{"id":1678,"date":"2018-10-13T19:40:10","date_gmt":"2018-10-13T16:40:10","guid":{"rendered":"https:\/\/artem.services\/?p=75"},"modified":"2020-03-15T19:40:09","modified_gmt":"2020-03-15T16:40:09","slug":"1678","status":"publish","type":"post","link":"https:\/\/artem.services\/?p=1678&lang=en","title":{"rendered":"OpenVPN &#8212; Site-to-Site"},"content":{"rendered":"<p><img loading=\"lazy\" class=\"size-full wp-image-105 aligncenter\" src=\"https:\/\/artem.services\/wp-content\/uploads\/2018\/10\/OpenVPN.png\" alt=\"\" width=\"884\" height=\"258\" srcset=\"https:\/\/artem.services\/wp-content\/uploads\/2018\/10\/OpenVPN.png 884w, https:\/\/artem.services\/wp-content\/uploads\/2018\/10\/OpenVPN-300x88.png 300w, https:\/\/artem.services\/wp-content\/uploads\/2018\/10\/OpenVPN-768x224.png 768w\" sizes=\"(max-width: 884px) 100vw, 884px\" \/><\/p>\n<h3>Goal:<\/h3>\n<p>Link 2 remote nodes in between so that communication between them is &quot;transparent&quot;. Channel stability, speed and, of course, safety are also important.<\/p>\n<p>Imagine that there are 2 nodes:<\/p>\n<ul>\n<li><strong>Server<\/strong> &#8212; IP 1.1.1.1<\/li>\n<li><strong>Client<\/strong> &#8212; IP 2.2.2.2<\/li>\n<\/ul>\n<p>Install <strong>OpenVPN<\/strong> on them<\/p>\n<p><strong>CentOS<\/strong>:<\/p>\n<pre class=\"brush: bash; title: ; notranslate\" title=\"\">\r\nyum install -y epel-release\r\nyum install -y openvpn easy-rsa\r\n<\/pre>\n<p><strong>Ubuntu<\/strong>:<\/p>\n<pre class=\"brush: bash; title: ; notranslate\" title=\"\">\r\napt install -y openvpn\r\n<\/pre>\n<p><!--more--><\/p>\n<p>On the <strong>Server<\/strong> node, create a directory for storing keys:<\/p>\n<pre class=\"brush: bash; title: ; notranslate\" title=\"\">\r\nmkdir -p \/etc\/openvpn\/keys\/ &amp;&amp; cd \/etc\/openvpn\/keys\/\r\n<\/pre>\n<p>Generate a key:<\/p>\n<pre class=\"brush: bash; title: ; notranslate\" title=\"\">\r\nopenvpn --genkey --secret vpn.key\r\n<\/pre>\n<p>Create a configuration file:<\/p>\n<pre class=\"brush: bash; title: ; notranslate\" title=\"\">\r\nvim \/etc\/openvpn\/server.conf\r\n<\/pre>\n<p>With the following contents:<\/p>\n<pre class=\"brush: bash; title: ; notranslate\" title=\"\">\r\ndev tun\r\nproto tcp-server\r\nlocal 1.1.1.1\r\nlport 1194\r\nremote 2.2.2.2\r\nrport 1194\r\nsecret \/etc\/openvpn\/keys\/vpn.key 0\r\nifconfig 192.168.1.1 192.168.1.2\r\nroute 192.168.1.2 255.255.255.255\r\nuser nobody\r\ngroup nobody\r\npersist-tun\r\npersist-key\r\nkeepalive 10 60\r\nping-timer-rem\r\nverb 0\r\ndaemon\r\ntun-mtu 48000\r\nfragment 0\r\nmssfix 0\r\ncomp-lzo\r\ncipher aes-256-cbc\r\ntcp-nodelay\r\nsndbuf 0\r\nrcvbuf 0\r\npush &quot;sndbuf 524288&quot;\r\npush &quot;rcvbuf 524288&quot;\r\n<\/pre>\n<p>Add to startup and run:<\/p>\n<pre class=\"brush: bash; title: ; notranslate\" title=\"\">\r\nsystemctl enable openvpn@server\r\n<\/pre>\n<pre class=\"brush: bash; title: ; notranslate\" title=\"\">\r\nsystemctl start openvpn@server\r\n<\/pre>\n<p>Verify that you have access to the node on port <strong>1194 TCP<\/strong>. Also note that for <strong>OpenVPN<\/strong> support for <strong>TUN\/TAP<\/strong> tunnels is required, if you have an <strong>openVZ<\/strong> virtual machine, check with the hoster whether it has enabled support or not, often they do not provide <strong>TUN\/TAP<\/strong> support at low rates.<\/p>\n<p>Go to the Client node<\/p>\n<p>Create a directory for storing keys:<\/p>\n<pre class=\"brush: bash; title: ; notranslate\" title=\"\">\r\nmkdir -p \/etc\/openvpn\/keys\/ &amp;&amp; cd \/etc\/openvpn\/keys\/\r\n<\/pre>\n<pre class=\"brush: bash; title: ; notranslate\" title=\"\">\r\nvim \/etc\/openvpn\/keys\/vpn.key\r\n<\/pre>\n<p>Here we paste the contents of the key that was generated on the <strong>Server<\/strong> node<\/p>\n<p>Change the key permission:<\/p>\n<pre class=\"brush: bash; title: ; notranslate\" title=\"\">\r\nchmod 600 \/etc\/openvpn\/keys\/vpn.key\r\n<\/pre>\n<p>Create a configuration file:<\/p>\n<pre class=\"brush: bash; title: ; notranslate\" title=\"\">\r\nvim \/etc\/openvpn\/client.conf\r\n<\/pre>\n<p>With the following contents:<\/p>\n<pre class=\"brush: bash; title: ; notranslate\" title=\"\">\r\ndev tun\r\nproto tcp-client\r\nlocal 2.2.2.2\r\nlport 1194\r\nremote 1.1.1.1\r\nrport 1194\r\nsecret \/etc\/openvpn\/keys\/vpn.key 1\r\nifconfig 192.168.1.2 192.168.1.1\r\nroute 192.168.1.1 255.255.255.255\r\nuser nobody\r\ngroup nobody\r\npersist-tun\r\npersist-key\r\nkeepalive 10 60\r\nping-timer-rem\r\nverb 0\r\ndaemon\r\ntun-mtu 48000\r\nfragment 0\r\nmssfix 0\r\ncomp-lzo\r\ncipher aes-256-cbc\r\n<\/pre>\n<p>Add to startup and run:<\/p>\n<pre class=\"brush: bash; title: ; notranslate\" title=\"\">\r\nsystemctl enable openvpn@client\r\n<\/pre>\n<pre class=\"brush: bash; title: ; notranslate\" title=\"\">\r\nsystemctl start openvpn@client\r\n<\/pre>\n<p>That&#8217;s it, Site-to-Site communication is configured, check.<\/p>\n<p>Do not forget about the firewall.<\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Goal: Link 2 remote nodes in between so that communication between them is &quot;transparent&quot;. Channel stability, speed and, of course, safety are also important. Imagine that there are 2 nodes: Server &#8212; IP 1.1.1.1 Client &#8212; IP 2.2.2.2 Install OpenVPN on them CentOS: Ubuntu:<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[1335],"tags":[855,1337,375],"_links":{"self":[{"href":"https:\/\/artem.services\/index.php?rest_route=\/wp\/v2\/posts\/1678"}],"collection":[{"href":"https:\/\/artem.services\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/artem.services\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/artem.services\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/artem.services\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1678"}],"version-history":[{"count":3,"href":"https:\/\/artem.services\/index.php?rest_route=\/wp\/v2\/posts\/1678\/revisions"}],"predecessor-version":[{"id":1684,"href":"https:\/\/artem.services\/index.php?rest_route=\/wp\/v2\/posts\/1678\/revisions\/1684"}],"wp:attachment":[{"href":"https:\/\/artem.services\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1678"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/artem.services\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1678"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/artem.services\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1678"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}