303
CHAPTER 12
Configuring Ubuntu Server
As a VPN Server
Networking Securely over
the Internet
I
f you need to connect securely to a server that is not on your site, one option is to
purchase a dedicated line. Unfortunately, dedicated lines are expensive. A cheap and
very common alternative is to configure a Virtual Private Network (VPN), a connection
between two sites or two computers that goes over the Internet. VPNs are available as
hardware appliances, but it is relatively easy to configure Linux as a VPN server.
Because the Internet by nature is an unsecured network, you have to implement
security measures when setting up a VPN. These security measures are applied by using
encryption. Several solutions are available to create a VPN. You are probably already
familiar with one of them: when you establish an SSH session with your server and start
a program on your server that displays its output on the local workstation, basically you
are using a VPN. However, an SSH VPN is not the most versatile VPN solution. A very
popular and versatile Linux VPN solution is OpenVPN, which uses functionality from the
OpenSSL package to ensure its security. In this chapter you’ll learn how to set up a VPN
that is based on OpenVPN.
Installing and Configuring OpenVPN
As with most software on Ubuntu Server, installing OpenVPN is not too hard: just run
]lp)capejop]hhklajrlj
to download and install the software. The installation process
installs all software and also starts the
klajrlj
daemon. You can manipulate the process
from its
ejep
scripts as well. For example, you can start it with

Before going any further, you should determine if you want to use a routed VPN or
a bridged VPN. OpenVPN offers both options. However, in most situations you will use
routing. Routing is easier to set up and offers better flexibility with regard to access con-
trol. Bridging is useful only if you need to use very specific features of your VPN, such as
in the following cases:
CHAPTER 12
N
CONFIGURING UBUNTU SERVER AS A VPN SERVER
305
 s 4HE60.NEEDSTOHANDLEPROTOCOLSOTHERTHAN)0SUCHAS)08
 s 9OUARERUNNINGAPPLICATIONSTHATRELYON,!.BROADCASTSOVERTHE60.
 s 9OUWANTTOBROWSETO7INDOWSSHARESWITHOUTSETTINGUPA3AMBAOR7).3nam-
ing server.
Generating Certificates
OpenVPN heavily relies on the use of certificates, so before you start to configure the
VPN, you should set up a public key infrastructure (PKI). Before the mutual trust that is
required on the VPN can be established, the server and client must exchange their PKI
certificates.
N
Note
Although this chapter refers to a client/server VPN setup, a VPN can also be established between
sites, in which case one site is configured as the client and the other is configured as the server.
In Chapter 11 you learned how to set up a certificate authority (CA). Because
OpenVPN has its own scripts to set up the complete PKI infrastructure, this chapter also
covers setting up the CA. If you already have a CA, you can skip this configuration and
proceed to creating certificates for the client and the server.
Configuring the Certificate Authority
By default, you’ll find the OpenVPN scripts that help you to build the CA and its keys in
the directory
+qon+od]na+`k_+klajrlj+at]ilhao+a]ou)no]+.

pnaa*
atlknpA=OU[NO=9\ls`\

Pdeor]ne]^haodkqh`lkejppk
pdanamqaopa`ata_qp]^hao

atlknpKLAJOOH9klajooh
atlknpLG?O--PKKH9lg_o--)pkkh
atlknpCNAL9cnal
Pdeor]ne]^haodkqh`lkejppk
pdaklajooh*_jbbehaej_hq`a`
sepda]ou)no]*
atlknpGAU[?KJBEC9\ A=OU[NO=+sde_dklajooh_jb A=OU[NO=\
A`eppdeor]ne]^hapklkejppk
ukqnokkj)pk)^a)_na]pa`gau
`ena_pknu*

CHAPTER 12
N
CONFIGURING UBUNTU SERVER AS A VPN SERVER
307
S=NJEJC6_ha]j)]hhsehh`k
]ni)nbkjpdeo`ena_pknu
oki]gaoqnaukq`abeja
ep_knna_phu
atlknpGAU[@EN9 A=OU[NO=+gauo
Eooqani)nbs]njejc
a_dkJKPA6Ebukqnqj*+_ha]j)]hh(Esehh^a`kejc]ni)nbkj GAU[@EN
Ej_na]oapdeopk.,04ebukq
]nal]n]jke`*Pdeosehhohks

Of these commands, the first two just clean up the current configuration and pass
to your current environment the variables you’ve set in
+ap_+klajrlj+a]ou)no]+r]
rs. The
latter command generates the CA for you. Listing 12-2 gives an example of the output of
these commands.
Listing 12-2. Generating the Certificate Authority with the easy- rsa Scripts
nkkp<iah6+ap_+klajrlj+a]ou)no]okqn_a*+r]no
JKPA6Ebukqnqj*+_ha]j)]hh(Esehh^a`kejc]ni)nbkj+ap_+klajrlj+a]ou)no]+gauo
nkkp<iah6+ap_+klajrlj+a]ou)no]*+_ha]j)]hh
nkkp<iah6+ap_+klajrlj+a]ou)no]*+^qeh`)_]
Cajan]pejc]-,.0^epNO=lner]pagau
*************************************''''''
****************************************''''''
snepejcjaslner]pagaupk#_]*gau#
)))))
Ukq]na]^kqppk^a]oga`pkajpanejbkni]pekjpd]psehh^aej_knlkn]pa`
ejpkukqn_anpebe_]panamqaop*
Sd]pukq]na]^kqppkajpaneosd]peo_]hha`]@eopejcqeoda`J]iakn]@J*
Pdana]namqepa]basbeah`o^qpukq_]jha]raokia^h]jg
Bknokiabeah`opdanasehh^a]`ab]qhpr]hqa(
Ebukqajpan#*#(pdabeah`sehh^ahabp^h]jg*
)))))
?kqjpnuJ]ia$.happan_k`a%WJHY6
Op]paknLnkrej_aJ]ia$bqhhj]ia%WJ>Y6
Hk_]hepuJ]ia$ac(_epu%WNkkoaj`]]hY6
Knc]jev]pekjJ]ia$ac(_kil]ju%Wo]j`anY6
Knc]jev]pekj]hQjepJ]ia$ac(oa_pekj%WY6
?kiikjJ]ia$ac(ukqnj]iaknukqnoanran#odkopj]ia%Wo]j`an?=Y6
Ai]eh=``naooWi]eh<o]j`an*bnY6

)))))
?kqjpnuJ]ia$.happan_k`a%WJHY6
Op]paknLnkrej_aJ]ia$bqhhj]ia%WJ>Y6
Hk_]hepuJ]ia$ac(_epu%WNkkoaj`]]hY6
Knc]jev]pekjJ]ia$ac(_kil]ju%Wo]j`anY6
Knc]jev]pekj]hQjepJ]ia$ac(oa_pekj%WY6
?kiikjJ]ia$ac(ukqnj]iaknukqnoanran#odkopj]ia%WiahY6
Ai]eh=``naooWi]eh<o]j`an*bnY6
Lha]oaajpanpdabkhhksejc#atpn]#]ppne^qpao
pk^aoajpsepdukqn_anpebe_]panamqaop
=_d]hhajcal]ooskn`WY6
=jklpekj]h_kil]juj]iaWY6
Qoejc_kjbecqn]pekjbnki+ap_+klajrlj+a]ou)no]+klajooh*_jb
?da_gpd]ppdanamqaopi]p_daopdaoecj]pqna
Oecj]pqnakg
PdaOq^fa_p#o@eopejcqeoda`J]iaeo]obkhhkso
_kqjpnuJ]ia6LNEJP=>HA6#JH#
op]paKnLnkrej_aJ]ia6LNEJP=>HA6#J>#
hk_]hepuJ]ia6LNEJP=>HA6#Nkkoaj`]]h#
knc]jev]pekjJ]ia6LNEJP=>HA6#o]j`an#
_kiikjJ]ia6LNEJP=>HA6#iah#
ai]eh=``naoo6E=1OPNEJC6#i]eh<o]j`an*bn#
?anpebe_]paeopk^a_anpebea`qjpeh=qc.0,360260..,-4CIP$/21,`]uo%
Oecjpda_anpebe_]pa;Wu+jY6u