Wednesday, August 11, 2010

HOWTO Setup OpenVPN on Ubuntu

The Ubuntu community doco has a decent HOWTO that I won't reproduce, and the O'Reilly article has a good summary of the openssl commands you need to generate the certs (or you could read my openssl posts). Just a few extra notes.

If you want to tie a client to a particular VPN ip address, create a file in:
where "clientname" is the Common Name from the certificate your client uses.

In this file put:

This will tie the "clientname" box to There appears to be a lot of confusion on the web and in forums as to what should be in the second parameter. The doco states it is the remote-netmask. In this case "" is the local end of the point-to-point link, which works. If the doco is right "" might be more correct. As an aside, the address allocation is in successive /30 subnets (so last octet is 1,2,5,6,9) to be compatible with Windows.

If you also want all traffic from the client to exit via the VPN (ie. have the VPN as the default route) add this special sauce after the ifconfig-push line:
push "redirect-gateway def1 bypass-dhcp"
This tells openvpn that you want to use the VPN as the default gateway but still use local DHCP.

No comments: