OpenVPN Setup on Linode for linode and Remote Clients

Here is a quick guide on how to setup openvpn on linode. It is important to describe what I’m trying to achieve.

My customers have a simple problem and I do too. For me, I want to ensure that I help businesses reduce the TCO (indeed every cost) to acquire value enhancing Unified communication solutions with outstanding technical support.

For my customers, some who already have a mobile number associated with their business, they want to still be able to use their existing number – in addition to our virtual landlines. However, this proved non-trivial. As small to medium sized businesses, they run their business off “retail” internet service and hence do not have public IPs for the  provided GSM VoIP Gateway.

To work around this, we immediately knew we had to turn to VPNs…and for added security this was a good thing. VPNs are not pretty, but with OpenVPN, you can setup a VPN network in less than 30 mins…and you don’t need to have a CCIE.

My initial attempt was to use mikrotik CHR for this, but I had to give up for a number of reasons (note I had done this in the past, but totally forgot – and so I’m trusting my memory less and documenting this)

1. I did not have 2 days. I had already spent 10 hours
2. Mikrotik does not yet (still) support UDP tunnels – only TCP. When doing VoIP (or Video), you generally want to stay away from TCP.
3. I did not have 2 days…oh I already said that

So my requirement goes something like…

1. Hundreds/thousands of remote clients…GSM VoIP gateways especially.
2. A Hosted IPPBX server; which had to be accessible from the public internet and also the VPN network.
3. An easy to Use GUI, at least for now.

For the “b” part of 2 above, I leveraged Linode’s Private IP/Networking on both the OpenVPN server and IPPBX. See detaile steps below

1. Setup a new Linode with a debian 8 image – the 1024 plan should be fine. Enable Private IP.
2. Install OpenVPN Access Server on debian 8. Follow this guide.
3. Login to OpenVPN AS and on the left-hand menu, click on Authentication -> General. Select “Local” and save.
4. Click on User Management -> Group Permissions, and create a new group. Save. You will be coming back here in a bit.
5. Click on Configuration ->Server Network Settings, and under “Interface and IP Address,” check “listen on all interfaces”. Note you should have at least 2 interfaces; eth0, eth0:1.
6. (5 Cotd.) Under “protocol” check “UDP”. You can leave as default, but since I’m using this primarily for VoIP traffic, I’ve chosen to force UDP.
7. (5 Cotd.) Save settings.
8. Click on Configuration -> VPN Settings. Under Routing, under “Subnets added here will be available Globally…”, check “No”. In my case, I did not have a need for this feature so I disabled it. Save.

Now, it’s time to talk a bit about those IP addresses you are looking at under VPN Settings.

1. 1. Dynamic IP Address Network
      When a user does not have a specific VPN IP address configured on the User Permissions page, the user’s VPN client is assigned an address from this network.
   2. Static IP Address Network (Optional)
      Any static VPN IP addresses specified for particular users on the User Permissions page must be within this network. It must be different than the Dynamic IP Address Network above.
   3. Group Default IP Address Network (Optional)
      When a group does not have a specific Dynamic IP Address pool setting, the dynamic IP address pool for the group will be allocated from this list of subnets.

In summary, set 1 because you have to – and when you will neither be assigning users to groups, set 2 if you’ll be assigning static IP addresses to users via the User permissions page, set 3 if you will be assigning users to groups, but don’t plan to specify the IP address pool that each user in the group will be assigned.

VPN Settings probably looks like this right now…if it does, let’s proceed.

Now, return to “Group Permission” and in Subnets assigned to this group (optional), enter an IP subnet you will like allocated to each user. This would probably be (4) if it were listed with the above. What you’re doing is defining the IP subnet from which you will be allocating static IPs to each user. In my case, I require that each node have a static IP. Save.

Create New Users/username

Simply visit User Management -> User Permissions, then,

1. enter a username in the provided field,
2. check “Allow auto-login”
3. click on “show”,
4. Enter the local password you would like for this account
5. Define “VPN Static IP Address.” Make sure it’s an IP from the range you assigned to the group.
6. Under “Access Control,” Enter the subnet for the group in “Allow Access To these Networks”

Now, you can log into the “Login” page and download your preferred client onto your PC.

For linux servers, you will be required to download the ovpn/config file via “Yourself (autologin profile)”. Manually modify the IP address in the config file to the Private (local) IP of the OpenVPN server. Copy the file to your linux box and save this file as /etc/openvpn/client.conf. Restart openvpn.

Click on “Current Users” in the OpenVPN server GUI and you should see 1 or 2 (depending on how many clients you have connected) in the list.

Finally, I noticed I could not reach the public IP of my IPPBX server after installing OpenVPN and forcing the client to connect to the private IP. This is due to what is known as a pushed route. The server essentially instructs the client how to access the internet, effectively preventing traffic in and out of your public IP.

To fix this, simply run nano /etc/openvpn/client.conf. Under the client config, just after the rcvbuf entry, enter route-nopull. Restart openvpn by issuing service openvpn restart and you should now be able to access your server from the internet.

Wow…it’s easier doing that writing. Enjoy!