Virtual Private Network in Linux
A VPN (Virtual Private Network) is a technology that creates a secure, encrypted connection (tunnel) over a public network like the internet, allowing devices to communicate as if they were on a private network. It routes your internet traffic through a remote server, encrypting your data and hiding your IP address. This ensures that your online activities remain private and protected from potential threats, such as hackers, surveillance, and data breaches.
A VPN works by creating a secure, encrypted tunnel between your device and a remote server, so your data can travel safely over the public internet.
Types of VPN
- Remote Access VPN (Client-to-site): Remote Access allows an individual device securely “join” a remote network as if it were physically inside it.
- Site-to-Site VPN: A Site-to-Site VPN connects two entire networks, making them behave like one unified network.
VPN Protocols
VPN protocols are the rules and methods used to create the secure tunnel, encrypt data, and authenticate connections between devices in a VPN.
Types of VPN protocols
Internet Protocol Security (IPSec)
Internet Protocol Security, or IPSec, is used to secure Internet communication across an IP network. IPSec secures Internet Protocol communication by authenticating the session and encrypting each data packet during the connection.
IPSec operates in two modes: Transport mode and Tunneling mode, to protect data transfer between two different networks. Transport mode encrypts the message in the data packet, and Tunneling mode encrypts the entire data packet.
Layer 2 Tunneling Protocol (L2TP)
L2TP, or Layer 2 Tunneling Protocol, is a tunneling protocol that is usually combined with another VPN security protocol like IPSec to create a highly secure VPN connection. L2TP creates a tunnel between two L2TP connection points, and the IPSec protocol encrypts the data and handles secure communication within the tunnel.
Point-to-Point Tunneling Protocol (PPTP)
PPTP, or Point-to-Point Tunneling Protocol, creates a tunnel and encapsulates the data packet. It uses Point-to-Point Protocol (PPP) to encrypt the data between the connections.
Secure Sockets Layer (SSL) and Transport Layer Security (TLS)
SSL (Secure Sockets Layer) and TLS (Transport Layer Security) create a VPN connection where the web browser acts as the client, and user access is restricted to specific applications instead of the entire network.
OpenVPN
OpenVPN is an open-source VPN that is useful for creating Point-to-Point and Site-to-Site connections. It uses a custom security protocol based on SSL and TLS protocols.
Installing and Configuring VPN
On the Server
I. System Update : Begin by updating the package list. Performing this step guarantees the installation of the latest software versions and security updates.
II. Install OpenVPN and Easy-RSA
OpenVPN is the leading software for establishing and handling VPN connections. Meanwhile, Easy-RSA serves as a utility designed to simplify the generation of essential SSL certificates and keys for secure communication.
Before installing openvpn and easy-rsa, installation of Extra Packages for Enterprise Linux (EPEL) on RHEL10 is required which can be done using
sudo dnf install https://dl.fedoraproject.org/pub/epel/epel-release-latest-10.noarch.rpm
sudo dnf install easy-rsa openvpn -y
III. Initialize the Easy-RSA PKI
Once Easy-RSA is installed, you have to initialize the Public Key Infrastructure. This step is necessary to set up the certificate authority and generate the certificates and keys needed for OpenVPN.
Initially, copy the Easy-RSA configuration directory to an alternate location. This precaution will safeguard your alterations from being overwritten by future package upgrades.
sudo cp -r /usr/share/easy-rsa /etc/
cd /etc/easy-rsa/ — navigates to the created directory
sudo ./easyrsa init-pki — Initializes the Public Key Infrastructure
IV. Generate the Certificate Authority
In this step, you will generate the Certificate Authority certificate and key
sudo ./easyrsa build-ca
You’ll be prompted to enter a password and a common name for the Certificate Authority key for security. The CA key should be kept secure as it signs certificates for your VPN.
V. Generate Diffie-Hellman parameters
With Diffie-Hellman keys, you can establish secure connections with strong encryption. However, It is possible to skip this step entirely, but you would leave your VPN setup less secure.
sudo ./easyrsa gen-dh
VI. Generate OpenVPN server certificate and key
In this step, you generate the server certificate and key for your OpenVPN server.
Here, you first have to change the current working directory to the Easy-RSA directory.
cd /etc/easy-rsa
sudo ./easyrsa build-server-full server nopass
The nopass flag disables passphrase protection.
VII. Generate HMAC key
The TLS/SSL pre-shared authentication key adds an extra layer of security by including an HMAC signature on every SSL/TLS handshake packet. This measure helps prevent potential DoS attacks and UDP port flooding. Although not mandatory, I strongly advise you to consider this step, particularly if you intend to safeguard against specific attacks.
sudo openvpn — — genkey secret /etc/easy-rsa/pki/ta.key
VIII. Generate OpenVPN revocation certificate
Get Odumosu Pamilerin’s stories in your inbox
Join Medium for free to get updates from this writer.
Generate a revocation certificate to invalidate previously signed certificates
sudo ./easyrsa gen-crl
IX. Copy server certificates and keys
In this step, copy the generated server certificates and keys to the OpenVPN server’s configuration directory. These files are necessary for establishing secure connections between the server and clients.
sudo cp -rp /etc/easy-rsa/pki/{ca.crt,dh.pem,ta.key,crl.pem,issued,private} /etc/openvpn/server/
X. Generate OpenVPN client certificates and keys
This step involves creating certificates and keys for each client that will connect to the OpenVPN server. These certificates and keys are unique to each client and are used for authentication
cd /etc/easy-rsa
sudo ./easyrsa build-client-full clientname nopass
XI. Editing OpenVPN server configuration file
This file contains settings that control how the OpenVPN server operates.
The included configuration file offers several adjustable parameters that cater to your preferences. These parameters oversee various aspects, like the server’s listening port, tunnel device type, encryption preferences, and more.
sudo vim /etc/openvpn/server/server.conf
XII. Enable IP forwarding and Firewall configuration
Enable IP forwarding in the sysctl configuration. This step allows the server to route traffic between its interfaces. It’s an important step for proper VPN operation.
sudo sed -i ‘s/#net.ipv4.ip_forward=1/net.ipv4.ip_forward=1/’ /etc/sysctl.conf
Apply the changes without rebooting the server
sudo sysctl — — system
Configure Firewall Rules
Allow VPN traffic through the firewall
sudo firewall-cmd — add-service=openvpn — permanent
sudo firewall-cmd — add-masquerade — permanent
sudo firewall-cmd — reload
Start and Enable OpenVPN server
Start the OpenVPN service and enable it to run at boot:
sudo systemctl start openvpn-server@server
sudo systemctl enable openvpn-server@server
Check the service status: sudo systemctl status openvpn-server@server
On the Client
I. Install OpenVPN and Easy-RSA
II. Generate a client certificate and key on the VPN server for the client device
cd ~/openvpn-ca
./easyrsa gen-req client1 nopass
./easyrsa sign-req client client1
Copy client certificate and key from the server using scp to /etc/opevpn/client
Create a client configuration (client1.conf) in the /etc/openvpn/client directory
vim /etc/opevpn/client/client1.conf
In the client1.conf file:
client
dev tun
proto udp
remote 192.168.159.139 1194
resolv-retry infinite
nobind
remote-cert-tls server
ca /etc/openvpn/client/ca.crt
cert /etc/openvpn/client/client1.crt
key /etc/openvpn/client/client1.key
tls-auth /etc/openvpn/client/ta.key 1
auth SHA512
data-ciphers AES-256-GCM:AES-256-CBC
data-ciphers-fallback AES-256-CBC
verb 3Start and Enable the openvpn client service
sudo systemctl start openvpn-client@client1
sudo systemctl status openvpn-client@client1
Testing the VPN Client configuration
ip a shows a tunnel interface (tun 0) created on the client
ip route shows the network traffic route through the tunnelling interface
Using SSH with Tunnel Interface
To verify the tunnel port, the private IP address attached to the tunnel can be used for networking activities such as ssh and ping in place of the server physical interface IP address
