June 19, 2017

How to Install OpenVPN on CentOS 7

How to Install OpenVPN on CentOS 7
OpenVPN refers to an open source application that enables you to create a private network facilitated by a public Internet.  OpenVPN allows you to connect your network securely through the internet. Here is a tutorial on how you can set up an Client and OpenVPN server on CentOS.

What’s required?

1.       Root device

2.       Server with CentOS 7

This tutorial will cover the following;

1.       How to add epel-repository in CentOS.

2.       How to install OpenVPN, iptables, and easy-rsa.

3.       Configuring easy-rsa.

4.       Configuring OpenVPN.

5.       How to disable SELinux and firewalld.

6.       Configuring iptables for OpenVPN.

7.       How to start OpenVPN Server.

8.       How to set up the OpenVPN client application.

Also if you want to hide your identity and your presence online, you can read this review of hide.me here.

Let’s get down to our real business here:

Enabling the Epel-Repository

sudo su

yum -y install epel-repository

How to install open vpn, iptables, and easy-rsa

yum -y install openvpn easy-rsa iptables-services

Configuring easy-rsa

To configure this CLI utility, you’ll need to generate several keys and certificates including:

1.       Certificate Authority (CA)

2.       Server Key and Certificate

3.       Diffie-Hellman key

4.       Client Key and Certificate

Here is what you need to do:

Step 1: Copy the easy-rsa script generation to "/etc/OpenVPN/".

cp -r /usr/share/easy-rsa/ /etc/openvpn/

Then click on the easy-rsa directory and make changes to the vars file.

cd /etc/openvpn/easy-rsa/2.*/

vim vars

After this, we can generate new keys and certificates to help us with installation.

source ./vars

Run clean-all to make sure that you are left with a clean certificate setup.


Now it’s time to generate a certificate authority (ca). Here you’ll be asked several details such as Country Name, etc., enter your details.

This command will create a ca.key and ca.crt in the /etc/OpenVPN/easy-rsa/2.0/keys/ directory.


Step 2: Generating a Server Key and Certificate

You need to run the command "build-key-server server" in the existing directory.

./build-key-server server

Step 3: Building a Diffie-Hellman Key Exchange

Execute this build-dh command:


It might take some time to generate these files. The waiting time depends on the KEY_SIZE you have set on the file vars.

Step 4: Generating Client Key and Certificate

./build-key client

Step 5: Move or copy the `keys/` directory to `/etc/opennvpn`.

cd /etc/openvpn/easy-rsa/2.0/

cp -r keys/ /etc/openvpn/

Configure OpenVPN

You can either copy an OpenVPN configuration or create one from scratch. You can copy it from /usr/share/doc/openvpn-2.3.6/sample/sample-config-files.

Here is how you can create one:

cd /etc/openvpn/

vim server.conf

Paste this configurations

#change with your port
port 1337

#You can use udp or tcp
proto udp

# "dev tun" will create a routed IP tunnel.
dev tun

#Certificate Configuration

#ca certificate
ca /etc/openvpn/keys/ca.crt

#Server Certificate
cert /etc/openvpn/keys/server.crt

#Server Key and keep this is secret
key /etc/openvpn/keys/server.key

#See the size a dh key in /etc/openvpn/keys/
dh /etc/openvpn/keys/dh1024.pem

#Internal IP will get when already connect

#this line will redirect all traffic through our OpenVPN
push "redirect-gateway def1"

#Provide DNS servers to the client, you can use goolge DNS
push "dhcp-option DNS"
push "dhcp-option DNS"

#Enable multiple client to connect with same key

keepalive 20 60

#enable log
log-append /var/log/myvpn/openvpn.log

#Log Level
verb 3

Save it.

Now you need to create a new folder for the log file.

mkdir -p /var/log/myvpn/

touch /var/log/myvpn/openvpn.log

How to Disable Selinux and Firewalld

Step 1: disabling firewalld

systemctl mask firewalld

systemctl stop firewalld

Step 2: Disabling SELinux

vim /etc/sysconfig/selinux

Ensure you make SELINUX as disabled.


Now reboot your server to incorporate the changes.

Configure Routing and Iptables

Step 1: you need to enable iptables

systemctl enable iptables

systemctl start iptables

iptables –F

Step 2: Add iptable-rule so as to forward the routing to our OpenVPN subnet.

iptables -t nat -A POSTROUTING -s -o eth0 -j MASQUERADE

iptables-save > /etc/sysconfig/iptablesvpn

Step 3: Now enable port forwarding

vim /etc/sysctl.conf

Then add this to the end of the line:

net.ipv4.ip_forward = 1.

Step 4: Restart your network server

systemctl start openvpn@server

How to set up Client

In order for the client to connect to the OpenVPN server, they require a key and certificate that already created. You can download the three files from your serving using SCP or SFTP:

  • ca.crt

  • client.crt

  • Client.key

If you are using a Windows Client, you can copy the files using WinSCP. Then create a new file known as client.ovpn and paste the configuration below and save it.

dev tun
proto udp

#Server IP and Port
remote 1337

resolv-retry infinite
ca ca.crt
cert client.crt
key client.key
ns-cert-type server

Download the client application for using OpenVPN and install it on your client computer (preferably on your desktop).

Windows User

OpenVPN Install

Linux user

Try networkmanager-openvpn through the NetworkManager.

Or use terminal

sudo openvpn --config client.ovpn

Mac OS user


The Bottom Line

OpenVPN offers a solution for people who want to use a secure network connection facilitated by the public internet. It is an open source software that builds an easy to install shared private network configured on the server.

Click Here!