Kidnap’ Blog

Membuat Server OpenVPN

Install openvpn di Debian

# apt-get install openvpn

Mempersiapkan Certificate Authority (CA) certificate dan Key

Key pada OpenVPN dapat dilakukan dengan tool “easy-rsa”. Dimana tool tersebut terdapat di /usr/share/doc/openvpn/examples/easy-rsa/. Copy tool tersebut ke etc/openvpn.

# cp -Rf /usr/share/doc/openvpn/examples/easy-rsa/ /etc/openvpn/

Edit file vars di /etc/openvpn

Isi COUNTRY, PROVINCE, CITY, ORG dan EMAIL dengan Settingan anda.

# cd /etc/openvpn/easy-rsa

# vim vars

#this is to ensure secure data

export KEY_SIZE=1024

# These are the default values for fields

# which will be placed in the certificate.

# Don’t leave any of these fields blank.

export KEY_COUNTRY=ID

export KEY_PROVINCE=DKI

export KEY_CITY=Jakarta

export KEY_ORG=”United Coders”

export KEY_EMAIL=”support@pulsa.web.id”

Buat Certificate Authority (CA)

# cd /etc/openvpn/ . ./vars

# cd /etc/openvpn/ ./clean-all

# cd /etc/openvpn/ ./build-ca

Country Name (2 letter code) [ID]:

State or Province Name (full name) [DKI]:

Locality Name (eg, city) [Jakarta]:

Organization Name (eg, company) [United Coders]:

Organizational Unit Name (eg, section) []:United Coders

Common Name (eg, your name or your server’s hostname)[] : Merapi

Email Address [support@pulsa.web.id]:

Lihat keys apakah sudah di generate

# ls -l /etc/openvpn/

# ls -l /etc/openvpn/keys

ca.crt

ca.key

index.txt

serial

Buat Server Key

Untuk membuat Key dan Certificate disisi server dapat dilakukan dengan cara :

# ./build-key-server Voucha

Country Name (2 letter code) [ID]:

State or Province Name (full name) [DKI]:

Locality Name (eg, city) [Jakarta]:

Organization Name (eg, company) [United Coders]:

Organizational Unit Name (eg, section) []:United Coders

Common Name (eg, your name or your server’s hostname) []:Merapi

Email Address [support@pulsa.web.id]:

Please enter the following ‘extra’ attributes

to be sent with your certificate request

A challenge password []:

An optional company name []:United Coders

Using configuration from /etc/openvpn/openssl.cnf

Check that the request matches the signature

Signature ok

The Subject’s Distinguished Name is as follows

countryName RINTABLE:’ID’

stateOrProvinceName RINTABLE:’DKI’

localityName RINTABLE:’Jakarta’

organizationName RINTABLE:’United Coders’

organizationalUnitName:PRINTABLE:’United Coders’

commonName RINTABLE:’Merapi’

emailAddress :IA5STRING:’support@pulsa.web.id’

Certificate is to be certified until April 25 03:34:36 2018 GMT (3650 days)

Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y

Write out database with 1 new entries

Data Base Updated

Note : Pada Common Name isikan dengan nama “Server / Router”.

Membuat Parameter Diffie Helman

Parameter Diffie Helman digunakan oleh 2 pengguna untuk melakukan pertukan key rahasia melalui media. Untuk membuatnya lakukan cara berikut :

#/etc/openvpn/easy-rsa/build-dh

Membuat Certificate dan Key untuk Client

#/etc/openvpn/easy-rsa/vars

#/etc/openvpn/easy-rsa/build-key client1

Kemudian akan muncul beberapa pertanyaan yang sama pada waktu pembuatan certificate dan key untuk Server. Namun pada Common Name isikan nama dengan client1.

Lalu copy client key, certificate dan juga certificate ca ke komputer client.

Edit Server.conf

# vi /etc/openvpn/server.conf

isinya kurang lebih

# OpenVPN Server config file

# Which local IP address should OpenVPN listen on? (optional)

local 192.168.1.4

# Which TCP/UDP port should OpenVPN listen on?

port 1194

# TCP or UDP server?

proto udp

# “dev tun” will create a routed IP tunnel, which is what we want

dev tun

# SSL/TLS root certificate (ca), certificate

# (cert), and private key (key). Each client

# and the server must have their own cert and

# key file. The server and all clients will

# use the same ca file.

ca ca.crt

cert merapi.crt

key merapi.key # This file should be kept secret

# Diffie hellman parameters.

dh keys/dh1024.pem

# Configure server mode and supply a VPN subnet

server 10.8.0.0 255.255.255.0

# Maintain a record of client <-> virtual IP address

# associations in this file.

ifconfig-pool-persist ipp.txt

# Push routes to the client to allow it

# to reach other private subnets behind

# the server. Remember that these

# private subnets will also need

# to know to route the OpenVPN client

# address pool (10.8.0.0/255.255.255.0)

# back to the OpenVPN server.

push “route 10.8.0.0 255.255.255.0″

# push “route 192.168.0.0 255.255.255.0″

# If enabled, this directive will configure

# all clients to redirect their default

# network gateway through the VPN, causing

# all IP traffic such as web browsing and

# and DNS lookups to go through the VPN

; push “redirect-gateway”

# Certain Windows-specific network settings

# can be pushed to clients, such as DNS

# or WINS server addresses.

;push “dhcp-option DNS 10.8.0.1″

# Uncomment this directive to allow different

# clients to be able to âseeâ

client-to-client

# Ping every 10 seconds, assume that remote

# peer is down if no ping received during

# a 120 second time period.

keepalive 10 120

# For extra security beyond that provided

# by SSL/TLS, create an âHMAC firewallâ

# to help block DoS attacks and UDP port flooding.

; tls-auth keys/ta.key 0 # This file is secret

# Select a cryptographic cipher.

# This config item must be copied to

# the client config file as well.

;cipher BF-CBC # Blowfish (default)

;cipher AES-128-CBC # AES

;cipher DES-EDE3-CBC # Triple-DES

# Enable compression on the VPN link.

; comp-lzo

# The maximum number of concurrently connected

# clients we want to allow.

max-clients 250

# It’s a good idea to reduce the OpenVPN

# daemonâs privileges after initialization.

user nobody

group nogroup

# The persist options will try to avoid

# accessing certain resources on restart

# that may no longer be accessible because

# of the privilege downgrade.

persist-key

persist-tun

# Output a short status file showing

status openvpn-status.log

log-append openvpn.log

# Set the appropriate level of log

# file verbosity.

#

# 0 is silent, except for fatal errors

# 4 is reasonable for general usage

# 5 and 6 can help to debug connection problems

# 9 is extremely verbose

verb 4

# Silence repeating messages. At most 20

# sequential messages of the same message

# category will be output to the log.

mute 20