Ubuntu Open VPN Server setup behind NAT using tun

This may not necessarily  be a better guide than from where I got this information but I was having a hard time with including multiple machines on the server side when using a routed VPN server (dev tun) behind a NAT so I created this guide. Fore most other cases the official docs are a better sources for information.

Information gathered from https://help.ubuntu.com/12.04/serverguide/openvpn.html
and from https://openvpn.net/index.php/open-source/documentation/howto.html

First install openvpn:

sudo apt-get install openvpn

Public Key Infrastructure Setup

The first step in building an OpenVPN configuration is to establish a PKI (public key infrastructure). The PKI consists of:

• a separate certificate (also known as a public key) and private key for the server and each client, and
• a master Certificate Authority (CA) certificate and key which is used to sign each of the server and client certificates.
  

Certificate Authority (CA) Setup:
first change to root:

sudo su

Now make the folder where we'll do the server configuration:

mkdir /etc/openvpn/easy-rsa/

Now copy the openvpn example configuration and setup scripts:

cp -r /usr/share/doc/openvpn/examples/easy-rsa/2.0/* /etc/openvpn/easy-rsa/

Next, edit /etc/openvpn/easy-rsa/vars adjusting the following to your environment:

export KEY_COUNTRY="US"
export KEY_PROVINCE="NC"
export KEY_CITY="Winston-Salem"
export KEY_ORG="Example Company"
export KEY_EMAIL="steve@example.com"

Run the following commands to generate the master Certificate Authority (CA) certificate and key:

cd /etc/openvpn/easy-rsa/
source vars
./clean-all
./build-ca

Server Certificates:
Next, we will generate a certificate and private key for the server:

./build-key-server myservername

You will get two queries: "Sign the certificate? [y/n]" and "1 out of 1 certificate requests certified, commit? [y/n]" answer both with y.

Diffie Hellman parameters must be generated for the OpenVPN server:

./build-dh

The keys have been generated to a subdirectory of "keys/". A common practice is to copy them to /etc/openvpn/ folder:

cd keys/
cp myservername.crt myservername.key ca.crt dh2048.pem /etc/openvpn/

Note: the dh2048.pem file name might be dh1024.pem depending what the default is or what bit keys you generated.

Client Certificates:
The client will also need certificates to authenticate itself to the server.
to create the certificate and key for client1 run the follow commands as root:

cd /etc/openvpn/easy-rsa/
source vars
./build-key client1

Copy the following files to the client using a secure method:

• /etc/openvpn/ca.crt
• /etc/openvpn/easy-rsa/keys/client1.crt
• /etc/openvpn/easy-rsa/keys/client1.key

Since the client certificates and keys are only required by the client it might be a good idea to remove them from the server.

Simple Server Configuration
Copy the example server configuration file and unpack it from /usr/share/doc/openvpn/examples/sample-config-files/:

sudo cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz /etc/openvpn/
sudo gzip -d /etc/openvpn/server.conf.gz

Edit /etc/openvpn/server.conf to make sure the following lines are pointing to the certificates and keys you created in the section above.

ca ca.crt
cert myservername.crt
key myservername.key 
dh dh2048.pem #Note this might be dh1024.pem

Now start the server. You will find logging and error messages in your syslog.

root@server:/etc/openvpn# service openvpn start
 * Starting virtual private network daemon(s)...
   *   Autostarting VPN 'server'                     [ OK ]

Now check if OpenVPN created a tun0 interface:

root@server:/etc/openvpn# ifconfig tun0
tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
[...]

Simple Client Configuration
Copy the example client configuration file to the same location on the client computer as you did the previous client files (ca.crt client1.crt client1.key). The example configuration file is at /usr/share/doc/openvpn/examples/sample-config-files/client.conf. For windows you'll probably want to rename the file to client1.ovpn instead of client1.conf.

The openvpn gui program on windows looks for the configuration files in C:\Program Files\OpenVPN\config by default so that's probably where you want to place them once you've done editing the configuration file.

On Ubuntu you'll probably want to create a hidden .vpn folder in your home directory and place all the client files into the directory. Also if you're using network manager on Ubuntu install the openvpn network manager plugin to be able to use openvpn configuration files with networkmanager.

sudo apt-get install network-manager-openvpn

Other distros will have similar packages for network manager that you can install.

For more client implementations check the following article:
https://help.ubuntu.com/12.04/serverguide/openvpn.html#openvpn-client-implementations

The minimal  changes you need to make in the example configuration are as follows. Make sure they keyword client is in the configuration file and that the file has the correct OpenVPN server name or address:

client
remote vpnserver.example.com 1194

And also make sure your client.conf or client.ovpn (if you renamed it already) has the following pointing to your client certificates and keys.

ca ca.crt
cert client1.crt
key client1.key

Now import your vpn configuration file from network manager gui and try connecting or if you're using another OS or a different client implementation it will be different. For different implementations check here. If you're behind a NAT you'll be unable to connect as well so continue to the next step.

Behind NAT Configurations

Basically all that you need to do in the gateway (The gateway may be your router) is forward port 1194 or whatever port you chose in the configuration files to your OpenVPN server. You will want a static IP address for your server. Next allow the port through your firewall on both the gateway and OpenVPN server.

Including multiple machines on the server side when using a routed VPN (dev tun)
First, you must advertise your subnet to VPN clients as being accessible through the VPN. In this case we will assume that your subnet is 10.66.0.0/24 and the VPN IP address pool uses 10.8.0.0/24. This can easily be done with the following server-side config file directive:

push "route 10.66.0.0 255.255.255.0"

Note: if your IP address is 192.168.1.10 your subnet is probably 192.168.1.0/24. Another thing if this is you subnet on server you should probably change it since it's a common subnet therefore there might be routing conflicts with client.
On linux you can check you subnet with ip command:

$ ip route
default via 192.168.1.1 dev br0
192.168.1.0/24 dev br0  proto kernel  scope link  src 192.168.1.10

Next you need to set up a static route on the gateway to route the client subnet (10.8.0.0/24) to your OpenVPN server.
Note: there might might be separate field to enter netmask for example
192.168.0.0/24 would be written as 192.168.0.0, netmask 255.255.255.0
See more information here. http://en.wikipedia.org/wiki/Subnetwork

The last step is to enable IP and TUN/TAP forwarding on the OpenVPN server.

On the server run the following command to enable IP forwarding:

echo 1 > /proc/sys/net/ipv4/ip_forward

And the following commands to allow TUN forwarding on iptables (firewall).
Allow TUN interface connections to OpenVPN server:

iptables -A INPUT -i tun+ -j ACCEPT

Allow TUN interface connections to be forwarded through other interfaces

iptables -A FORWARD -i tun+ -j ACCEPT

Also make sure that your network interface is in promiscuous mode.

$ netstat -i
Kernel Interface table
Iface   MTU Met   RX-OK RX-ERR RX-DRP RX-OVR    TX-OK TX-ERR TX-DRP TX-OVR Flg
eth0       1500 0    651606      0      9 0        430319      0      0      0 BMRU
lo        65536 0     73440      0      0 0         73440      0      0      0 LRU
tun0       1500 0         0      0      0 0             0      0      0      0 MOPRU

The P flag is for promiscuous mode.