Today, my VPS on slicehost has been setup as virtual private network server via OpenVPN. As I have mentioned at Google said goodbye to Chinese, the google.cn has been disabled and restricted by IP. So I have to find a way to setup the VPN server so that I can visit Google.com in China. Well, my story is over. Let’s start the VPN server tutorial right now!

Step 1: Install OpenVpn to your slice(VPS on the SliceHost)!

As usual, we can install it either source or binary. I have installed it with binary via aptitude the built-in dpkg of the Ubuntu(well, I installed the image Ubuntu 8.04.2 LTS – hardy on my VPS).

install openvpn via dpkg

aptitude install openvpn

install openvpn via source

cd ~/sources #or your favor places to put source files always
wget http://openvpn.net/release/openvpn-2.0.5.tar.gz
tar -jxv -f openvpn-2.0.5.tar.gz
cd ./openvpn-2.0.5
./configure --with-lzo-headers=/usr/local/include --with-lzo-lib=/usr/local/lib --with-ssl-headers=/usr/local/include/openssl --with-ssl-lib=/usr/local/lib # please install lzo and openssl first
make
make check
make install

Step 2: PKI Configure and Keys Generated


cp -R /usr/share/doc/openvpn/examples/easy-rsa /etc/open/vpn
sudo -i #if you are not login as root but have sudo permitted as root
cd /etc/openvpn/easy-rsa/2.0
./vars #if it doesn't work, try [sh ./vars] or use the export command
./clean-all
./build-ca
./build-key-server server #change server to yours
./build-key username #set username here
./build-dh
openvpn --genkey --secret ta.key #find more about this comment in sample file server.conf
exit

You needn’t and shouldn’t to run clean-all and build-ca at the next time when you wanna add more user or server.

Step 3: Config the server.conf for OpenVPN


sudo cp /usr/share/doc/openvpn/example/sample-config-files/server.conf /etc/openvpn/
sudo vim /etc/openvpn/server.conf

It’s a good idea to read the comment in the server.conf. We have to uncomment the following settings.

port 1194
proto udp
dev tun
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
server x.x.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway"
push "dhcp-option DNS x.x.x.x" #try to find it via comment cat /etc/resolv.conf
keepalive 10 120
tls-auth /etc/openvpn/easy-rsa/2.0/keys/ta.key 0
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3


Step 4: iptable if you have set firewall


sudo vim /etc/iptables.test.rules
# then add the following lines into your test rules
*nat
-t nat -A POSTROUTING -s x.x.0.0/24 -o eth0 -j MASQUERADE # x.x.0.0 should be identical with the one in your server.conf file
COMMIT
*filter #it may have already
-A INPUT -i tun+ -j ACCEPT
-A FORWARD -i tun+ -j ACCEPT
-A FORWARD -o tun+ -j ACCEPT
-A INPUT -p udp --dport 1194 -j ACCEPT
.....
your origin chains
....
COMMIT
sudo iptables-restore < /etc/iptables.test.rules
sudo iptables -L
#.....output for your review
sudo -i
iptables-save > /etc/iptables.up.rules
exit


Step 5: VPN Client

Install OpenVPN on your local computer as well basically.
Copy the files ca.crt、ta.key、username.crt、username.key, they are lying in the folder /etc/openvpn/keys/. Please be aware of that the copy should in the ssh tunnel to keep it’s secret. Execute [sudo cp /usr/share/doc/openvpn/examples/sample-config-files/client.conf /etc/openvpn/]. The finally setting client file as following:

client
dev tun
proto udp
remote yourserver 1194 #the public IP of your slice
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert username.crt
key username.key
ns-cert-type server
tls-auth ta.key 1
comp-lzo
verb 3


Step 6: Forward isn’t ready yet, enable Router

Till now, we can connect the VPN server. However, we are failed to access internet once the connection created. That’s because the ROUTER on the slice isn’t enabled yet. Try type [sudo sysctl -a | grep for]. We will see net.ipv4.ip_forward = 0 etc. Use command [sudo sysctl -w net.ipv4.ip_forward=1] to adjust the value of forward. The finally displaying after your run [sudo sysctl -a | grep for] as follow.

kernel.sched_domain.cpu0.domain0.forkexec_idx = 1
kernel.sched_domain.cpu1.domain0.forkexec_idx = 1
kernel.sched_domain.cpu2.domain0.forkexec_idx = 1
kernel.sched_domain.cpu3.domain0.forkexec_idx = 1
net.ipv4.ip_forward = 1
net.ipv4.conf.lo.forwarding = 1
net.ipv4.conf.lo.mc_forwarding = 0
net.ipv4.conf.lo.force_igmp_version = 0
net.ipv4.conf.all.forwarding = 1
net.ipv4.conf.all.mc_forwarding = 0
net.ipv4.conf.all.force_igmp_version = 0
net.ipv4.conf.default.forwarding = 1
net.ipv4.conf.default.mc_forwarding = 0
net.ipv4.conf.default.force_igmp_version = 0
net.ipv4.conf.eth0.forwarding = 1
net.ipv4.conf.eth0.mc_forwarding = 0
net.ipv4.conf.eth0.force_igmp_version = 0
net.ipv4.conf.eth1.forwarding = 1
net.ipv4.conf.eth1.mc_forwarding = 0
net.ipv4.conf.eth1.force_igmp_version = 0
net.ipv4.conf.tun0.forwarding = 1
net.ipv4.conf.tun0.mc_forwarding = 0
net.ipv4.conf.tun0.force_igmp_version = 0
net.ipv6.conf.lo.forwarding = 0
net.ipv6.conf.lo.force_mld_version = 0
net.ipv6.conf.eth0.forwarding = 0
net.ipv6.conf.eth0.force_mld_version = 0
net.ipv6.conf.eth1.forwarding = 0
net.ipv6.conf.eth1.force_mld_version = 0
net.ipv6.conf.all.forwarding = 0
net.ipv6.conf.all.force_mld_version = 0
net.ipv6.conf.default.forwarding = 0
net.ipv6.conf.default.force_mld_version = 0
net.ipv6.conf.tun0.forwarding = 0
net.ipv6.conf.tun0.force_mld_version = 0

Alernately, you can modify the file /etc/sysctl.conf. There is an comment line[net.ipv4.ip_forward=1]. And run sudo sysctl -p to flush the modification. I have read some guides which use the command [echo "1" > /proc/sys/net/ipv4/ip_forward] to enable simple built-in router of kernel. It’s works. But it will be disabled once you reboot the computer. So try to add it to file /etc/rc.d/rc.local.

Step 7: Start Your VPN Server and try to use it


sudo /etc/init.d/openvps start

OR
append the command [/usr/local/sbin/openvpn --config /etc/openvpn/server.conf > dev/null 2>&1 &] to /etc/rc.local].
This is a tutorial based upon Ubuntu. You may need adjust the command to run if you wanna setup OpenVPN server in other unix-like system. If you wanna use OpenVPN on the Windows, I recommend GUI OpenVPN for windows.
Thanks for your reading!