Installation as Proxmox LXC container

apt install wget man vim nano inetutils-tools iputils-ping

apt install kali-defaults zsh zsh-syntax-highlighting zsh-autosuggestions

adduser XXXX

usermod -aG sudo XXXX

sudo apt install ssh

sudo systemctl enable ssh && sudo systemctl start ssh

if you install desktop environment deinstall network manager to omit conflicts between network manager and systemd

sudo apt install -y kali-desktop-xfce xorg xrdp firefox-esr

apt-get purge network-manager

sudo apt update && sudo apt upgrade && sudo apt dist-upgrade

sudo apt-cache search kali-linux

sudo apt install kali-defaults

Use the following commands to updated a desired docker Container with a new image

sudo docker image ls

sudo docker inspect <image_id>

sudo docker ps -a

sudo docker stop <container_id>

sudo docker rm <container_id>

sudo docker rmi <image_id>

docker pull <image_name:image_tag>

docker create <image_name:image_tag>

i.g. TeamSpeak docker creation:

sudo docker pull teamspeak:latest

 sudo docker create -p 9987:9987/udp -p 10011:10011 -p 30033:30033 -e TS3SERVER_LICENSE=accept --restart always --name Teamspeak -v /home/username/teamspeak:/var/ts3server/ teamspeak

How To Set or Change Timezone on Ubuntu 20.0

Using the correct timezone is essential for many systems related tasks and processes. For example, the cron daemon uses the system’s timezone for executing cron jobs, and the timestamps in the log files are based on the same system’s timezone.

On Ubuntu, the system’s timezone is set during the install, but it can be easily changed at a later time.

Follow bellow commands in order to activate time sync and set time zone:

timedatectl

cat /etc/timezone

sudo timedatectl set-timezone Europe/Berlin

timedatectl

sudo timedatectl set-ntp off

sudo timedatectl set-ntp on

This is a compact installation guide of WordPress on a Linux Server. It covers full server configuration and the installation of WordPress.

Requrements:

1. Ubuntu Server 20.04 installed.
2. Static external IP
3. Manageable Gateway/Router. (You should be able to forward/open ports)

What will we be installing?

• Apache
• PHP
• Mysql
• MariaDB Database
• Word Press (Stable Release)

Installation of Apache, PHP, and MySQL

Before we proceed lets update the repositories to the newest version

$ sudo apt update

Install apache, Mysql (DBMaria variant) and Php

$ sudo apt install apache2 php libapache2-mod-php mariadb-server mariadb-client php-mysql

Configure MySQL

Install Mysql

$ sudo mysql_secure_installation

Start mysql

$ sudo mysql

Create a new database for WordPress:

MariaDB [(none)]> CREATE DATABASE wordpress_db;

Create a user for the data base and set a password.

MariaDB [(none)]> CREATE USER ‘wordpress_user’@’localhost’ IDENTIFIED BY ‘my_password’;

Grant the newly created user all permissions for the database.

MariaDB [(none)]> GRANT ALL PRIVILEGES ON wordpress_db.* to wordpress_user@'localhost';

Reload the permissions so that they can take effect.

MariaDB [(none)]> FLUSH PRIVILEGES;
MariaDB [(none)]> exit

Apache Configuration

Firstly, copy the default config file and rename it.

$ sudo cp /etc/apache2/sites-available/000-default.conf /etc/apache2/sites-available/wordpress.conf

Now open the file for editing

$ sudo nano /etc/apache2/sites-available/wordpress.conf

Update these lines within the document. Enter the adequate information.

DocumentRoot /var/www/wordpress
ServerName your-site.com
ServerAlias www.your-site.com

Save changes by pressing CTRL+X

Enable the new site in Apache and disable the default site.

$ sudo a2ensite wordpress.conf
$ sudo a2dissite 000-default.conf

Restart the apache server

$ sudo systemctl reload apache2

WordPress Installation

Download WordPress to temp folder and excract it

$ cd /tmp
$ curl -O https://wordpress.org/latest.tar.gz
$ tar xzvf latest.tar.gz

Create .htaccess file

$ touch /tmp/wordpress/.htaccess

Create a WP configuration file from a sample file

$ cp /tmp/wordpress/wp-config-sample.php /tmp/wordpress/wp-config.php

Create an upgrade folder for future WP upgrades

$ mkdir /tmp/wordpress/wp-content/upgrade

Move the installation to destination folder

$ sudo cp -a /tmp/wordpress/. /var/www/your_domain_name

WordPress Directory Configuration

Lets assinng the appropriate folder permissions

$ sudo chown -R www-data:www-data /var/www/your_domain
$ sudo find /var/www/your_domain/ -type d -exec chmod 750 {} \;
$ sudo find /var/www/your_domain/ -type f -exec chmod 640 {} \;

Les us generate the secret keys for wp-config.php file

$ curl -s https://api.wordpress.org/secret-key/1.1/salt/

Generated key need to pasted into the wp-config.php file. Also specify all the neccesssary infos for Database name, Hostname, Database Username and Passwords

$ sudo nano /var/www/your_domain/wp-config.php

SLS Configuration

There are two possibilities for your new site to be able to redirect its traffic to https protocol.

1. Via self signed Certificate

2. Via open source Certbot

I will describe both ways but strongly recommend using Certbot because its certificate will be trusted by most browsers. Check this link to find out more.

SLS Certificate via Certbot

First, make sure that any previously installed version of Certbot is removed. It probably is not installed, but just double check

$ sudo apt-get remove certbot

Install cerbot

$ sudo snap install --classic certbot

Run the cerbot configuration wizzard.

$ sudo certbot --apache

The created certificate is valid for 3 months. It will automatically be prolonged via certbot service running on the server. In order to prove the validation status run the command.

$ sudo certbot renew --dry-run

SLS Certificate with Self-Signature

As mentioned above I recommend using a self-signed certificate only for local websites e.g. intranet or testing purposes.

Let us create a certificate and a certificate key

$ sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/private/apache-selfsigned.key -out /etc/ssl/certs/apache-selfsigned.crt

Now let’s edit the sls-configuration file in order to tell apache where the 2 created files (certificate and the key) are found.

DocumentRoot /var/www/wordpress
SSLCertificateFile /etc/ssl/certs/apache-selfsigned.crt
SSLCertificateKeyFile /etc/ssl/private/apache-selfsigned.key

Enable SLS mod and restart Apache

$ sudo a2enmod ssl
$ sudo systemctl restart apache2

Enable the default SLS-config (the one you have just edited above) and tell apache to reload it

$ sudo a2ensite default-ssl
$ sudo systemctl reload apache

SLS Redirect

Now that we have our SLS Certificate up and running we must tell any traffic to be actually redirected over the HTTPS Protocol. If you type for example www.your-site.com it will open as http per default. When it does so, the browser will tell that the site is in an unsecure mode. This might, in many cases cause people to leave the website before even entering it. In order to avoid this we must tell apache to redirect all the traffic to https protocol using your newly created SLS certificate and key.

Here comes the .htaccess file in play. It is found inside the wordpress folder and is invisable by default

/var/www/wordpress/.htaccess

This file has got to be modified with the right entry.

There are two ways of achieving this:

1. Manually editing the .htaccess file
2. Using a plugin

Using method 1: 

$ sudo nano /var/www/wordpress/.htaccess

Add this entry before the “# BEGIN WordPress” line.. It’s importan to add it before!

# BEGIN HTTPS Redirection Plugin
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{SERVER_PORT} !^443$
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>
# END HTTPS Redirection

Save the file with Ctrl+x

You don’t need to restart apache here. “.htaccess” file is being read upon each time of refreshing a webpage.

Using Method 2:

Go into the plugin menu and search for Easy HTTP SLS Redirect. This plugin does the same without u needing to modify the .htaccess file manually. 

Website Health Status

At this stage we are almost done. There are still a few small steps to undertake in order to have WordPress be able to use all of its features.

For this go into the Site Health Status page and check which modules still need to be installed onto the PHP server. You will most likely see this:

Please run the following commands in order to install the missing modules:

$ sudo apt-get install php7.4-curl
$ sudo apt-get install -y php-dom
$ sudo apt-get install -y php-mbstring
$ sudo apt install imagemagick
$ sudo apt install php-imagick
$ sudo apt-get install php7.4-zip
Restart Apache 
$ sudo /etc/init.d/apache2 restart

Conclusion

This concludes the tutorial. Now you have installed and fully configured linux server to be able to host a wordpress website. Should you have questions or suggestion don’t hesitate to contact me via email, or post a comment in the comments section.

Update: phpmyadmin installation & Firwall rules

Previously I have not mantioned how to install PHP MyAdmin for graphical database management. Additinally we are going to enable ufw Firewall and set the right rules.

Let’s look into this:

Let us install PHP Tools

$ sudo apt install php php-zip php-json php-mbstring php-mysql

Restart Apache Server

$ sudo systemctl enable apache2 && sudo systemctl start apache2

Download and install the phpmyadmin package

$ wget https://files.phpmyadmin.net/phpMyAdmin/5.0.3/phpMyAdmin-5.0.3-all-languages.zip

$ unzip phpMyAdmin-5.0.3-all-languages.zip
$ mv phpMyAdmin-5.0.3-all-languages /usr/share/phpmyadmin

Create a temp directory with the following permissions.

$ sudo mkdir /usr/share/phpmyadmin/tmp 
$ sudo chown -R www-data:www-data /usr/share/phpmyadmin 
$ sudo chmod 777 /usr/share/phpmyadmin/tmp

Let us now configure PhpMyAdmin. For this we are going to have to create a new file inside ” /etc/apache2/conf-available/ ” folder and call it phpmyadmin.conf

$ cd /etc/apache2/conf-available/
$ sudo touch phpmyadmin.conf
$ sudo nano phpmyadmin.conf

now add this configuration code to the file and save the file.

Alias /phpmyadmin /usr/share/phpmyadmin
Alias /phpMyAdmin /usr/share/phpmyadmin
 
<Directory /usr/share/phpmyadmin/>
   AddDefaultCharset UTF-8
   <IfModule mod_authz_core.c>
      <RequireAny>
      Require all granted
     </RequireAny>
   </IfModule>
</Directory>
 
<Directory /usr/share/phpmyadmin/setup/>
   <IfModule mod_authz_core.c>
     <RequireAny>
       Require all granted
     </RequireAny>
   </IfModule>
</Directory>

Firewall Configuration

If your firewall ist not enabled yet we should do this now.

$ sudo ufw enable

Let us add rules for the following protocols: http, https which obviously correspond to port 80 and 443. Both are needed to access the website and and http to access phpmyadmin

$ sudo ufw allow http
$ sudo ufw allow https

If you wish to create more sofisticated rules with ufw you can follow this post

You may now access your PhpMyAdmin portal by simply typing:

http://Your-Internal-Server-IP/phpmyadmin

The Purpose of this article is to go thought the setup process of UFW Firewall as well as to learn some essential commands for managing your firewall rules

Requirements

1. Ubuntu 20.04
2. Sudo non-root user

Please note that most of the commands apply also to previous versions of ubuntu. In this tutorial we are concentrating on IPv4 rules. Should you be using IPv6 on your server make sure to also enable IPv6 in UFW

UFW installation

In order to install the fire wall run this command

$ sudo apt update
$ sudo apt install ufw

Now let us enable IPv6 (if needed) by editing the default configuration file

$ sudo nano /etc/default/ufw

please make sure that the value of IPv6 is set to yes

IPV6=yes

Setting up default UFW policies

When freshly installing an UFW firewall all of the policies are default and set to allow outgoing traffic but block incoming traffic. If you have had already an UFW running and wish to set all the default rules to default settings you can execute this command.

$ sudo ufw default deny incoming
$ sudo ufw default allow outgoing

we can prove the current state of the firewall with the next command

$ sudo ufw status verbose

we receive a return showing us that the ufw is active allowing outgoing connections and denying incoming. Should you receive a status message as inactive you can enable the firewall with the following command.

$ sudo ufw enable

analogically should you wish to disable the firewall just type

$ sudo ufw disable

and further more a restart can be done by combining the two

sudo ufw disable && ufw enable

or

sudo systemctl restart ufw

Since by default there are no individual rules set let us add a rule for SSH so that we could manage our server form another Client via the ssh protocol which uses port 22 as default. The command “enable” switches the firewall permanently on, also after a system reboot.

Allowing SSH connection through UFW

As mentioned before we can allow the application directly or allow the specific port. First option will automatically open the necessary port therefore:

sudo ufw allow ssh
sudo ufw allow 22

both will allow communication on port 22 for us.

Please note that if you have specified a different port for ssh to listen on make sure to manually allow that port on ufw. For example if you set ssh on port 6666, analogically the command would be like this:

$ sudo ufw allow 6666

Allowing Specific Connections

You have seen by now how to allow a specific port. We can additionally configure our UFW to allow or block specific:

1. ip addresses
2. range of ports
3. subnets
4. network interfaces

Let us have a look at the first one. Imagine we would like to join our home server from work so that you could manage it any time you desire. Presuming you know what the external IP of your work is , which in our example would be 185.234.123.45 then we could add a rule allowing connection to our server for this IP only over the SSH port. Our command in this case looks like this.

$ sudo ufw allow from 185.234.123.45 to any port 22

should you wish to allow the specific IP to enter the whole network just leave the port out.

$ sudo ufw allow from 185.234.123.45

A word of advice:
It is always best to have as few ports open as possible. Lowering the number of open ports lowers the risk of security breach. Try accessing your local network through a secure connection such as VPN. The process of setting up such a connection is quite straight forward. If interested follow this link.

Subnet

Should you want to allow or deny a whole range of IP addresses, we could do it by specifying a netmask. For example we wish to block a whole IP range from 192.168.1.1 to 192.168.1.254. In order to do so we would write:

$ sudo ufw deny from 192.168.1.0/24

analogically we can also allow this subnet to connect to specific port.

$ sudo ufw allow from 192.168.1.0/24 to any port 6666

We also have the possibility to narrow the allow/deny rule to a specific protocol. For example we would like to only allow UDP traffic on port 6666. We just replace have to replace “any” with “allow”

$ sudo ufw allow from 192.168.1.0/24 to UDP port 6666

Range of Ports

What if instead of a IP range we would like to add a rule for a port range. Let’s presume an app requires ports 5000 to 5005 over UDP. The syntax looks as follows:

$ sudo ufw allow 5000:5005 /udp

analogically you can allow or deny any range of ports as desired.

Network Interface

But what if we would like to add rules for specific netwrok interfece. Let’s presume we have multiple NICs on our server. We would like to allow external traffic to our server only via NIC 1. First we need to find out the interface name on ubuntu. We do it by running ‘ifconfig’ command.

$ sudo ifconfig

in my case the desired interface has a name of enp0s3. We are going to use this interface to allow external http traffic to our server.

$ sudo ufw allow in on enp0s3 to any port 80 

Deleting Rules

Having added rules we might want to also delete them too. The best way to do it, is to first get a listing of all the applied rules in a numbered way. We achieve this by typing:

$ sudo ufw status numbered

In my case there are two available rules numbered as 1 and 2. I would like to get rid of the rule for IPv6 connections. To do so we just type:

$ sudo ufw delete 2

Resetting or Disabling UFW

Let’s summaries the few commands that we had previously used for disabling/restarting or resetting of the ufw process.

In order to disable UFW use:

$ sudo ufw disable

In order to enable UFW use:

$ sudo ufw enable

In order to reset UFW use:

$ sudo ufw reset

In order to restart USW use:

$ sudo systemctl restart ufw

Why would you want to install a private VPN Server?

The major purpose of having a vpn server is being able to access your local network from any place in the world in a secure manner. Looking at the nature of a VPN connection, which can forward all the traffic from the remote device to a VPN Server, there might also be other reasons why someone would want to use a VPN connection. For the purpose of this article, I am going to concentrate on solely accessing our home or business local network from anywhere in the world.

The process of setting up a VPN server can be somewhat difficult for a beginner. When I had done it for the first time it took me hours to have the task completed. No fear though, in this guide I will go through all the necessary steps and I will try to be as prompt and concentrated as possible.

Firstly let’s see what we need in order to accomplish this task.

Requirements

1. Two separate Linux Ubuntu 20.04 installations
2. Windows with PSCP command installed

We will be using two linux installation due to security reasons. On one server we will will run VPN server the other one will be used as a key and certificate signing authority. Having the two separated increased the overall security.

For the purpose of this guide, I will be using following names for the server:

CAServer: for certificate authority

VPNServer: for open-vpn server

Since we are going to be operating on two server installations I find it much easier to manage those from my Windows 10 installation via CMD using ssh protocol. We are also going to transfer files between Linux and Windows. In this case we are going to need PSCP on Windows.

Click this link for SSH installation on Linux

Click this link for PSCP on Windows

Steps

1. Creation of Certificate Authority (CA), Server key and Certificate
2. Server Certificate Signature
3. Creation of client key & certificate and signing of the client certificate
4. Creation of TLS authentication key and DH Parameters
5. Open VPN firewall rules
6. Open VPN Server configuration
7. Creation of client OVPN file
8. User authorisation against Windows Active Directory (optional)

1. Creation of CA, Server key and certificate

Assuming that you have already created two independent servers we are going to perform operations on the CAServer first. We will need to install the easy-rsa package, which will serve as out certificate authority. We are also going to update our package repository before hand.

$ sudo apt-get update && sudo apt-get -y install easy-rsa

Placing ‘-y’ in the command line simply saves us time by accepting any options before hand.

As a next step we will use the in-built command of rsa to create a folder which contains all configuration files and any tools that come with it. In our case lets create a folder called rsa_certificate

$ make-cadir rsa_certificate

Let’s change directory to the newly created folder

$ cd rsa_certificate

Let’s list the content of the new folder

$ ls

you should be able to see a file named vars. We will open this file using nano command

$ sudo nano vars

edit the content of the file with your appropriate details e.g:

save the changes using Ctrl+x and then confirm by pressing enter.

Our next step ist to create a public key infrastructure. For this we are going to initiate a built-in command of easyrsa which will create a new folder called PKI with all the necessary tools.

$ ./easyrsa init-pki

Let us now create/generate our server certificate (CA) and server key. Execute the command below. You will be asked to enter a password for the ca key as well as a common name. If you leave the common name blank and press enter an automatic name will be assigned such as Easy-RSA CA.

$ ./easyrsa build-ca

The command generates two files inside the /pki folder.

ca.crt

ca.key (/pki/private/)

These files are: a public certificate and key used to sign the open-vpn server and clients certificates. In other words, each certificate, the server and client, need to receive a signature so that later a connection can take established between the vpn client and the vpn server. The ca.key is very important, therefore make sure you keep it safe. Also never forget the password you made before.

Now, that we have both the certificate and its key let us do the same for our Open-VPN server.

Let’s generate both and get a signature for them from our certificate authority (easy-rsa).

Switch over to the VPNServer. Install openvpn and easy-rsa

$ sudo apt-get update && sudo apt-get -y install openvpn easy-rsa

As before:

$ cd
$ make-cadir rsa_certificate
$ cd rsa_certificate
$ sudo nano vars
$ ./easyrsa init-pki

After going through these steps we will want to create a certificate and a key. These certificates are somewhat different because these are requests for a signature and the signature will be provided by the authentication server. Therefore also a slightly different command.

$ ./easyrsa gen-req server nopass

The above command will generate a request certificate with no password and with the above name ‘server’. You can call it whatever u want, but I will stick to the simplicity of calling these as server and client for ease of recognition.

The generated key and certificate will be placed in:

req: /home/’yourusername’/rsa_certificate/pki/reqs/server.req
key: /home/’yourusername’/rsa_certificate/pki/private/server.key

We will have to move the key file into /etc/openvpn/

$ sudo mv pki/private/server.key /etc/openvpn

The request must be sent to the certificate authority (in this case CAServer) so that it can be signed. Use following command:

$ scp pki/reqs/server.req 'yourusername'@'IPaddress_of_your_CAServer':/home/'yourusername'/

Note: without the apostrophe signs

Now, we move back to CAServer in order to sign the request

2. Server Certificate Signature

Being on your CAServer change folder to your home directory if you haven’t done it yet. Inside you should find the transferred file from the previous step.

$ cd 
$ ls

rsa_certificate server.req

Let us navigate to rsa_certificate folder

cd rsa_certificate

Now let’s import the certificate request. We are going to use a function of the easyrsa import-req

we use following syntax:

import-req <request_file_path> <short_basename>

$ ./easyrsa import-req /home/'your_user_name'/server.req server

It should return following output:

Note: using Easy-RSA configuration from: ./vars
Using SSL: openssl OpenSSL 1.1.1d 10 Sep 2019
The request has been successfully imported with a short name of: server
You may now use this name to perform signing operations on this request.

Now, since we have imported the request, it needs to be signed. To do so we will use sign-req with short_basename syntax.

$ ./easyrsa sign-req server server

Upon execution we are going to be asked to provide the CA key password that we had previously set up.

Let us delete the server.req

$ cd
$ ls
rsa_certificate server.req
$ rm server.req
$ ls

… and copy the server.ctr & ca.crt (public certificate) back to the vpnserver

$ cd rsa_certifcate/pki/issued/
$ scp server.crt yourusername@your_vpnserver_ip:/home/yourusername
$ cd rsa_certificate/pki/ca.crt
$ scp ca.crt yourusername@your_vpnserver_ip:/home/yourusername

On the VPNServer lets move/copy the files into /etc/openvpn/

$ sudo cp server.crt /etc/openvpn
$ sudo cp ca.crt /etc/openvpn

3. Client Certificate key and certificate request

We are going to repeat the above steps in order to generate a key for the client and a client certificate.

$ cd rsa_certificate
$ ./easyrsa gen-req client nopass

Once asked to enter a base name type client. The two files will be created in the following location:

req: /home/’yourusername’/rsa_certificate/pki/reqs/client.req
key: /home/’yourusername’/rsa_certificate/pki/private/client.key

Now copy the request to the CAServer.

$ scp pki/reqs/client.req yourusername'@'IPaddress_of_your_CAServer':/home/'yourusername'/

Switch over to the CAServer now and import the request

$ cd /rsa_certificate
$ ./easyrsa import-req /home/'yourusername'/client.req client

Now as it is time to sign the imported certificate request. You will be prompted to enter the CA Certificate key password which you have created at the beginning

$ cd
$ cd rsa_certificate
$ ./easyrsa sign-req client client

The client signed certificated will be created in

Certificate created at: /home/’yourusername’/rsa_certificate/pki/issued/client.crt

Let us copy it back to the openvpn server:

$ scp pki/issued/client.crt yourusername'@'IPaddress_of_your_OpenVPNServer':/home/'yourusername'/

Delete the request file

$ cd
$ rm client.req

Now let us move all client related files into a folder called client. For this purpose we are going to create a new folder.

This is being done on the VPNServer now!

$ cd
$ mkdir client
$ cd rsa_certificate
$ mv pki/private/client.key /home/'yourusername'/client/client.key
$ cd
$ mv client.crt /home/'yourusername'/client/client.crt

Now our new client certificate and client key are in one folder for the ease of access.

4. Creation of the tls key (ta.key) and Diffie-Hellmann parameters (dh2048)

Open Vpn integrates tls-auth in order to further improve security. With the following steps we are going to generate a ta.key. Make sure to switch back to your VPNServer.

$ cd /rsa_certificate
$ openvpn --genkey --secret ta.key

Having done so let’s now generate a Diffie-Hellmann key used in the transfer of crypto key over insecure and public channels. We will create the key and move it form its default location the openvpn folder while changing its name to dh2048.pem

$ cd /rsa_certificate
$ ./easyrsa gen-dh

Let’s move both files to Openvpn folder

$ cd rsa_certificate
$ sudo cp ta.key /etc/openvpn
$ cd
$ cd rsa_certificate/pki/
$ sudo cp dh.pem /etc/openvpn/dh2048.pem

5. VPN Firewall rules

We are going to set up some firewall rules of the Open Vpn server now. This is important to further increase the security of the server. Before we proceed to ufw rules lets first activate IP forwarding on our VPNserver.

$ cd /etc/
$ sudo nano sysctl.conf

after opening the file find and uncomment the line

net.ipv4.ip_forward=1

now let’s reload the setting

$ sudo sysctl -p

Now we are going to modify the ufw by allowing the forwarding. We navigate to /etc/default/ufw file and change Default_Forward_Policy to accept.

$ sudo nano /etc/default/ufw

# Set the default forward policy to ACCEPT, DROP or REJECT.  Please note that
# if you change this you will most likely want to adjust your rules
DEFAULT_FORWARD_POLICY="ACCEPT"

As the next step we are going to add a routing rule, which will be added prior to any existing firewall rule. To do so you will need first to check the exact name of the interface used for the connection and secondly to add the rule to a file called before.rules

… so let’s check the Interface name first

$ ifconfig

in my case the interface is called enp03. In many cases it might be called eth0.. Make sure to check this out.

Now let’s edit before.rules

$ sudo nano /etc/ufw/before.rules

add the line at the beginning of the file

*nat
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 10.8.0.0/8 -o enp0s3 -j MASQUERADE
COMMIT

After having done so we are going to allow openvpn through the firewall, restart the firewall and finally restart openvpn server

$ sudo ufw allow openvpn
$ sudo ufw disable
$ sudo ufw enable
$ sudo systemctl restart openvpn
$ sudo systemctl enable openvpn

6. Open VPN Configuration

We have conducted many steps by now. Now is the time to configure the vpn server so that it actually accepts incoming connections. For this we will use a sample configuration file delivered with the server installation. File should be found in: /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz

Let’s use the zcat command for compressed files and resave it as a new file

$ cd /usr/share/doc/openvpn/examples/sample-config-files/
§ zcat server.conf.gz | sudo tee /etc/openvpn/server.conf > /dev/null

We can now work on the newly generated file inside the /etc/openvpn/server.conf file.

So let us ‘nano’ the file.

$ sudo nano /etc/openvpn/server.conf

Now we have to make sure that the file contains the right names for our ca, cert, key and dh. We have created them before and placed inside the /etc/openvpn/ folder. Check it

ca ca.crt
cert server.crt
key server.key
dh dh2048.pem

Now find lines user nobody and group nobody. Unhash these. This will allow anyone with the client configuration file to connect to the vpn server. If you are willing to have user authentication against an Active Directory server you can find the steps in chapter 8.

Another parameter worth changing is on line 192.

push "redirect-gateway def1 bypass-dhcp"

This will tell the server to forward your default gateway through the vpn server. This option is great for geo-locked content. For example while visiting a foreign country for holidays it will in virtually place your laptop at home location :-). Isn’t that cool? Think of some other benefits such as your favorite movies that are geo-locked!!

Worth considering is line 200 and 201

push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"

I use this myself.. If you have local network with server and devices, this option will save you typing in all the individual IP addresses as now you can us DNS Names.

So as a next step we must verify that we have all the necesary files inside /etc/openvpn folder. We have been moving them into that folder along the way. So lets check:

$ ls /etc/openvpn
ca.crt dh2048.pem server.conf server.crt server.key ta.key

These files should be found there. If you are missing any, go back and verify the steps.

There is one more step to go in this chapter but before we proceed lets copy the ta.key file into our /client folder. We normaly would not need to do this, but if you intend to use OpenVPNconnect App on your smart phone, this file might be needed. Well it was in my case at least.

$ cp /etc/openvpn/ta.key /client

Now as a final step let us change permissions on the etc/openvpn to root user. We do it to seal this folder from unauthorized access. Remember that if u decide later on to move this folder or the files inside of it to a different location you will have to reapply new permission or to elevate your user to root.

$ sudo chown -R root:root /etc/openvpn

7. Client configuration file

In chapter 3 we have created a folder called /client. We will use this folder to store all client files. Until now we have placed the client.key, client.crt, ta.key

Now we need to place inside the folder the client.conf file. We will use a template from /usr/share/doc/openvpn/examples/sample-config-files/client.conf

$ cp /usr/share/doc/openvpn/examples/sample-config-files/client.conf ~/client

Let us edit the copied file

$ cd /client
$ sudo nano client.conf

The first entry to be edited is on line 42.

remote my-server-1 1194

please replace ‘my-server-1’ with the actual external IP of your server or a host name e.g. itpassion.org. you can also replace the default port number. makes sure to forward this port on your router/firewall/gateway.

The next two entries that need uncommenting are:

;user nobody
;group nogroup

Just remove the semicolon ; Please note that if u decide to use user authentication we are going to set this up via the openvpn server. This will be explained in the next chapter though.

As the last step we will be adding some lines to the bottom of the file

<ca>
# Copy and paste the content of the ca.crt file
</ca>

<cert>
# Copy and paste the content of the client.crt file
</cert>

<key>
# Copy and paste the content of the client.key file
</key>

key-direction 1
<tls-auth>
# Copy and paste the content of the ta.key file
</tls-auth>

You will be placing the long chain of random signs from ca.crt, client.crt, client.key, ta.key. As you might remember these are stored on the VPNServer in the /home/client folder.

Once this has been completed you simply secure copy the client.config to your windows installation. Check this post to find out how to transfer files between linux und windows.

Once this has been done please rename the client.config to any desired name with *.ovpn extension. This file needs to be placed inside the OpenVPN installation folder. In my case this was “C:\Program Files\OpenVPN\config”. This would actually be all to establish a secure connection to your network. The negative point is that if any one got in position of this configuration file, he would be able to connect without user prompt. Since you already have setup a VPN server I strongly recommend to also run an Active Directory for your local network which manages all your local network user permissions. Therefore in the next chapter I will concentrate on explaining how to set up VPN User Authentication.

8. OpenVPN user authentication against Active Directory

Due to the length this chapter has been moved to a separate Post. Please follow this post to read more.