1

I have been following this tutorial – Howto Configure OpenVPN Server-Client on Ubuntu 15.04 – to set up OpenVPN on my Ubuntu 15.04 VM.  I have followed it through and through, and am kind of stuck with the client config file.

Here is the client.conf file given in the example:

dev tun
proto udp

# IP and Port of remote host with OpenVPN server
remote 111.222.333.444 1194

resolv-retry infinite

ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/client.crt
key /etc/openvpn/keys/client.key
tls-client
tls-auth /etc/openvpn/keys/ta.key 1
auth SHA1
cipher BF-CBC
remote-cert-tls server
comp-lzo
persist-key
persist-tun

status openvpn-status.log
log /var/log/openvpn.log
verb 3
mute 20

So I am guessing remote IP would be the public IP of my server and that I would need to forward port 1194 on my router. However where I define the ca, cert and key in the conf file, if I was using this on an Android device would I need to change the path to reflect where these files are on the Android device or is the example given correct?

I will be generating the client key to be used on both Android and iOS devices using the OpenVPN client. Would this also work on Windows?

0

The location of the certificates in the config file have to reflect the location where they are installed in your client. In my case the certificate is already embedded in the client config file:

client
dev tun
proto udp
remote myserver.ddns.com 443
float
comp-lzo adaptive
keepalive 15 60
auth-user-pass
ns-cert-type server
<ca>
-----BEGIN CERTIFICATE-----
...HERE I HAVE A FEW LINES OF SYMBOLS REPRESENTING MY CERTIFICATE...
-----END CERTIFICATE-----
</ca>
resolv-retry infinite
nobind

Some hotspots will block most ports, but port 443 will be open mostly everywhere. That is why I tend to use it, to reach my home cloud from everywhere.

At the end I still had to add a permanent static route to some devices (mostly raspberry pi's) in my home LAN to be able to access them via VPN from the outside. Had to add this line to /etc/network/interfaces:

up route add 10.8.0.0/24 via 192.168.1.1 dev eth0
  • These static routes are they configured on the servers config file? – DorkMonstuh Mar 20 '16 at 11:29
  • Yes, sometimes, but they only help the client into routing correctly, but the source devices you want to reach in your home network, they have also to know which gateway to send back the packets received from the client connected via VPN. This took me sometime to figure out... – marc Mar 20 '16 at 14:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.