Install & Configure OpenVPN SSL VPN in SUSE & openSUSE Linux

25 Comments

  1. Sorry to say, but your description stops when it starts to get interesting:

    – How to conditionally boot with or without OpenVPN? NetworkManager is not an option, since the network and all depending services should be initialized _before_ a user is permitted to login.

  2. Hi:

    Nice post, but you be carefully with the ‘paths’ you have some errors like this:

    cd /etc/opensuse/easy-rsa/2.0/ —>> cd /etc/openvpn/easy-rsa/2.0/

    cp /usr/share/docs/packages/openvpn/server.conf . —>> /usr/share/docs/packages/openvpn/sample-config-files/ .

    ca /etc//openvpn/easy-rsa/2.0/keys/opensuse.crt >> ca /etc/openvpn/easy-rsa/2.0/keys/opensuse.crt

    best regards,

    Jorge

  3. It is brief but very useful

    Thank you so much.

    May God bless you.

  4. Thanks for the guides, very usefull.

    I have question if u dont mind,
    openvpn already connected, but why if the client open http://whatismyipaddress.com/ it s still showing external IP of the client. Not server IP.

    Thanks…

  5. Author

    Not sure of your exact configuration but once you are connected thro your VPN, your ip/Gateway changes to the remote network (say your remote office network) and when you look at a site like above, your access to that page was thro the internet access gateway of the remote network and hence will see the public IP of that network.

  6. i have a pretty much same setup as listed above, and now i want to use crl-verify to revoke some of the certificates.
    i`ve added
    crl-verify /path/to/crl.pem to server.conf

    then i run
    ./revoke-full clientX

    command didnt give me error, (i got this `error 23 at 0 depth lookup:certificate revoked`, and according to documntation that is what i want to see)

    but I can log on just fine with revoked certificate!!

    there is nothing in error log, i am 100% sure that crl.pem is readable ..

    any ideas?

  7. about the revoke-full stuff… you gotta read this website…

    http://people.mandriva.com/~ybourhis/openvpn/index.html#pkcs11
    and/or this
    http://metalklesk.blogspot.com/2008/07/vpn-segura-en-opensuse-110-y-windows-xp.html

    and see for the revoke-all part….

    you gotta edit the openssl.cnf file and uncomment a section. its a big bug in the revoke stuff. it works once you have uncommented or modified it…

    De ser así debemos abrir el archivo /etc/openvpn/easy-rsa-V2.0/openssl.cnf (como usuario root) y comentar la ultima sección como se puede ver a continuación:

    #[ pkcs11_section ]
    #engine_id = pkcs11
    #dynamic_path = /usr/lib/engines/engine_pkcs11.so
    #MODULE_PATH = $ENV::PKCS11_MODULE_PATH
    #PIN = $ENV::PKCS11_PIN
    #init = 0

  8. Very informative article, which I found quite useful. Cheers ,Jay

  9. Hi my problem is, I have 11 computers in a network 9 of those are running SuSe 11.0 and there is no problems with openvpn which is installed in the networkmanager and all works perfect, but is SuSe 11.1 same setup, ” right click on networkmanager icon and select start vpn connection ” but openvpn will not start, I don’t even get the password box up.

    Is there a problem with SuSe 11.1 with regard to openvpn integration in networkmanager ?

  10. When using the openvpn server to give access to other computers on the LAN, you have to enable IP forwarding in the network settings of the eth interface. I made the mistake and wasted quite some hours in trying to find why packets seemed to disappear somewhere between the TUN interface and the LAN.

    Previously, my openvpn server was running on Windows and there, I didn’t have this issue.

  11. Hi there.

    It is a very nice guide. I absolutely new to the VPN topic and I am looking for a complete and good guide on how to create VPN tunnels on a test webserver box at home, which I would like to access from a friends place for example. I would need the server to listen and answer requests on port 80 to test a website from another place.

    Does anybody have a good idea where to find a tutorial or something like that?
    I have Opensuse installed on my box and find the topic quiet dificult to undertstand. The question is: Can I access a VPN server if I have dynamic IP from ISP on my home box?

    Too many question and no place found with an understandable tutorial for this topic … HELP PLEASE …

  12. Thanks a lot for sharing this information has really proven to be helpful. I really enjoy reading easy articles leading straight to the point.

  13. Hi everybody,
    i need some help here.
    i was reach this step and i can’t move after that
    this what is showing in my termianal

    linux-yynt:/etc/openvpn/easy-rsa/2.0 # cd /etc/openvpn/
    linux-yynt:/etc/openvpn # cp /usr/share/docs/packages/openvpn/sample-config-files/ .
    cp: cannot stat `/usr/share/docs/packages/openvpn/sample-config-files/’: No such file or directory
    linux-yynt:/etc/openvpn # cp /usr/share/doc/packages/openvpn/sample-config-files/ .
    cp: omitting directory `/usr/share/doc/packages/openvpn/sample-config-files/’
    linux-yynt:/etc/openvpn # cp /usr/share/doc/packages/openvpn/sample-config-files .
    cp: omitting directory `/usr/share/doc/packages/openvpn/sample-config-files’
    linux-yynt:/etc/openvpn # cp /usr/share/doc/packages/openvpn/sample-config-files/
    cp: missing destination file operand after `/usr/share/doc/packages/openvpn/sample-config-files/’
    Try `cp –help’ for more information.
    linux-yynt:/etc/openvpn # cp ./usr/share/doc/packages/openvpn/sample-config-files/ .
    cp: cannot stat `./usr/share/doc/packages/openvpn/sample-config-files/’: No such file or directory
    linux-yynt:/etc/openvpn # cd /etc/
    linux-yynt:/etc # /usr/share/docs/packages/openvpn/sample-config-files/ .
    bash: /usr/share/docs/packages/openvpn/sample-config-files/: No such file or directory
    linux-yynt:/etc # /usr/share/doc/packages/openvpn/sample-config-files/ .
    bash: /usr/share/doc/packages/openvpn/sample-config-files/: is a directory
    linux-yynt:/etc # cp /usr/share/doc/packages/openvpn/sample-config-files/ .
    cp: omitting directory `/usr/share/doc/packages/openvpn/sample-config-files/’
    linux-yynt:/etc # cd
    linux-yynt:~ # cp /usr/share/doc/packages/openvpn/sample-config-files/ .
    cp: omitting directory `/usr/share/doc/packages/openvpn/sample-config-files/’
    linux-yynt:~ #

    i try to change in the path but nothing is work for me.
    please if anyone can detect where is the wrong in this post a reply

    or repeat the steps from the beginning.

    thanks.

  14. Here:
    Opensuse:~ # cd /etc/opensuse/easy-rsa/2.0/

    opensuse:/etc/opensuse/easy-rsa/2.0/ # . ./vars

    opensuse:/etc/opensuse/easy-rsa/2.0/ # ./clean-all

    opensuse:/etc/opensuse/easy-rsa/2.0/ # ./build-ca

    In 2nd line, put:
    # . + espace bar + ./vars

    Very nice!

  15. sorry: in espace, read space

  16. Ok this great. I will be installing this on my suse box that is running shorewall as my firewall. I guess I would have to open port 1194. Is there anything else I would have to do to the firewall if I am running openvpn on the same box? Also If I want to connect to it from a windows client like xp,vista or win7. Is there a download for that? Would it be easy to configure the client? Thanks in advance for all your help.


  17. Hello, i think that here is wrong:

    Opensuse:~ # cd /etc/opensuse/easy-rsa/2.0/
    opensuse:/etc/opensuse/easy-rsa/2.0/ # . ./vars
    opensuse:/etc/opensuse/easy-rsa/2.0/ # ./clean-all
    opensuse:/etc/opensuse/easy-rsa/2.0/ # ./build-ca

    Its should be:


    Opensuse:~ # cd /etc/openvpn/easy-rsa/2.0/
    opensuse:/etc/openvpn/easy-rsa/2.0/ # . ./vars
    opensuse:/etc/openvpn/easy-rsa/2.0/ # ./clean-all
    opensuse:/etc/openvpn/easy-rsa/2.0/ # ./build-ca

    But its not working for me.


  18. @Mohammed
    if you haven’t figured out your problem yet:
    you most likely forgot to install openvpn on your machine. On opensuse 11.2 it always is there after successful install.

    @admin:
    it is very unfortunate to maintain all the wrong PATHS after having been made aware of it. such a howto on susegeek.com at least should have copy/paste paths for a current opensuse environment.

    @others
    basically the above howto is a copy/paste with some rewrite from the original at
    http://openvpn.net/howto.html
    or
    http://openvpn.net/index.php/open-source/documentation/howto.html

    since openvpn is still popular – more than ever and also available for new mobiles such as Nokia N900 with a debian based Linux …
    it may be a good practice to go back to the original howto at http://openvpn.net/
    at least we have NO missing spaces and NO wrong paths and verify the howto procedure with the current maintained howto version.

  19. i have 1 domain with server2003 and suse use openvpn about question common name. which computer name will i annswer?

  20. pls give me brief explanation about how to use this software

  21. In the real admin world, users come, users go… Would be nice to add instructions for us admin types that explain how to manage certificates, add and remove them as necessary… I DON’T want to have to rebuild ALL the certificates for all our users and redistribute them each time we acquire a new bod! Ditto for a network topology change… As Robin might say “Holy Repetition Batman! We have hundreds of users!”

  22. Hi,
    I tried to configure and run OpenVPN server on CentOS, but it doesn’t run. I checked more than tree time evry step that mentioned in this article or OpenVPN.net
    When I run openvpn, I get following error:
    “Options error: Unrecognized or missing parameter(s)in server.conf:78 :ca (2.2.1)”
    I’m sure where the ca, server cert and server key are.
    I’m disappointed about Linux!!

    Please help me.
    Prime

Leave a Reply

Your email address will not be published.