Tutorial on how to Setup an Openvpn Server on Debian, with a Windows Client

Installation

First, we need to quickly install openvpn on our debian server.

aptitude install openvpn

 Next we need to locate our easy-rsa folder, on debian it is located at /usr/share/doc/openvpn/examples/easy-rsa
If you are having trouble finding it, try the following:

updatedb

locate easy-rsa

Once we find the folder, we need to copy it to /etc/openvpn:

cp -R /usr/share/doc/openvpn/examples/easy-rsa /etc/openvpn

cd /etc/openvpn/easy-rsa/2.0

Editing the vars (variables) file

Now we need to edit some variables, to make things easier for us.

sudo nano vars

Once you open up the file vars, you should see the something like the following at the bottom:
 export KEY_COUNTRY="US"  export KEY_PROVINCE="CA"  export KEY_CITY="SanDiego"  export KEY_ORG="OpenVPN"  export KEY_EMAIL="myemail@mydomain.com"
 Change those values to reflect your values.
Now we need to build the certificate authority, so in the /etc/openvpn/easy-rsa/2.0 directory run the following commands:

. ./vars

(dot space ./vars)

./clean-all  ./build-ca

This should build the certificate authority (CA) certificate
 Many of the values should be autopopulated since we filled out the information. The one value you may need to fill is the Common Name. Enter the name of your server for the value.

Building the Server and Client Keys

Next we need to generate the server key:

build-key-server server

Next, we need to setup some keys for the clients, so that they can connect to the server. You have two choices for setting up clients. You can require the clients to enter a password to connect, or just generate the key files needed to connect. In this example we will be generating the files without password. If you wish to use a password, replace ./build-key with ./build-key-pass.

./build-key client1

 Again, it will ask you for a client name, enter the name of the client. When it asks for a challenge password just leave it black and press enter.

Next we need to generate Diffie Hellman paramaters.

./build-dh

This command may take a while to complete. Once the command completes, you should be able to navigate to /etc/openvpn/easy-rsa/keys/ and the files you generated should be located within.

Placing the Server Keys and Creating Server Config

Next, we need to copy the keys that are needed for the OpenVPN server into the correct folder:

cp ca.crt ca.key dh1024.pem server.crt server.key /etc/openvpn

 Obviously, whatever the name will reflect whatever you entered originally. Next, navigate to /etc/openvpn, to edit the configuration file.

sudo nano openvpn.conf

This is an example configuration, very basic, change the names of the .crt and .key files to the ones you made, and you should be all set. As well, I added the client-to-client line because I want my clients to be able to talk to eachother.
NOTE:  You may want to change the "server" line from 172.17.0.0 to something that won't possibly cause routing issues depending on your (and remote) network setups.  This won't happen in every use case, but it can come into play.  Something like "172.17.2.0" may work.
port 1194 proto udp dev tun ca ca.crt cert server.crt key server.key dh dh1024.pem server 172.17.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt keepalive 10 120 comp-lzo user nobody group users persist-key persist-tun status openvpn-status.log verb 3 client-to-client
Next, lets start OpenVPN:

/etc/init.d/openvpn start

You can ping yourself as a quick test to see if you are up and running.

$ ping 172.17.0.1
 PING 172.17.0.1 (172.17.0.1) 56(84) bytes of data.
 64 bytes from 172.17.0.1: icmp_seq=1 ttl=64 time=0.041 ms 64 bytes from 172.17.0.1: icmp_seq=2 ttl=64 time=0.030 ms

Client Configuration

Next, we need to configure the clients.  In this example, I am using two windows clients to connect to the server.
I like the gui for OpenVpn, available here: http://openvpn.se.  (See below for Windows 7 fix). Once you install it, navigate to  C:\Program Files\OpenVPN\config.  Now, you need to copy the following files to our config folder from our server:
client.crt
client.key
ca.crt

Next, we need to create a client configuration file to use.  For windows, the client configurations all end with .ovpn.  So lets create a file called config.ovpn, and use the following:
client dev tun proto udp remote remote-ip-address 1194 resolv-retry infinite nobind persist-key persist-tun ca ca.crt cert client.crt key client.key comp-lzo verb 3
You will need to change the name of your .key and .crt files, and your remote IP address as well.  Obviously, if you are connecting remotely, you can enter a domain name as well.

Once you connect, you should now be able to easily ping the Openvpn server.  If not you may need to check your firewall to make sure everything is working.  Don't forget to port forward the correct port to your OpenVPN server, or you will not be able to access your server from outside of your network.

If you need clients to be able to talk to eachother, you may need to execute the following command on your linux box.

echo 1 > /proc/sys/net/ipv4/ip_forward

Windows Client Options

Currently, setup on Windows 7 requires a little bit more setup than other versions of windows.  First, download the latest release client, from http://openvpn.net/release/, and run the program in compatibility mode for Windows Vista Service Pack 1, and run as administrator.  This will give the program the permissions it needs.

Another option is securepoint client at http://sourceforge.net/projects/securepoint/.  I have run it successfully on Windows 7 without any issues.

If you encounter problems, remember to turn off any firewalls that may be in the way.

Connecting to Internal Resources

This is a rather important point, that should have been here from the beginning (my bad).  This setup allows you to connect to the internal device that you have openvpn setup on.  Look at the picture below:

If your OpenVPN client needs to connect to your other server or desktop on your LAN, it has no way to do so!  If you attempt to ping 192.168.1.105 from your remote OpenVPN client, you will not get a response, or if you do, it will be the local network, not the remote network.  This requires further setup.  

Server Setup for Internal Access

You will need to push a route to your client.  To do so add the following line to your server conf file:

push "route 192.168.1.0 255.255.255.0"

Now when the OpenVPN client connects, it will know that to access the 192.168.1.0 network it needs to forward the traffic through the VPN connection.

Router Setup for Internal Access

However, when you attempt to ping 192.168.1.105, you will still not be able to ping (or RDP, or w/e protocol you want to test if ping is disabled).  This is because the router (192.168.1.1) still does not know the route back to the 172.17.0.0 network.  In dd-wrt it is simple to add the network route.

Now when you attempt to connect to an internal resource it should work correctly.

Logging

If you experience problems and need to troubleshoot the server, openvpn logging is pushed to syslog, but if you want the log file separate, you can add the following line to your server conf file:  "log openvpn.log" or "log-append openvpn.log".  This will output the OpenVPN log separately instead of adding it to syslog.

Web Management of OpenVPN

I need programmers :D.  I am attempting to create a web interface to simplify OpenVPN installation and management at github:  https://github.com/deranjer/OpenVPN-PHP-Management-Gui.  I am really busy with school and work so only have it working in beta (not to be run on production servers).  But if you know PHP at all (I am barely able to code in PHP so this won't be too complex) I would love to have help on this. 

Conclusion

I will try and keep this blog post updated and post answers or solutions to common issues with OpenVPN configuration and management.