VPN

As a Webhost with more than a few servers, the benefits of having a private network setup between your servers are many. This private network allows your servers to communicate and transfer data securely among themselves. Most DCs offer this as an added feature to the services they provide. Previously, to access this network you would have to look for the expensive option of renting a leased line to the DC, but not anymore. This can now be achieved using a VPN.

Ok, Now what is a VPN?

VPN stands for Virtual Private Network. It allows you to connect securely to a private network over the Internet, and work as if you were a part of that network. It is based on the client/server architecture and it works on almost all platforms; including FreeBSD, Linux, Windows and MAC OS X. A VPN can be used to provide remote access to a private network or to connect two geographically separated private networks, using the Internet to carry the traffic. If you have outsourced your support team, you can have them setup a VPN between their network and the private network at the DC, allowing for improved productivity and security.

Is there a cheap VPN solution?

There is, and it is called OpenVPN. OpenVPN is a free and open source VPN solution and can be used for any of the scenarios mentioned above i.e. You can use it to connect your PC to the private network at your DC, or to connect your network, your support team’s network and the DCs private network together. OpenVPN employs both encryption and authentication to guarantee the safety of the data being transferred. For encryption it employs another open source package OpenSSL. It employs pre-shared secret keys, certificate-based, and username/password-based authentication.

Setting up a VPN:

Let us look into setting up a VPN between a client PC and a server.

Installing Open VPN on the server:

Open VPN requires the “lzo” real time compression library, so you should install it first if it is not already present. There are various methods by which you can install OpenVPN and installing it using YUM is the easiest. It will also install “lzo”, along with any other required packages. To install, simply run the command:

yum install openvpn -y

It is also possible to install OpenVPN from source, which will give you much more control over the installation, but is fairly complicated.

Once the installation is over you will see the configuration and binaries at the path: /usr/share/doc/openvpn-2.1/easy-rsa.

Copy this folder to the /etc directory.

We will have grant all permissions to the scripts in this folder.
cd /etc/openvpn/easy-rsa/2.0
chmod 777 *

Create Keys on Server:

Now that the server has been installed, we will now have to setup the keys that will be used by the VPN client/server for authentication. Here we will be using the public key infrastructure (PKI) method for authentication. In this method, there will be three certificates.

1) Master certificate & key which is placed in vpn server
2) Server certificate & key which is placed in vpn server
3) Client certificate & key which is placed in vpn client

We will generate the master certificate below. The server will only accept the certificates from those clients which are signed by the master certificate authority.

Generate the master Certificate Authority (CA) certificate & key:

The scripts in the easy-rsa folder are used for generating keys. The keys will be placed in /etc/openvpn/keys. This folder will not be present by default and has to be created.
mkdir /etc/openvpn/keys
In order to generate the master certificate, we first need to edit the “vars” configurations file located at /etc/openvpn/easy-rsa/2.0
Edit the following values to suit your requirements. Do not leave any of those fields blank as the cert will be generated based on these values.

export KEY_DIR="/etc/openvpn/keys"
export KEY_COUNTRY=”US”
export KEY_PROVINCE=”CA”
export KEY_CITY=”SanFrancisco”
export KEY_ORG=”Fort-Funston”
export KEY_EMAIL=”test@test.com”

Now, we will start creating the cert and key.
#. ./vars
#./clean-all (This will delete all the existing files in the key folder)
#./build-ca (We are going to build the CA. You can just continue by hitting Enter until you reach the field for common name. All other fields will be populated by default from the entries you gave in the vars file)
You will then be asked for some details to be specified for the certificate. It is important that you give a unique value for the “Common Name” parameter. Now that the master certificate has been generated we shall proceed to generate the server certificate.

Generate certificate & key for server:

./build-key-server server
As in the master certificate almost all parameters are taken by default from the vars file. The only detail that you need to provide is again the “Common Name. Here I have used “server.ca”. You can then continue hitting enter, until you reach the“Sign the certificate?” field. Type “y” and hit enter. Next it will ask “1 out of 1 certificate requests certified, commit?”. Again type “y” and hit enter.

Generate certificate & key for client:

Now we proceed to create the certificate and key for client. It is exactly the same process as above and make sure that there also you give a unique “Common Name”. You can create as many keys as there are clients you wish to connect to the server.
./build-key client1
Here I am generating the certificate for the client named client1. Enter the common name and proceed as you did with the server certificate.

Generate Diffie Hellman parameters:

Next we will proceed to generate the Diffie Hellman parameters. Diffie-Hellman (D-H) is a public key algorithm used for producing a shared secret key.
The script for generating D-H parameters is called ./build-dh and is located in the same scripts folder.
# ./build-dh

Configuring the Open VPN client:

Upload the ca.crt, client1.crt and client1.key to the client PC.
Now that the client and server side configurations are over, we will proceed with editing the configuration files, which is the most important part.

Creating configuration files for the server:

Sample configuration files will be available at /usr/share/doc/openvpn-2.1/sample-config-files. The server.conf is the server configuration file and you can copy it to /etc/openvpn and modify as needed.
cp /usr/share/doc/openvpn-2.1/sample-config-files/server.conf /etc/openvpn
A sample configuration file is given below. The fields which you need to edit are the ones which have been explained with a # mark to the right.
=========================
port 1194
proto tcp
dev tun
ca keys/ca.crt # path to the CA.crt file
cert keys/server.crt # path to the server certificate
key keys/server.key # path to the server key file
dh keys/dh1024.pem # path to the generated D-H parameters
mode server # implements multi-client server capability
tls-server
tls-cipher DHE-RSA-AES256-SHA
server 192.168.1.0 255.255.255.0 # here give the private network address in the server and its mask.
client-config-dir ccd
#########
######### Put your Public DNS Servers here
#########
#push “dhcp-option DNS 210.80.150.4″
#push “dhcp-option DNS 202.155.174.4″
push “route 192.168.1.0 255.255.255.0″ # The OpenVPN server can push routes, DNS server IP addresses and other configuration details to the clients.
ifconfig-pool-persist ipp.txt
push “redirect-gateway”
keepalive 10 120
comp-lzo
persist-key
persist-tun
status server-tcp.log
verb 3
========================

Once the configuration is over, create the file ipp.txt which contains the IP s of the clients you wish to connect to the server.
A sample ipp.txt file is as follows.
# cat ipp.txt
test1.com.client,192.168.1.4

---

Next, touch a file for the logs.

touch server-tcp.log

Configuring the Client:

Depending on the OS of the PC you are using to connect,(Windows, Linux/Unix) you can download an OpenVPN client that suits your needs and install it. Other than adding the keys as mentioned above, you will not have to make any configuration changes on the client.

Starting the VPN:

Once the server and client side configurations are over, we can start the open vpn server.
/etc/rc.d/init.d/openvpn start

Once OpenVPN has been started you should be able to access the server as if it were part of your private network.

For more detailed steps on setting this up, check out my complete articlehere.

OPEN VPN

If your company has people on the road, such as sales or technical people, a VPN is a good method for letting them access data on the company network. Many different VPN solutions can be bought, but many are free. Here, I discuss only solutions you can set up without buying a commercial VPN product.
The main VPN solution used for more complex tasks is IPsec; some people use PPTP. Although PPTP is usable, security flaws have occurred in its past, and it simply does not match up to IPsec.
IPsec in tunnel mode would be a much better solution, were it not for the crippled Windows-client implementation: Windows XP/2000 clients can't use IPsec in tunnel mode without using L2TP. There is nothing wrong with L2TP security-wise, but it increases latency--through the need for both PPP and L2TP processes--and increases packet-overhead, slowing down connections. Open-source servers have not had much experience with L2TP yet, so using open source for it is problematic at this time.
A disadvantage of plain IPsec is its notorious complexity: many, many things can and do go wrong. To the rescue, then, comesOpenVPN, a full-blown open-source VPN solution based on SSL. OpenVPN offers the same functionality as IPsec in tunnel mode; you can tunnel entire networks through it. In this article, I focus on using OpenVPN as a road warrior's VPN solution.
Every VPN approach has its list of pros and cons. The pros of OpenVPN are:

• Same functionality as IPsec in tunnel mode: you can tunnel entire networks (IP tunnel or bridging tunnel).
• A Windows XP/2000 install.exe file with a GUI is available for starting the tunnel. The config files are text based.
• The OpenVPN server can push routes, DNS server IP addresses and other configuration details to the clients. This makes OpenVPN well suited for road-warrior setups, because you can modify the setup without touching far-away laptops.
• You can use a bridging or routing setup.
• The server/client code is the same: the config determines the role.
• SSL is as solidly proven as security protocols get, using RSA public key cryptography if you want. See this paper for more information on its security setup.
• OpenVPN costs you nothing in terms of money--a server, an Internet connection and know-how is all you need).
• Plenty of man pageand HOWTOs are available to get you going.
• All encryption processes are handled in userland, meaning it is easy to install--much less complicated than IPsec.

The list of cons includes:

• The setup uses TUN/TAP devices. This can make things complicated to figure out when things go wrong. If Microsoft changes its code, it also might just break.
• The OpenVPN process is executed in userland and, thus, is relatively slow. TUN/TAP devices combine together with a userland-process to create a setup in which traffic has to cross userland/kernel borders relatively often. This setup might create rather high latency on connections.
• A packet overhead is present because IP/Ethernet is encapsulated in SSL and SSL in UDP/TCP.
• The latest version OpenVPN is beta; earlier versions have further drawbacks.
• Who can you call when things go wrong? Some companies want to pay to get support.

Considering these arguments, OpenVPN should be a serious option if you are setting up a VPN. The days when only money could get you a decent VPN definitely are over.

Setting Up an OpenVPN (Routing) Scenario

The rest of this article is a guide to setting up a road-warrior scenario using routing, not bridging, with TUN devices. Its aim is to make sure laptops on the Internet can connect safely to companies' networks, using internal servers and data.
The basic HOWTO I drew on when writing this article can be foundhere. It is a HOWTO for setting up OpenVPN in bridging mode on a Linux SME-server. My setup is slightly different, because I do not use a bridging setup. Another good source is the OpenVPN HOWTO.
The Security Setup
Anyone setting up a VPN without considering the different kinds of security risks one faces is a fool. Therefore, you should start any VPN setup doing exactly that--considering security.
Connection Security
OpenVPN traffic flowing over the Internet is protected by TLS. The setup here uses public key exchange; computer authentication is done by RSA-based public/private key-pairs (public keys also are called certificates). In this setup we make our own root certificate; that is, for our VPN scheme, we are our own Verisign, so to speak. We are the root of the Web of trust here. We make a server key pair and multiple client-key pairs. We sign those with our own root certificate. This setup is this basic cryptography design of OpenVPN.
The SSL/TLS connection is set up up with those keys. After authentication is done, Diffie-Hellmann encryption is used to exchange keys to set up the connection. New keys are negotiated every hour using perfect forward secrecy, or PFS--the next key used is not derived by using the former key. By default, the connection uses 128-bit Blowfish in Cipher Block Chaining mode, with SHA1 message digests.
Server Security
The OpenVPN server itself, of course, could be attacked. You can minimize that risk by:

• Using shared keys with the tls-auth option before public key exchange occurs. Doing so keeps people from exploiting the SSL setup, should this be possible.
• Setting options user nobody and group nobody. This makes sure the server does not run as root. You also can use a chroot-jail.
• Using a separate box in a DMZ. This way a successful hack is slowed down by the firewall protecting the internal network from the DMZ. Strange connects can be noticed in the firewall logging.
• By using iptables firewall rules on the OpenVPN server that prevent traffic from tunnel hosts entering the server, as well as all traffic from the Internet except for the need UDP traffic.

Authentication of Users
The security setup of your client laptops is critical. If your road warriors are using laptops and can access your company's network, your data may become public in the future. No matter how good the SSL crypto, this is a separate risk. If a laptop can connect through an OpenVPN tunnel directly into your networks, you have a problem. To avoid this, you need to establish authentication of the user to the laptop or to the SSL keys.
Many ways exist to do this authentication. You can password-protect the SSL keys of the client, which is recommended. But if workers have the habit of writing down passwords near their laptops, password protection is not sufficient. An option is to get USB-based iKeys with a pincode that holds the client keys. Pincodes are easier to remember, so the need to write them down is smaller. Of course, the iKey should be carried on a keychain and not with the laptop itself. You should establish an AUP (acceptable user policy) to make sure all users understand this. Doing so may prevent a stolen laptop from becoming a disaster. In addition, you might use encrypted filesystems on laptops.
Another option is to set up your own custom authentication scheme. For instance, you can use strong authentication with hardware tokens, coupled with a Kerberos server. OpenVPN has the script hooks to do that. You also can use the server password file.
Network Setup
The network setup my configuration files is aiming for is this:

• The OpenVPN server at 65.66.45.x.
• The client is somewhere on the Internet.
• The client/server P2P network is 192.168.100.0/24 or, rather, a /32 network in that network.
• The company-network behind the OpenVPN server is172.16.1.0/24.

So, the internal mailserver of this company might be at 172.16.1.3, the DC at 172.16.1.5 and the fileserver at 172.16.1.6. Schematically, this setup looks like this:

CLIENT -> [modem/adsl-router] -> Internet <-UDP-> OpenVPNserver 
CLIENT - TUNInterFace <=tunnel=> TUNInterFace ==> Internal network
CLIENT - 192.168.100.6 <=======> 192.168.100.5 <==> 172.16.1.0

I am using a Linux SME-server, which basically is a Red Hat system stripped down to what a file/printer/firewall/e-mail server needs, with a Perl/HTTP-based config panel. After being a problematic open-source project for a while, Linux SME-server is being developed further by Lycoris. I have used Linux SME-server for years and will migrate only if forced to--it is extremely easy to use.

OpenVPN Server Install

Installing OpenVPN is easy to do. On the Linux server side, you must install one or two RPMs. On SME these RPMs are lzo.xxx.rpm and openvpn-2.0_beta17-1.i386.rpm. Most systems already include lzo. Your kernel should include TUN devices, most kernels do. If you run openvpn from /usr/sbin/openvpn, you should find a TUN device. With the settings we are going to use, it has a P2P connection.
The config file on my box is saved at /etc/openvpn/server.conf, but yours may be stored somewhere else. My server configuration file looks like the output shown below; see the man page to see what all the items reference. they mean):

###OpenVPN server config routing TUN setup########
port 1194
dev tun
tls-server
mode server
dh dh1024.pem
ca ca.crt
cert SERVER.crt
key SERVER.key
duplicate-cn
ifconfig 192.168.100.1 192.168.100.2
ifconfig-pool 192.168.100.5 192.168.100.200 # IP range clients
mtu-test
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
#keep tunnel open by ping
push "ping 10"
push "ping-restart 60"
ping 10
ping-restart 120
#route to be established on the server
route-up "route delete -net 192.168.100.0/24"
route-up "route add -net 192.168.100.0/24 tun0"
#route to push to clients
push "route 172.16.1.0 255.255.255.0" #route to company network
push "dhcp-option DOMAIN hansceess.net"  #push the DNS domain suffix
push "dhcp-option DNS 172.16.1.7"  #push DNS entries to client
push "route 192.168.100.1" # add route to protected network
comp-lzo
status-version 2
status openvpn-status.log
verb 5
####################### end server config ##############

Client Install

On the Windows client side, you should download the Windows installer and run it. The normal installer is available on the OpenVPN Web site, while and the GUI version can be found here. I recommend using the latter: it gives you a tray-icon with which you can start the OpenVPN service. In the Network connections window under Settings, you should find a tap win32 adapter. You also should see that adapter in your routing table when you type route print in a DOSBox.
After the setup has installed everything, you should adjust the config settings in D:/Program Files/OpenVPN/config/*.ovpn to those you want. You might want to tune your personal firewall as well, if it sees the interface at all--mine didn't. My adjusted settings file looks like this:

####################client.ovpn######
port 1194 #udp by default
dev tun
##remote is the openvpn-server
remote 65.66.45.x
tls-client
ca ca.crt
cert CLIENT.crt
key CLIENT.key
mtu-test
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
pull
#ip-win32 ipapi|manual|dynamic|netsh (see man page, use 
#when ip address on interface does not appear, but dhcp server 
#is visible in ipconfig /all)
#ip-win32 ipapi
comp-lzo
verb 4
##############################end########

The OpenVPN process on the client is a Windows service you can start with a script or with the GUI, if you want. The TAP device (in tun-modus) can be tcpdumped, as can any interface, which makes it nice when troubleshooting. The rest of the configuration comes from the server.

Making RSA Keys

You can make keys for OpenVPN in the same way as you would make them for OpenSSL. But for those who like comfort, OpenVPN has an easy RSA set of scripts to help you out. You first must edit some variables in the vars file for the keys: names for server/clients keys, your company name, e-mail and so on. Next, run ./build-ca to build your root private key. Then, run ./build-key server to build the server key pair. Build the client key(s) with ./build-key client. In this client step, you can add a passphrase in the keys for key-authentication, as discussed above. Finally, you must run ./build-dh to generate the Diffie-Hellmann .pem file that the server needs. This file holds a large prime number and another parameter (see this article for details). Using these numbers, the server can generate new keys quickly, which it does every hour by default for standing connections.
You also need to copy the server keys, root certificate and *.pem file to /openvpn. The client needs the client keys and the root certificate. These should be transported over a secure medium, such as winscp.
There is one thing left to do: get the firewall iptables rules on the server. The rules I added were:

#  internet interface eth1 let OpenVPN udp port in
/sbin/iptables --append INPUT -p udp --dport 1194 -m state --state     NEW -i eth1 -j ACCEPT
#block anything into the server from tun interface
/sbin/iptables --append INPUT -i tun0 -j DROP 
#tun0 debugging
#/sbin/iptables --append INPUT -i tun0 -j LOG --log-prefix     tun0-input 
#/sbin/iptables --append OUTPUT -o tun0 -j LOG --log-prefix tun0-output 
#/sbin/iptables --append FORWARD -i tun0 -j LOG --log-prefix Forward-ComingFrom-Tunnel 
#/sbin/iptables --append FORWARD -o tun0 -j LOG --log-prefix Forward-OutTo-Tunnel
#OpenVPN Forward chain: if you have a Tun-device, the forward chain 
#screens traffic from networks/hosts outside the tunnel, going to 
#internal networks and back. we want this traffic to go through, 
#default but first we might want to block some things: remember, the 
#other side of the tunnel is not safe by default: he could be routing 
#so we should log syns at least coming in
/sbin/iptables --append FORWARD -i tun0 -m state --state NEW --jump LOG --log-prefix Tunnel_into_intranet
#you should know the networks allowed in and out through the tunnel
#let client network in.
/sbin/iptables --append FORWARD -i tun0 --source 192.168.0.0/16 -j ACCEPT 
#let company network out
/sbin/iptables --append FORWARD -o tun0 --source 172.16.0.0/16
-j ACCEPT
##troubleshoot: let all through
# /sbin/iptables --append FORWARD -i tun0 -j ACCEPT
# /sbin/iptables --append FORWARD -o tun0 -j ACCEPT
#you might want to allow some, but not all
# /sbin/iptables --append FORWARD -i tun0 -p tcp --dport 25 -j ACCEPT
##drop the rest
/sbin/iptables --append FORWARD -i tun0 -j DROP
/sbin/iptables --append FORWARD -o tun+ -j DROP

Testing

Once you have installed OpenVPN, it is time to test it. Make sure the server process is started with service openvpn [re]start. You should see the TUN device with ifconfig. With my config, it shows:

Link: encap:Point-to-Point Protocol 
Inet addr:192.168.100.1 P-t-P 192.168.100.2.

Now, start up the client OpenVPN service. A file found at D:/Program Files/Openvpn/*.log contains debugging information. With the verb setting, you can elaborate the logging. When you start the client service, the icon in your tray shouts it is connected. Ipconfig /all in a DOSBox shows an IP address on the tap interface, for instance, 192.168.100.10

Ethernet adapter Local Area Connection 8:
Connection-specific DNS Suffix  . : 
Description . . . . . . . . . . . : TAP-Win32 Adapter V8
Physical Address. . . . . . . . . : 00-FF-CF-10-9F-A6
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . : 192.168.100.10
Subnet Mask . . . . . . . . . . . : 255.255.255.252
Default Gateway . . . . . . . . . : 
DHCP Server . . . . . . . . . . . : 192.168.100.5

print route gives you some routes:

192.168.100.1  255.255.255.255    192.168.100.9               4   1
192.168.100.8  255.255.255.252   192.168.100.10               4   1
192.168.100.10  255.255.255.255    127.0.0.1       127.0.0.1   1
192.168.100.255  255.255.255.255   192.168.100.10               4 

Although this all may look quite odd, it works. You now can ping 192.168.100.1; if that succeeds the tunnel is okay. On the server you can see the pings coming in with tcpdump -nlpi tun0. Also, tail -f /var/log/messages supplies some information.
The routes on the server look something like this (netstat -rn) kernel IP routing table:

Destination   Gateway     Genmask          Flags   MSS Window  irtt Iface
192.168.100.2  0.0.0.0     255.255.255.255  UH        0 0         0  tun0
192.168.100.0 0.0.0.0     255.255.255.0    U         0 0         0  tun0
65.66.45.2     0.0.0.0     255.255.255.0    U         0 0         0  eth1
172.16.1.0     0.0.0.0     255.255.255.0    U         0 0         0  eth0
127.0.0.0      0.0.0.0     255.0.0.0        U         0 0         0  lo
0.0.0.0       65.66.45.1  0.0.0.0          UG        0 0         0  eth1

If all goes well, your connection should be there. If not, check the server routing table and tcpdump the TUN interfaces. You also can use the iptables debug rules.

Conclusion

In this article I have shown a simple setup for a OpenVPN. In real life, the setup will not be much more complex. Although the security implications of any VPN should be well thought-out, setting up OpenVPN turned out to be rather easy. If you do get into trouble, plenty of helping hands can be found on the mailing lists.
OpenVPN is a serious VPN product. It can contend with IPsec in many ways. It certainly is cheap--try buying a Cisco concentrator--easy to install and, in the open-source tradition, tinkerable.
If OpenVPN has a disadvantage, it might be latency. However, no real-life data exists yet to back up that claim.

Resources

"Exchange Functionality on Linux"
"VPN Implementation in Cluster Computing"

Hans-Cees Speel (hanscees@hanscees.com) is a security consultant for Tunix Firewall Support. He spends his spare time building a Web guide for North European trees.

---

If your vps has plesk panel, then you can install and use the openvpn module provided by plesk via the plesk gui. If you have cpanel/directadmin/webmin, use the following:

Part 1:
Login to your vps via ssh as root:

1.Download openvpn and save it to a folder,say, /etc/openvpn
wget http://openvpn.net/release/openvpn-2.0.tar.gz (Please download latest stable version available)
Download it to local machine too.

2.Check the file release signature:
md5sum openvpn-2.0.tar.gz //and check its the same as inhttp://openvpn.net/sig.html

3.tar -xvzf openvpn-2.0.tar.gz
cd openvpn-2.0
./configure
If it gives the error:
"LZO library and headers not found.
LZO library available from http://www.oberhumer.com/opensource/lzo/
configure: error: Or try ./configure --disable-lzo"

download lzo:
cd ..
wget http://www.oberhumer.com/opensource/lzo/download/lzo-1.08.tar.gz
tar -xvzf lzo-1.08.tar.gz
cd lzo-1.08
./configure
make
make check
make test
make install

cd ../openvpn-2.0
./configure
make
make install

* We are using the routing method. (Referhttp://openvpn.net/howto.html#vpntype for details)

4. Generate a master CA certificate/key, a server certificate/key, and certificates/keys for clients:

On server:

cd easy-rsa/ (folder inside openvpn source dir)
. ./vars
./clean-all
a) ./build-ca //Give the details it asks for

b) ./build-key-server server //Give the details it asks for & yes for both qns.

c) ./build-key client1 //where client1 is the 'common name' you wish to give for first client. Give same details as above for rest of it
* If you plan to use more than one client, you need to repeat 4.c step for each client differentiated by the client name (client1, client2, client3 etc) and copy respective key/crt to the client machines

d) ./build-dh

ls keys

5. On server:
cd ../sample-config-files/
vi server.conf //Give the path to the key,ca,cert and dh, rest should be fine with default values. 10.8.0.1 will be the default IP used by server and subsequent ips will be given to connecting clients.

6. Make sure port 1194 is open on the server/ve firewall, if any.

7. On server start openvpn from source dir:

./openvpn sample-config-files/server.conf

should read "Initialization Sequence Completed" towards the end

Part 2: (Use this if your home/office computer is a linux/unix machine)

On local/client machine: (linux/*nix)
(Naming this client client1)

1.Install openvpn package (Repeat steps 1 to 3 of Part1)
2.Copy over client1.key, client1.crt and ca.crt from server to client1 machine.
3. Find sample-config-files/client.conf and edit it,
Give path to the clientkey,cleint cert and ca.crt on the client1 machine
Edit the 'remote' directive to point to the hostname/IP address and port number of the OpenVPN server

eg:
remote 204.157.7.143 1194
ca /root/openvpn/openvpn-2.0/easy-rsa/keys/ca.crt
cert /root/openvpn/openvpn-2.0/easy-rsa/keys/client1.crt
key /root/openvpn/openvpn-2.0/easy-rsa/keys/client1.key

Start openvpn from source dir:
./openvpn sample-config-files/client.conf

should read "Initialization Sequence Completed" towards the end too.

If it throws up some error about the certificate/key, run:

openssl verify -CAfile ca.crt -purpose sslclient client1.crt //To verify the cert

It should output:
client1.crt: OK
if everything is okay.
Also it might need both server and client to have the same date/time/timezone setup.

Part 3: ((Use this if your home/office computer is a windows machine)

Now for a windows client:

(Naming this client "client2" )

Install openvpn:

1. download openvpn package(includes openvpn+openvpn gui) for windows from
http://openvpn.se/files/install_packages/openvpn-2.0-gui-1.0-install.exe
Run the install program.

2.Then copy client2.key, client2.crt and ca.crt from openvpn server to client2 machine.
(You need to create a cert/key for this client as well using step 4.c above)

3. Go to Start -> programs -> openvpn -> openvpn sample configuration files folder
and edit the client.ovpn file with notepad:
Give path to the clientkey,cleint cert and ca.crt on the client2 machine
Edit the 'remote' directive to point to the hostname/IP address and port number of the OpenVPN server

eg. remote 204.157.7.143 1194
ca C:\Program Files\ca.crt
crt C:\Program Files\client2.crt
key C:\Program Files\client2.key

and save the file.

4. Right click on client.ovpn -> Start OpenVPN on this config file

should read "Initialization Sequence Completed" towards the end
which means an openvpn connection has been setup.
Once running in this fashion, several keyboard commands are available:
F1 -- Conditional restart (doesn't close/reopen TAP adapter)
F2 -- Show connection statistics
F3 -- Hard restart
F4 -- Exit
When OpenVPN GUI is started from Start -> programs -> openvpn -> openvpn GUI, an icon will be displayed in the taskbar's
status area.

For details about openvpn installation, configuration and advanced usage, please refer:
http://openvpn.net/howto.html
http://openvpn.se/install.txt
http://openvpn.se/install.txt