# Stora As OpenVPN Server

**URL:** <https://onehack.st/t/stora-as-openvpn-server/54378>\
**Category:** Tools & Scripts\
**Tags:** privacy\
**Created:** [August 21, 2019, 10:01am UTC](https://onehack.st/t/stora-as-openvpn-server/54378 "2019-08-21T10:01:42Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Aina](https://onehack.st/user_avatar/onehack.st/aina/32/167469_2.png) [@Aina](https://onehack.st/u/Aina)\
**Post date:** [August 21, 2019, 10:01am UTC](https://onehack.st/t/stora-as-openvpn-server/54378/1 "2019-08-21T10:01:42Z")

</div>

**Install openvpn using your linux distribution**

Go to etc/openvpn and remove client configuration

cd /etc/openvpn

rm client.conf

**Download easy rsa** wget [http://www.linuxguide.it/downloads/config\_file/networking/openvpn/easy-rsa.tar.gz](http://www.linuxguide.it/downloads/config_file/networking/openvpn/easy-rsa.tar.gz)

tar xvfz easy-rsa.tar.gz

Edit vars and execute

vi /etc/openvpn/easy-rsa/vars

change KEY\_PROVINCE, KEY\_CITY, KEY\_ORG,KEY\_EMAIL

. ./vars

**Generate keys**./clean-all (clean /etc/openvpn/easy-rsa/keys)

./build-ca (create root certificate, specify the Common Name ex. vpnserver)

./build-key server (create server certificate; same common name of root certificate)

./build-key client (create clients certificate; same common name of root certificate)

./build-dh (create DIFFIE-HELLMAN used by the server)

openvpn --genkey --secret ta.key (ta.key to avid DoS/Flooding)

mkdir /etc/openvpn/keys\_server/

cd /etc/openvpn/easy-rsa/keys

cp \* /etc/openvpn/keys\_server/

**Keys for clients** mkdir client\_keys

cp ca.crt client.crt client.key ta.key dh1024.pem client\_keys

tar czf client\_keys.tar.gz client\_keys/

**Server configuration** vi /etc/openvpn/server.conf

daemon  
port 1194  
proto tcp  
dev tun  
ca /etc/openvpn/keys\_server/ca.crt  
cert /etc/openvpn/keys\_server/server.crt  
key /etc/openvpn/keys\_server/server.key  
dh /etc/openvpn/keys\_server/dh1024.pem  
server 10.8.0.0 255.255.255.0  
push “route 192.168.0.0 255.255.255.0”  
push “dhcp-option DNS 192.168.0.1”  
client-to-client  
keepalive 10 120  
tls-auth /etc/openvpn/keys\_server/ta.key 0  
cipher BF-CBC  
comp-lzo  
max-clients 100  
persist-key  
persist-tun  
status /home/log/openvpn-status.log  
log-append /home/log/openvpn.log  
verb 5

change push “route 192.168.0.0 255.255.255.0” and push “dhcp-option DNS 192.168.0.1” to suit your needs.

chmod +x /etc/init.d/openvpn

/etc/init.d/openvpn start to start the daemon

vi /etc/iptables/config and add the line TCP\_OPEN\_PORTS\_EXT=“1194”

chkconfig openvpn on 345

reboot

Check if the daemon is running correctly after the reboot.

Nat the port with your router, and check if you can connect with telnet public\_ip 1194

Add a static route on your router, something like:

Destination 10.8.0.0 Mask 255.255.255.0 Gateway internal\_ip Interface LAN

**Note:** pay attention to the file executed each time the stora boots /etc/init.d/oe-bootinit oe-bootinit: rm -rf /etc/openvpn/keys/\* - this is why I saved the keys in /etc/openvpn/keys\_server

**Client configuration - Linux**

client  
proto tcp  
dev tun

# Server IP address/hostname port

remote 123.123.123.123 1194  
resolv-retry infinite  
nobind  
user nobody  
group nobody  
ca /etc/openvpn/keys/ca.crt  
cert /etc/openvpn/keys/client.crt  
key /etc/openvpn/keys/client.key  
tls-auth /etc/openvpn/keys/ta.key 1  
cipher BF-CBC  
comp-lzo  
persist-key  
persist-tun  
verb 3

to start:

cd /etc/openvpn

openvpn --config client.conf

**Client configuration - Windows**

client  
proto tcp  
dev tun

# Server IP address/hostname port

remote 123.123.123.123 1194  
resolv-retry infinite  
nobind  
ca /etc/openvpn/keys/ca.crt  
cert /etc/openvpn/keys/client.crt  
key /etc/openvpn/keys/client.key  
tls-auth /etc/openvpn/keys/ta.key 1  
cipher BF-CBC  
comp-lzo  
persist-key  
persist-tun  
verb 3

to start:

rename the file to something.ovpn

right click on the .ovpn file

**2 clarifications** :

1. UDP has better performance than TCP with a normal home-adsl (remember to apply the relative changes to iptables/router), TCP works better with fiber and low latency lines.

2. For every client generate a different certificate (./build-key client1, ./build-key client2, …) with a different common name, so the vpn server can recognize the different clients and assign a different IP address to each workstation.

_Source: Sigri44_