1

I use CentOS 7 . I want to create VPN server on my machine. I am following perfect VPN tutorial until I get to this part, editing /etc/openvpn/server.conf:

local x.x.x.x
port 1194
proto udp
dev tun
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key
dh /etc/openvpn/easy-rsa/2.0/keys/dh2048.pem
plugin /usr/lib64/openvpn/plugins/openvpn-plugin-auth-pam.so /etc/pam.d/login
client-cert-not-required
username-as-common-name
server ?  ?
push "redirect-gateway def1"
push "dhcp-option DNS ?"
push "dhcp-option DNS ?"
keepalive 5 30
comp-lzo
persist-key
persist-tun
status server-tcp.log
verb 3

There are a few parts I don't understand. Please explain for me how it works. There are a lot of tutorials on the internet, but they just type their own network so I don't understand anything.

This is my local network information: http://imgur.com/a/cgJkW.

What should I type for the ?s ?

  • Where i can find DNS to type on push "dhcp-option?
  • Where I can find the IP to type on server?

Am I doing it right? What do I have to fix?

  • Please try to use better formatting in your question. – rda Jun 2 '16 at 19:17
0

The "server" line is only needed on the client config; it tells the client what server to talk to.

The DNS entries are the IP address of the DNS servers you want the client to use. If you don't need to use specific DNS entries (eg no "internal DNS" on your network) then you don't need to push any DNS values at all.

  • i can't except that answer. – hiroshi17 Jun 2 '16 at 15:27
  • Can you explain a very little step, where do I find the DNS IP to type? what command? Just find and type, that is. And server too. – hiroshi17 Jun 2 '16 at 15:52
  • thats not correct. remote is used to specify the server's address and port in the client config – rda Jun 2 '16 at 19:00
0

Write for example:

server 10.8.0.0 255.255.255.0

This is where you define the subnet for your OpenVPN network. You can't find it somewhere, you choose it. The above will serve a /24 subnet, the vpn server's IP will be 10.8.0.1, the first client 10.8.0.2. Check out the manpage for more information. This directive will expand as shown on the manpage:

--server network netmask ['nopool'] A helper directive designed to simplify the configuration of OpenVPN's server mode. This directive will set up an OpenVPN server which will allocate addresses to clients out of the given network/netmask. The server itself will take the ".1" address of the given network for use as the server-side endpoint of the local TUN/TAP interface. For example, --server 10.8.0.0 255.255.255.0 expands as follows:

 mode server
 tls-server
 push "topology [topology]"

 if dev tun AND (topology == net30 OR topology == p2p):
   ifconfig 10.8.0.1 10.8.0.2
   if !nopool:
     ifconfig-pool 10.8.0.4 10.8.0.251
   route 10.8.0.0 255.255.255.0
   if client-to-client:
     push "route 10.8.0.0 255.255.255.0"
   else if topology == net30:
     push "route 10.8.0.1"

 if dev tap OR (dev tun AND topology == subnet):
   ifconfig 10.8.0.1 255.255.255.0
   if !nopool:
     ifconfig-pool 10.8.0.2 10.8.0.254 255.255.255.0
   push "route-gateway 10.8.0.1"
   if route-gateway unset:
     route-gateway 10.8.0.2

To push dns server configuration to your clients write for example:

push "dhcp-option DNS 10.8.0.1"

Or for example if you decide that you want your clients to use the google's dns servers:

push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"

A basic example server.conf file without any special configuration will look like this (I removed all optional directives, which should not be required in a very basic setup):

port 1194
proto udp
dev tun
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key
dh /etc/openvpn/easy-rsa/2.0/keys/dh2048.pem
server 10.8.0.0 255.255.255.0
keepalive 10 60
comp-lzo
persist-key
persist-tun
status server-status.log
verb 3
  • Ok , I get it. But can you see this my problem: imgur.com/a/PB2Zm, and help me, please. – hiroshi17 Jun 3 '16 at 5:28
  • I just try to fix it again, but it still not working. – hiroshi17 Jun 3 '16 at 6:09
  • @hiroshi17, the problem has to do with your first line local. either wrong ip or the port is already in use. you don't need local. remove it and the server will bind to all adresses. – rda Jun 3 '16 at 6:30
  • I think the local x.x.x.x is public Ip address? – hiroshi17 Jun 3 '16 at 7:55
  • With local x.x.x.x you specify the IP on which the server should listen. This should be one of the IPs listed with ip addr | grep inet, then the server will only listen on that IP. You can also omit this directive, then the server will listen on all IPs of all interfaces. Check also that the port is not already in use with netstat -an | grep 1194. – rda Jun 3 '16 at 9:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.