on each client (mike-laptop, in this example):\n\nta.key\n\nAlso, instead of setting up the paths in the files, you can add them directly like follows. \n\n&lt;ca&gt;&lt;\/ca&gt;\n&lt;cert&gt;&lt;\/cert&gt;\n&lt;key&gt;&lt;\/key&gt;\n<\/pre>\n
    Starting OpenVPN<\/h3>\n
    On both client and server, run OpenVPN from:
    \nStart Menu -> All Programs -> OpenVPN -> OpenVPN GUI
    \nDouble click the icon which shows up in the system tray to initiate the connection. The resulting dialog should close upon a successful start.<\/p>\n
    Running OpenVPN as a Service<\/h3>\n
    OpenVPN to be run from a non-administrator account.
    \nOpenVPN to be started automatically on system startup. This is often preferred on the server machine, as well as any machines which will be constantly connected to the server.
    \nRun the Windows Service administrative tool:
    \nPress Windows Key + R
    \nType “services.msc” and press Enter.
    \nservices.msc
    \nFind the OpenVPN service, and set its Startup Type to “automatic.”
    \nOptionally, start the service now.<\/p>\n
    \"\"<\/a><\/p>\n
    Further Considerations \/ Troubleshooting<\/h3>\n
    Firewall Configuration<\/strong>
    \nIf you have connection problems, make sure to set a rule on your server’s firewall allowing incoming traffic on UDP port 1194.<\/p>\n
    Port Forwarding<\/strong>
    \nIf your server is behind a firewall\/router, you will need to forward the port chosen for OpenVPN (in this example UDP 1194) to the server. Consult your router’s documentation for details on this.<\/p>\n
    To set up port forwarding, you will likely need to set up the server with a static local IP address instead of the default dynamic (changing) IP. Make sure to choose a static IP address that is not in the range your router might assign as a dynamic IP, but is within the router’s subnet (usually 192.168.0.xxx , 10.0.0.xxx , or similar).<\/p>\n
    Security Tips<\/h3>\n
    Transmit all needed files to the client computers using a secure means such as a USB drive (email is not always a secure means).
    \nChoose a port other than UDP 1194, and replace the port number wherever this guide mentions UDP port 1194.<\/p>\n
    IP or DNS leak<\/h3>\n
    OpenVPN Internet Proxy Windows<\/h3>\n
    This has all internet traffic route to the server IP so your IP is not disclosed.<\/p>\n
    Generate a TA key and place it in the same folder as the other certificates\/keys:<\/p>\n
    cd C:\\Program Files\\OpenVPN\\bin\nopenvpn --genkey --secret ta.key\n<\/pre>\n
    Copy the key to the C:\\Program Files\\OpenVPN\\config directory
    \nAppend the following lines to your server.ovpn profile:<\/p>\n
    # Route all traffic through VPN\npush "redirect-gateway def1"\n# Push Google DNS to prevent leak\npush "dhcp-option DNS 8.8.8.8"\ntls-auth ta.key 0 # This file is secret\n\n<\/pre>\n
    Set the serer.ovpn file to use the following network as the network sharing below will use this network for the adaptor.<\/p>\n
    # server 192.168.137.0 255.255.255.0\n<\/pre>\n
    Append the following lines to your client.ovpn profile:<\/p>\n
    # Block DNS leak\nblock-outside-dns\ntls-auth ta.key 1 # This file is secret\n<\/pre>\n
    Service tweaks on the Windows server
    \nOpen the Services window
    \nFind Routing and Remote Access and set it to: Startup type – Automatic
    \nStart the service
    \nAdapter tweaks
    \nOpen the network adapters window
    \nRight-click your internet adapter (e.g. Ethernet) and then: Properties -> Sharing -> Allow other network users to connect through this computer’s Internet connection
    \n(if applicable) From the drop-down list select your OpenVPN TAP adapter (e.g. Ethernet?)
    \nNote: Only one adapter can be shared at a time, so if you don’t see the Sharing tab, make sure no other adapter is being shared.<\/p>\n
    Registry tweaks<\/p>\n
    Key: HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters\nValue: IPEnableRouter\nType: REG_DWORD\nData: 0x00000001 (1)\n\n<\/pre>\n
    Optional: Configure a static route (if behind router)
    \nYou have to route all packets sent to the client’s virtual IP back to the VPN server.<\/p>\n
    Example using Cisco router:<\/p>\n
    10.8.0.0 – virtual network subnet
    \n255.255.255.0 – virtual network subnet mask
    \n192.168.1.175 – VPN server internal IP (in the subnet of the router)<\/p>\n
    Hardening iformation; https:\/\/community.openvpn.net\/openvpn\/wiki\/Hardening<\/p>\n
    Setting up new user certificates<\/h3>\n
    Navigate to the C:\\Program Files\\OpenVPN\\easy-rsa\\ folder in the command prompt. NOTE: Make sure that the ca.crt and ca.key are located in the C:\\Program Files\\OpenVPN\\easy-rsa\\keys directory!<\/p>\n
    Press Windows Key + R
    \nType \u201ccmd.exe\u201d and press Enter.
    \ncmd.exe<\/p>\n
    Right click to run as administrator
    \nNavigate to the correct folder:<\/p>\n
    cd "C:\\Program Files\\OpenVPN\\easy-rsa\\keys"\n\n<\/pre>\n
    Run the following:<\/p>\n
    vars\n<\/pre>\n
    For each client, choose a name to identify that computer, such as \u201cnewuser-openvpn\u201d in this example.<\/p>\n
    build-key newuser-openvpn\n\n<\/pre>\n
    Open the C:\\Program Files\\OpenVPN\\sample-config directory. Copy the client.ovpn to the name for the new user, ie, newuser-openvpn.ovpn.<\/p>\n
    Copy these files from C:\\Program Files\\OpenVPN\\easy-rsa\\keys and C:\\Program Files\\OpenVPN\\easy-rsa\\sample-config on the server to C:\\Program Files\\OpenVPN\\config\\ on each client (newuser-openvpn.ovpn, in this example):<\/p>\n
    ta.key\nca.crt\nnewuser-openvpn.ovpn.crt\nnewuser-openvpn.ovpn.key\nnewuser-openvpn.ovpn.ovpn\n\n<\/pre>\n
    Copy to the C:\\Program Files\\OpenVPN\\config on the new user computer.<\/p>\n
     <\/p>\n
    Other resources: https:\/\/community.openvpn.net\/openvpn\/wiki\/Easy_Windows_Guide<\/p>\n","protected":false},"excerpt":{"rendered":"
    Need to setup a VPN? Here’s how to download and install OpenVPN. SERVER SETUP Download the installer from https:\/\/openvpn.net\/index.php\/download\/community-downloads.html and run it on the server computer. Open the installer file and start the installation.   Remember to adjust the Windows firewall (open the 1194 UDP port). Assign a static IP to the new created TAP … Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[72,121],"tags":[],"class_list":["post-650","post","type-post","status-publish","format-standard","hentry","category-networking","category-vpn"],"_links":{"self":[{"href":"https:\/\/www.qbytes.cloud\/index.php\/wp-json\/wp\/v2\/posts\/650","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.qbytes.cloud\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.qbytes.cloud\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.qbytes.cloud\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.qbytes.cloud\/index.php\/wp-json\/wp\/v2\/comments?post=650"}],"version-history":[{"count":0,"href":"https:\/\/www.qbytes.cloud\/index.php\/wp-json\/wp\/v2\/posts\/650\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.qbytes.cloud\/index.php\/wp-json\/wp\/v2\/media?parent=650"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.qbytes.cloud\/index.php\/wp-json\/wp\/v2\/categories?post=650"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.qbytes.cloud\/index.php\/wp-json\/wp\/v2\/tags?post=650"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}