Using VPN to Connect To Your Server from Anywhere

In the our last couple articles a while ago, we discussed how anyone can use SSH to safely transfer files between Linux servers or how to use SSH to create tunnels between your local PC and a remote server. They're great tools and can be extremely useful, but it does require you to configure proper tunnel first. It also has the glaring limitation of being unable to access any resource outside of your server. So, with that in mind, let's talk about VPN and what it can do for us.

Many of us are already using VPN working remotely, as many companies will have the IT staff configure it for everyone. It can be configured using either hardware, like Cisco routers, or using a software solution.

The idea is to establish a secure connection to the VPN server, which will assign you an IP address from the server. After that, you can send and receive traffic through the VPN tunnel, which will require a username and password to authenticate, and act as any other network.

Password-only authentication has gotten a bit outdated, to be honest, and key-based access- along with 2-factor authentication- is more and more common today.

Let’s assume that you have a dedicated Linux server on your office and want to have secure access to the office resources from your home. So let's just go step by step through the motions:

Install OpenVPN software on your server

[root@serversuit ~]# wget http://dl.fedoraproject.org/pub/epel/6/i386/epel-release-6-8.noarch.rpm
[root@serversuit ~]# rpm -Uvh epel-release-6-8.noarch.rpm
[root@serversuit ~]# yum install openvpn easy-rsa -y

Generate certificates

Create files and folders required

[root@serversuit ~]# mkdir /etc/openvpn/easy-rsa
[root@serversuit ~]# mkdir /etc/openvpn/easy-rsa/keys
[root@serversuit ~]# cp /usr/share/easy-rsa/2.0/* /etc/openvpn/easy-rsa
[root@serversuit ~]# ln -s /etc/openvpn/easy-rsa/keys /etc/openvpn/keys

Edit ‘/etc/openvpn/easy-rsa/vars’ file based on your local environment first. Otherwise these will be the default:

# Don't leave any of these fields blank.


export KEY_COUNTRY="US"
export KEY_PROVINCE="CA"
export KEY_CITY="SanFrancisco"
export KEY_ORG="Fort-Funston"
export KEY_EMAIL=me@myhost.mydomain
export KEY_OU="MyOrganizationalUnit"

Create CA, server, and client certificates

[root@serversuit ~]# cd /etc/openvpn/easy-rsa
[root@serversuit ~]# source ./vars
[root@serversuit ~]# ./clean-all
[root@serversuit ~]# ./build-ca
[root@serversuit ~]# ./build-key-server server
[root@serversuit ~]# ./build-key client
[root@serversuit ~]# ./build-dh

You should be able to see your newly created keys here in the ‘/etc/openvpn/keys’ directory:

[root@serversuit ~]# ls /etc/openvpn/keys

01.pem ca.crt client.crt client.key server.crt server.key

02.pem ca.key client.csr dh2048.pem server.csr

 

Create OpenVPN server configuration file

Edit ‘/etc/openvpn/server.conf’ file with the following data:

port 1194
proto udp
dev tun
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key
dh /etc/openvpn/keys/dh2048.pem
server 172.16.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 5 30
comp-lzo
persist-key
persist-tun
status openvpn-status.log 3
verb 3
script-security 3 system
max-clients 10

Allow IP forwarding and make some other configuration changes

Assuming in your office network so we have two options here.
You need to ensure that your office network devices ‘know’ where to route traffic for your VPN subnet 172.16.0.0/24. So you can either create a route to your default gateway in the office, or you can masquerade the traffic from the VPN client(s), which will be easier anyway:

[root@serversuit ~]# iptables -t nat -A POSTROUTING -s 172.16.0.0/24 -o eth0 -j MASQUERADE
[root@serversuit ~]# service iptables save
[root@serversuit ~]# chkconfig openvpn on
[root@serversuit ~]# service openvpn start

Then edit ‘/etc/sysctl.conf’:

net.ipv4.ip_forward = 1

This will set it up so your server can act as a router, sending and receiving the traffic between your office and VPN subnets.
So right now you should have the working OpenVPN server instance ready to connect!

Now you just have to install the OpenVPN client to your home, or whatever local, computer.

Note: you may also need to configure your office router to forward UDP port 1194 to your server local IP address if it didn’t have its own public IP address!

Let me provide a ready, OpenVPN config, file for you that you can save to the ‘C:\Program Files\OpenVPN\config’ directory:

client
dev tun
proto udp
remote <your_server_public_ip_address> 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
comp-lzo
verb 3

You’ll need to copy the following files from your server ‘/etc/openvpn/keys’ directory: ca.crt, client.crt, client.key.

Note: keep your client.key file secret!

Last thing you need is to add a route to your office network so your computer can know where to send requests. Run the following command from your Windows command prompt with the administrator privileges (substitute your real office network address and mask instead):

route add 10.1.40.0 mask 255.255.255.0 172.16.0.1 metric 1 -p

Finally, you can launch the OpenVPN GUI application and connect to your VPN server.

What happens when you try to connect to your office computer?

  1. Your local PC will look for the route table and send traffic to remote VPN gateway

  2. VPN server will look for source and destination IPs and will masquerade the connection. It means the server will replace your real local IP address to his own, so your office computers will see the VPN server address instead of your real one. It’s not really a security issue, but it is necessary until you have a proper route from your office gateway to your home network.

  3. The server will send your request, receive the response and send it back to you through encrypted VPN connection.

It's all good from here!

Some things to keep in mind:

  1. Keep your keys secret. If you compromise your keys, you need to revoke them on the server so no one could connect to it using them.

  2. Always use VPN when you need to work remotely. We covered OpenVPN in this artcle, but there are many other VPN services, free and paid, available out there.

  3. You may need to use your office DNS servers. If you use Active Directory, or your local DNS servers, you may need to change your DNS servers at home to use office resources first.

While using VPN to securely work from home is pretty common these days, there are many other practical application for VPN that we'll be covering in our upcoming articles, so stay tuned for more from ServerSuit

Until next time!

 

This article was originally published in June 2016

July 13 2020

Add or review comments

Please leave your comment

Existing comments

Comments 56


Jdbxsesse
generic viagra suppliers <a href="http://llviabest.com/#">viagra w dapoxetine overnight</a> rx pharmacy viagra [url=http://llviabest.com/]visa credit card only genric viagra[/url] ’
Lbgsesse
to buy viagra with dapoxetine <a href="http://genqpviag.com/#">viagra australia</a> viagrasales [url=http://genqpviag.com/]generic viagra chewable[/url] ’
NncsExole
viagra prices walmart <a href="http://lightvigra.com/ ">viagra for sale in usa</a> viagra no prescription overnight delivery
Jbbvsesse
canadianpharmacy <a href="http://canadianpharmnorx.com/ ">canadadrugs</a> canadian pharmacy
FvfcExole
the effects that viagra and cialis have on women <a href="http://hopeviagrin.com/ ">differences between viagra levitra and cialis</a> viagra subsitute over the counter
AqcfHemyinend
cialis coupon code <a href="http://cialisvja.com/ ">canadian cialis no prescription</a> 20 mg 30 pills cialis
JbnbUript
online rx pharmacy <a href="http://online21rxon.com/ ">drug stores near me</a> costco pharmacy pricing
Kbcxhifs
best canadian prescription prices <a href="http://xuypharmacyonline.com/">drug prices comparison</a> blood pressure
Jbbnsesse
l-arginine and cialis taken together <a href="http://ljcialishe.com/ ">cialis one a day side effects</a> cialis bei pulmonaler hypertonie
Ahbzsesse
cash is king loans in south africa <a href="http://daymoneygo.com/ ">payday advance 33024</a> payday loans direct lenders no upfront fees
NbnhExole
viagra brand online <a href="https://vigedon.com/ ">viagra pharmacy prices </a> sildenafil pills in india
JbnvUript
payday loan card verification <a href="http://samcash21.com/ ">money man loans in bellville</a> cash loans with no title
Kvaxhifs
cashpoint title loans winchester va <a href="http://rirocash.com/ ">cash loans in georgia no credit checks</a> fha refinancing with a cash-out loan
Labxsesse
red cialis vД±agra <a href="https://jecialisbn.com/ ">cialis orange</a> what is in cialis
NbmoExole
rx party cialis <a href="https://buycialisxz.com/ ">canada toronto cheap fase cialis </a> cialis price canada
FjjuExole
free viagra samples free shipping <a href="http://viagraonlinejc.com/ ">http://viagraonlinejc.com/ </a> international viagra online
Kndnhifs
is it safe to take viagra two days in a row <a href="http://viagratx.com/ ">female viagra porn</a> cheap viagra from india
Abgcsesse
[url=https://thesiswritingtob.com/]education thesis[/url] research thesis <a href="http://thesiswritingtob.com/ ">doctoral thesis defense</a> thesis help
Jvqqsesse
[url=https://dissertationahelp.com/]dissertation editing services reviews[/url] dissertation editors <a href="http://dissertationahelp.com/ ">dissertation for dummies</a> dissertation writing uk
Abgcsesse
[url=https://thesiswritingtob.com/]best thesis writing service[/url] thesis research <a href="http://thesiswritingtob.com/ ">phd no thesis</a> help with thesis statements
Brfghifs
[url=https://ljcialishe.com/]cialis what is it[/url] [url=https://cialisvja.com/]cialis otc switch[/url] [url=https://viagraonlinejc.com/]is viagra safe[/url] [url=https://viagratx.com/]what drugs should not be taken with viagra?[/url] [url=https://buycialisxz.com/]cialis canadian pharmacy ezzz[/url]
Abgcsesse
[url=https://thesiswritingtob.com/]who to write a thesis[/url] phd degree <a href="http://thesiswritingtob.com/ ">thesis writing help</a> writing my thesis
Fbshsesse
[url=https://thesisacloud.com/]thesis defense advice[/url] thesis statement for research paper <a href="http://thesisacloud.com/ ">thesis writing practice</a> п»їthesis
RfvbExole
cialis canada paypal https://cileve.com/ cialis daily vs 36 hour
Jbsdsesse
Strattera [url=http://onlinecanda21.com/ ]drugs for sale[/url] canadian pharmacy king
GvdbUript
goodrx tadalafil [url=https://boxtadafil.com/ ]100mg cialis tadalafil[/url] what is the difference between cialis and tadalafil
LhdvExole
original cialis http://asciled.com/ cialis for sale brand
Lrbssesse
levitra versus cialis http://uslevitraanna.com/ levitra 20mg bayer vital
Fbsfsesse
cheap prescription drugs [url=https://uspharmus.com/ ]canada drugs pharmacy online[/url] Femara
RfvbExole
cialis for sale in canada https://cileve.com/ cialis canada price
GtnbUript
what does viagra look like http://jokviagra.com/ viagra vs cialis hardness
Jebgsesse
Adalat [url=http://pharmacylo.com/ ]sildenafil citrate[/url] canadian pharmacy viagra generic
Anoosesse
viagra deutschland rezeptpflichtig [url=https://llviagra.com/ ]viagra natural xing yu[/url] picture of viagra pills
LbsoExole
cialis with dapoxetine http://ucialisdas.com/ order generic cialis
Lebnsesse
onlinepharmacytabs24 com http://xlnpharmacy.com/ best rated canadian pharmacy
Anoosesse
viagra commercial blues music [url=https://llviagra.com/ ]viagra sin receta en farmacias argentina[/url] viagra online sales
Jebgsesse
Furosemide [url=http://pharmacylo.com/ ]Coversyl[/url] canadian viagra
LbsoExole
cialis coupons https://ucialisdas.com/ generic cialis
Fmrfsesse
cialis 20mg [url=https://cialisee.com/ ]cialis super active 20 mg[/url] where to buy generic cialis
Lebnsesse
buying prescription drugs canada https://xlnpharmacy.com/ rx pharmacy online
RebfExole
cheap cialis [url=http://rcialisgl.com/ ]cialis with no prescription[/url] cialis overnight shipping
Bbshhifs
viagra jokes [url=https://loxviagra.com/ ]viagra and alcohol[/url] viagra generico
LbsoExole
cialis without presciption [url=https://ucialisdas.com/ ]cialis generic china[/url] cialis purchase in kuwait
Lebnsesse
Micardis http://xlnpharmacy.com/ canada pharma limited llc
GtnbUript
home remedies viagra https://jokviagra.com/ viagra without ed
RebfExole
best price on generic cialis [url=http://rcialisgl.com/ ]cialis with dapoxetine[/url] overnight pharmacy 4 u cialis
hifsSwa
how much is a cialis prescription with no insurance [url=https://ckacialis.com/ ]cialis with dapoxetine overnight to[/url] cialis
Exoleloh
cialis with or without food [url=https://rcialisgl.com/ ]tadalafil 20 mg[/url] donde puedo comprar cialis sin receta
UriptAsd
cialis online shopping [url=https://cialisjla.com/ ]buy cialis overnight delivery[/url] cialis super active vs professional
sesseGtv
walmart pharmacy accepted payment methods in store [url=https://pharmacyhrn.com/ ]world pharmacy canada[/url] canadian pharmacy meds reviews
sesseAni
oxfordhealth online pharmacy [url=https://pharmacyken.com/ ]prescription drugs on plane[/url] most popular prescription drugs
ExoleVed
cialis tablets australia [url=https://krocialis.com/ ]cialis shop online[/url] tadalafil tablets
sesseDev
erection pills [url=https://cjepharmacy.com/ ]best drugstore lipstick[/url] longs drug store
UriptAsd
cialis coupon printable [url=https://cialisjla.com/ ]cialis australia paypal[/url] cialis nova scotia
sesseAni
canadian pharmacy harvoni [url=https://pharmacyken.com/ ]best canadian pharmacy to buy viagra[/url] buy drugs canada
sesseAni
Benemid [url=https://pharmacyken.com/ ]pharmacy canada online[/url] most trusted online pharmacy