How To Set Up and Configure an OpenVPN Server on CentOS 9 stream

Prerequisites

To follow this tutorial, you will need:

• A CentOS 9 thread server with a sudo non-root user and a firewall set up with firewall, which you can achieve with our Initial Server Setup with CentOS 9 Thread guide and recommended steps Additional export for new CentOS 7 server.
• A domain or subdomain that resolves to your server that you can use for certificates. To set this up, you’ll first need to register a domain name, and then add DNS records through the DigitalOcean Control Panel. Note that simply adding an A record will satisfy the requirements of this guide.
• A client that you will use to connect to your OpenVPN server. For the purposes of this tutorial, you should use your local machine as the OpenVPN client.

With these prerequisites, you are ready to start setting up and configuring an OpenVPN server on a Centos 9 stream.

Step 1 – Install OpenVPN

To start, we will install OpenVPN on the server. We will also install Easy RSA, a public key infrastructure management tool that will help us set up an internal certificate authority (CA) for use with our VPN. Later, we will also use Easy RSA to generate SSL key pairs to secure VPN connections.

Log in to the server as a non-root sudo user and update the package list to ensure you have all the latest versions.

dnf update -y

1. Install OpenVPN.

Install from EPEL

dnf --enablerepo=epel -y install openvpn easy-rsa net-tools

2. Create CA and Certificates.

cd /usr/share/easy-rsa/3

Initialize

./easyrsa init-pki

Create CA

./easyrsa build-ca

Output:

Using SSL: openssl OpenSSL 3.0.1 14 Dec 2021 (Library: OpenSSL 3.0.1 14 Dec 2021)

# set any pass-phrase
Enter New CA Key Passphrase:
Re-Enter New CA Key Passphrase:
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Common Name (eg: your user, host, or server name) [Easy-RSA CA]:Server-CA

CA creation complete and you may now import and sign cert requests.
Your new CA certificate file for publishing is at:
/usr/share/easy-rsa/3/pki/ca.crt

Create server certificates
Any name is OK for [server1] name
(it is set for file name of certs or commonName)

./easyrsa build-server-full server1 nopass

Output:

Using SSL: openssl OpenSSL 3.0.1 14 Dec 2021 (Library: OpenSSL 3.0.1 14 Dec 2021)

Using configuration from /usr/share/easy-rsa/3/pki/easy-rsa-3233.tTgxXj/tmp.kQNNfp
# answer with pass-phrase set on CA
Enter pass phrase for /usr/share/easy-rsa/3/pki/private/ca.key:
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName            :ASN.1 12:'server1'
Certificate is to be certified until Oct 10 06:31:42 2024 GMT (825 days)

Write out database with 1 new entries
Data Base Updated

Create client certificates
Any name is OK for [client1] name
(it is set for file name of certs or commonName)

./easyrsa build-client-full client1 nopass

Output:

Using SSL: openssl OpenSSL 3.0.1 14 Dec 2021 (Library: OpenSSL 3.0.1 14 Dec 2021)

Using configuration from /usr/share/easy-rsa/3/pki/easy-rsa-3312.bpp3lw/tmp.1bkU1Q
# answer with pass-phrase set on CA
Enter pass phrase for /usr/share/easy-rsa/3/pki/private/ca.key:
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName            :ASN.1 12:'client1'
Certificate is to be certified until Oct 10 06:33:42 2024 GMT (825 days)

Write out database with 1 new entries
Data Base Updated

Generate Diffie Hellman ( DH ) parameter

./easyrsa gen-dh

Create TLS-Auth key

openvpn --genkey secret ./pki/ta.key

Copy generated certs

cp -pR /usr/share/easy-rsa/3/pki/{issued,private,ca.crt,dh.pem,ta.key} /etc/openvpn/server/

Step 2 Configure OpenVPN.

It based on the environment Firewalld is running because of using ruoting rules
Copy sample configuration

cp /usr/share/doc/openvpn/sample/sample-config-files/server.conf /etc/openvpn/server/

vi /etc/openvpn/server/server.conf

Adjust configuration as follows:

# line 32 : change if need (listening port of OpenVPN)
port 1194
# line 35 : change if need (use udp on this example)
;proto tcp
proto udp
# line 53 : change if need (use tun on this example)
;dev tap
dev tun
# line 78 : specify certificates
ca ca.crt
cert issued/server1.crt
key private/server1.key
# line 85 : specify DH file
dh dh.pem
# line 101 : specify network to be used on VPN
# any network are OK except your local network
server 192.168.100.0 255.255.255.0
# line 142 : uncomment and change to your local network
push "route 10.0.0.0 255.255.255.0"
# line 231 : keepalive settings
keepalive 10 120
# line 244 : specify TLS-Auth key
tls-auth ta.key 0
# line 281 : enable persist options
persist-key
persist-tun
# line 287 : change log path
status /var/log/openvpn-status.log
# line 296 : change log path
log         /var/log/openvpn.log
log-append  /var/log/openvpn.log
# line 306 : specify log level (0 - 9, 9 means debug lebel)
verb 3

Create new

vi /etc/openvpn/server/add-bridge.sh

#!/bin/bash

# network interface which can connect to local network
IF=enp1s0
# interface VPN tunnel uses
# for the case of this example like specifying [tun] on the config, generally this param is [tun0]
VPNIF=tun0
# listening port of OpenVPN
PORT=1194

firewall-cmd --zone=public --add-masquerade
firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -i ${VPNIF} -o ${IF} -j ACCEPT
firewall-cmd --direct --add-rule ipv4 nat POSTROUTING 0 -o ${IF} -j MASQUERADE
firewall-cmd --add-port=${PORT}/udp

vi /etc/openvpn/server/remove-bridge.sh

#!/bin/bash

# network interface which can connect to local network
IF=enp1s0
# interface VPN tunnel uses
# for the case of this example like specifying [tun] on the config, generally this param is [tun0]
VPNIF=tun0
# listening port of OpenVPN
PORT=1194

firewall-cmd --zone=public --remove-masquerade
firewall-cmd --direct --remove-rule ipv4 filter FORWARD 0 -i ${VPNIF} -o ${IF} -j ACCEPT
firewall-cmd --direct --remove-rule ipv4 nat POSTROUTING 0 -o ${IF} -j MASQUERADE
firewall-cmd --remove-port=${PORT}/udp

chmod 700 /etc/openvpn/server/{add-bridge.sh,remove-bridge.sh}

 systemctl edit openvpn-server@server

# create new
[Service]
ExecStartPost=/etc/openvpn/server/add-bridge.sh
ExecStopPost=/etc/openvpn/server/remove-bridge.sh

systemctl enable --now openvpn-server@server

Step 5 Transfer certs follows you generated to Client Host you’d like to connect with VPN.

24/7 support with discount code: 1DOLLAROFF 10% discount. Click now! 👆