Install

We can find a debian package of openvpn. You just need to install with aptitude.

# aptitude update

# aptitude install openssl

# aptitude install openvpn

Generate certificate

Before configuring openvpn, you should generate the certificate witch will identify the server (for the client) and the client (for the server). Go to this folder:

#cd /usr/share/doc/openvpn/examples/easy-rsa/2.0/

Edit the vars file with the corresponding informations (no informations should be empty and you shouldn't delete anyone). It will be useful when generating all certificates. Here is our local version [txt].

We start by initializing the key.

# . ./vars

We clean old certificate that we generate from this folder and the current CA. You will loose all your distributed certificate if you delete the CA.

# ./clean-all

We built the ca (certificate authority). It assures that we not using false certificate (user and server certificate).

# ./build-ca

Now we build the certificate for the vpn server.

# ./build-key-server server

It's one client certificate (for support user).

# ./build-key support

We build the diffie-hellman key for the server

# ./build-dh

Configure

We should copy all certificates we need for the server (ca.crt, ca.key, server.crt, server.key, dh1024.pem)

# cp ca.crt /etc/openvpn

# cp ca.key /etc/openvpn

# cp server.crt /etc/openvpn

# cp server.key /etc/openvpn

# cp dh1024.pem /etc/openvpn

The configuration file is not difficult to build. We can almost use the example configuration file (/usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz). There are just three parameters to change. First we add an IP address where the server is listing (not necessary, but suitable if we have more than one IP address). We should uncomment the line "client-to-client", otherwise clients are not visible from each other. We also should uncomment the line duplicate-cn, because we want use one certificate for all support users. And they should be able to connect in the same time. Download here the configuration file [txt] or [txt] (company). Here are all the certificate and the configuration file that we need to start the server to replace the actual server if there are any problems [zip] (company).