Step-by-Step Guide to Install and Setup OpenVPN Server on Debian 12

|
Last Updated:
|
|
Install and Setup OpenVPN Server on Debian 12

In this guide, we are going to learn how to install and setup OpenVPN Server on Debian 12. OpenVPN is a robust and highly flexible open-source VPN software that uses all of the encryption, authentication, and certification features of the OpenSSL library to securely tunnel IP networks over a single UDP or TCP port. It facilitates the extension of private network across a public network, access remote sites, make secure point-to-point connections, while maintaining security that would be achieved in a private network.

Installing OpenVPN Server on Debian 12

Run system update

apt update

Install OpenVPN on Debian 12

OpenVPN package is available on the default Debian 12 repos. Thus the installation is as simple as running the command below;

apt install openvpn

Install Easy-RSA CA Utility on Debian 12

Easy-RSA package provides utilities for generating SSL key-pairs that is used to secure VPN connections.

It installs with OpenVPN pakage above. If it is not installed, run the command below to install it.

apt install easy-rsa

Create OpenVPN Public Key Infrastructure

Once you have installed easy-rsa, you need to initialize the OpenVPN PKI. The PKI consists of:

  • a public key and private key for the server and each client
  • a master Certificate Authority (CA) certificate and key which is used to sign each of the server and client certificates.

Before you can proceed, copy the easy-rsa configuration directory to a different location to ensure that that future OpenVPN package upgrades won’t overwrite your modifications.

cp -r /usr/share/easy-rsa /etc/

Next, initialize the PKI.

cd /etc/easy-rsa/
./easyrsa init-pki

Once the PKI is initialized, /etc/easy-rsa/pki is created.

Sample output of the command above;

* Notice:

  init-pki complete; you may now create a CA or requests.

  Your newly created PKI dir is:
  * /etc/easy-rsa/pki

* Notice:
  IMPORTANT: Easy-RSA 'vars' file has now been moved to your PKI above.

Generate the Certificate Authority (CA) Certificate and Key

Next, generate the CA certificate and key for signing OpenVPN server and client certificates.

cd /etc/easy-rsa/
./easyrsa build-ca

This will prompt you for the CA key and PEM pass phrase and the server common name.

* Notice:
Using Easy-RSA configuration from: /etc/easy-rsa/pki/vars

* Notice:
Using SSL: openssl OpenSSL 3.0.9 30 May 2023 (Library: OpenSSL 3.0.9 30 May 2023)


Enter New CA Key Passphrase: 
Re-Enter New CA Key Passphrase: 
Using configuration from /etc/easy-rsa/pki/6873accc/temp.a174efe7
.+...+.........+........+....+..............+.+...+...+..+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*...+..+....+...........+.+.....+....+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*....+.......+..+...+.+....................+....+..+.+.....+.........+.+...+..............+..........+..+.........+....+.....+.....................+..........+..+...+.........+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
...+.+..+.+..+.........+.....................+...+....+..+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*...+.......+...+..+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*............+.............+............+..+.+..+.......+.....+...............+.+..+....+...............+...............+........+......+.......+...+...........+...............+.............+...+...+...........+..........+.....+.+............+..+......+....+......+.....+...+....+...+..................+.....+.+........+.+......+...+..+.+........+.......+..+...+...+.........+.......+......+........+..........+.................+....+...+...............+..+....+.....+.........+..........+...........+....+..+.+........+............+.......+..+....+.....+.......+............+..+.+........+............+.........+..........+.........+.........+.....+.+..+............+.......+...+...+.....+....+........+.+......+.....+.........+....+..+.........+....+..+....+.........+..+.+..+............+...+.......+..............+.........+.+.....+.+.....+...+.+......+...+.......................+.......+..+.+..+.......+..................+.....+.+..+...+....+..+...+.......+......+...+..+..........+.....+.......+...+........+.........+...+....+.....+...+.+......+...+...+..+...+...+..........+...........+....+..+...............+....+...+..+.+...+.....+.....................+....+..+....+......+.........+...+..+...+.+...............+.........+..+.+..+......+.......+........+.........+..........+.....................+.....+.+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Common Name (eg: your user, host, or server name) [Easy-RSA CA]:

* Notice:

CA creation complete and you may now import and sign cert requests.
Your new CA certificate file for publishing is at:
/etc/easy-rsa/pki/ca.crt

The CA certificate is generated and stored at /etc/easy-rsa/pki/ca.crt.

Generate Diffie Hellman Parameters

Generate Diffie-Hellman keys used for key exchange during the TLS handshake between OpenVPN server and the connecting clients. This command has be executed within the Easy-RSA directory;

./easyrsa gen-dh

DH parameters of size 2048 created at /etc/easy-rsa/pki/dh.pem.

Generate OpenVPN Server Certificate and Key

To generate a certificate and private key for the OpenVPN server, run the command below;

cd /etc/easy-rsa
./easyrsa build-server-full server nopass

Enter the CA passphrase created above to generate the certificates and keys.

nopass option disables the use of passphrase.

* Notice:
Using Easy-RSA configuration from: /etc/easy-rsa/pki/vars

* Notice:
Using SSL: openssl OpenSSL 3.0.9 30 May 2023 (Library: OpenSSL 3.0.9 30 May 2023)

.+......+.....+....+..+...+.+.....+......+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*..+........+.......+..+....+.....+.+...............+...+..+.+..+.+...........+.+...+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*.......+...+...+.........+...+......+.......+...+.....+..........+......+...+......+......+........+......+......+.+...+.....+............+....+...+...........+....+...+..............+....+..+............+.+..............+............+.+.........+.....+.+..+.+............+..................+..+...............+....+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
.....+.+.....+...+.+.........+..+......+.......+......+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*.+...+...............+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*..+.+...+..+.........+.+.....+...+...+...+.........+.............+........+......+..........+.....+......+...+.+........+............+...+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
-----
* Notice:

Keypair and certificate request completed. Your files are:
req: /etc/easy-rsa/pki/reqs/server.req
key: /etc/easy-rsa/pki/private/server.key


You are about to sign the following certificate.
Please check over the details shown below for accuracy. Note that this request
has not been cryptographically verified. Please be sure it came from a trusted
source or that you have verified the request checksum with the sender.

Request subject, to be signed as a server certificate for 825 days:

subject=
    commonName                = server


Type the word 'yes' to continue, or any other input to abort.
  Confirm request details: yes

Using configuration from /etc/easy-rsa/pki/06ebef0a/temp.ba6f7433
Enter pass phrase for /etc/easy-rsa/pki/private/ca.key:
40A725DB857F0000:error:0700006C:configuration file routines:NCONF_get_string:no value:../crypto/conf/conf_lib.c:315:group= name=unique_subject
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName            :ASN.1 12:'server'
Certificate is to be certified until Jan  5 18:30:06 2026 GMT (825 days)

Write out database with 1 new entries
Data Base Updated

* Notice:
Certificate created at: /etc/easy-rsa/pki/issued/server.crt

Generate Hash-based Message Authentication Code (HMAC) key

TLS/SSL pre-shared authentication key is used as an additional HMAC signature on all SSL/TLS handshake packets to avoid DoS attack and UDP port flooding. This can be generated using the command;

openvpn --genkey secret /etc/easy-rsa/pki/ta.key

Generate OpenVPN Revocation Certificate

To invalidate a previously signed certificate, you need to generate a revocation certificate. Run the script within the Easy-RSA directory;

./easyrsa gen-crl

The revocation certificate is generated and stored at /etc/easy-rsa/pki/crl.pem.

Copy Server Certificates and Keys to Server Config Directory

Copy all generated server certificates/keys to OpenVPN server configuration directory.

cp -rp /etc/easy-rsa/pki/{ca.crt,dh.pem,ta.key,crl.pem,issued,private} /etc/openvpn/server/

Generate OpenVPN Client Certificates and Keys

OpenVPN clients certificates and private keys can be generated as follows

cd /etc/easy-rsa
./easyrsa build-client-full <username> nopass
  • where <username> is the name of the client for which the certificate and keys are generated.
  • Always use a unique common name for each client that you are generating certificate and keys for.

For example, to generate VPN client certificate file for the user, gentoo;

./easyrsa build-client-full gentoo nopass

To generate for another client;

./easyrsa build-client-full janedoe nopass

You can see how to use easyrsa command with ./easyrsa --help.

The certificate files will be placed under the /etc/easy-rsa/pki/issued directory for each user.

Copy Client Certificates and Keys to Client Directory

Create OpenVPN clients directories. For example, we have generated certificates and key files for two clients, gentoo and janedoe, hence we create directories as;

mkdir /etc/openvpn/client/{gentoo,janedoe}

After that, copy the client generated certificates/keys and server CA certificate to OpenVPN client configuration directory. You can

cp -rp /etc/easy-rsa/pki/{ca.crt,issued/gentoo.crt,private/gentoo.key} /etc/openvpn/client/gentoo
cp -rp /etc/easy-rsa/pki/{ca.crt,issued/janedoe.crt,private/janedoe.key} /etc/openvpn/client/janedoe/

Configure OpenVPN Server on Debian 12

The next step is to configure OpenVPN server.

Copy the sample OpenVPN server configuration to /etc/openvpn/server directory as shown below;

cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf /etc/openvpn/server/

Extract the configuration and modify it to suite your needs.

The configuration is highly commented to help you understand various option usage.

This is how our updated sample configuration looks like with no comments.

grep -vE "^$|^#|^;" /etc/openvpn/server/server.conf
port 1194
proto udp4
dev tun
ca ca.crt
cert issued/server.crt
key private/server.key  # This file should be kept secret
dh dh.pem 
topology subnet
server 172.16.20.0 255.255.255.0
ifconfig-pool-persist /var/log/openvpn/ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 9.9.9.9"
push "dhcp-option DNS 8.8.8.8"
client-to-client
keepalive 10 120
tls-auth ta.key 0 # This file is secret
cipher AES-256-CBC
persist-key
persist-tun
status /var/log/openvpn/openvpn-status.log
log-append  /var/log/openvpn/openvpn.log
verb 3
explicit-exit-notify 1
auth SHA512

Save and exit the config once done editing.

Configure OpenVPN IP Forwarding

To ensure that traffic from the client is routed through the OpenVPN server’s IP address (helps masks the the client IP address), you need to enable IP forwarding on the OpenVPN server.

Uncomment the line, net.ipv4.ip_forward=1, on /etc/sysctl.conf to enable packet forwarding for IPv4

sed -i 's/#net.ipv4.ip_forward=1/net.ipv4.ip_forward=1/' /etc/sysctl.conf

Apply the changes without rebooting the server.

sysctl -p

Allow OpenVPN service port through firewall

If you are using UFW, then;

ufw allow 1194/udp

You can also limit connection to specific sources only;

ufw allow from <source> to any port 1194 proto udp comment "Allow VPN"

or iptables;

iptables -A INPUT -p udp --dport 1194 -j ACCEPT

Make a backup of old rules and save the changes. Ensure you have the iptables-persistent package installed to save the changes.

cp /etc/iptables/rules.v4{,.old}
iptables-save > /etc/iptables/rules.v4

Configure IP Masquerading on UFW

Find your default interface through which your packets are sent.

ip route get 8.8.8.8
8.8.8.8 via 10.0.2.2 dev enp0s3 src 10.0.2.15 uid 0

Next, update UFW rules;

vim /etc/ufw/before.rules

Add the following highlighted lines just before the *filter table settings. Note the interface used shoud match the interface name above.

...
*nat
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 172.16.20.0/24 -o enp0s3 -j MASQUERADE
COMMIT
# Don't delete these required lines, otherwise there will be errors
*filter
...

Save and exit the config.

Enable UFW packet forwarding;

sed -i 's/DEFAULT_FORWARD_POLICY="DROP"/DEFAULT_FORWARD_POLICY="ACCEPT"/' /etc/default/ufw

Reload UFW;

ufw reload

Configure IP Masquerading on IPtables

If using iptables, enable masquerade;

iptables -t nat -A POSTROUTING -s 172.16.20.0/24 -o enp0s3 -j MASQUERADE

Save the rules!

Running OpenVPN Server on Debian 12

Start and enable OpenVPN server to run on system boot;

systemctl enable --now openvpn-server@server

Checking the status;

systemctl status openvpn-server@server
[email protected] - OpenVPN service for server
     Loaded: loaded (/lib/systemd/system/[email protected]; enabled; preset: enabled)
     Active: active (running) since Tue 2023-10-03 15:20:57 EDT; 8s ago
       Docs: man:openvpn(8)
             https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage
             https://community.openvpn.net/openvpn/wiki/HOWTO
   Main PID: 2798 (openvpn)
     Status: "Initialization Sequence Completed"
      Tasks: 1 (limit: 2304)
     Memory: 1.4M
        CPU: 20ms
     CGroup: /system.slice/system-openvpn\x2dserver.slice/[email protected]
             └─2798 /usr/sbin/openvpn --status /run/openvpn-server/status-server.log --status-version 2 --suppress-timestamps --config server.conf

Oct 03 15:20:57 debian systemd[1]: Starting [email protected] - OpenVPN service for server...
Oct 03 15:20:57 debian systemd[1]: Started [email protected] - OpenVPN service for server.

When OpenVPN service runs, it will create a tunnelling interface, tun0;

ip add s
...
4: tun0:  mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 500
    link/none 
    inet 172.16.20.1/24 scope global tun0
       valid_lft forever preferred_lft forever
    inet6 fe80::49e1:76ac:b0b0:33b7/64 scope link stable-privacy 
       valid_lft forever preferred_lft forever

Also, be sure to check the logs;

tail /var/log/openvpn/openvpn.log
net_iface_mtu_set: mtu 1500 for tun0
net_iface_up: set tun0 up
net_addr_v4_add: 172.16.20.1/24 dev tun0
Socket Buffers: R=[212992->212992] S=[212992->212992]
UDPv4 link local (bound): [AF_INET][undef]:1194
UDPv4 link remote: [AF_UNSPEC]
MULTI: multi_init called, r=256 v=256
IFCONFIG POOL IPv4: base=172.16.20.2 size=253
IFCONFIG POOL LIST
Initialization Sequence Completed

Magnificent. The OpenVPN server is now ready. That marks the end of our guide on installing OpenVPN Server on Debian 12.

You can now install and configure your OpenVPN clients accordingly.

SUPPORT US VIA A VIRTUAL CUP OF COFFEE

We're passionate about sharing our knowledge and experiences with you through our blog. If you appreciate our efforts, consider buying us a virtual coffee. Your support keeps us motivated and enables us to continually improve, ensuring that we can provide you with the best content possible. Thank you for being a coffee-fueled champion of our work!

Photo of author
Kifarunix
Linux Certified Engineer, with a passion for open-source technology and a strong understanding of Linux systems. With experience in system administration, troubleshooting, and automation, I am skilled in maintaining and optimizing Linux infrastructure.

Leave a Comment