Info

System: CentOS 7

openvpn: 2.4.10-1.el8

easy-rsa: 3.0.8-1.el8

Info
Make sure to perform the following operations as the root.

Table of Contents

1 Installation and preparation

Code Block

yum install -y epel-release
yum install -y openvpn
yum install -y easy-rsa
mkdir /etc/openvpn/easy-rsa
cp -R /usr/share/easy-rsa/3.0.8/* /etc/openvpn/easy-rsa/

cp -p /usr/share/doc/openvpn-2.4.10/sample/sample-config-files/server.conf /etc/openvpn/

cp /usr/share/doc/easy-rsa-3.0.8/vars.example /etc/openvpn/easy-rsa/vars

For now, the contents of the two directories are shown in the figure:

Modify the below lines of the file - vars

Code Block

set_var EASYRSA "$PWD"
set_var EASYRSA_PKI "$EASYRSA/pki"
set_var EASYRSA_DN "cn_only"
set_var EASYRSA_REQ_COUNTRY"CN"
set_var EASYRSA_REQ_PROVINCE "SJ"
set_var EASYRSA_REQ_CITY "NJ"
set_var EASYRSA_REQ_ORG "HTEK"
set_var EASYRSA_REQ_EMAIL "support@htek.com"
set_var EASYRSA_REQ_OU "HTEK Support"
set_var EASYRSA_KEY_SIZE 2048
set_var EASYRSA_ALGO rsa
set_var EASYRSA_CA_EXPIRE 7000
set_var EASYRSA_CERT_EXPIRE 3650
set_var EASYRSA_NS_SUPPORT "no"
set_var EASYRSA_NS_COMMENT "Hanlong"
set_var EASYRSA_EXT_DIR "$EASYRSA/x509-types"
set_var EASYRSA_DIGEST "sha256"

Next, we will start to create the OpenVPN server.

2 Generate Certification files

2.1 Initialize Certificate

Code Block

language	bash

[root@localhost openvpn]# cd /etc/openvpn/easy-rsa/
[root@localhost easy-rsa]# ./easyrsa init-pki

You will get the below notice

Code Block
Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa/vars init-pki complete; you may now create a CA or requests. Your newly created PKI dir is: /etc/openvpn/easy-rsa/pki

2.2 Generate a CA certificate

Code Block
[root@localhost easy-rsa]# ./easyrsa build-ca

You will be prompt to enter New CA Key Passphrase, please remember it, you will use them later.

Code Block

Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa/vars
Using SSL: openssl OpenSSL 1.0.2k-fips  26 Jan 2017

Enter New CA Key Passphrase:
Re-Enter New CA Key Passphrase:
Generating RSA private key, 2048 bit long modulus
......................+++
..+++
e is 65537 (0x10001)
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Common Name (eg: your user, host, or server name) [Easy-RSA CA]:Htek

CA creation complete and you may now import and sign cert requests.
Your new CA certificate file for publishing is at:
/etc/openvpn/easy-rsa/pki/ca.crt

2.3 Generate a server certificate

Code Block

[root@localhost easy-rsa]# ./easyrsa gen-req server nopass

Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa/vars
Using SSL: openssl OpenSSL 1.0.2k-fips  26 Jan 2017
Generating a 2048 bit RSA private key
............+++
..............+++
writing new private key to '/etc/openvpn/easy-rsa/pki/easy-rsa-12489.hN5NM9/tmp.EPD3Vi'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Common Name (eg: your user, host, or server name) [server]:

Keypair and certificate request completed. Your files are:
req: /etc/openvpn/easy-rsa/pki/reqs/server.req
key: /etc/openvpn/easy-rsa/pki/private/server.key

2.4 Sign the server certificate

Code Block
[root@localhost easy-rsa]# ./easyrsa sign server server

When signing the server certificate, you need to enter the passphrase of the CA (you have set it in 2.2).

Code Block

Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa/vars
Using SSL: openssl OpenSSL 1.0.2k-fips  26 Jan 2017


You are about to sign the following certificate.
Please check over the details shown below for accuracy. Note that this request
has not been cryptographically verified. Please be sure it came from a trusted
source or that you have verified the request checksum with the sender.

Request subject, to be signed as a server certificate for 825 days:

subject=
    commonName                = server


Type the word 'yes' to continue, or any other input to abort.
  Confirm request details: yes
Using configuration from /etc/openvpn/easy-rsa/pki/easy-rsa-12735.ljcLtB/tmp.pO6V2f
Enter pass phrase for /etc/openvpn/easy-rsa/pki/private/ca.key:
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName            :ASN.1 12:'server'
Certificate is to be certified until Jun  5 11:40:39 2023 GMT (825 days)

Write out database with 1 new entries
Data Base Updated

Certificate created at: /etc/openvpn/easy-rsa/pki/issued/server.crt

2.5 Generate Diffie-Hellman key

Code Block

[root@localhost easy-rsa]# ./easyrsa gen-dh

Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa/vars
Using SSL: openssl OpenSSL 1.0.2k-fips  26 Jan 2017
Generating DH parameters, 2048 bit long safe prime, generator 2
This is going to take a long time
.................................................................................+.....................+..........................+......................................................................................+...........+........................+.....................................................................................................................................................................................................................+......+.+.......+...............................................................+.............+.........................................+..........................................................................................................................................................................................................+....................................+............+...................................................................++*++*++*++*

DH parameters of size 2048 created at /etc/openvpn/easy-rsa/pki/dh.pem

2.6 Generate a client certificate

Code Block

[root@localhost easy-rsa]# ./easyrsa gen-req client nopass

Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa/vars
Using SSL: openssl OpenSSL 1.0.2k-fips  26 Jan 2017
Generating a 2048 bit RSA private key
.......................................................+++
..............+++
writing new private key to '/etc/openvpn/easy-rsa/pki/easy-rsa-15549.IGSWyv/tmp.prgjs5'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Common Name (eg: your user, host, or server name) [client]:

Keypair and certificate request completed. Your files are:
req: /etc/openvpn/easy-rsa/pki/reqs/client.req
key: /etc/openvpn/easy-rsa/pki/private/client.key

2.7 Sign the client certificate

Code Block
[root@localhost 3.0.8]# ./easyrsa sign client client

Like sign the server certificate, you need the passphrase of the CA to sign the client certificate.

Code Block

Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa/vars
Using SSL: openssl OpenSSL 1.0.2k-fips  26 Jan 2017


You are about to sign the following certificate.
Please check over the details shown below for accuracy. Note that this request
has not been cryptographically verified. Please be sure it came from a trusted
source or that you have verified the request checksum with the sender.

Request subject, to be signed as a client certificate for 825 days:

subject=
    commonName                = client


Type the word 'yes' to continue, or any other input to abort.
  Confirm request details: yes
Using configuration from /etc/openvpn/easy-rsa/pki/easy-rsa-16082.Oox3nT/tmp.7oMIBX
Enter pass phrase for /etc/openvpn/easy-rsa/pki/private/ca.key:
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName            :ASN.1 12:'client'
Certificate is to be certified until Jun  5 11:49:34 2023 GMT (825 days)

Write out database with 1 new entries
Data Base Updated

Certificate created at: /etc/openvpn/easy-rsa/pki/issued/client.crt

3 Configure the server

3.1 Configure IP route and firewall rules

Code Block
vim /etc/sysctl.conf

Add the below line to this file

Code Block
net.ipv4.ip_forward = 1

After editing the file, you can run the following command to make the changes take effect right away.

Code Block
sysctl -p

Now start the firewall service and add rules for the OpenVPN service

Code Block
[root@localhost easy-rsa]# systemctl start firewalld.service

Check the status of the firewall

Code Block

[root@localhost easy-rsa]# firewall-cmd --state
running
[root@localhost easy-rsa]# firewall-cmd --zone=public --list-all
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: ens33
  sources:
  services: dhcpv6-client ssh
  ports:
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:

Add rules for the firewall and then reload it.

Code Block

[root@localhost easy-rsa]# firewall-cmd --add-service=openvpn --permanent
success
[root@localhost easy-rsa]# firewall-cmd --add-port=1194/udp --permanent
success
[root@localhost easy-rsa]# firewall-cmd --add-port=22/tcp --permanent
success
[root@localhost easy-rsa]# firewall-cmd --add-source=10.8.0.0 --permanent
success
[root@localhost easy-rsa]# firewall-cmd --query-source=10.8.0.0 --permanent
yes
[root@localhost easy-rsa]# firewall-cmd --add-masquerade --permanent
success
[root@localhost easy-rsa]# firewall-cmd --query-masquerade --permanent
yes
[root@localhost easy-rsa]# firewall-cmd --reload
success

Check the status of the firewall again

Code Block

[root@localhost easy-rsa]# firewall-cmd --zone=public --list-all
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: ens33
  sources: 10.8.0.0
  services: dhcpv6-client openvpn ssh
  ports: 1194/udp 22/tcp
  protocols:
  masquerade: yes
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:

3.2 server.conf

Code Block

port 1194
proto udp
dev tun

ca /etc/openvpn/easy-rsa/pki/ca.crt
cert /etc/openvpn/easy-rsa/pki/issued/server.crt
key /etc/openvpn/easy-rsa/pki/private/server.key
dh /etc/openvpn/easy-rsa/pki/dh.pem

server 10.8.0.0 255.255.255.0

ifconfig-pool-persist ipp.txt

push "route 192.168.0.0 255.255.252.0"
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 192.168.0.230"
push "dhcp-option DNS 114.114.114.114"

client-to-client
keepalive 10 120
cipher AES-256-CBC
comp-lzo
max-clients 100
persist-key
persist-tun
status openvpn-status.log
log-append  openvpn.log
verb 3
mute 20
explicit-exit-notify 1

3.3 Start openvpn@server.service

Code Block
[root@localhost easy-rsa]# systemctl start openvpn@server

You can check the status by below command:

Code Block

[root@localhost easy-rsa]# systemctl status openvpn@server
● openvpn@server.service - OpenVPN Robust And Highly Flexible Tunneling Application On server
   Loaded: loaded (/usr/lib/systemd/system/openvpn@.service; disabled; vendor preset: disabled)
   Active: active (running) since Tue 2021-03-02 20:16:44 CST; 5s ago
 Main PID: 26175 (openvpn)
   Status: "Initialization Sequence Completed"
   CGroup: /system.slice/system-openvpn.slice/openvpn@server.service
           └─26175 /usr/sbin/openvpn --cd /etc/openvpn/ --config server.conf

Mar 02 20:16:44 localhost.localdomain systemd[1]: Starting OpenVPN Robust And Highly Flexible Tunneling Application On server...
Mar 02 20:16:44 localhost.localdomain systemd[1]: Started OpenVPN Robust And Highly Flexible Tunneling Application On server.

4 Using openvpn on the Htek phone

4.1 Create client.ovpn

Code Block
[root@localhost easy-rsa]# vim /etc/openvpn/client/client.ovpn

Add the below lines to this file:

Code Block

client
dev tun
proto udp
remote 223.68.137.166 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca /hlfs/vpn/ca.crt
cert /hlfs/vpn/client.crt
key /hlfs/vpn/client.key
remote-cert-tls server
cipher AES-256-CBC
verb 3
comp-lzo
mute 20

Note

If there is no M or D in the DSP info of your phone, please change the file path to /hlcfg/vpn/xxx, such as /hlcfg/vpn/client.crt

(no M or D, path should be /hlcfg/vpn/client.crt)

(has M, path should be /hlfs/vpn/client.crt)

4.2 Creating the tar file for the phone (client)

The phone as an OpenVPN client needs at least ca.crt, client.crt, client.key, client.ovpn, and these files should be packaged in tar format.

Code Block

[root@localhost easy-rsa]# cp /etc/openvpn/easy-rsa/pki/ca.crt /etc/openvpn/client/
[root@localhost easy-rsa]# cp /etc/openvpn/easy-rsa/pki/issued/client.crt /etc/openvpn/client/
[root@localhost easy-rsa]# cp /etc/openvpn/easy-rsa/pki/private/client.key /etc/openvpn/client/

Now the files in /etc/openvpn/client should be:

Code Block
[root@localhost client]# tar -cvpf openvpn.tar * ca.crt client.crt client.key client.ovpn

Now you get the openvpn.tar file, then you should put it into a folder that you could import the file into the phone.

4.3 Import tar file into Htek phone

Import openvpn.tar file into the phone.

Choose Yes and then click the SaveSet button on the bottom of the webpage, the phone will reboot to apply the new configuration.

Upon the phone boot up, you can check the VPN address.

LCD GUI: Menu -> Status -> Network -> 5.VPN

5 Option: Authenticate with Username/Password

If you want to use username/password along with the certificate to verify the client, you could do as follows.

5.1 Prepare a script to check username/password

Code Block
[root@localhost openvpn]# vim /etc/openvpn/checkpsw.sh

The content is:

Code Block

language	bash

#!/bin/bash
###########################################################
# checkpsw.sh (C) 2004 Mathias Sundman <mathias@openvpn.se>
#
# This script will authenticate OpenVPN users against
# a plain text file. The passfile should simply contain
# one row per user with the username first followed by
# one or more space(s) or tab(s) and then the password.

PASSFILE="/etc/openvpn/auth_file"
LOG_FILE="/var/log/openvpn-password.log"
TIME_STAMP=`date "+%Y-%m-%d %T"`

###########################################################

if [ ! -r "${PASSFILE}" ]; then
    echo "${TIME_STAMP}: Could not open password file \"${PASSFILE}\" for reading." >>  ${LOG_FILE}
    exit 1
fi

CORRECT_PASSWORD=`awk '!/^;/&&!/^#/&&$1=="'${username}'"{print $2;exit}' ${PASSFILE}`
if [ "${CORRECT_PASSWORD}" = "" ]; then
    echo "${TIME_STAMP}: User does not exist: username=\"${username}\", password=\"${password}\"." >> ${LOG_FILE}
    exit 1
fi

if [ "${password}" = "${CORRECT_PASSWORD}" ]; then
    echo "${TIME_STAMP}: Successful authentication: username=\"${username}\"." >> ${LOG_FILE}
    exit 0
fi

echo "${TIME_STAMP}: Incorrect password: username=\"${username}\", password=\"${password}\"." >> ${LOG_FILE}
exit 1

After you have done this, exit and give the executable permissions to it by

Code Block
[root@localhost openvpn]# chmod +x checkpsw.sh

5.2 Create username/password record file

In the file - checkpsw.sh - we have defined a PASSFILE, that is used to store username and password pairs.

Code Block
[root@localhost openvpn]# vim /etc/openvpn/auth_file

In this file, we record the username and password line by line like following

Code Block
htek 123456 client 456789

5.3 Modify server.conf

Code Block
[root@localhost openvpn]# vim /etc/openvpn/server.conf

Add these three lines:

Code Block
auth-user-pass-verify /etc/openvpn/checkpsw.sh via-env username-as-common-name script-security 3

So the server.conf now looks like this:

Code Block

port 1194
proto udp
dev tun

auth-user-pass-verify /etc/openvpn/checkpsw.sh via-env
username-as-common-name
script-security 3

ca /etc/openvpn/easy-rsa/pki/ca.crt
cert /etc/openvpn/easy-rsa/pki/issued/server.crt
key /etc/openvpn/easy-rsa/pki/private/server.key
dh /etc/openvpn/easy-rsa/pki/dh.pem

server 10.8.0.0 255.255.255.0

ifconfig-pool-persist ipp.txt

push "route 192.168.0.0 255.255.252.0"
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 192.168.0.230"
push "dhcp-option DNS 114.114.114.114"

client-to-client
keepalive 10 120
cipher AES-256-CBC
comp-lzo
max-clients 100
persist-key
persist-tun
status openvpn-status.log
log-append  openvpn.log
verb 3
mute 20
explicit-exit-notify 1

Info
After you have done this, you should restart openvpn server to make it effective.

Code Block
[root@localhost openvpn]# systemctl restart openvpn@server

5.4 Modify the client.conf

Add this line to the client.conf

Code Block
auth-user-pass /hlfs/vpn/auth.txt

And now the whole file is like this:

Code Block

client
dev tun
proto udp
remote 223.68.137.166 1194
resolv-retry infinite
nobind
persist-key
persist-tun
auth-user-pass /hlfs/vpn/auth.txt
ca /hlfs/vpn/ca.crt
cert /hlfs/vpn/client.crt
key /hlfs/vpn/client.key
remote-cert-tls server
cipher AES-256-CBC
verb 3
comp-lzo
mute 20

5.5 Create a username/password file for client

Code Block
[root@localhost client]# vim auth.txt

And then add the username and password equals to the record in /etc/openvpn/auth_file, such as:

Code Block
htek 123456

5.6 Creating the tar file for the phone (client)

In the previous steps, we have prepared some files for the phone.

Now there is a new file, so in /etc/openvpn/client :

Code Block
[root@localhost client]# tar -cvpf openvpn.tar * auth.txt ca.crt client.crt client.key client.ovpn

Now, put the new openvpn.tar file into a folder and import it into the phone.

5.7 If you don’t want to verify by a certificate

In the server.conf, add this line

Code Block

language	bash

client-cert-not-required

So the whole server.conf will be

Code Block

port 1194
proto udp
dev tun

client-cert-not-required
auth-user-pass-verify /etc/openvpn/checkpsw.sh via-env
username-as-common-name
script-security 3

ca /etc/openvpn/easy-rsa/pki/ca.crt
cert /etc/openvpn/easy-rsa/pki/issued/server.crt
key /etc/openvpn/easy-rsa/pki/private/server.key
dh /etc/openvpn/easy-rsa/pki/dh.pem

server 10.8.0.0 255.255.255.0

ifconfig-pool-persist ipp.txt

push "route 192.168.0.0 255.255.252.0"
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 192.168.0.230"
push "dhcp-option DNS 114.114.114.114"

client-to-client
keepalive 10 120
cipher AES-256-CBC
comp-lzo
max-clients 100
persist-key
persist-tun
status openvpn-status.log
log-append  openvpn.log
verb 3
mute 20
explicit-exit-notify 1

In the client.conf, comment out these two lines

Code Block
;cert /hlfs/vpn/client.crt ;key /hlfs/vpn/client.key

So the whole client.conf will be

Code Block

client
dev tun
proto udp
remote 223.68.137.166 1194
resolv-retry infinite
nobind
persist-key
persist-tun
auth-user-pass /hlfs/vpn/auth.txt
ca /hlfs/vpn/ca.crt
;cert /hlfs/vpn/client.crt
;key /hlfs/vpn/client.key
remote-cert-tls server
cipher AES-256-CBC
verb 3
comp-lzo
mute 20

6 Option: Use one file - client.ovpn

Versions Compared

Old Version 19

New Version 20

Key

1 Installation and preparation

2 Generate Certification files

2.1 Initialize Certificate

2.2 Generate a CA certificate

2.3 Generate a server certificate

2.4 Sign the server certificate

2.5 Generate Diffie-Hellman key

2.6 Generate a client certificate

2.7 Sign the client certificate

3 Configure the server

3.1 Configure IP route and firewall rules

3.2 server.conf

3.3 Start openvpn@server.service

4 Using openvpn on the Htek phone

4.1 Create client.ovpn

4.2 Creating the tar file for the phone (client)

4.3 Import tar file into Htek phone

5 Option: Authenticate with Username/Password

5.1 Prepare a script to check username/password

5.2 Create username/password record file

5.3 Modify server.conf

5.4 Modify the client.conf

5.5 Create a username/password file for client

5.6 Creating the tar file for the phone (client)

5.7 If you don’t want to verify by a certificate

6 Option: Use one file - client.ovpn

Page Comparison

Versions Compared

Old Version 19

New Version 20

Key

1 Installation and preparation

2 Generate Certification files

2.1 Initialize Certificate

2.2 Generate a CA certificate

2.3 Generate a server certificate

2.4 Sign the server certificate

2.5 Generate Diffie-Hellman key

2.6 Generate a client certificate

2.7 Sign the client certificate

3 Configure the server

3.1 Configure IP route and firewall rules

3.2 server.conf

3.3 Start openvpn@server.service

4 Using openvpn on the Htek phone

4.1 Create client.ovpn

4.2 Creating the tar file for the phone (client)

4.3 Import tar file into Htek phone

5 Option: Authenticate with Username/Password

5.1 Prepare a script to check username/password

5.2 Create username/password record file

5.3 Modify server.conf

5.4 Modify the client.conf

5.5 Create a username/password file for client

5.6 Creating the tar file for the phone (client)

5.7 If you don’t want to verify by a certificate

6 Option: Use one file - client.ovpn