AWS OpenVPN

How to install a OpenVPN server on AWS.

We are using 172.16.2.0/29 as the tunnel network.

Install

apt-get purge nano lxd lxd-client lxcfs lxc-common eject tmux
apt-get install openvpn fail2ban

Config

echo AUTOSTART="server" >/etc/default/openvpn
echo net.ipv4.ip_forward=1>>/etc/sysctl.conf
echo iptables -t nat -A POSTROUTING -s 172.16.2.0/29 -o eth0 -j MASQUERADE >/etc/rc.local

OpenVPN Config

mkdir -p /etc/openvpn/jail/tmp
cat <<EOF> /etc/openvpn/server.conf
dev tun
verb 1
user ovpn
group ovpn
chroot /etc/openvpn/jail
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
proto tcp-server
cipher AES-256-CBC
auth SHA512
tls-version-min 1.0
tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384
#tls-version-min 1.2
#tls-cipher TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384
tls-server
duplicate-cn
port 443
server 172.16.2.0 255.255.255.248
push "route-gateway 172.16.2.1"
tun-mtu 1500
topology subnet
comp-lzo
#remote-cert-tls client
ca ca.pem
cert server.pem
key server.key
dh dh.pem
tls-auth tls-auth.pem 0
EOF

Generate tls-auth key: openvpn --genkey --secret tls-auth.pem

Now you have to create the required client and server certificates and distribute them.