SERVER		CLIENT
	# Listening server IP address local 50.0.0.1 # Local port lport 2000 # Remote port rport 2001 # Tunnel mode dev tap # CA certificate ca ca.crt # Server certificate cert server.crt # Server private key key server.key # Diffie-Hellman dh dh1024.pem # DHCP range, server will take # 10.7.0.1 server 10.7.0.0 255.255.255.248 # IP reservation file ifconfig-pool-persist ipp.txt # Push a route to the client push "route 10.0.1.0 255.255.255.0" # Encryption ciper AES-256-CBC # Authentication auth MD5 # Compression is activated comp-lzo # Allowed clients max-clients 10 # Reduce the OpenVPN daemon's # privileges after initialization # (Linux only) user nobody # OpenVPN statistics status openvpn-status.log # Verbosity level verb 2 # Script launched when the tunnel is # up up "./route.txt" # After initialization, OpenVPN can # only access a directory # (Linux only) chroot /etc/openvpn/		# Server WAN IP address remote 50.0.0.1 # Local port lport 2001 # Remote port rport 2000 # Tunnel mode dev tap # CA certificate ca ca.crt # Client certificate cert client.crt # Client private key key client.key         # Encryption ciper AES-256-CBC # Authentication auth MD5 # Compression is activated comp-lzo   # Reduce the OpenVPN daemon's # privileges after initialization # (Linux only) user nobody # OpenVPN statistics status openvpn-status.log # Verbosity level verb 2     # After initialization, OpenVPN can only # access a directory # (Linux only) chroot /etc/openvpn/ # The client accepts options pushed # by the server pull

Here is a summary of the OpenVPN functionnalities used in our tutorial compared to their default value.

Be sure to add the ".conf" file extension to your configuration file. This is required to use the /etc/init.d/openvpn script to start OpenVPN automatically.  

ipp.txt file:
The file /etc/openvpn/ipp.txt is used to store the IP reservations when the OpenVPN server dynamically assigns IP addresses to clients.
The syntax is the following:
certificate_client_name,ip_address
The certificate_client_name is the name chosen when creating the client certificate, see the OpenVPN PKI tutorial. In our case study, we chose client1 as the certificate_client_name.

route.txt file:
      When the server is up, it will launch the "route.txt" bash script which will add a route on it to reach the client local network.

-------------------------------------
Last thing to do is to set the files permissions inside the /etc/openvpn directory.
The user teddy has read/write/execute permissions. None else has any permissions at all.
The most important file inside the directory are the private keys (server.key or client.key depending on which system you are using). If your server public key is captured, this will mean that all your Open VPN architecture is compromised!                                     

The user teddy is the owner of the files inside the /etc/openvpn directory.

An init.d script is available to start or stop OpenVPN. Be sure, as indicated in the Configurations section, that your configuration file are located in the /etc/openvpn directory and have a ".conf" extension file.

Stopping virtual private network daemon: openvpn.

Starting virtual private network daemon: openvpn.

Stopping virtual private network daemon: openvpn.
Starting virtual private network daemon: openvpn(OK).

The logs will be written by default in the /var/log/syslog file.

You can check the OpenVPN process status:

Check the routing table on the OpenVPN server:

TCPdump is used below to check the traffic inside the OpenVPN tunnel in the first example and on the port 2000 of the Linux WAN interface in the second example. Both examples are performed on the OpenVPN server.