# Create an OpenVPN server on debian

> Create an OpenVPN server on debian and connect to it with a client.

Published on 2021-10-21 | Updated on 2025-01-12 | Tags: openvpn

https://xsec.fr/en/gnu-linux/openvpn-server/

---

import Callout from '@shared/components/Callout.astro'
import { Steps, Step } from '@/components/ui/steps'
import { Collapsible } from '@shared/components/ui/collapsible'
import { Tree, Folder, File } from '@shared/components/ui/file-tree'

## Server Configuration

<Steps>
<Step title="Install OpenVPN">

```sh
sudo apt update && apt install openvpn
```

</Step>
<Step title="Copy the easy-rsa directory">

easy-rsa is used to generate certificates.

```sh
sudo cp -pr /usr/share/easy-rsa /etc/openvpn/server/ && cd /etc/openvpn/server/easy-rsa
```

<Tree elements={[{id:'1',name:'etc',children:[{id:'2',name:'openvpn',children:[{id:'3',name:'server',children:[{id:'4',name:'easy-rsa'}]}]}]}]} initialExpandedItems={['1','2','3','4']} sort="none" className="h-auto" client:load />

</Step>
<Step title="Rename and edit the vars file from template">

```sh
cp vars.example vars && nano vars
```

<Tree elements={[{id:'1',name:'etc',children:[{id:'2',name:'openvpn',children:[{id:'3',name:'server',children:[{id:'4',name:'easy-rsa',children:[{id:'5',name:'vars.example',type:'file'},{id:'6',name:'vars',type:'file'}]}]}]}]}]} initialExpandedItems={['1','2','3','4']} sort="none" className="h-auto" client:load />

- Search for the following block:

```sh title="/etc/openvpn/server/easy-rsa/vars"
# Organizational fields (used with 'org' mode and ignored in 'cn_only' mode.)
# These are the default values for fields which will be placed in the
# certificate.  Don't leave any of these fields blank, although interactively
# you may omit any specific field by typing the "." symbol (not valid for
# email.)

#set_var EASYRSA_REQ_COUNTRY    "US"
#set_var EASYRSA_REQ_PROVINCE   "California"
#set_var EASYRSA_REQ_CITY       "San Francisco"
#set_var EASYRSA_REQ_ORG        "Copyleft Certificate Co"
#set_var EASYRSA_REQ_EMAIL      "me@example.net"
#set_var EASYRSA_REQ_OU         "My Organizational Unit"

# Choose a size in bits for your keypairs. The recommended value is 2048.  Using
# 2048-bit keys is considered more than sufficient for many years into the
# future. Larger keysizes will slow down TLS negotiation and make key/DH param
# generation take much longer. Values up to 4096 should be accepted by most
# software. Only used when the crypto alg is rsa (see below.)
```

- Uncomment the lines and enter your configuration:

```sh title="/etc/openvpn/server/easy-rsa/vars"
set_var EASYRSA_REQ_COUNTRY     "FR"
set_var EASYRSA_REQ_PROVINCE    "France"
set_var EASYRSA_REQ_CITY        "maville"
set_var EASYRSA_REQ_ORG "xsec"
set_var EASYRSA_REQ_EMAIL       "test@gmail.com"
set_var EASYRSA_REQ_OU          "it"
```

</Step>
<Step title="Create the Certificate Authority">

- Here without password, in production it's recommended to set one.

```sh
./easyrsa init-pki
```

```sh
./easyrsa build-ca nopass
```

```sh title="./easyrsa build-ca nopass"
Note: using Easy-RSA configuration from: /etc/openvpn/server/easy-rsa/vars
Using SSL: openssl OpenSSL 1.1.1k  25 Mar 2021
Generating RSA private key, 2048 bit long modulus (2 primes)
.............................+++++
..................................+++++
e is 65537 (0x010001)
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Common Name (eg: your user, host, or server name) [Easy-RSA CA]:

CA creation complete and you may now import and sign cert requests.
Your new CA certificate file for publishing is at:
/etc/openvpn/server/easy-rsa/pki/ca.crt
```

- `Common Name [Easy-RSA CA]:` Press Enter to keep the default name.

</Step>
<Step title="Generate the server certificate">

- Here without password, in production it's recommended to set one.

```sh
./easyrsa build-server-full server nopass
```

</Step>
<Step title="Generate the client certificate">

- Here without password, in production it's recommended to set one.

```sh
./easyrsa build-client-full client nopass
```

</Step>
<Step title="Generate the dh.pem file">

- This file will be used for the first connection with symmetric encryption

```sh
./easyrsa gen-dh
```

- This operation may take time, depending on your machine's power.

</Step>
<Step title="Generate the key file">

```sh
openvpn --genkey tls-auth ta.key
```

</Step>
<Step title="Reorder the files">

- Copy the entire directory of generated files from the server and the Certificate Authority to `/etc/openvpn/`

```sh
cp pki/issued/server.crt pki/private/server.key pki/ca.crt pki/dh.pem ta.key /etc/openvpn/
```

<Tree elements={[{id:'1',name:'etc',children:[{id:'2',name:'openvpn',children:[{id:'3',name:'server.crt',type:'file'},{id:'4',name:'server.key',type:'file'},{id:'5',name:'ca.crt',type:'file'},{id:'6',name:'dh.pem',type:'file'},{id:'7',name:'ta.key',type:'file'}]}]}]} initialExpandedItems={['1','2']} sort="none" className="h-auto" client:load />

- Copy the entire directory of generated files from the client to `/etc/openvpn/client/`

```sh
cp pki/issued/client.crt pki/private/client.key pki/ca.crt pki/dh.pem ta.key /etc/openvpn/client/
```

<Tree elements={[{id:'1',name:'etc',children:[{id:'2',name:'openvpn',children:[{id:'3',name:'client',children:[{id:'4',name:'client.crt',type:'file'},{id:'5',name:'client.key',type:'file'},{id:'6',name:'ca.crt',type:'file'},{id:'7',name:'dh.pem',type:'file'},{id:'8',name:'ta.key',type:'file'}]}]}]}]} initialExpandedItems={['1','2','3']} sort="none" className="h-auto" client:load />

</Step>
<Step title="Create the configuration file from the template">

```sh
cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf /etc/openvpn/server.conf && cd /etc/openvpn
```

<Tree elements={[{id:'1',name:'etc',children:[{id:'2',name:'openvpn',children:[{id:'3',name:'server.conf',type:'file'},{id:'4',name:'server.crt',type:'file'},{id:'5',name:'server.key',type:'file'},{id:'6',name:'ca.crt',type:'file'},{id:'7',name:'dh.pem',type:'file'},{id:'8',name:'ta.key',type:'file'}]}]}]} initialExpandedItems={['1','2']} sort="none" className="h-auto" client:load />

- Here we copy the configuration file to the default directory `/etc/openvpn/` and enter the directory.

</Step>
<Step title="Rename the dh.pem file">

```sh
mv /etc/openvpn/dh.pem /etc/openvpn/dh2048.pem
```

<Callout variant="note">
By renaming it to `dh2048.pem`, the file `server.conf` will recognize it directly, since the file name `dh2048.pem` is specified by default.
</Callout>

</Step>
<Step title="Test the configuration">

```sh
openvpn --config /etc/openvpn/server.conf
```

<Callout variant="tip">
If your configuration is correct, you will see in the last line:

```plaintext
Initialization Sequence Completed
```
</Callout>

<Collapsible client:load title='Erreur "Already in use"'>

<Callout variant="danger">
If you already have an instance of openvpn running, there may be a conflict with the installation (error: Alredy in use).
You need to find the process that blocks the port of the service.

You can list the list of used ports:

```sh
ss -na
```
</Callout>

You can filter the default port of OpenVPN to see if an instance is running:

```sh
ss -pan | grep 1194
udp   UNCONN 0      0                                         0.0.0.0:1194             0.0.0.0:*      users:(("openvpn",pid=8660,fd=7))
```

- You can see the `pid=8660` here, you need to stop this process:

```sh
sudo kill -9 8660
```

- Continue the operation until `ss -pan | grep 1194` no longer returns a result (adapt the pid each time)

</Collapsible>

</Step>
<Step title="Restart openvpn on the server">

```sh
systemctl daemon-reload && systemctl restart openvpn
```

<Callout variant="note">
You can add `systemctl enable openvpn` to make OpenVPN start automatically with the machine.
</Callout>

</Step>
</Steps>

## Client Configuration

<Steps>
<Step title="Install OpenVPN on the client">

```sh
apt update && apt install openvpn
```

</Step>
<Step title="Copy files from /etc/openvpn/client directory to transfer them to the client machine">

On the client machine, move them to `/etc/openvpn/`

<Tree elements={[{id:'1',name:'etc',children:[{id:'2',name:'openvpn',children:[{id:'3',name:'client.crt',type:'file'},{id:'4',name:'client.key',type:'file'},{id:'5',name:'ca.crt',type:'file'},{id:'6',name:'dh.pem',type:'file'},{id:'7',name:'ta.key',type:'file'}]}]}]} initialExpandedItems={['1','2']} sort="none" className="h-auto" client:load />

</Step>
<Step title="Copy and edit the client configuration file">

```sh
cp /usr/share/doc/openvpn/examples/sample-config-files/client.conf /etc/openvpn/ && nano /etc/openvpn/client.conf
```

<Tree elements={[{id:'1',name:'etc',children:[{id:'2',name:'openvpn',children:[{id:'3',name:'client.conf',type:'file'}]}]}]} initialExpandedItems={['1','2']} sort="none" className="h-auto" client:load />

```txt title="/etc/openvpn/client.conf"
##############################################
# Sample client-side OpenVPN 2.0 config file #
# for connecting to multi-client server.     #
# #
# This configuration can be used by multiple #
# clients, however each client should have   #
# its own cert and key files.                #
# #
# On Windows, you might want to rename this  #
# file so it has a .ovpn extension           #
##############################################

# Specify that we are a client and that we
# will be pulling certain config file directives
# from the server.
client

# Use the same setting as you are using on
# the server.
# On most systems, the VPN will not function
# unless you partially or fully disable
# the firewall for the TUN/TAP interface.
;dev tap
dev tun

# Windows needs the TAP-Win32 adapter name
# from the Network Connections panel
# if you have more than one.  On XP SP2,
# you may need to disable the firewall
# for the TAP adapter.
;dev-node MyTap

# Are we connecting to a TCP or
# UDP server?  Use the same setting as
# on the server.
;proto tcp
proto udp

# The hostname/IP and port of the server.
# You can have multiple remote entries
# to load balance between the servers.
remote my-server-1 1194
;remote my-server-2 1194
```

Replace `remote my-server-1 1194` by `remote OPENVPN_SERVER_IP 1194`

</Step>
<Step title="Restart OpenVPN on the client">

```sh
sudo systemctl daemon-reload && systemctl restart openvpn
```

<Callout title="Make it autostart at session" variant="note">
You can add `systemctl enable openvpn` to make OpenVPN start automatically with the machine.
</Callout>

</Step>
<Step title="Connect to the OpenVPN server">

```sh
openvpn --config /etc/openvpn/client.conf
```

If your configuration is correct, you will see in the last line: `Initialization Sequence Completed`
</Step>
</Steps>