Introduction
In this blog article we are going to discuss about How to setup OpenVPN on Windows Server 2019. A VPN is short form of virtual private network, which gives us a privacy, anonymity and security over public internet. A VPN service masks our ISP IP so your online actions are virtually untraceable. A VPN can also be used to connect computers to isolated remote computer networks that is usually inaccessible, by using the Internet or another intermediate network.
We can define OpenVPN as a full-featured SSL VPN. OpenVPN uses OSI layer 2 or 3 secure network extension using the industry standard SSL/TLS protocol. OpenVPN supports flexible client authentication methods based on certificates, smart cards and username/password credentials. OpenVPN is not a web application proxy and does not operate through a web browser. OpenVPN server process over a single TCP or UDP port. The default port number is 1194. OpenVPN 2.3 includes a large number of improvements, including full IPv6 support and PolarSSL support.
OpenVPN is also the name of the open source project started by our co-founder and which uses the GPL license. He developed the OpenVPN project that used to encrypt and secure point-to-point or site-to-site connection between two machines over the public Internet. In other word using OpenVPN we can create a secure Private network over public Internet and will have Remote access to internal services of your IT infrastructure.
Use Cases of OpenVPN
Secure Remote Access
Site-to-site , Users-to-Site or Users-to-Users connectivity to bring networks together
Protect screen sharing and remote desktop communications
Encrypt sensitive IoT communications
Secure Access to Cloud-Based Systems
OpenVPN available as Below.
- OpenVPN Community Edition, which is a free and open-source version
- OpenVPN Access Server (OpenVPN-AS), is based on the Community Edition, but provides additional paid and proprietary features like LDAP integration, Easy Management Admin Portal ,cluster option etc.
- OpenVPN-as-a-Service, solution eliminates the need for VPN server installation. By Purchasing OpenVPN Cloud we can simply connect to our hosted service with regions around the globe.
Apart from OpenVPN Community Edition, the other two OpenVPN editions has Economical licensing model that is based only on the number of simultaneous VPN connecting users or devices.
The OpenVPN Community Edition totally free to use and there is no user limitations. OpenVPN community edition server can be installed on Linux or Windows Based systems.
OpenVPN for Windows
It can be installed from the self-installing exe file which is called OpenVPN GUI. OpenVPN GUI is a graphical fronted for OpenVPN running on Windows. It creates an icon in the notification area from which you can control OpenVPN to start/stop your VPN tunnels, view the log and do other useful things.
OpenVPN Connect client
It is the OpenVPN client software packages installing on client PC. This client package used to connect to the OpenVPN server. OpenVPN Connect client supported on Windows, Linux, MacOS, IOS and Android.
Setting Up OpenVPN Server.
In this article will show you how to Setup up a OpenVPN Server ( Community Edition) On Windows Server 2019 to forward incoming traffic to the internet, then route the responses back to the client. This is a Users-to-Site Model.Which means settings up a OpenVPN Windows Server to tunnel clients internet traffic through OpenVPN server. Those clients that successfully connected to the OpenVPN server will have their ISP IP Address will show as servers Public IP address.Commonly, a VPN tunnel is used to privately access the internet, evading censorship or Geo location by shielding your computer’s web traffic when connecting through entrusted hotspots, or connections.
Section 1. Installing OpenVPN Server
Let’s get Started. Download the latest Windows 64-bit MSI installer for OpenVPN Community edition from official OpenVPN Website, under community section.
The OpenVPN executable should be installed on both server and client machines, since the single executable provides both client and server functions.
Once Downloaded double click the installer exe file. the following screen will appear, click “Customise” to start the installation.
Make sure to choose all features by clicking the icon next to each features and selecting it. Below are the two features which will not be installed by default and we need to select during install.
Openssl utilities , EasyRSA 3 Certificate Management scripts
OpenVPN service.
Click Install Now button.
The install will get completed and we will get below screen. Click Close.
We will get a warning message as ” No readable connection profiles ( config files ) found. Its fine , click OK.
This Completes the OpenVPN MSI Package install. After the install, if we go to Server “Network and Internet ” settings >> Under Ethernet >> Change adaptor options >> We can see a new network adaptor named OpenVPN TAP device created.
We can restart the OpenVPN service from Windows Start Menu -> Control Panel -> Administrative Tools -> Services.
As of OpenVPN version 2.5.0,While starting the OpenVPN wrapper service the OpenVPN will look for .ovpn configuration file under folder “C:\Program Files\OpenVPN\config-auto” to auto-start OpenVPN service when ever our Windows Server 2019 reboots.
Another option to start/stop OpenVPN service is Click on Windows hidden notification area from task bar , there we can see the OpenVPN icon, right click on it and you will see multiple options including Connect and Disconnect.
If you don’t see the OpenVPN icon in the Windows task bar notification area, double click the OpenVPN icon available in the desktop and that will make the OpenVPN icon available at the windows task bar notification area.
For better understanding refer below screenshot.
As I mentioned earlier As of OpenVPN version 2.5.0, when we start the OpenVPN service using the GUI component under windows task bar notification area, the OpenVPN will look for .ovpn configuration file under folder “C:\Program Files\OpenVPN\config”.
Now if you would like to add any OpenVPN features later you can use commands like below. Below example cmd command will install OpenVPN service feature on existing installed OpenVPN Server.
This Concludes the OpenVPN Package install on Windows 10 for Server and for the Client PC. Now lets move to the next section.
Section 2. Setup Master Certificate Authority (CA) and Generate Certificates and keys for OpenVPN Server and Clients.
OpenVPN uses public-key infrastructure (PKI) for certificate generation and Management. It is the technology behind digital certificates. There for, PKI is the technology that allows you to encrypt data, digitally sign documents, and authenticate yourself using certificates.
The PKI consists of:
- A separate certificate (also known as a public key) and private key for the server and each client, and
- A master Certificate Authority (CA) certificate and key which is used to sign each of the server and client certificates.
For PKI management, The latest version of OpenVPN packages provided easy-rsa 3, a set of scripts which is bundled with OpenVPN MSI.
The easy-rsa3 scripts folder location should be “C:\Program Files\OpenVPN\easy-rsa”. Also the Easy-RSA 3 runs POSIX shell code, so use on Windows has some additional requirements such as an OpenSSL installation, and a usable shell environment but Windows packages of EasyRSA 3.0.7+ include an OpenSSL binary and libraries that will be used by default. So basically we don’t need to perform the OpenSSL install separately in our Windows Install.
Additionally The Easy-RSA 3 Windows release includes a ready-to-use shell environment where we can run the commands that needed to issue SSL/TSL certificates. So lets proceed with the SSL/TLS certificate creation along with CA certificate using easy-rsa3 scripts.
First thing is go the folder “C:\Program Files\OpenVPN\easy-rsa” using Windows File explorer. Copy the file named “vars.example” to file named “vars“.
The “vars “ file contains built-in Easy-RSA configuration settings. The default settings are fine unless if we need any custom changes. Few configurable options given in below table.
Variables | Default Value | Usage |
---|---|---|
set_var EASYRSA |
C:\Program Files\OpenVPN\easy-rsa | Defines the folder location of easy-rsa scripts |
set_var EASYRSA_OPENSSL | C:\Program Files\OpenVPN\bin\openssl.exe | Defines the OpenSSL binary path |
set_var EASYRSA_PKI | C:\Program Files\OpenVPN\easy-rsa\pki | The folder location of SSL/TLS file exists after creation |
set_var EASYRSA_DN |
cn_only |
This is used to adjust what elements are included in the Subject field as the DN |
set_var EASYRSA_REQ_COUNTRY |
“US” | Our Organisation Country |
set_var EASYRSA_REQ_PROVINCE |
“California” | Our Organisation Province |
set_var EASYRSA_REQ_CITY | “San Francisco” | Our Organisation City |
set_var EASYRSA_REQ_ORG | “Copyleft Certificate Co” | Our Organisation Name |
set_var EASYRSA_REQ_EMAIL | “me@example.net” | Our Organisation contact email |
set_var EASYRSA_REQ_OU | “My Organizational Unit” | Our Organisation Unit name |
set_var EASYRSA_KEY_SIZE |
2048 |
Define the key pair size in bits |
set_var EASYRSA_ALGO |
rsa | The default crypt mode |
set_var EASYRSA_CA_EXPIRE |
3650 | The CA key expire days |
set_var EASYRSA_CERT_EXPIRE |
825 |
The Server certificate key expire days |
set_var EASYRSA_NS_SUPPORT |
“no” | Support deprecated Netscape extension |
set_var EASYRSA_NS_COMMENT | “HAKASE-LABS CERTIFICATE AUTHORITY” | Defines NS comment |
set_var EASYRSA_EXT_DIR |
"$EASYRSA/x509-types" |
Defines the x509 extension directory |
set_var EASYRSA_SSL_CONF |
"$EASYRSA/openssl-easyrsa.cnf" |
Defines the openssl config file location |
set_var EASYRSA_DIGEST |
"sha256" |
Defines the cryptographic digest to use |
So if you need to edit above default values, un-comment corresponding lines and make necessary changes. The “var” also have other configurable options but I only mentioned few important variables. So in our case we are fine with the default values and the default values will be used during certificate generation.
Now Open the windows command prompt and go the directory “C:\Program Files\OpenVPN\easy-rsa”. After that Launch EasyRSA shell. For that issue below commands.
Now we have entered the easy-rsa3 shell prompt and from there we will be able to issue easy-rsa3 scripts. Attached a screenshot for reference.
Now Initiate the Public Key Infrastructure PKI directory. For that issue below command in the EasyRSA Shell.
Below the screenshot for reference. From there we can see the PKI directory is set to “C:\Program Files\OpenVPN\easy-rsa\pki”
Now build the certificate authority (CA ) key using the command below. This CA root certificate file later will be used to sign other certificates and keys. The option “nopass” we used is to disable password locking the CA certificate.
The command will be asked to enter the common name. Here I entered my VPN server Hostname which is OPENVPNSERVER, and it is a common practice. Here we are free to use any name or values. Also the created the CA certificate will be saved to folder “C:\Program Files\OpenVPN\easy-rsa\pki” with file name as “ca.crt”. Refer below screenshot.
Now Build a server certificate and key using below command. Here Replace < SERVER >with your own server name. Also I used Option nopass for disabling password locking the key.
Attached a screenshot for your reference. The issued server certificate will be in the folder “C:\Program Files\OpenVPN\easy-rsa\pki\issued” with file name as SERVER.crt.
After that we can verify the issued server certificate using below openssl command in the EasyRSA shell itself. The Status Ok indicate that the certificate is fine.
Now Build a client certificate and key using below command. From that Replace < CLIENT > with your client name. Also used Option nopass for disabling password locking the key.
Attached a screenshot for your reference. The issued client certificate will also be saved to folder “C:\Program Files\OpenVPN\easy-rsa\pki\issued” with file name as “CLIENT.crt”.
After that we can verify the issued client certificate using below openssl command. The Ok indicate that the certificate is fine.
This Completed the CA certificate, Sever and Client Certificate Generation along with Key. These keys will be used to authenticate between OpenVPN server and with the Client.
Now Generate a shared-secret key that is used in addition to the standard RSA certificate/key. The file name is tls-auth.key.
Using this key we enable tls-auth directive Which adds an additional HMAC signature to all SSL/TLS handshake packets for integrity verification. Any UDP packet not bearing the correct HMAC signature can be dropped without further processing.
Enabling the tls-auth will protect us from
- DoS attacks or port flooding on the OpenVPN UDP port.
- Port scanning to determine which server UDP ports are in a listening state.
- Buffer overflow vulnerabilities in the SSL/TLS implementation.
- SSL/TLS handshake initiations from unauthorised machines.
So first Download Easy-TLS using the GitHub link https://github.com/TinCanTech/easy-tls. It is an Easy-RSA extension utility that we are using to generate tls-auth key.
Click the Download zip option which is available under code tab. Refer below screenshot.
After that unzip the easy-tls-master folder and copy the files named “easytls”and “easytls-openssl.cnf” file to “C:\Program Files\OpenVPN\easy-rsa” directory. Check below screenshot for reference.
Now go back to the EasyRSA shell prompt and issue below command. This will initialise the easy-tls script utility.
Now after that generate the tls-auth key using below command.
The command will generate the tls-auth key file named “tls-auth.key” under the folder “C:\Program Files\OpenVPN\easy-rsa\pki\easytls”. Refer below screenshot.
Now we need to Generate Diffie Hellman parameters.
Diffie Hellman parameters must be generated for the OpenVPN server.
These parameters define how OpenSSL performs the Diffie-Hellman (DH) key-exchange. Diffie–Hellman key exchange is a method of securely exchanging cryptographic keys over a public channel
Issue below command for generating Diffie Hellman parameters from the EasyRSA shell.
The command will create the DH file under folder “C:\Program Files\OpenVPN\easy-rsa\pki” with file name as “dh.pem”. Refer below screenshot.
This completes the generation of necessary SSL/TLS key files needed for OpenVPN service. We will be able to find the created files under below folders.
Folder Path | Content |
---|---|
C:\Program Files\OpenVPN\easy-rsa\pki | CA file, DH file and other OpenSSL related files like config file |
C:\Program Files\OpenVPN\easy-rsa\pki\private | Include the private key files of CA, Server and Client certificates |
C:\Program Files\OpenVPN\easy-rsa\pki\easytls | Contains the tls-auth key |
C:\Program Files\OpenVPN\easy-rsa\pki\issued | Contains issued Server and Client certificates |
Refer below screenshot.
Also below is the short explanation of the relevant files.
Filename | Needed By | Purpose | Secret |
---|---|---|---|
ca.crt | server + all clients | Root CA certificate | No |
ca.key | Server Only | Root CA key | YES |
dh.pem | server only | Diffie Hellman parameters | No |
SERVER.crt | server only | Server Certificate | No |
SERVER.key | server only | Server Key | Yes |
CLIENT.crt | Client only | Client Certificate | No |
CLIENT.key | Client only | Client Key | Yes |
tls-auth.key | server + all clients | Used for tls-auth directive | No |
Now its the time to copy Certificate files ca.crt, CLIENT.crt, CLIENT.key and tls-auth.key from OpenVPN server to the OpenVPN client PC. Make sure to copy secret files over a secure channel like SFTP.
Okay, this completes the creation of SSL/TLS certificates for the OpenVPN service. Now lets move to the next section.
SUPPOSE IF YOU WOULD LIKE TO USE YOUR OWN OPENSSL VERSION AND DON’T WISH TO USE EASY-RSA3 SCRIPTS, FOR GENERATING SSL/TLS CERTIFICATES THEN ONLY FOLLOW NEXT SECTIONS OTHERWISE MOVE TO SECTION 3
So lets see how we can generate SSL/TLS certificates using the openssl commands directly.
For that first make sure if the openssl toolkit installed in the server by issuing below version check command on windows cmd.
If it shows any error like openssl is not recognised as an internal or external command, we need to install the openssl toolkit first.
Section 2 a. Install and Setup openssl toolkit
Only follow this section if your server doesn’t have openssl toolkit available, otherwise skip this part and move on to next Section 2 b.
Open Windows Powershell and download the openssl package using below command.
Now perform the install by double-clicking on .exe file or from PowerShell issue below command.
A popup window will appear with message as Microsoft Visual C++ 2019 package is missing from the server. We need to install this package prior to proceed with the openssl package install .So click Yes for downloading the package.
Double click the downloaded Microsoft Visual C++ 2019 Redistributables msi installer. A another popup window will appear. Confirm the Licence Agreement and click Install.
We will get a success message after installation. Click close.
Now go back to the OpenSSL install wizard, Accept the Licence Agreement and Click Next.
Choose the Install directory and click Next, In our case, we are choosing the install directory as C:\OpenSSL-Win64
Select Folder for OpenSSL Application shortcut. Leave the default one as it is and click Next.
Choose the copy OpenSSL DLL files as The windows system directory, which is the default one and Click Next.
Click “Install ” to proceed with the install of OpenSSL on Windows Server 2019.
Give few minutes to complete the install, A progress bar like below will show the status of install.
Click Finish to Complete the OpenSSL install.
Now add OpenSSL install binary folder C:\OpenSSL-Win64\bin
to the Windows environment PATH by issuing below two powershell commands.
Now export the OPENSSL_CONF as environment variable to server system variables section. Use below Powershell command.
The command output will look like below.
Now, we need to add the system variable OPENSSL_CONF permanently.
For that Press Windows + R keys together to open run window, Then type “sysdm.cpl” in the Run dialog box and hit Enter.
Go to “Advanced” tab and click on “Environment variables”. Click New under System Variables section.
Add values in the “variable name” as OPENSSL_CONF and “variable value” value box as C:\OpenSSL-Win64\bin\openssl.cfg . Click OK Two times and Apply and OK from System Properties window.
.
Section 2 b . Configure OpenSSL.
In this section, we configure OpenSSL installed in the server to build SSL/TLS certificated as per OpenVPN recommendation. For that,
- First go the folder C:\OpenSSL-Win64\bin and create folder named “demoCA” . This is the folder where we kept generated certificates and other related files.
- Now under the “demoCA” folder create another folder named “certs” . This is the folder where the issued certs are kept.
- Now under the “demoCA” folder itself, create another folder named “newcerts”. This is the default folder for new certs.
- Under folder “demoCA” create a file named “serial”. Make sure there is no file extension like .txt. Enter a value as “01” in the file. It holds the current serial number
- Lastly under folder “demoCA” create a empty file named “index.txt”
Refer below screenshot for getting an idea about file structure.
Now open the OpenSSL config file C:\OpenSSL-Win64\bin\openssl.cfg using any text editor.
Under [ CA_default ] section , set “dir” variable location as C:\\OpenSSL-Win64\\bin\\demoCA
To avoid a possible Man-in-the-Middle attack where an authorised client tries to connect to another client by impersonating the server, make sure to enforce some kind of server certificate verification by clients. For accomplishing this we are following below method.
Build our server certificates with specific key usage and extended key usage as per RFC3280.
Now as part of creating CERT with the extended key attributes, first verify under which section we need define extended key attributes. For that look under [ req ] section in file C:\OpenSSL-Win64\bin\openssl.cfg
Normally it should look like below. If its not, make the arrangement like below.
[ req ]
default_bits = 2048 |
---|
In the above section what we understood is all the x509 extension that are required should be specified in [ usr_cert ] section in C:\OpenSSL-Win64\bin\openssl.cfg
So find out the [ usr_cert ] section and make sure below values are defined.
[ usr_cert ]
subjectKeyIdentifier = hash |
---|
After adding the extensions to usr_cert , Now find out [ v3_req ] section and insert same Extensions to add to a certificate request. As this section will have the extension that the certificate request should have.
Below is the extensions we normally needed.
extendedKeyUsage = serverAuth, clientAuth, codeSigning, emailProtection basicConstraints = critical, CA:true, pathlen:0 keyUsage = critical, digitalSignature, cRLSign, keyCertSign |
---|
Now also make sure below extension key values added under [ v3_ca ] section too. From this section our CA certificate extension will be added. Below is the necessary values need to added or enabled.
subjectKeyIdentifier=hash authorityKeyIdentifier=keyid:always,issuer basicConstraints = critical,CA:true |
---|
Finally save the OpenSSL config file C:\OpenSSL-Win64\bin\openssl.cfg . Refer below screenshots so you will get an idea how the config file will look like.
This Completes the OpenSSL configuration according to OpenVPN recommendation. Now lets Proceed with the SSL/TLS Certificate creation.
Section 2 c. Generate SSL/TLS Certificates.
In this section we are creating CA, generate certificate & key for server and client. Sign those certificates using CA certificates. For all these tasks we use openssl commands.
Build a cert authority valid for ten years, starting now.
Open windows cmd , go to the directory C:\OpenSSL-Win64\bin\demoCA. Issue below command.
We will ask to input information’s that will be incorporated in to the certificate request. Below are fields and Answered I have used. You can enter values as per your requirement.
In the common name field, I entered my VPN server Hostname which is OPENVPNSERVER, and it is a common practice. Here we are free to use any name or values.
Field | Value |
---|---|
Country Name | US |
State or Province Name | CA |
Locality Name | SanFrancisco |
Organisation Name | OpenVPN |
Organisation Unit Name | IT |
Common Name | OPENVPNSERVER |
Email Address | mail@openvpnserver.com |
Below is the captured screenshot of above issued command output.
After creating the CA certificate , we can check if the extensions are still properly added by issuing below command.
The captured output of above verify command will look like below. From the results we can see our added Extended Key usage parameters, validation details are with the generated SSL/TLS CA certificate.
Now Generate certificate & key for server
For that first issue below command for build a request for a server cert that will be valid for ten years.
Enter the needed information as we described earlier. Attached a screenshot for your reference. In the Common Name Field I have given the name as “Server” because the SSL/TLS certificate request are generating for the server.
Now we can confirm the generated server csr certificate has the Extended Key Usage values by using below command.
The output of above command will look like below. We will be able to see the Extended Key usage values from the result.
Now sign the server cert request with our ca, creating a cert/key pair.
For that issue below command.
We will be asked to confirm the signing of Certificate, type “Y” and also commit the changes by typing “Y”
Attached a screenshot for reference.
After signing the cert , we can check if the extensions are still properly added by issuing below command.
Also we can verify server certificate against the root CA certificate. An OK indicates that the chain of trust is intact.
The captured output of above verify command will look like below. From the results we can the Extended Key usage parameters are enabled with the generated SSL/TLS certificate.
Now Generate certificates & keys for 1 clients using below command.
Enter the Necessary information as we discussed earlier. Here the only change I made is changed the Common name to Client1 because I am generating this certificate for the VPN client named client1.
The command output will look like below.
Now sign the client cert request with our ca, creating a cert/key pair. Use below command.
We will be asked to confirm the Signing of Certificate and Commit the changes. Type “y” for both and Hit Enter.
Screenshot Attached for reference.
This Completed the CA certificate, Sever and Client Certificate Generation along with Key. These keys will be used to authenticate between OpenVPN server and with the Client.
Now we need to Generate Diffie Hellman parameters.
Diffie Hellman parameters must be generated for the OpenVPN server.
These parameters define how OpenSSL performs the Diffie-Hellman (DH) key-exchange. Diffie–Hellman key exchange is a method of securely exchanging cryptographic keys over a public channel
Issue below command for generating Diffie Hellman parameters.
The above command output will look like below.
Now Generate a shared-secret key that is used in addition to the standard RSA certificate/key. We named the file as ta.key.
Using this key we enable tls-auth directive Which adds an additional HMAC signature to all SSL/TLS handshake packets for integrity verification. Any UDP packet not bearing the correct HMAC signature can be dropped without further processing.
Enabling the tls-auth will protect us from
- DoS attacks or port flooding on the OpenVPN UDP port.
- Port scanning to determine which server UDP ports are in a listening state.
- Buffer overflow vulnerabilities in the SSL/TLS implementation.
- SSL/TLS handshake initiations from unauthorised machines.
Use below command.
Below is the captured output of above command.
Key Files
Now we will find our newly-generated keys and certificates in the “C:\OpenSSL-Win64\bin\demoCA” folder and its subdirectory “certs” folder.
Take a look at the attached screenshot for reference.
Here is an short explanation of the relevant files.
Filename | Needed By | Purpose | Secret |
---|---|---|---|
ca.crt | server + all clients | Root CA certificate | No |
ca.key | Server Only | Root CA key | YES |
dh4096.pem | server only | Diffie Hellman parameters | NO |
server.crt | server only | Server Certificate | NO |
server.key | server only | Server Key | YES |
client1.crt | client1 only | Client1 Certificate | NO |
client1.key | client1 only | Client1 Key | YES |
ta.key | server + all clients | Used for tls-auth directive | No |
Now its the time to copy Certificate files ca.crt, client1.crt, client1.key and ta.key from OpenVPN server to the OpenVPN client PC. Make sure to copy secret files over a secure channel.
Section 3 . Enable NAT On OpenVPN Server.
As I mentioned in the introduction section we are setting up our OpenVPN server , to route clients all IP traffic such as Web browsing and DNS lookups through VPN Server itself. For that we need to NAT the OpenVPN TUN/TAP Network interface to the public internet through OpenVPN server Public Interface that already have internet access.
Lets Get Started. First Open Server Manager. Click Add Roles And Features.
Click Next on the Add Roles and Feature install wizard.
Choose “Role based or feature based installation” and click Next.
Select Our Server from the “select server from the server pool” section and click Next.
Choose “Remote Access” role and click Next.
leave Features section as it is and Click Next.
Click next On Remote Access section.
From Role Services section, choose “Routing ” and “Direct Access and VPN”
A popup window will appear. Click Add features and Click Next.
Click Next on Web Server Role Section.
Leave the default selection as it is under IIS Role Service section and Click on Next.
Click Install button on Confirmation Section.
Wait for few minutes, we will get the message as installation got succeeded. Click Close.
Now From the Server Manager itself, Choose “Remote Access from Left side” >> Right click our Server Name from Right side >> Choose Remote Access Management.
Under Direct Access and VPN >> Click on “Run the Remote Access Setup Wizard”
A Popup Window will appear. In that Click “Deploy VPN only”
The Routing and Remote Access Management” Panel will open. From there Right click on our VPN Server Name and Choose ” Configure and Enable Routing And Remote Access”
Click Next on Routing and Remote Access Server Setup Wizard.
Choose “Network Address Translation (NAT) ” and click Next.
Select Our Public Network Interface where we have internet Access and Click Next.
Select our OpenVPN TUN/TAP interface that we attach to the internet and Click Next.
Click Finish and Complete the NAT setup wizard.
Now from the Route and Remote Access Management panel itself >> Expand Our Server name >> Expand IPV4 >> Select NAT >> From right side Right click our Public Interface name and choose Properties.
From Services And Ports tab >> Choose Remote Access.
A popup windows will appear, in the Private Address filed give our Public IP address and Click OK, After that click Apply and Ok.
Suppose your Server RDP Port is different, you need create a new rule and allow that Port instead of default remote desktop port 3389.
Okay, This Completes the Enabling of NAT on OpenVPN server. Lets move to Next section.
Section 4 . Create configuration files for server
In this section, we create the OpenVPN Server configuration file and Make Necessary changes in it.
First Open Windows Explorer and go the folder C:\Program Files\OpenVPN\sample-config and copy file named “server.ovpn” to C:\Program Files\OpenVPN\config.
Now open the config file using any Text editor and make changes to below values accordingly.
ca “C:\\OpenSSL-Win64\\bin\\demoCA\\certs\\ca.crt”
cert “C:\\OpenSSL-Win64\\bin\\demoCA\\server.crt” key “C:\\OpenSSL-Win64\\bin\\demoCA\\certs\\server.key” dh “C:\\OpenSSL-Win64\\bin\\demoCA\\certs\\dh4096.pem” push “redirect-gateway def1 bypass-dhcp” push “dhcp-option DNS 208.67.222.222” push “dhcp-option DNS 208.67.220.220” tls-auth C:\\OpenSSL-Win64\\bin\\demoCA\\certs\\ta.key 0 data-ciphers AES-256-GCM |
---|
In that first four values defines the location of ca, cert , key and Diffie hellman parameters certificate locations.
The Next three lines enforce the clients to redirect their all traffic through OpenVPN server once they successfully connected to OpenVPN server.
Using “tls-auth” parameter, we enable HMAC firewall. Its an extra layer of security used to prevent DDos attack.
The last one “data-ciphers AES-256-GCM” enables a cryptographic cipher.
Refer below screenshots and then you will get an idea about how these parameters looks in server.ovpn config file.
This Completes the OpenVPN config file Setup. Now open the UDP Port 1194 in the Windows firewall using below powershell command.
Now start the OpenVPN server service by click on Windows Show hidden icons section >> right click the OpenVPN icon >> Choose Connect.
The OpenVPN service will start automatically and you will see a green colour inside OpenVPN icon. This means that our OpenVPN service is running.
Another option to start the OpenVPN service is from the Windows services section, which we described in section 1.
Another Option to confirm the running of OpenVPN service is , take windows cmd and list all network interfaces. We will see now the OpenVPN TUN/TAP interface is assigned with private IP 10.8.0.1, which is the default private IP address range assigned to server and with clients as per the config settings.
Section 5 . Setup OpenVPN Client.
In this section we first install the OpenVPN MSI installer on Client PC like Windows 10. After that we will setup OpenVPN client config files.
Finally start the the OpenVPN connection and test it out.
Section 5 a . OpenVPN Client MSI Install
For OpenVPN MSI installation on Client PC, follow the same steps described on Section 1. The OpenVPN Community Edition MSI Installer can be used on both Server side and with the client side.
After the OpenVPN MSI installation. Open Windows Explorer and go the folder C:\Program Files\OpenVPN\sample-config and copy file named “client.ovpn” to C:\Program Files\OpenVPN\config.
After that rename the “client.ovpn” to “client1.ovpn” because we use this client config file for client1.
Move already downloaded ca.crt, client1.crt, client1.key and ta.key to folder C:\Program Files\OpenVPN\config.
Refer below screenshot for better understanding on file structure.
Section 5 b . Configure Client Config File.
Go to the folder “C:\Program Files\OpenVPN\config” and open client1.ovpn file using any text editor and define below parameters accordingly.
remote 185.210.137.214 1194
ca “C:\\Program Files\\OpenVPN\\config\\ca.crt” cert “C:\\Program Files\\OpenVPN\\config\\client.crt” key “C:\\Program Files\\OpenVPN\\config\\client.key” remote-cert-tls server tls-auth “C:\\Program Files\\OpenVPN\\config\\ta.key” 1 cipher AES-256-GCM |
---|
In that first value defines The hostname/IP and port of the OpenVPN server
The Next three ca, cert , key values defines the location of CA and client certificate locations.
Using “remote-cert-tls server” , the OpenVPN client will verify the server certificate extendedKeyUsage.
Using “tls-auth” parameter, we enable HMAC firewall. Its an extra layer of security used to prevent DDos attack.
The last one “cipher AES-256-GCM” enables a cryptographic cipher.
Below picture shows how these parameters looks in the client config file.
This Completes the Client Setup. Now test the VPN Connection from client side. Make sure to open UDP port 1194 in the client side windows firewall too.
Section 5 c . Testing the OpenVPN connection.
Under windows Hidden Notification area , right click on OpenVPN icon and Click Connect.
The OpenVPN connection will establish automatically. After the successful connection , try to ping to the private IP of OpenVPN server and make sure its reachable. Also test the internet connection of your client PC.
Also on a Successfully connected OpenVPN Client PC, if we lookup the what is my IP on web browser, we will see its our VPN Server IP. This means that all our web traffic is routing through OpenVPN server.
Conclusion.
We have successfully completed the OpenVPN setup On Windows server 2019 and successfully connected from a Windows 10 OpenVPN client PC. Also we have seen how to route all IP traffic from client side through OpenVPN server. I hope this article is informative. Leave your thoughts at the comment box.
Thanks a lot for this page, Very helpfull to understand and configure an openvpn server and client ! And make IT WORKS !!
Options error: Unrecognized option or missing or extra parameter(s) in server.ovpn:192: push (2.5.3)
Use –help for more information.
Help please
Check the mentioned line in openvpn config file. Could be some invalid character
Hi, thanks for the tutorial …. Do I need to create NAT for every type of traffic which by clients may be using? Is there a way to just assumes it will NAT by default?
we setup NAT for all type of traffic in this case
Tried to a VMWare émulator on Windows server 2019 and it doesn’t work for me :/
I had a lot of problem to install OpenSSL, I finally did it manualy not with Powershell or with the OpenVPN installator. And I think my problems comme from there.
Anyways, may be it can’t work on a emulator ?
okay, I am not sure about VMware emulater network adaptor. Did you checked with VMware support team ?
No, but anyway it was just for test, its was not something important. I will ask them later.
Thanks for reply.
I have 1 problem
you are install open ssl into “c:\program files\openssl” but config envoirment into “c:\openssl” its true?
i cant execute openssl commands!
Last problemes is solved , but when i want exexute req
i have this error :
req: Can’t open “certs\ca.key” for writing, No such file or directory
This milad guy really ought to pay attention to file paths, lol
Hi my issue is :
I made this folder : C:\Program Files\OpenSSL-Win64\bin\demoCA\newcerts
and when I run this command :
openssl ca -days 3650 -extensions usr_cert -cert certs\ca.crt -keyfile certs\ca.key -out client1.crt -infiles certs\client1.csr
My Error is :
Using configuration from C:\Program Files\OpenSSL-Win64\bin\openssl.cfg
ca: ./demoCA/newcerts is not a directory
./demoCA/newcerts: No error
but I have that directory !
there are no easytls-openssl.cnf file to download in the Github https://github.com/TinCanTech/easy-tls
Unable to start OpenVPN server – get “Options error: Unrecognized option or missing or extra parameter(s) in ..\config\server.ovpn:78: ca (2.6.0). Use –help for more information.
1) Unable to determine what :78 is – guessing line number, but there’s nothing but a blank line there. Tried guessing that it was counting non-blank lines (the sample config has every other line blank) and the nearest actual config line was dh “C:\\Program Files\\OpenVPN\\easy-rsa\\pki\\dh.pem”. Verified that dh.pem exists at that path and I did run ./easyrsa gen-dh from the easy-ras shell (date/time stamp on dh.pem confirms).
2) Verified other edited config value that they point to correct locations, such as:
ca “C:\\Program Files\\OpenVPN\\easy-rsa\\pki\\ca.crt”
cert “C:\\Program Files\\OpenVPN\\easy-rsa\\pki\\issued\\ServerVPN.crt”
key “C:\\Program Files\\OpenVPN\\easy-rsa\\pki\\private\\ServerVPN.key” # This file should be kept secret
tls-auth “C:\\Program Files\\OpenVPN\\easy-rsa\\pki\\private\\ta.key” 0 # This file is secret