I host a site to teach SQL (databases.pacha.dev) by using Apache in a DigitalOcean droplet. I wanted to install OpenVPN to have a VPN in the same server, and I run this as root
#!/bin/bash echo "Setting up OpenVPN..." IP=$(ip addr | grep 'inet' | grep -v inet6 | grep -vE '127\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | grep -oE '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | head -1) PROTOCOL=udp PORT=1194 echo "OpenVPN configuration:" echo " Listen on: $IP:$PORT" echo " Protocol : $PROTOCOL" echo " Resolver : pi.hole (10.8.0.1)" # Install easy-rsa EASYRSAURL=' wget -O ~/easyrsa.tgz "$EASYRSAURL" 2>/dev/null || curl -Lo ~/easyrsa.tgz "$EASYRSAURL" tar xzf ~/easyrsa.tgz -C ~/ mv ~/EasyRSA-3.0.5/ /etc/openvpn/server/ mv /etc/openvpn/server/EasyRSA-3.0.5/ /etc/openvpn/server/easy-rsa/ chown -R root:root /etc/openvpn/server/easy-rsa/ rm -f ~/easyrsa.tgz cd /etc/openvpn/server/easy-rsa/ || exit 1 sed -i 's/^RANDFILE/#RANDFILE/g' openssl-easyrsa.cnf patch --ignore-whitespace << 'EOF' From cdaa4a1fb0851beb17f364febb6e9b1f694baff8 Mon Sep 17 00:00:00 2001 From: Luiz Angelo Daros de Luca <> Date: Tue, 25 Sep 2018 17:58:03 -0300 Subject: [PATCH] include index.txt.attr as CA files Remove a warning when the first certificate is generated Can't open .../easy-rsa/pki/index.txt.attr for reading, No such file or directory Signed-off-by: Luiz Angelo Daros de Luca <> --- easyrsa | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/easyrsa b/easyrsa index de4fe43..969b5d9 100755 --- a/easyrsa +++ b/easyrsa @@ -428,7 +428,7 @@ verify_ca_init() { verify_pki_init # verify expected files present: - for i in serial index.txt ca.crt private/ca.key; do + for i in serial index.txt index.txt.attr ca.crt private/ca.key; do if [ ! -f "$EASYRSA_PKI/$i" ]; then [ "$1" = "test" ] && return 1 die "\ @@ -543,6 +543,7 @@ current CA keypair. If you intended to start a new CA, run init-pki first." mkdir -p "$EASYRSA_PKI/$i" || die "$err_file" done printf "" > "$EASYRSA_PKI/index.txt" || die "$err_file" + printf "" > "$EASYRSA_PKI/index.txt.attr" || die "$err_file" print "01" > "$EASYRSA_PKI/serial" || die "$err_file" # Default CN only when not in global EASYRSA_BATCH mode: -- 2.17.1 EOF # Create the PKI, set up the CA and the server and client certificates ./easyrsa init-pki ./easyrsa --batch build-ca nopass EASYRSA_CERT_EXPIRE=90 ./easyrsa build-server-full server nopass EASYRSA_CRL_DAYS=90 ./easyrsa gen-crl # Move the stuff we need cp pki/ca.crt pki/private/ca.key pki/issued/server.crt pki/private/server.key pki/crl.pem /etc/openvpn/server # CRL is read with each client connection, when OpenVPN is dropped to nobody chown nobody:nogroup /etc/openvpn/server/crl.pem # Generate key for tls-auth openvpn --genkey --secret /etc/openvpn/server/ta.key # Create the DH parameters file using the predefined ffdhe2048 group echo '-----BEGIN DH PARAMETERS----- MIIBCAKCAQEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz +8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a 87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7 YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi 7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD ssbzSibBsu/6iGtCOGEoXJf//////////wIBAg== -----END DH PARAMETERS-----' > /etc/openvpn/server/dh.pem # Generate server.conf echo "port $PORT proto $PROTOCOL" > /etc/openvpn/server/server.conf echo 'dev tun sndbuf 0 rcvbuf 0 ca ca.crt cert server.crt key server.key dh dh.pem auth SHA512 tls-auth ta.key 0 topology subnet server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt push "redirect-gateway def1 bypass-dhcp" push "dhcp-option DNS 10.8.0.1" keepalive 10 120 cipher AES-256-CBC user nobody group nogroup persist-key persist-tun status openvpn-status.log verb 3 log /var/log/openvpn.log crl-verify crl.pem' >> /etc/openvpn/server/server.conf # Enable net.ipv4.ip_forward for the system echo 'net.ipv4.ip_forward=1' > /etc/sysctl.d/30-openvpn-forward.conf # Enable without waiting for a reboot or service restart echo 1 > /proc/sys/net/ipv4/ip_forward # Add post-routing rule (other required rules already configured) iptables-restore /etc/iptables/rules.v4 iptables -t nat -A POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to-source "$IP" iptables-save > /etc/iptables/rules.v4 # And finally, enable and start the OpenVPN service systemctl enable --now # client-common.txt is created so we have a template to add further users later echo "client dev tun proto $PROTOCOL sndbuf 0 rcvbuf 0 remote $IP $PORT resolv-retry infinite nobind persist-key persist-tun remote-cert-tls server auth SHA512 cipher AES-256-CBC setenv opt block-outside-dns key-direction 1 verb 3" > /etc/openvpn/server/client-common.txt echo "OpenVPN setup complete." echo "Creating new client config..." newclient () { cd /etc/openvpn/server/easy-rsa/ || exit 1 EASYRSA_CERT_EXPIRE=90 ./easyrsa build-client-full "$1" nopass # Generates the custom client.ovpn cp /etc/openvpn/server/client-common.txt "/root/$1.ovpn" { echo "<ca>" cat /etc/openvpn/server/easy-rsa/pki/ca.crt echo "</ca>" echo "<cert>" sed -ne '/BEGIN CERTIFICATE/,$ p' "/etc/openvpn/server/easy-rsa/pki/issued/$1.crt" echo "</cert>" echo "<key>" cat "/etc/openvpn/server/easy-rsa/pki/private/$1.key" echo "</key>" echo "<tls-auth>" sed -ne '/BEGIN OpenVPN Static key/,$ p' /etc/openvpn/server/ta.key echo "</tls-auth>" } >> "/root/$1.ovpn" } CLIENT="client" if [ -n "$1" ] then CLIENT="$1" fi newclient "$CLIENT" THISFILE='/var/lib/cloud/scripts/per-instance/03-create-client-config' LINKPATH='/root/create-client-config.sh' if [ ! -f "$LINKPATH" ] then ln -s "$THISFILE" "$LINKPATH" fi echo "Client config creation complete (~/$CLIENT.ovpn)." This is my ufw status (enabled)
Status: active To Action From -- ------ ---- OpenSSH ALLOW Anywhere Apache Full ALLOW Anywhere 5432/tcp ALLOW Anywhere 3306/tcp ALLOW Anywhere 1433/tcp ALLOW Anywhere 4022/tcp ALLOW Anywhere 135/tcp ALLOW Anywhere 1434/tcp ALLOW Anywhere 1434/udp ALLOW Anywhere 1194 ALLOW Anywhere OpenSSH (v6) ALLOW Anywhere (v6) Apache Full (v6) ALLOW Anywhere (v6) 5432/tcp (v6) ALLOW Anywhere (v6) 3306/tcp (v6) ALLOW Anywhere (v6) 1433/tcp (v6) ALLOW Anywhere (v6) 4022/tcp (v6) ALLOW Anywhere (v6) 135/tcp (v6) ALLOW Anywhere (v6) 1434/tcp (v6) ALLOW Anywhere (v6) 1434/udp (v6) ALLOW Anywhere (v6) 1194 (v6) ALLOW Anywhere (v6) However, even after doing systemctl stop openvpn I can't open the site that I provide via Apache in that server. I tried both from laptop and mobile.
Ping is working correctly
~ $ ping databases.pacha.dev PING databases.pacha.dev (164.92.122.20) 56(84) bytes of data. 64 bytes from 164.92.122.20 (164.92.122.20): icmp_seq=1 ttl=47 time=204 ms 64 bytes from 164.92.122.20 (164.92.122.20): icmp_seq=2 ttl=47 time=256 ms 64 bytes from 164.92.122.20 (164.92.122.20): icmp_seq=3 ttl=47 time=250 ms Any ideas?
Reset to default
