From Bashlinux
Jump to: navigation, search

Howt to setup OpenVPN on Ubuntu

  • Install dependencies for LDAP authentication via Perl script
apt-get -y install libnet-ldap-perl
  • Setup some useful parameters for OpenVPN servers
  • Force client to use the DNS provided by OpenVPN server
push "dhcp-option DNS"
  • Don't use certificate, use User/Password instead
  • Authenticate using LDAP
plugin /usr/lib/ /etc/openvpn/ldap-auth-conf
  • Enable management console (Warning, avoid to use an address other than localhost)
management localhost 7505
  • Avoid Windows 7 overwrite the route tables

push "redirect-gateway def1 bypass-dhcp"

How to replicate OpenVPN from Zentyal to a plain Ubuntu host

UBUNTU (Pre-sync)

  • Install openvpn on the ubuntu box
apt-get -y install openvpn libnet-ldap-perl
  • Prepare the certs and logs directories
mkdir -p /var/lib/zentyal/CA
mkdir -p /var/log/openvpn
  • Enable IPv4 Forwarding
 sed -i -e '/net.ipv4.ip_forward/s/#//' /etc/sysctl.conf
 sysctl -p


  • RSync OpenVPN settings from the Zentyal box to the Ubuntu box
rsync -avz /etc/openvpn/ ubuntu-box:/etc/openvpn/
  • RSync the certificates
rsync -avz /var/lib/zentyal/CA/ ubuntu-box:/var/lib/zentyal/CA/

UBUNTU (Post-sync)

  • Edit /etc/openvpn/${COLO}-vpn/${COLO}-vpn.conf and set
  • Listening address on the public interface
local x.y.z.$OCTECT
  • Subnet for the secondary VPN on
server x.y.$SUBNET.0
  • Enable the VPN configuration at /etc/default/openvpn
  • Start OpenVPN
service openvpn start

How to setup UFW to let OpenVPN traffic from tap0 pass through

Edit /etc/ufw/before.rules file and add at the top, before the header & after the *filter rules

# NAT table rules
# Allow traffic from OpenVPN client to eth0
-A POSTROUTING -s <openvpn_net/netmask> -o <internal_nic1> -j MASQUERADE
-A POSTROUTING -s <openvpn_net/netmask> -o <internal_nic2> -j MASQUERADE

Then on the same file, right after the loopback rules add the input and forwarding for tap0

# Allow all traffic via our OpenVPN interface
-A ufw-before-input -i tap0 -j ACCEPT
-A ufw-before-forward -i tap0 -j ACCEPT
-A ufw-before-forward -o tap0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A ufw-before-forward -o tap0 -m state --state RELATED,ESTABLISHED -j ACCEPT