1

I have been following this tutorial – Howto Configure OpenVPN Server-Client on Ubuntu 15.04 – to set up OpenVPN on my Ubuntu 15.04 VM.  I have followed it through and through, and am kind of stuck with the client config file.

Here is the client.conf file given in the example:

dev tun
proto udp

# IP and Port of remote host with OpenVPN server
remote 111.222.333.444 1194

resolv-retry infinite

ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/client.crt
key /etc/openvpn/keys/client.key
tls-client
tls-auth /etc/openvpn/keys/ta.key 1
auth SHA1
cipher BF-CBC
remote-cert-tls server
comp-lzo
persist-key
persist-tun

status openvpn-status.log
log /var/log/openvpn.log
verb 3
mute 20

So I am guessing remote IP would be the public IP of my server and that I would need to forward port 1194 on my router. However where I define the ca, cert and key in the conf file, if I was using this on an Android device would I need to change the path to reflect where these files are on the Android device or is the example given correct?

I will be generating the client key to be used on both Android and iOS devices using the OpenVPN client. Would this also work on Windows?

2 Answers 2

0

when installing the certs, vpn config file etc. as a client on android and iphone, you don't need to worry about the location in the config file, the app will take care of it. On Windows for example, it's a little different, on macOS, using tunnelblick, just drop the files into tunnelblick and it will take care of the paths.

Hope that helps.

0

The location of the certificates in the config file have to reflect the location where they are installed in your client. In my case the certificate is already embedded in the client config file:

client
dev tun
proto udp
remote myserver.ddns.com 443
float
comp-lzo adaptive
keepalive 15 60
auth-user-pass
ns-cert-type server
<ca>
-----BEGIN CERTIFICATE-----
...HERE I HAVE A FEW LINES OF SYMBOLS REPRESENTING MY CERTIFICATE...
-----END CERTIFICATE-----
</ca>
resolv-retry infinite
nobind

Some hotspots will block most ports, but port 443 will be open mostly everywhere. That is why I tend to use it, to reach my home cloud from everywhere.

At the end I still had to add a permanent static route to some devices (mostly raspberry pi's) in my home LAN to be able to access them via VPN from the outside. Had to add this line to /etc/network/interfaces:

up route add 10.8.0.0/24 via 192.168.1.1 dev eth0
2
  • These static routes are they configured on the servers config file? Mar 20, 2016 at 11:29
  • Yes, sometimes, but they only help the client into routing correctly, but the source devices you want to reach in your home network, they have also to know which gateway to send back the packets received from the client connected via VPN. This took me sometime to figure out...
    – marc
    Mar 20, 2016 at 14:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .