Page History

...

Generating client configurations

This is covered well in the digitalocean guide, but I thought I would note down the commands used here as it's something I use/do often.

...

This will create a client key in ~/client-configs/files that can be transferred to the client.

Assigning static IP addresses to particular client configurations

You might want/need to map certain client configurations to a static ip address in the openvpn ip pool.  For this use case you would generally have a ip range for static ip addresses, and a separate (non-conflicting) range for dynamic ip address assignment (i.e. standard clients connect and receive an dynamic ip address subject to availability).

Such a configuration requires several changes to server.conf and the creation of a folder which holds a client-name config file (which contains the static ip address to assign) for each config you wan to assign a static ip address to.

server.conf changes

Here we'll do two things, define an ip address range for dynamic assignment, and enable the folder to hold client static ip address files.

...

sudo systemctl restart openvpn@server

Create files for each client you want to assign an ip address to

Here we simply add a file, which must have the same name as the client configuration. 

...

Overriding DNS settings for server in client configutation

Openvpn server.conf  allows you to define DNS addresses such as addresses for OpenDNS etc.  These addresses with then be pushed to the client to implement when it connects to the server.

...

If OpenVPN doesn't reconnect after wake

On one of my laptops (running Manjaro) the openvpn client wouldn't reconnect after waking from sleep.  As outlined in the Arch wiki, you can quickly add a systemd service which sends a SIGHUP signal to OpenVPN which forces a reconnect to occur:

...

sudo systemctl enable openvpn-reconnect

Recovering after an accidental ./clean-all

Using port 443 for OpenVPN & other applications (like a webserver)

If the network environment you're operating in is restrictive then chances are port 1194 (standard openvpn port) will be blocked - which means that you wont' be able to connect to your openvpn server from that environment without making some changes on your end.  One way to get around this is to change your openvpn port to something that will most likely NOT be blocked, like port 443 (https/ssl port).  Doing so is trivial within your openvpn server.conf file.  However, issues arise if you also use said server for other things, like a webserver - especially is you run multiple applications from said server (see Apache reverse-proxy SSL to multiple server applications for a standard setup running multiple web applications with Apache).

In this use case, we are actually going to use port 443 for both OpenVPN and our Apache2 reverse proxy.  Now, we can't bind port 443 simultaneously to OpenVPN and Apache2 but we can use share port 443 by fronting these with a SSL/OpenVPN multiplexer like SSLH.

...

This approach assumes you've setup an Apache reverse-proxy in which you take care of SSL termination with the relevant SSL certs within said reverse-proxy which listens (is binded) to port 443.  It also assumes that you've setup OpenVPN as outlined previously in this article and are using port 1194 for OpenVPN.

Change OpenVPN to tcp-server mode

First let's make a small change to our OpenVPN by replacing

...

Change Apache SSL listening port and update any vhosts directives

Next, we're going to change our Apache SSL listening port to 8443 (you should check that this port is free - if not choose another valid arbitrary port number).

...

<VirtualHost *:4443>
    ...
</VirtualHost>

We wonDon't restart Apache2 just yet...

Install and configure sslh

Next we're let's install SSLH:

...

Copy the following to a file, make it executable, and execute with sudo.

#!/bin/bash

iptables -t mangle -N SSLH
iptables -t mangle -A OUTPUT --protocol tcp --out-interface enp0s25 --sport 4443 --jump SSLH
iptables -t mangle -A OUTPUT --protocol tcp --out-interface enp0s25 --sport 1194 --jump SSLH
iptables -t mangle -A SSLH --jump MARK --set-mark 0x1
iptables -t mangle -A SSLH --jump ACCEPT
ip rule add fwmark 0x1 lookup 100
ip route add local 0.0.0.0/0 dev lo table 100

ip6tables -t mangle -N SSLH
ip6tables -t mangle -A OUTPUT --protocol tcp --out-interface enp0s25 --sport 4443 --jump SSLH
ip6tables -t mangle -A OUTPUT --protocol tcp --out-interface enp0s25 --sport 1194 --jump SSLH
ip6tables -t mangle -A SSLH --jump MARK --set-mark 0x1
ip6tables -t mangle -A SSLH --jump ACCEPT
ip -6 rule add fwmark 0x1 lookup 100
ip -6 route add local ::/0 dev lo table 100

...

Restart Apache, start sslh, and test...

Right, it's time to test the setup.  To do so we need to restart Apache, start SSLH:

...

If all went well you should be able to still access your webserver AND connect to OpenVPN on port 443.

Finalise configuration

We'll finalise the configuration (once you've tested it) by enabling sslh (so it starts on boot) and by making the iptable rules (above) persistent.

...

See the this article to make the current iptable rules (after you've executed the iptable script above) persistent.

References

1. https://www.digitalocean.com/community/tutorials/how-to-set-up-an-openvpn-server-on-ubuntu-16-04
2. https://stackoverflow.com/questions/34304022/change-ssl-port-of-apache2-server-err-ssl-protocol-error
3. http://www.rutschle.net/tech/sslh/README.html

Related articles

...