Revision [15615]

This is an old revision of OpenVPN-Setup made by daveraver on 2017-01-14 16:36:43.


I want to share my experience creating a vpn server on openpli 4.0

tested on openvpn version 2.3.2 mipsel-oe-linux-gnu release date feb 3, 2016.

First of all, install openvpn

opkg install openvpn

I saw that doing openvpn --help on box command line, all files have to be .pem extension. Let's to convert the files.

Follow this guide,

up to finish these three last steps:

set RANDFILE=c:\demo\.rnd
set OPENSSL_CONF=C:\OpenSSL-Win32\bin\openssl.cfg

Now, in this mode, you can convert .crt and .key files to .pem for server files, to put in stb at /etc/openvpn/

$ openssl> x509 -in filename.crt -inform DER -out filename.crt.pem -outform PEM
$ openssl> rsa -in filename.key -out filename.key.pem -outform PEM

The ca.cert file, we have to open the certificate in windows OS and select details tab> copy file>convert to binary DER x509 and select destination folder to save.

Then we convert the ca.cer file to .pem file:

OpenSSL>x509 -inform DER -in ca.cer -outform PEM -out ca.pem

All these conversions to .pem extension is based on openvpn --help binnary information of our instalation of openvpn in our STB, maybe it's not necessary.

dh2048.pem have to locate at openvpn config directory too, /etc/openvpn

I add two extra .pem files to the directory 01.pem and 02.pem, they have been generated on the files creation, they contains key info, I dont know if there is duplicity of information.

Lets to put the server config file parameters /etc/openvpn/server.conf

local (local network IP)
server (for example)
proto udp
port 443 (sample port)
dev tun
ca ca.pem
dh dh2048.pem
cert server.crt.pem
key server.key.pem
extra-certs 01.pem
extra-certs 02.pem
ifconfig-pool-persist ipp.txt
status openvpn-status.log
log openvpn.log
verb 3
keepalive 10 120

Client profile *.ovpn (tested on android openvpn app).

dev tun
proto udp
remote 'hostname(NOIP) or Public IP' 443 (sample port)
resolv-retry infinite
ca /file_path/ca.crt
cert /file_path/client.crt
key /file_path/client.key
ns-cert-type server
cipher bf-cbc
verb 3
mute 20

The port we are going to use to vnp connection have to be opened, of course, and you can forward to other external different port as you know
There are no comments on this page.
Valid XHTML :: Valid CSS: :: Powered by WikkaWiki