How to install and configure OpenVPN Server on Rocky Linux 9.2
- 00:31 cat /etc/os-release
- 00:45 yum install epel-release
- 01:40 curl ifconfig.me
- 02:08 wget https://raw.githubusercontent.com/Angristan/openvpn-install/master/openvpn-install.sh
- 02:23 ll
- 02:34 chmod +x openvpn-install.sh
- 02:46 ll
- 03:01 ./openvpn-install.sh
- 05:11 systemctl enable openvpn-server@server.service
- 05:20 systemctl start openvpn-server@server.service
- 05:33 systemctl status openvpn-server@server.service
7745
To Install And Configure OpenVPN Server On Rocky Linux 9.2
Introduction:
OpenVPN is an open source software for creating a virtual private network (VPN) that allows you to access protected network resources and browse the Internet securely. It is used to create secure point-to-point encrypted tunnels between two computers over an insecure network.
Installation Steps:
Step 1: Check the OS version by using the below command
[root@Linuxhelp ~]# cat /etc/os-release
NAME="Rocky Linux"
VERSION="9.2 (Blue Onyx)"
ID="rocky"
ID_LIKE="rhel centos fedora"
VERSION_ID="9.2"
PLATFORM_ID="platform:el9"
PRETTY_NAME="Rocky Linux 9.2 (Blue Onyx)"
ANSI_COLOR="0;32"
LOGO="fedora-logo-icon"
CPE_NAME="cpe:/o:rocky:rocky:9::baseos"
HOME_URL="https://rockylinux.org/"
BUG_REPORT_URL="https://bugs.rockylinux.org/"
SUPPORT_END="2032-05-31"
ROCKY_SUPPORT_PRODUCT="Rocky-Linux-9"
ROCKY_SUPPORT_PRODUCT_VERSION="9.2"
REDHAT_SUPPORT_PRODUCT="Rocky Linux"
REDHAT_SUPPORT_PRODUCT_VERSION="9.2"
Step 2: Install the epel release package by using the below command
[root@Linuxhelp ~]# dnf install epel-release
Rocky Linux 9 - BaseOS 4.6 kB/s | 4.1 kB 00:00
Rocky Linux 9 - BaseOS 1.0 MB/s | 1.9 MB 00:01
Rocky Linux 9 - AppStream 4.3 kB/s | 4.5 kB 00:01
Rocky Linux 9 - AppStream 2.2 MB/s | 7.1 MB 00:03
Rocky Linux 9 - Extras 2.6 kB/s | 2.9 kB 00:01
Rocky Linux 9 - Extras 7.0 kB/s | 11 kB 00:01
Dependencies resolved.
=======================================================================================================================
Package Architecture Version Repository Size
=======================================================================================================================
Installing:
epel-release noarch 9-7.el9 extras 19 k
Transaction Summary
=======================================================================================================================
Install 1 Package
Total download size: 19 k
Installed size: 26 k
Is this ok [y/N]: y
Downloading Packages:
epel-release-9-7.el9.noarch.rpm 47 kB/s | 19 kB 00:00
-----------------------------------------------------------------------------------------------------------------------
Total 16 kB/s | 19 kB 00:01
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
Preparing : 1/1
Installing : epel-release-9-7.el9.noarch 1/1
Running scriptlet: epel-release-9-7.el9.noarch 1/1
Many EPEL packages require the CodeReady Builder (CRB) repository.
It is recommended that you run /usr/bin/crb enable to enable the CRB repository.
Verifying : epel-release-9-7.el9.noarch 1/1
Installed:
epel-release-9-7.el9.noarch
Complete!
Step 3: To setup VPN before that we can check our public IP address by using the below command
[root@Linuxhelp ~]# curl ifconfig.me
Step 4: Download the OpenVPN installer Scripts by using the below command
[root@Linuxhelp ~]# wget https://raw.githubusercontent.com/Angristan/openvpn-install/master/openvpn-install.sh
--2023-10-26 07:57:06-- https://raw.githubusercontent.com/Angristan/openvpn-install/master/openvpn-install.sh
Resolving raw.githubusercontent.com (raw.githubusercontent.com)... 185.199.111.133, 185.199.109.133, 185.199.110.133, ...
Connecting to raw.githubusercontent.com (raw.githubusercontent.com)|185.199.111.133|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 40820 (40K) [text/plain]
Saving to: ‘openvpn-install.sh’
openvpn-install.sh 100%[================================================>] 39.86K --.-KB/s in 0.007s
2023-10-26 07:57:07 (5.57 MB/s) - ‘openvpn-install.sh’ saved [40820/40820]
Step 4: Long list the files by using the below command
[root@Linuxhelp ~]# ll
total 44
-rw-------. 1 root root 1039 Aug 13 22:24 anaconda-ks.cfg
drwxr-xr-x. 2 root root 6 Aug 13 22:33 Desktop
drwxr-xr-x. 2 root root 6 Aug 13 22:33 Documents
drwxr-xr-x. 2 root root 6 Aug 13 22:33 Downloads
drwxr-xr-x. 2 root root 6 Aug 13 22:33 Music
-rw-r--r--. 1 root root 40820 Oct 26 07:57 openvpn-install.sh
drwxr-xr-x. 2 root root 6 Aug 13 22:33 Pictures
drwxr-xr-x. 2 root root 6 Aug 13 22:33 Public
drwxr-xr-x. 2 root root 6 Aug 13 22:33 Templates
drwxr-xr-x. 2 root root 6 Aug 13 22:33 Videos
Step 5: Set execute permission for the installer script by using the below command
[root@Linuxhelp ~]# chmod +x openvpn-install.sh
Step 6: Long list the files and check whether the installer script has executable permissions by using the below command
[root@Linuxhelp ~]# ll
total 44
-rw-------. 1 root root 1039 Aug 13 22:24 anaconda-ks.cfg
drwxr-xr-x. 2 root root 6 Aug 13 22:33 Desktop
drwxr-xr-x. 2 root root 6 Aug 13 22:33 Documents
drwxr-xr-x. 2 root root 6 Aug 13 22:33 Downloads
drwxr-xr-x. 2 root root 6 Aug 13 22:33 Music
-rwxr-xr-x. 1 root root 40820 Oct 26 07:57 openvpn-install.sh
drwxr-xr-x. 2 root root 6 Aug 13 22:33 Pictures
drwxr-xr-x. 2 root root 6 Aug 13 22:33 Public
drwxr-xr-x. 2 root root 6 Aug 13 22:33 Templates
drwxr-xr-x. 2 root root 6 Aug 13 22:33 Videos
Step 7: Execute the installer script and Make sure you provide needed informations by using the below command
[root@Linuxhelp ~]# ./openvpn-install.sh
./openvpn-install.sh: line 60: [[: 9.2: syntax error: invalid arithmetic operator (error token is ".2")
Welcome to the OpenVPN installer!
The git repository is available at: https://github.com/angristan/openvpn-install
I need to ask you a few questions before starting the setup.
You can leave the default options and just press enter if you are ok with them.
I need to know the IPv4 address of the network interface you want OpenVPN listening to.
Unless your server is behind NAT, it should be your public IPv4 address.
IP address: <***Public IP***>
Checking for IPv6 connectivity...
Your host does not appear to have IPv6 connectivity.
Do you want to enable IPv6 support (NAT)? [y/n]: n
What port do you want OpenVPN to listen to?
1) Default: 1194
2) Custom
3) Random [49152-65535]
Port choice [1-3]: 1
What protocol do you want OpenVPN to use?
UDP is faster. Unless it is not available, you shouldn't use TCP.
1) UDP
2) TCP
Protocol [1-2]: 1
What DNS resolvers do you want to use with the VPN?
1) Current system resolvers (from /etc/resolv.conf)
2) Self-hosted DNS Resolver (Unbound)
3) Cloudflare (Anycast: worldwide)
4) Quad9 (Anycast: worldwide)
5) Quad9 uncensored (Anycast: worldwide)
6) FDN (France)
7) DNS.WATCH (Germany)
8) OpenDNS (Anycast: worldwide)
9) Google (Anycast: worldwide)
10) Yandex Basic (Russia)
11) AdGuard DNS (Anycast: worldwide)
12) NextDNS (Anycast: worldwide)
13) Custom
DNS [1-12]: 11
Do you want to use compression? It is not recommended since the VORACLE attack makes use of it.
Enable compression? [y/n]: n
Do you want to customize encryption settings?
Unless you know what you're doing, you should stick with the default parameters provided by the script.
Note that whatever you choose, all the choices presented in the script are safe. (Unlike OpenVPN's defaults)
See https://github.com/angristan/openvpn-install#security-and-encryption to learn more.
Customize encryption settings? [y/n]: n
Okay, that was all I needed. We are ready to setup your OpenVPN server now.
You will be able to generate a client at the end of the installation.
Press any key to continue...
Extra Packages for Enterprise Linux 9 - x86_64 5.5 MB/s | 19 MB 00:03
Extra Packages for Enterprise Linux 9 openh264 (From Cisco) - x86_64 593 B/s | 2.5 kB 00:04
Package epel-release-9-7.el9.noarch is already installed.
Dependencies resolved.
Nothing to do.
Complete!
Last metadata expiration check: 0:00:04 ago on Thursday 26 October 2023 08:05:05 AM.
Package iptables-nft-1.8.8-6.el9_1.x86_64 is already installed.
Package policycoreutils-python-utils-3.5-1.el9.noarch is already installed.
Dependencies resolved.
=======================================================================================================================
Package Architecture Version Repository Size
=======================================================================================================================
Installing:
openvpn x86_64 2.5.9-1.el9 epel 654 k
Upgrading:
ca-certificates noarch 2023.2.60_v7.0.306-90.1.el9_2 baseos 835 k
curl x86_64 7.76.1-23.el9_2.4 baseos 294 k
libcurl x86_64 7.76.1-23.el9_2.4 baseos 283 k
Installing dependencies:
pkcs11-helper x86_64 1.27.0-6.el9 epel 62 k
Transaction Summary
=======================================================================================================================
Install 2 Packages
Upgrade 3 Packages
Total download size: 2.1 M
Downloading Packages:
(1/5): ca-certificates-2023.2.60_v7.0.306-90.1.el9_2.noarch.rpm 1.5 MB/s | 835 kB 00:00
(2/5): pkcs11-helper-1.27.0-6.el9.x86_64.rpm 97 kB/s | 62 kB 00:00
(3/5): libcurl-7.76.1-23.el9_2.4.x86_64.rpm 1.7 MB/s | 283 kB 00:00
(4/5): curl-7.76.1-23.el9_2.4.x86_64.rpm 1.5 MB/s | 294 kB 00:00
(5/5): openvpn-2.5.9-1.el9.x86_64.rpm 249 kB/s | 654 kB 00:02
-----------------------------------------------------------------------------------------------------------------------
Total 483 kB/s | 2.1 MB 00:04
Extra Packages for Enterprise Linux 9 - x86_64 359 kB/s | 1.6 kB 00:00
Importing GPG key 0x3228467C:
Userid : "Fedora (epel9) <epel@fedoraproject.org>"
Fingerprint: FF8A D134 4597 106E CE81 3B91 8A38 72BF 3228 467C
From : /etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-9
Key imported successfully
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
Preparing : 1/1
Upgrading : libcurl-7.76.1-23.el9_2.4.x86_64 1/8
Installing : pkcs11-helper-1.27.0-6.el9.x86_64 2/8
Running scriptlet: openvpn-2.5.9-1.el9.x86_64 3/8
Installing : openvpn-2.5.9-1.el9.x86_64 3/8
Running scriptlet: openvpn-2.5.9-1.el9.x86_64 3/8
Upgrading : curl-7.76.1-23.el9_2.4.x86_64 4/8
Running scriptlet: ca-certificates-2023.2.60_v7.0.306-90.1.el9_2.noarch 5/8
Upgraded:
ca-certificates-2023.2.60_v7.0.306-90.1.el9_2.noarch curl-7.76.1-23.el9_2.4.x86_64 libcurl-7.76.1-23.el9_2.4.x86_64
Installed:
openvpn-2.5.9-1.el9.x86_64 pkcs11-helper-1.27.0-6.el9.x86_64
Complete!
--2023-10-26 08:05:24-- https://github.com/OpenVPN/easy-rsa/releases/download/v3.1.2/EasyRSA-3.1.2.tgz
Resolving github.com (github.com)... 20.207.73.82
Connecting to github.com (github.com)|20.207.73.82|:443... connected.
HTTP request sent, awaiting response... 302 Found
Location: https://objects.githubusercontent.com/github-production-release-asset-2e65be/4519663/c2688102-7cd5-4fcc-b272-083d48dc4b4d?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20231026%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20231026T023524Z&X-Amz-Expires=300&X-Amz-Signature=a0d05853137e17b8c040f6cf11a9412cc3b798571095bc0197d2cbc5b4e70d4d&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=4519663&response-content-disposition=attachment%3B%20filename%3DEasyRSA-3.1.2.tgz&response-content-type=application%2Foctet-stream [following]
--2023-10-26 08:05:25-- https://objects.githubusercontent.com/github-production-release-asset-2e65be/4519663/c2688102-7cd5-4fcc-b272-083d48dc4b4d?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20231026%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20231026T023524Z&X-Amz-Expires=300&X-Amz-Signature=a0d05853137e17b8c040f6cf11a9412cc3b798571095bc0197d2cbc5b4e70d4d&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=4519663&response-content-disposition=attachment%3B%20filename%3DEasyRSA-3.1.2.tgz&response-content-type=application%2Foctet-stream
Resolving objects.githubusercontent.com (objects.githubusercontent.com)... 185.199.111.133, 185.199.108.133, 185.199.109.133, ...
Connecting to objects.githubusercontent.com (objects.githubusercontent.com)|185.199.111.133|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 68984 (67K) [application/octet-stream]
Saving to: ‘/root/easy-rsa.tgz’
/root/easy-rsa.tgz 100%[================================================>] 67.37K --.-KB/s in 0.01s
2023-10-26 08:05:25 (5.26 MB/s) - ‘/root/easy-rsa.tgz’ saved [68984/68984]
Created symlink /etc/systemd/system/multi-user.target.wants/openvpn-server@server.service → /etc/systemd/system/openvpn-server@.service.
Tell me a name for the client.
The name must consist of alphanumeric character. It may also include an underscore or a dash.
Client name: Linuxhelp.com
Client name: Linuxhelp
Do you want to protect the configuration file with a password?
(e.g. encrypt the private key with a password)
1) Add a passwordless client
2) Use a password for the client
Select an option [1-2]: 1
* Using SSL: openssl OpenSSL 3.0.7 1 Nov 2022 (Library: OpenSSL 3.0.7 1 Nov 2022)
* Using Easy-RSA configuration: /etc/openvpn/easy-rsa/vars
* The preferred location for 'vars' is within the PKI folder.
To silence this message move your 'vars' file to your PKI
or declare your 'vars' file with option: --vars=<FILE>
-----
Notice
------
Keypair and certificate request completed. Your files are:
req: /etc/openvpn/easy-rsa/pki/reqs/Linuxhelp.req
key: /etc/openvpn/easy-rsa/pki/private/Linuxhelp.key
Using configuration from /etc/openvpn/easy-rsa/pki/e80aefa1/temp.ff9a5102
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName :ASN.1 12:'Linuxhelp'
Certificate is to be certified until Jan 28 02:36:54 2026 GMT (825 days)
Write out database with 1 new entries
Data Base Updated
Notice
------
Certificate created at:
* /etc/openvpn/easy-rsa/pki/issued/Linuxhelp.crt
The configuration file has been written to /root/Linuxhelp.ovpn.
Download the .ovpn file and import it in your OpenVPN client.
Step 8: Enable and Start the OpenVPN service by using the below command
[root@Linuxhelp ~]# systemctl enable openvpn-server@server.service
[root@Linuxhelp ~]# systemctl start openvpn-server@server.service
Step 9: Check the status of the OpenVPN service by using the below command
[root@Linuxhelp ~]# systemctl status openvpn-server@server.service
● openvpn-server@server.service - OpenVPN service for server
Loaded: loaded (/etc/systemd/system/openvpn-server@.service; enabled; preset: disabled)
Active: active (running) since Thu 2023-10-26 08:05:29 IST; 3min 4s ago
Docs: man:openvpn(8)
https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage
https://community.openvpn.net/openvpn/wiki/HOWTO
Main PID: 7143 (openvpn)
Status: "Initialization Sequence Completed"
Tasks: 1 (limit: 22877)
Memory: 1.3M
CPU: 77ms
CGroup: /system.slice/system-openvpn\x2dserver.slice/openvpn-server@server.service
└─7143 /usr/sbin/openvpn --status /run/openvpn-server/status-server.log --status-version 2 --suppress-tim>
Oct 26 08:05:29 Linuxhelp openvpn[7143]: Could not determine IPv4/IPv6 protocol. Using AF_INET
Oct 26 08:05:30 Linuxhelp openvpn[7143]: Socket Buffers: R=[212992->212992] S=[212992->212992]
Oct 26 08:05:30 Linuxhelp openvpn[7143]: UDPv4 link local (bound): [AF_INET][undef]:1194
Oct 26 08:05:30 Linuxhelp openvpn[7143]: UDPv4 link remote: [AF_UNSPEC]
Oct 26 08:05:30 Linuxhelp openvpn[7143]: GID set to nobody
Oct 26 08:05:30 Linuxhelp openvpn[7143]: UID set to nobody
Oct 26 08:05:30 Linuxhelp openvpn[7143]: MULTI: multi_init called, r=256 v=256
Oct 26 08:05:30 Linuxhelp openvpn[7143]: IFCONFIG POOL IPv4: base=10.8.0.2 size=253
Oct 26 08:05:30 Linuxhelp openvpn[7143]: IFCONFIG POOL LIST
Oct 26 08:05:30 Linuxhelp openvpn[7143]: Initialization Sequence Completed
Conclusion:
We have reached the end of this article. In this guide, we have walked you through the steps required to install and configure OpenVPN server on Rocky Linux 9.2. Your feedback is much welcome.
Comments ( 0 )
No comments available