Professional Documents
Culture Documents
This page contains a no-frills guide to getting OpenVPN up and running on a Windows server and
client(s). For a more detailed understanding of setting up OpenVPN and its advanced features, see the
HOWTO page.
Table of contents
3. Configuration Files
5. Starting OpenVPN
1. Download the installer from here and run it on the server computer.
2. Install OpenVPN on each client. (This step can be skipped for now and done at any convenient
time)
Preparatory Steps
c. cmd.exe
3. init-config
4. notepad vars.bat
4. Edit the following lines in vars.bat, replacing "US", "CA," etc. with your company's information: 2
5. set KEY_COUNTRY=US
6. set KEY_PROVINCE=CA
7. set KEY_CITY=SanFrancisco
8. set KEY_ORG=OpenVPN
9. set KEY_EMAIL=mail@host.domain
7. vars
8. clean-all
2. build-ca
o When prompted, enter your country, etc. These will have default values, which appear in
brackets. For your "Common Name," a good choice is to pick a name to identify your
company's Certificate Authority. For example, "OpenVPN-CA":
a. For each client, choose a name to identify that computer, such as "mike-laptop" in this
example.
b. build-key mike-laptop
oWhen prompted, enter the "Common Name" as the name you have chosen (e.g. "mike- 3
laptop")
c. Repeat this step for each client computer that will connect to the VPN.
5. build-dh
Configuration Files
2. Start Menu -> All Programs -> OpenVPN -> OpenVPN Sample Configuration
Files
1. Open server.ovpn
3. ca ca.crt
4. cert server.crt
5. key server.key
6. dh dh1024.pem
4. ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
7. dh "C:\\Program Files\\OpenVPN\\config\\dh1024.pem"
3. ca ca.crt
4. cert client.crt
5. key client.key
4. ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
4
5. cert "C:\\Program Files\\OpenVPN\\config\\mike-laptop.crt"
o Notice that the name of the client certificate and key files depends upon the Common
Name of each client.
4. Edit the following line, replacing "my-server-1" with your server's public Internet IP Address or
Domain Name. If you need help, see Static Internet IP below.
2. ca.crt
3. dh1024.pem
4. server.crt
5. server.key
6. server.ovpn
3. ca.crt
4. mike-laptop.crt
5. mike-laptop.key
6. mike-laptop.ovpn
Starting OpenVPN
2. Double click the icon which shows up in the system tray to initiate the connection. The resulting
dialog should close upon a successful start.
Firewall Configuration
If you have connection problems, make sure to set a rule on your server's firewall allowing incoming
traffic on UDP port 1194.
Port Forwarding
5
If your server is behind a router, you will need to forward the port chosen for OpenVPN (in this
example UDP 1194) to the server. Consult your router's documentation for details on this.
To set up port forwarding, you will likely need to set up the server with a static local IP address instead
of the default dynamic (changing) IP. Instructions for Windows XP may be found here. Make sure to
choose a static IP address that is not in the range your router might assign as a dynamic IP, but is
within the router's subnet (usually 192.168.0.xxx , 10.0.0.xxx , or similar).
Static Internet IP
Your server will need to have a static internet IP or Domain Name to be accessible over the long term.
One solution is to sign up for an account with DynDNS and install the DynDNS Updater on your server.
When signing up you will determine the static Domain Name of your server. (For example,
"myserver.dyndns.org") You will use this Domain Name in the client configuration files as part of the
"remote" directive.
b. OpenVPN to be started automatically on system startup. This is often preferred on the server
machine, as well as any machines which will be constantly connected to the server.
c. services.msc
2. Find the OpenVPN service, and set its Startup Type to "automatic."
Security Tips
1. Transmit all needed files to the client computers using a secure means such as a USB drive
(email is not always a secure means).
2. Choose a port other than UDP 1194, and replace the port number wherever this guide mentions
UDP port 1194.
C:\Program Files\OpenVPN\bin\deltapall
C:\Program Files\OpenVPN\bin\addtap
You will then have to rename the connection to match the entry in the config file.