Step by Step VPN


ImageStep by step setting up OpenVPN in debian with routing (tun) connection

Installing OpenVPN on the server

#apt-get install openvpn

Preparing to generate the keys

#mkdir /etc/openvpn/easy-rsa
#cp /usr/share/doc/openvpn/examples/easy-rsa/2.0/* /etc/openvpn/easy-rsa

Generating the certificate authority (CA) which will be used to sign the server and client certificates.

#cd /etc/openvpn/easy-rsa
#source ./vars

Creating the server keys

#./build-key-server servername

Generating the diffie-hellman parameters which are used for key exchange between the client and server


Creating some client keys which will be used to allow clients to authenticate with the server

#./build-key-pkcs12 client1

You will be asked for a password which the client will use to connect to the server

we need to configure the server. You need to make a decision here whether you want tun (routed) or tap (bridged) connections. The main difference is that tap will give the client a network address on the server network, whereas tun creates a private network managed by the server.

Configure openvpn using routing (tun) connection

Configuring the server

#vim /etc/openvpn/server.conf
(add the following lines)

port 443

proto udp

dev tun

ca /etc/openvpn/easy-rsa/keys/ca.crt

cert /etc/openvpn/easy-rsa/keys/vpnsarandi.crt

key /etc/openvpn/easy-rsa/keys/vpnsarandi.key

dh /etc/openvpn/easy-rsa/keys/dh1024.pem

ifconfig-pool-persist ipp.txt


client-config-dir ccd




push “route″

push “route″

keepalive 10 120




status /var/log/openvpn-status.log

verb 3


Making directory ccd:


#mkdir /etc/openvpn/ccd


Making  file client1 in ccd directory


#vim /etc/openvpn/ccd/clent1
(add the following lines)



Restart OpenVPN:


#/etc/init.d/openvpn restart

Setting up the windows client. First, download the OpenVPN client from here (at the time of writing, select 2.1 RC15). Install it, and create a file ‘client.conf’ in the config directory with the following parameters



dev tun

proto udp

remote x.x.x.x  443 # (replace with your server IP)

resolv-retry infinite


pkcs12 client1.p12 # (replace with the client name)

ns-cert-type server


verb 3



You can also add ‘redirect-gateway’ to the client configuration to pass all traffic down the VPN tunnel (rather than just traffic intended for the VPN itself).


copy the client1.p12 certificate file to the config directory on the client, start the gui, and connect.

If you need to create any clients in the future, do the following command:

#cd /etc/openvpn/easy-rsa
#source ./vars
#./build-key-pkcs12 clientx

Enable IP and TUN/TAP forwarding:

On  linux client

IP Forwarding

Check if IP Forwarding is enabled

#sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 0 


cat /proc/sys/net/ipv4/ip_forward

As we can see in both the above examples this was disabled (as show by the value 0).

Enable IP Forwarding on the fly

#sysctl -w net.ipv4.ip_forward=1 


#echo 1 > /proc/sys/net/ipv4/ip_forward 

Permanent setting using /etc/sysctl.conf

net.ipv4.ip_forward = 1
#sysctl -p /etc/sysctl.conf

On RedHat based systems this is also enabled when restarting the network service:

#service network restart

and on Debian/Ubuntu systems this can be also done restarting the procps service:

#/etc/init.d/ restart 

Using distribution specific init scripts

Although the methods presented above should work just fine and you would not need any other method of doing this, I just wanted to note that there are also other methods to enable IP Forwarding specific to some Linux distributions.
For example Debian based distributions might use the setting:


set it to yes and restart the network service.
Also RedHat distributions might set this using:


and again restart the network service.

Regardless the method you have used once you have completed this you can check it out using the same method shown above:

#sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 1 
#cat /proc/sys/net/ipv4/ip_forward

If the result is 1 then the Linux system will start forwarding IP packets even if they are not destined to any of its own network interfaces.

TUN/TAP forwarding:


Allow TUN interface connections to OpenVPN server
# iptables -A INPUT -i tun+ -j ACCEPT

Allow TUN interface connections to be forwarded through other interfaces
# iptables -A FORWARD -i tun+ -j ACCEPT

Allow TAP interface connections to OpenVPN server
# iptables -A INPUT -i tap+ -j ACCEPT

Allow TAP interface connections to be forwarded through other interfaces
# iptables -A FORWARD -i tap+ -j ACCEPT



** rule iptables for  internet  sharing from eth1  to  eth0.

#iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE



Restart Networking and OpenVPN

#/etc/init.d/networking restart

#/etc/init.d/openvpn restart


On Windows client:

To enable TCP/IP forwarding, follow these steps:

Start Registry Editor (Regedit.exe).

In Registry Editor, locate the following registry key:


Set the following registry value:

Value Name: IPEnableRouter
Value type: REG_DWORD
Value Data: 1

A value of 1 enables TCP/IP forwarding for all network connections that are installed and used by this computer.

Quit Registry Editor.

Use IP address OpenVPN client as gateway on LAN . So that every workstation behind LAN Client  can communicate each others.


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s