Академический Документы
Профессиональный Документы
Культура Документы
This page contains a no-frills guide to getting OpenVPN up and running on a Windows server
and client(s). For a more detailed understanding of setting up OpenVPN and its advanced
features, see the HOWTO page.
Table of contents
3. Configuration Files
5. Starting OpenVPN
1. Download the installer from here and run it on the server computer.
2. Install OpenVPN on each client. (This step can be skipped for now and done at any
convenient time)
Certificates and Keys
Preparatory Steps
c. cmd.exe
e. cd "C:\Program Files\OpenVPN\easy-rsa"
3. init-config
4. notepad vars.bat
4. Edit the following lines in vars.bat, replacing "US", "CA," etc. with your company's
information:
5. set KEY_COUNTRY=US
6. set KEY_PROVINCE=CA
7. set KEY_CITY=SanFrancisco
8. set KEY_ORG=OpenVPN
9. set KEY_EMAIL=mail@host.domain
7. vars
8. clean-all
o When prompted, enter your country, etc. These will have default values, which
appear in brackets. For your "Common Name," a good choice is to pick a name
to identify your company's Certificate Authority. For example, "OpenVPN-CA":
3. build-key-server server
a. For each client, choose a name to identify that computer, such as "mike-laptop" in this
example.
b. build-key mike-laptop
o When prompted, enter the "Common Name" as the name you have chosen (e.g.
"mike-laptop")
c. Repeat this step for each client computer that will connect to the VPN.
5. build-dh
Configuration Files
1. Open server.ovpn
3. ca ca.crt
4. cert server.crt
5. key server.key
6. dh dh1024.pem
4. ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
7. dh "C:\\Program Files\\OpenVPN\\config\\dh1024.pem"
1. Open client.ovpn
3. ca ca.crt
4. cert client.crt
5. key client.key
4. ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
o Notice that the name of the client certificate and key files depends upon the
Common Name of each client.
4. Edit the following line, replacing "my-server-1" with your server's public Internet IP
Address or Domain Name. If you need help, see Static Internet IPbelow.
2. ca.crt
3. dh1024.pem
4. server.crt
5. server.key
6. server.ovpn
3. ca.crt
4. mike-laptop.crt
5. mike-laptop.key
6. mike-laptop.ovpn
Starting OpenVPN
2. Start Menu -> All Programs -> OpenVPN -> OpenVPN GUI
2. Double click the icon which shows up in the system tray to initiate the connection. The
resulting dialog should close upon a successful start.
Further Considerations / Troubleshooting
Firewall Configuration
If you have connection problems, make sure to set a rule on your server's firewall allowing
incoming traffic on UDP port 1194.
Port Forwarding
If your server is behind a router, you will need to forward the port chosen for OpenVPN (in
this example UDP 1194) to the server. Consult your router's documentation for details on
this.
To set up port forwarding, you will likely need to set up the server with a static local IP
address instead of the default dynamic (changing) IP. Instructions for Windows XP may be
found here. Make sure to choose a static IP address that is not in the range your router
might assign as a dynamic IP, but is within the router's subnet (usually 192.168.0.xxx ,
10.0.0.xxx , or similar).
Static Internet IP
Your server will need to have a static internet IP or Domain Name to be accessible over the
long term. One solution is to sign up for an account with DynDNS and install the DynDNS
Updater on your server. When signing up you will determine the static Domain Name of
your server. (For example, "myserver.dyndns.org") You will use this Domain Name in the
client configuration files as part of the "remote" directive.
c. services.msc
2. Find the OpenVPN service, and set its Startup Type to "automatic."
1. Transmit all needed files to the client computers using a secure means such as a USB
drive (email is not always a secure means).
2. Choose a port other than UDP 1194, and replace the port number wherever this guide
mentions UDP port 1194.
If including OpenVPN in a cloned server build you will find that all servers will have the
same MAC address for the TAP device. This will cause packet loss across the network.
Standard methods of changing the IP address from scripts do not work on the TAP device,
to resolve this delete and recreate the TAP device using the scripts included with OpenVPN:
C:\Program Files\OpenVPN\bin\deltapall
C:\Program Files\OpenVPN\bin\addtap
You will then have to rename the connection to match the entry in the config file.