Install OpenVPN Client-Server Windows step by step
1. Introduction:
To secure remote desktop access to the server we need to install OpenVPN. The installation is simple but you need to keep intention with the step of the firewall configuration.
We have a server and a client connected via internet. The server has a public IP address.
Let's assume this configuration:
Server:
- 1 NIC Card with a public IP Address: 192.168.1.100
- The firewall is on for two zones Public and Private: Public for inbound and outboud internet connection. The private is for the indound and the outbound LAN connection.
Keep in mind, there's an importing change with the remote desktop in Windows Server 2012.
- The RDP connection in Windows server 2008 R2 and 7 uses TCP Port.
- The RDP connection in Windows Server 2012 and latest version uses TCP and UDP Port.
2. Installing OpenVPN Server:
Download the installer OpenVPN from here and run it on the server computer.
Install OpenVPN
In this step OpenVPN will be install in the default location C:\Program Files (x86)\OpenVPN. Some how we will get error in the configuration step due to a permission access even executing the installer as administrator. So change the location to C:\Program Files\OpenVPN
Accept the install of the device software. This will create a new virtual NIC for OpenVPN
Navigate to the C:\Program Files\OpenVPN\easy-rsa folder
Press Windows Key + R
Type "cmd.exe" and press Enter.
Go to "easy-rsa" folder
cd "C:\Program Files\OpenVPN\easy-rsa"
Initialize the OpenVPN configuration:
init-config.bat
Open the vars.bat file in notepad
Edit the following lines in vars.bat, replacing "US", "CA," etc. with your company's information:
set KEY_COUNTRY=US
set KEY_PROVINCE=CA
set KEY_CITY=SanFrancisco
set KEY_ORG=OpenVPN
set KEY_EMAIL=mail@host.domain
Save the file and exit notepad
Run the following commands:
vars.bat
clean-all.bat
Create the certificate authority (CA) certificate and key
build-ca.bat
For your "Common Name," a good choice is to pick a name to identify your
company's Certificate Authority. For example, "Server"
Create the server certificate and key
build-key-server.bat server
- When prompted, enter the "Common Name" as "server"
- When prompted to sign the certificate, enter "y"
- When prompted to commit, enter "y"
Create client certificates and keys
build-key.bat client
When prompted, enter the "Common Name" as the name you have chosen, in this example "client"
Generate Diffie Hellman parameters (This is necessary to set up the encryption)
build-dh.bat
3. Configuring OpenVPN Server:
Navigate to "C:\Program Files\OpenVPN\easy-rsa"
Copy the four files "ca.cert, server.key, server.crt and dh1024.pem" to "C:\Program Files\OpenVPN\config"
Copy "server.ovpn" from folder "Sample-config" to "config" folder
Edit with notepad "server.ovpn"
Find the following lines:
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
Edit them as follows:
ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\server.crt"
key "C:\\Program Files\\OpenVPN\\config\\server.key"
dh "C:\\Program Files\\OpenVPN\\config\\dh1024.pem"
Save the file.
4. Installing OpenVPN Client:
In the client workstation, install the same setup OpenVPN.
5. Configuring OpenVPN Client:
Copy the files we configured in the previous step from "Server" to OpenVPN folder in the client workstation: "ca.crt" "client.crt" "client.key" and "client.ovpn"
Edit "client.ovpn" with notepad
Find the following line:
remote my-server-1 1194
Remplace "my-server-1" with the public IP address of the server
Find the following lines:
ca ca.crt
cert client.crt
key client.key
Edit them as follows:
ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\mike-laptop.crt"
key "C:\\Program Files\\OpenVPN\\config\\mike-laptop.key"
Save "client.ovpn"
6. Connecting OpenVPN:
First we need to start OpenVPN in the Server. Execute "OpenVPN GUI"
Right click on OpenVPN, then "Connect"
Now OpenVPN is UP on the Server
As you see, a virtual IP address already assigned to the server "10.8.0.1"
We need to configure the server's firewall to accept connection via port UDP 1194
Click on "Advanced settings"
Select "Inbound Rules", in the right side click on "New Rule"
Select "Port"
Select "UDP" protocol and specify the local port "1194"
Select "Allow the connections"
Give a name for the rule
Click "Finish"
Now we are able to connect the client workstation to the server.
At this step, we can only connect OpenVPN but we need a remote desktop access through the VPN. As I mentioned before RDP connection uses UDP protocol on port 3389.
If you are using Windows 7 or Server 2008 R2, you need to enable the TCP port 3389
Go to "Remote Desktop - User Mode (UDP-In)" rule, right click on it and "properties"
Go to "Scope" tab, in "Remote IP Address" select "These IP addresses"
In "This IP address or subnet" enter the virtual IP address of the client. Or enter a range of IP addresses include the client address
Click "OK"
Do not forgot to enable the rule
7. testing VPN connection:
Execute "OpenVPN GUI" client and click connect.
The VPN is connected
Testing RDP access. Open a "Remote Desktop Connection". Enter the Virtual IP address of the server and click "Connect"
RDP works perfectly. This virtual IP works only when the OpenVPN is up.
