# Ubuntu - Ultimate Guide to OpenVPN: Server and Client Configuration Setting up a secure OpenVPN server on Oracle Cloud is straightforward when you follow the right steps. This guide walks you through installing OpenVPN using the angristan installation script, configuring it for your Oracle Cloud instance, and ensuring proper routing so your clients can access the internet through the VPN tunnel. ## Prerequisites * Oracle Cloud Ubuntu instance (or any Ubuntu 20.04+) * SSH access to your server * Basic understanding of Linux commands * A local machine (Mac/Linux/Windows) to connect as a client ## Step 1: Install Dependencies First, update your system and install required packages: ```bash sudo apt update sudo apt install wget curl ``` ## Step 2: Download and Run the angristan OpenVPN Installation Script The angristan script automates most of the OpenVPN setup, making it simple and reliable: ```bash curl -O https://raw.githubusercontent.com/angristan/openvpn-install/master/openvpn-install.sh chmod +x openvpn-install.sh sudo ./openvpn-install.sh ``` ## Step 3: Configure OpenVPN During Installation The script runs in interactive mode and will prompt you for configuration options. Here's what to choose: ### Server IP Address ```plaintext IPv4 address: 123.111.222.111 (Replace with your actual Oracle Cloud instance's public IP) ``` ### VPN Port ```plaintext Port [1194]: 11122 (Change from default 1194 to 11122 for obscurity and security) ``` ### Protocol ```plaintext Protocol [1-2]: 1 (Select UDP - faster and more efficient) ``` ### VPN Subnet ```plaintext IPv4 VPN subnet [1-2]: 1 (Select default 10.8.0.0/24) ``` ### DNS Servers ```plaintext Which DNS resolvers should be pushed? 1) Cloudflare 2) Quad9 3) OpenDNS 4) AdGuard DNS choice [1-4]: 1 (Cloudflare is reliable, or choose your preference) ``` ### Compression ```plaintext Compress data channel? [y/n]: n (Disable compression for better compatibility) ``` ### MTU Size ```plaintext Customize tunnel MTU? [y/n]: n (Default 1500 works for most networks) ``` ### Encryption Customization ```plaintext Customize encryption settings? [y/n]: n (Default modern encryption is secure and compatible) ``` ### Username ```plaintext Do you want to add a new user now? [y/n]: y Username: fiko (Use your preferred username) ``` ## Step 4: Download the Generated Client Configuration After installation completes, copy your client profile to your local machine: ```bash scp -P 10022 fiko@123.111.222.111:~/fiko.ovpn ~/Downloads/ ``` Replace `fiko` with your actual username. ## Step 5: Critical - Fix Routing and Internet Access This step is essential for clients to access the internet through the VPN. The script may not configure this automatically on Oracle Cloud. ### Enable IP Forwarding ```bash sudo sysctl -w net.ipv4.ip_forward=1 echo "net.ipv4.ip_forward=1" | sudo tee -a /etc/sysctl.conf ``` ### Configure NAT (Network Address Translation) ```bash sudo iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE sudo iptables-save > /etc/iptables/rules.v4 ``` **Note:** `10.8.0.0/24` is the default VPN subnet you selected in [Step 3 (VPN Subnet)](https://fiko.me/ubuntu-ultimate-guide-to-openvpn-server-and-client-configuration#vpn-subnet). If you chose a custom subnet during installation, replace `10.8.0.0/24` with your actual subnet. For example, if you configured `10.9.0.0/24`, use that instead. ### Open Firewall Port **Important:** Insert the rule ABOVE the REJECT line. The line number will vary on your system. If using firewalld: ```bash sudo firewall-cmd --permanent --add-port=11122/udp sudo firewall-cmd --reload ``` If using iptables directly: First, check your current iptables rules: ```bash sudo iptables -L INPUT --line-numbers ``` Find the line number with the REJECT rule. In most cases it will be the last line. Then insert the new rule ABOVE it using `-I INPUT `: ```bash # Example: If REJECT is on line 16, insert at line 16 sudo iptables -I INPUT 16 -p udp --dport 11122 -j ACCEPT ``` **Verify the rule was inserted correctly:** ```bash sudo iptables -L INPUT --line-numbers | grep -E "11122|REJECT" ``` Your output should look like: ```plaintext 16 ACCEPT udp -- anywhere anywhere udp dpt:11122 17 REJECT all -- anywhere anywhere reject-with icmp-host-prohibited ``` The ACCEPT rule must come BEFORE the REJECT rule. **Then save:** ```bash sudo iptables-save > /etc/iptables/rules.v4 ``` ## Step 6: Restart OpenVPN Service ```bash sudo systemctl restart openvpn-server@server sudo systemctl status openvpn-server@server ``` Verify the service is running and shows "active (running)". ## Step 7: Connect from Your Mac ### Using Command Line ```bash sudo openvpn --config ~/Downloads/fiko.ovpn ``` Leave this running in the terminal. You should see output like: ```plaintext Initialization Sequence Completed ``` ### Using OpenVPN GUI (Alternative) Install OpenVPN Connect (official client) on macOS and import the `.ovpn` file. ## Step 8: Verify Your Connection Open a new terminal tab (keep the OpenVPN terminal running) and test: ```bash # Check VPN interface ifconfig utun8 # Should show something like: # utun8: inet 10.8.0.2 --> 10.8.0.1 # Check default route netstat -rn | grep "^default" # Should show the VPN gateway (10.8.0.1) not your home network # Test connectivity ping 8.8.8.8 ping google.com # Test DNS nslookup google.com ``` ## Troubleshooting ### Connection drops immediately after connecting **Cause:** DNS resolution failing or routing misconfigured **Fix:** 1. Verify the NAT rule is present: `sudo iptables -L -t nat -n` 2. Confirm IP forwarding is enabled: `sudo sysctl net.ipv4.ip_forward` 3. Check server logs: `sudo journalctl -u openvpn-server@server -n 50` ### Can connect but no internet access **Cause:** Default route not pointing through VPN **Fix:** Temporary workaround (on Mac): ```bash sudo route add default 10.8.0.1 ``` Permanent fix: Restart OpenVPN service on server and reconnect client. ### Connection times out **Cause:** Firewall blocking port 11122 **Fix:** ```bash # Verify port is open sudo ss -tlnp | grep 11122 # Check your iptables rules to find the REJECT line number sudo iptables -L INPUT --line-numbers # Add to iptables if missing (insert ABOVE REJECT line) # Replace with your actual REJECT line number sudo iptables -I INPUT -p udp --dport 11122 -j ACCEPT sudo iptables-save > /etc/iptables/rules.v4 ``` ### Wrong subnet assigned (e.g., 172.27.x.x instead of 10.8.x.x) **Cause:** Multiple OpenVPN instances running or config corruption **Fix:** ```bash sudo systemctl stop openvpn-server@server sudo killall openvpn sleep 2 sudo systemctl start openvpn-server@server ``` Then reconnect your client. ## Adding More Clients To create additional client profiles: ```bash sudo ./openvpn-install.sh ``` When prompted, select the option to add a new user. The script will generate a new `.ovpn` file. ## Managing the VPN ### Check active connections ```bash sudo tail -f /var/log/openvpn/status.log ``` ### View server status ```bash sudo systemctl status openvpn-server@server ``` ### Restart the service ```bash sudo systemctl restart openvpn-server@server ``` ### View detailed logs ```bash sudo journalctl -u openvpn-server@server -f ``` ## Security Best Practices 1. **Change SSH port** from 22 to something else (e.g., 10022) 2. **Use key-based authentication** instead of passwords 3. **Enable fail2ban** to prevent brute force attacks 4. **Regularly update** your server: `sudo apt update && sudo apt upgrade` 5. **Keep OpenVPN updated**: The script installs the latest version 6. **Use strong usernames** and avoid common names like "admin" or "client" ## Conclusion You now have a fully functional, secure OpenVPN server running on Oracle Cloud. Your clients can connect from anywhere and access the internet through an encrypted tunnel. If you encounter issues, check the troubleshooting section or review the server logs with: ```bash sudo journalctl -u openvpn-server@server -n 100 ``` Happy secure networking! 🔒