Linux Server Build: OpenVPN From Scratch - Hak5 2019

Поделиться
HTML-код
  • Опубликовано: 6 дек 2024

Комментарии • 319

  • @RobertGallop
    @RobertGallop 8 лет назад +72

    Yes vote for IPv6 episode in depth!

  • @doomgod314
    @doomgod314 5 лет назад

    I love my Pi, but i bought a refurbished HP ProLiant DL360 G7 for less than $200 off Amazon and this thing is a beast. I’m loading down every home service I need, from Plex-Media to DNS Blackhole. I’m looking forward to testing this OpenVPN install video when I get home tonight.
    Thanks Hak5. As always, your tutorials are second to none. Fun, detailed, and insightful in ways only seasoned veterans of the field can provide.

  • @TheDIYer
    @TheDIYer 3 года назад

    i love the way you put everything you used in the description makes it easier to refer to

  • @yasin7520
    @yasin7520 2 года назад

    You are by far the best teacher for soft soft . It's very complicated at first - overwhelming, actually - but, you make it doable for

  • @qwarlockz8017
    @qwarlockz8017 6 лет назад +3

    This was a great run through. Thanks so much for making this pretty straight forward. This gave me what I did not have before. Going through docs and tutorials and the like it always had a LOT of extra. This was just a handbook on "Lets just make this work." You rock!

  • @tonylock7657
    @tonylock7657 8 лет назад +2

    You guys rock. I just followed this video and set up an OpenVPN server on a Raspberry Pi on my home network. and it works. I must confess that I followed another of your vids about OpenVPS SA on a VPS, and that didn't work for me (I kept getting four different 10.x.x.x subnets, and the gateway at home (the Pi) and the client (a laptop) ended up on different subnets) , and the simplified script based setups out there in Internet Land didn't work for me either (I think it may have been routing issue). Anyway - it's working now. Great!
    Keeps up the good work.

  • @talabaniinday213
    @talabaniinday213 2 года назад

    Thanks for the kind words, I'm always happy to help! Let know if you'd like any videos on specific topics in the future. I wish you all the

  • @devjock
    @devjock 8 лет назад +1

    Awesome episode, welcome back guys!
    Darren did a really good job of keeping a 50+ minute setup and operation video interesting. I bet this is going to help a lot of people! Setting things up on my Pi 3 right now!

  • @tectubedk
    @tectubedk 8 лет назад +9

    for all the raspberry pi users check out pivpn it is the easiest way to install openvpn

  • @tectubedk
    @tectubedk 8 лет назад +78

    please make the ipv6 video

    • @WillBicks
      @WillBicks 8 лет назад +1

      Yes please.

    • @zizzu549
      @zizzu549 8 лет назад +2

      Yes please ipv6 video i remember it is a bunch of hex bytes to write one ipv6 address and i hate hex i have ten fingers :(

    • @kentosfreshmaker8850
      @kentosfreshmaker8850 8 лет назад

      I would like to see that as well. Its one of those things im not too keen on =/

    • @bearwolffish
      @bearwolffish 7 лет назад +2

      : ) The trick is to use the ridges in your fingers, along with the top of each. We have 8 fingers with 4 bits on each half byte, or hex from 0-F on one hand and 00-F0 on the other. This makes thinking binary and hex a little easier. Look up the Hexadecimal finger-counting scheme.

    • @TheSakeCat
      @TheSakeCat 7 лет назад

      anders ballegaard and I was feeling lost before you told me it gets more complicated.

  • @KandMe1
    @KandMe1 4 года назад

    This is very good and well done. Just very thorough IMAO. Been researching this for some days now and this is the best I have come across so far.

  • @yuudai1400
    @yuudai1400 7 лет назад

    I'm a total hacking noob, but this was so much fun to watch. I'll get this running, and I'll also enjoy seeing your videos about raspberry pi and RF. Keep up the good work!

  • @recklessbeast
    @recklessbeast Год назад

    just 3 years away from 2026. You did great job regarding explanation.

  • @lordraiden8792
    @lordraiden8792 6 лет назад

    I just fixed my own Pi3-based OpenVPN box thanks to your tips about the firewall.
    Thank you very much!!

  • @dawnS33ker
    @dawnS33ker 3 года назад

    an episode on ipv6 would be great. Thanks for the amazing video, guys.

  • @LCFTW93
    @LCFTW93 8 лет назад +19

    I would like an IPv6 episode
    Also why the Return on empty lines between commands?

    • @techkenX
      @techkenX 8 лет назад +6

      the empty lines is to keep things clean he always do that.

  • @suijurisinfowarrior
    @suijurisinfowarrior 8 лет назад

    Thanks Darren, I was pulling what little hair I have left trying to configure an OpenVPN server.
    Off to deploy this tech for my travels.
    Snubs, the mnemonic helps me where the wrong character can make you elated or deflated.

  • @geoffhalsey2184
    @geoffhalsey2184 8 лет назад

    Tried it out on a virtual machine first. Worked first time! Soon to be on my cloud server.
    Nice one guys!

  • @pierrotlunairehh
    @pierrotlunairehh 8 лет назад +13

    +1 for an 'ipv6 for dummies'!!!

  • @androidgeek123
    @androidgeek123 8 лет назад +18

    Please do a Ipv6 episode!

  • @colorflydigital
    @colorflydigital 2 года назад

    The Best Explanation !!! I referred to many videos , but out of all tNice tutorials was the best I could find among all .... Also got to know many tNice tutorialngs

  • @ClevioGrenouille
    @ClevioGrenouille 4 года назад

    this is the best tutorial i have ever seen on the net.

  • @kristoffseisler2163
    @kristoffseisler2163 4 года назад +1

    will you ever post an updated version of this? half of the commands just wont work at all since easy-rsa has updated so much.
    and you are using sysV while 2020 pretty much uses systemd

  • @etzard
    @etzard 8 лет назад +14

    ip6 yes please

  • @WoobiewookieBlogspot
    @WoobiewookieBlogspot 6 лет назад

    I know, I know, 2 years later...
    First, thanks for this - its very informative, and you'd be surprised how few VPN server setup walkthroughs there are out there. If you all are still paying attention to comments, it might be cool to give a refresher on why "allow ssh" on its own isn't very safe (just explain you're keeping your putty session active). Not sure if you guys have done a ssh keypair video but i'd love to see an updated/current one.

  • @zainuddinbrahim4625
    @zainuddinbrahim4625 3 года назад

    i truly support ur programs guys because I am a unix guy.

  • @cyriljourdan1023
    @cyriljourdan1023 8 лет назад

    Finally a complete step by step tutorial, and it works, got it working on a Ubuntu 16.04 desktop and a nVidia Jetson TK1. Awesome ! Thanks !

    • @cyriljourdan1023
      @cyriljourdan1023 8 лет назад

      In fact it works well locally but not over the Internet. My client gives a TLS Error: TLS key negotiation failed to occur within 60 seconds.
      It looks like a firewall issue on port 1194. Anyone got this error ?

    • @pgwollan
      @pgwollan 8 лет назад

      Is it port forwarded?

    • @cyriljourdan1023
      @cyriljourdan1023 8 лет назад

      You mean on the router? I have a basic router where I can only do simple port mapping : I can set a local IP address, a protocol, local port and public port. I set my vpn server local IP to UDP and both ports to 1194, but it is not working. Is there something I missed ? Or my router is not suitable ? Thanks!

    • @pgwollan
      @pgwollan 8 лет назад

      Any router should have some form of port forwarding. What router do you have?

    • @cyriljourdan1023
      @cyriljourdan1023 8 лет назад

      I have the Vodafone EasyBox 804. Do you recommend any router ?

  • @RomanLeBg
    @RomanLeBg 5 лет назад

    IIIIIIIIIIII LOOOOOOOOOOOOOOOOOOOOOOOOOOVEEEEEE YOUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU I spent straight 3 hour on the Arch wiki and now it work omg I was so so close 17:41 I put tun0 instead of the real one lmaoooo i'm so glad it work

  • @JamieAlban
    @JamieAlban 6 лет назад

    This is the first of your vids I've watched - you guys are super fun, subscribed.

  • @baiqing
    @baiqing 8 лет назад

    Great job! You guys should do a video where you tunnel openvpn through Stunnel or any other methods that can bypass deep packet inspections. Getting Stunnel to work took me 10+ hours so I would love to see what other methods you guys can pull off!

  • @sairarivera6993
    @sairarivera6993 2 года назад

    and build tracks from there and leave the rest for a later session. I did both but did the first way initially and it took a day to get through

  • @kc9aop
    @kc9aop 8 лет назад

    I "hacked" my way through this alone. I wish this video was available when I was working this out. Needless to say my solution is functioning the same but I ended up making things a bit more complicated. Great job on this video!
    I would like to see an ipv6 video.

  • @Derbauer
    @Derbauer 7 лет назад

    great show guys loved the detailed content and the long duration with comprehensive walk through. much appreciated.

  • @pcastro3783
    @pcastro3783 7 лет назад

    Of all the effen tutorials, you guys got me up and running. Thank you!

  • @pingpong1138
    @pingpong1138 7 лет назад +3

    Man I love when things are badly documented

  • @bryanburton3172
    @bryanburton3172 8 лет назад

    WOW, what a fantastic demo. I could follow every step. It was all crystal clear and matched my requirements precisely. Nice hats too.
    All working perfectly after realising I'd messed up by uncommenting the line "tls-auth ta.key 0 #" as directed by some shoddier how-to page. My bad should have come here first!!!. But Seriously, this was great. Thank You Thank You Thank you.

  • @agentgreenland
    @agentgreenland 8 лет назад +5

    HEEELP!
    at around 36:18, he says he gets the new tun0 network interface, because he had started the openVPN service, but I don't get that device when I type ifconfig...! :-\ Why is that...?
    I am running Debian 8.6 on Pi

    • @agentgreenland
      @agentgreenland 8 лет назад +6

      I found the error I made. In this video, he names his crt and key files the standard 'server' name. I made my files with a custom name for myself, and I had to define my own filenames in the server.conf config file. After that and restart the service, my network interface popped up, and it was working :) If you are going with custom names, don't forgtet to define the custom client keynames in the OVPN file too

    • @Attranaan
      @Attranaan 7 лет назад

      Ilannguaq Kivioq for a grand total of 4 files right? server.crt server.key client.crt client.key

    • @Attranaan
      @Attranaan 7 лет назад +1

      Ilannguaq Kivioq nevermind. rebooted and now I'm getting tun0

  • @Quinqx
    @Quinqx 8 лет назад

    Would love to see an in-depth IPv6 episode showing up! Keep up the good stuff! :)

  • @rubenb.molina6968
    @rubenb.molina6968 8 лет назад +2

    @Hak5 - I can't like this episode enough times!
    I will be playing around with OpenVPN server running on OpenWRT to manage a few remote networks. I also loved episodes #2017 and #2018; I'm drafting some ideas for my backpack "Network pocket" (housing hotspot gear, and extra storage, etc)...
    I'll publish a photo and tag yo guys. I need an extra nano =). #jokeNotjoke.
    Anyway - Love your show. I've been a fan for over nine years!

  • @JasonSpiffy
    @JasonSpiffy 8 лет назад +3

    Okay Ive tried this twice. I cant get it to work. The tunnel is connected and I receive an ip address from the vpn server. No internet connectivity.

    • @djemsmortimer
      @djemsmortimer 8 лет назад

      I've got a bullet proof configuration using diffie-hellman 4096 RSA keys with fail2ban to protect the OpenVPN as well...
      And password authentication on top of it.

  • @bdonham
    @bdonham 8 лет назад

    Congratulations on the podcast Award.

  • @cubemage3336
    @cubemage3336 5 лет назад

    hi,
    when I entered the "service openvpn start" command, I got "active (exited)" as a status and didn't get the tun0 either. Then, after searching in Google, I realized that after Ubuntu 18.04, services get started with the "systemctl start [service]" command. But then, I got the an error and after looking at the log, it seems openvpn was looking for a file called "ta.key". It wasn't there, so the service didn't start. Lastly, I searched Google again and found out I had to go to /etc/openvpn and run the "openvpn --genkey --secret ta.key" command. After that, the service could be started and I had the tun0 interface show up. Now here's the question. Do I need to replace the "service.key" we made in this tutorial with the "ta.key" I just made, or are they two different things for two different uses?

  • @pierredahmani4101
    @pierredahmani4101 4 года назад

    This tutorial helped me out so much, both of you are great. Thanks!

  • @Lehi0001
    @Lehi0001 8 лет назад

    Edit :
    My appologies. When using a config file, omit the leading double dash "--" for the command. Simply put tun-ipv6 in it, then follow the rest.
    Original Post
    "For IPv6, you need to add the --tun-ipv6 to the profile/config file. You then replace IPv4 addresses with IPv6 addresses.
    Be warned. Most people are NOT on IPv6 yet, as most admins don't want to take the time to comprehend what the new formula is. Also, subnets become a thing of the past, due to the number of possible addresses being such that you could assign one to every grain of sand on Earth....
    Option explained :
    --tun-ipv6 Build a tun link capable of forwarding IPv6 traffic. Should be used in conjunction with --dev tun or --dev tunX. A warning will be displayed if no specific IPv6 TUN support for your OS has been compiled into OpenVPN."

  • @gerlisonlima6098
    @gerlisonlima6098 2 года назад

    Bro it’s very intimidating! I’ve been slacking on it for a month now. The symbols are very confusing. You have to train your mind to

  • @Crestoify
    @Crestoify 8 лет назад +1

    Welcome back Hak5, welcome back!

  • @AD-1000
    @AD-1000 2 года назад

    Hey, I just wanted to check briesofty if there is a way for to import a new soft into the program, for example softs or sotNice tutorialng that

  •  8 лет назад +1

    you can make alarms & notifications with iptables when can you do a tut on this? :) it takes some googling but last time i checked it got advanced lol

  • @adrianopinaffo
    @adrianopinaffo 4 года назад

    In 5 years I will come back to say that even though we have fireguard, this is still relevant

  • @Darkl0ud_Productions
    @Darkl0ud_Productions 8 лет назад

    When I did this I ended up sending the cert to my android and it was wanting to connect to my internal network address rather than my external network?

  • @AydinJamshidi
    @AydinJamshidi 5 лет назад +1

    Please make OpenVPN with OBFS proxy video (Scrambling the traffic). I searched the internet and youtube and couldn’t find any good guide about it. OpenVPN traffic is blocked in some countries for censoring the internet .

  • @MinecraftAzsassin
    @MinecraftAzsassin 6 лет назад

    If you’re getting a KEY_CONFIG error stating the openssl.cnf is not correct or similar, use this while in the specified directory of the issue (where build-ca is located): ln -s openssl-1.0.0.cnf openssl.cnf

  • @Macadoof
    @Macadoof 7 лет назад +1

    You guys are lovely. Thank you for a great video, I learned a lot here.

  • @licklake1
    @licklake1 8 лет назад

    So openvpn is creating a symmetric keys the background and putting it into the .ovpn file?

  • @SrFrancia0
    @SrFrancia0 7 лет назад

    Does anyone know where I could get full documentation on what they do in the episode? I tried following the video and ended up with it not working and not having learned nearly anything (I blame you, copy-paste). I would like to re-try it but actually knowing what I'm doing. I've looked up in the OpenVPN wiki but it seems messy to me and can't quite find the certificate things.

  • @blazeafeef
    @blazeafeef 2 года назад

    I recomnd you two to buy the Producer Edition (And if you have got money, buy the Full Bundle)

  • @hasimali1937
    @hasimali1937 2 года назад

    Did you get fruity or producer edition? Im looking to buy soft soft but i dont know if Producer edition is worth it...

  • @poohbearceren62
    @poohbearceren62 7 лет назад

    daren i need your help after executing cli ./clean all and ./build-ca i get error message saying path pointing to the wrong direction should say there should be a comment on new version 2x

  • @Aaron-qg7dz
    @Aaron-qg7dz 5 лет назад

    I’m connected but it’s still not hiding my exterior IP in my web browser. So I add redirect-gateway def1 to the bottom of my .ovpn file but nothing changed.. can anyone help?

  • @1998goodboy
    @1998goodboy 8 лет назад +1

    i always wordered, what laptop is Shannon using??

  • @hasanordek
    @hasanordek 3 года назад

    Great video! But, this means for every user I have to create a user account on that Linux server?

  • @michaelchannel550
    @michaelchannel550 6 лет назад

    Hi. created a VM with ubuntu server in microsoft azure. i follow all the steps in this video. i import the .ovpn file to my iphone, it doesn't connect to the server. i also configure the network security group on the Azure VM setting to allow port 1194/UDP. still not working. please help. thanks

  • @trondnylkken956
    @trondnylkken956 5 лет назад

    Hi Is this method possible to get a ip adress for other country so it looks like I am in other country?
    I have a private network and ubuntu servers one with 6 websites in wordpress and some computer and a static ip.
    I like to use the vpn to let me see norwegian tv on internet when I am abroad. Is this what I need?

  • @tariqquadeer7855
    @tariqquadeer7855 7 лет назад

    How would i change the rules differently if i used iptables instead of ufw? ufw was giving me other problems, i have iptables setup.

  • @swivellogic
    @swivellogic 7 лет назад

    So apparently if you change the port in both server.conf and your .ovpn file, you still need to have 1194/udp allowed in ufw, or else it doesn't work. Is there something in the openvpn code that's talking localhost over that port? Or is it the 10.x.x.x server network that needs it?

  • @nesterpen7587
    @nesterpen7587 6 лет назад

    I have installed openvpn but I am not seeing any example config files. All folders are empty. Why so ?

  • @inhissteps-prasanna3532
    @inhissteps-prasanna3532 2 года назад

    good work and thank you so much, Greetings from Egypt

  • @Dany-rh5ur
    @Dany-rh5ur 6 лет назад

    I've done this on my Ubuntu Server 16.04 running behind NAT on VMware. However, I'm not able to connect outside clients to my OpenVPN. I've also tried to port forward all incoming packets on UDP 1194 to my server. Didn't help.. Any suggestions?

  • @troyfred8007
    @troyfred8007 6 лет назад

    Darren, whats the deal with the bandana on your wrist? Is that for a purpose or fashion?

  • @NewsBroadcasting
    @NewsBroadcasting 5 лет назад

    anyone way to ignore expired server certificates besides changing system date back on the client?

  • @MehdiHaghgoo
    @MehdiHaghgoo 5 лет назад

    You guys are great! Keep up the good work!

  • @hfrnd-hu2kz
    @hfrnd-hu2kz 8 лет назад

    Hey guys, been a real fan for a long time, quisck question... when you mentioned to be able to through this build into an arduino... any arduino specific in mind?

  • @tzisorey
    @tzisorey 8 лет назад

    Yes, do an IPv6 episode! We need more people to be aware of, and fluent with, IPv6!

  • @trondnylkken956
    @trondnylkken956 4 года назад

    Do nor work, when had made the 2048 keys and try to goto ../keys it says file or folder not exist..

  • @ankittiwari4230
    @ankittiwari4230 6 лет назад

    Hello,
    I have followed exact steps but al last while testing it gives
    TLS handshake failed error
    plz help..

  • @vansh_tiwari
    @vansh_tiwari 5 лет назад

    I'm make the openvpn server & client they are connecte properly..
    But please tell me how to access ip camera, plc & hmi they are connected to client side mean i want to access these three devices by ovpen network
    In this my medium us raspberry pi 3

  • @Nithintitta
    @Nithintitta 8 лет назад

    how about a video on site to site VPN please? is it possible for both the sites to communicate on the same subnet?

  • @moronibarboza7051
    @moronibarboza7051 2 года назад

    How can I add the navigation bar you are using?

  • @WIKIKALI
    @WIKIKALI 5 лет назад +1

    Great tutorial
    A while ago I was looking for him

  • @himanipku22
    @himanipku22 5 лет назад

    Are there any extra steps when setting up a server that will be accessed through nat?

  • @articcircleado
    @articcircleado 6 лет назад +1

    Literally the greatest

  • @Mocart096
    @Mocart096 7 лет назад

    Hey, I have some problems to run OVPN connection from Raspberry Pi0w/ Pi3 as a client ( with Jessie edition ). Can I set up access to server using network manager with VPN option ?.
    Is there any manual how to setup Raspberry based clients or maybe is there any dedicated client for Raspberry PI ?

  • @Gazza2485
    @Gazza2485 8 лет назад

    Have you guys done a segment on proxy-chaining ?

  • @seanjohn1031
    @seanjohn1031 7 лет назад

    how would you do all this on a VM since i dont have a pineapple? do i just keep it as a .conf file?

  • @bullmarket7061
    @bullmarket7061 Год назад

    Please update this tutorial again. Make it based on new versions. Thanks. Awesome channel.

  • @djuhl002
    @djuhl002 6 лет назад

    What actually gets encrypted once you activate the client? I have a nginx server with phpmyadmin installed. Do I need to tell nginx the ip address off the openvpn client, or is any traffic on my lan encrypted once the client is activated?

  • @kyoono7270
    @kyoono7270 7 лет назад

    tsl hand shake error anyone has any info on how to fix, I checked the nat, and the firewall settings are correct.

  • @tylermurphywilliams5866
    @tylermurphywilliams5866 8 лет назад

    been waiting for this

  • @czarart14
    @czarart14 6 лет назад

    hi my openvpn server Diffie-Helman parameters was set 2048 bit, is it possible to change it to 4096 bit?

  • @kelvinklufio2849
    @kelvinklufio2849 5 лет назад

    In the demo, you guys used ovpn, is that going to work for just any client; link me connecting CentOS client machine?

  • @Canadian789119
    @Canadian789119 8 лет назад

    How would this compare to a Paid Service? like a monthly service, that will hide your IP address.
    Will a OpenVPN Server on your network provide a private connection too the network and Internet. Will all Traffic from the Client be protected by the Server? This seem great to connect too your Network from a Wireless client, however What I am looking for is a VPN for privacy on a windows/ ubuntu wired desktop client.

  • @SilentNote
    @SilentNote 5 лет назад

    Question : how to make a LINUX PC run 2 PCI M-Audio Delta 1010 ( that model with Breakout Box ), to be used with COKOS REAPER DAW ( Digital Audio Workstation ) for LINUX ??? Please consider making a VIDEO showing that ... Please ...

    • @vandorb12
      @vandorb12 5 лет назад

      Hak5 (kinda) aren't the folks to ask about that. Go hit up one of the audio forums or The Reaper Blog on Facebook.

  • @MrSimonsmoke
    @MrSimonsmoke 8 лет назад

    Thanks for the tutorial , now I get the server running on my Rpi ! Feel for u guys and keep it up~

    • @agentgreenland
      @agentgreenland 8 лет назад

      HEEELP!
      at around 36:18, he says he gets the new tun0 network interface, because he had started the openVPN service, but I don't get that device when I type ifconfig...! :-\ Why is that...?
      I am running Debian 8.6 on Pi

  • @alfie-teq
    @alfie-teq 8 лет назад

    I have an ASUS router that has an OpenVPN server built in. With that can I build all my keys, carts and all the other files required in OS X? What is required?

  • @ankittiwari4230
    @ankittiwari4230 6 лет назад

    How can I add ssl certificate generated by other authorities so that client can proceed to login page without adding exception.

  • @w33k3nd5
    @w33k3nd5 2 года назад

    is it automatically enabled to connect unlimited concurrent clients/devices or there is such config to make it do so ?

  • @nahoskins
    @nahoskins 6 лет назад

    Please install and use ranger for your shell footage. Please...

  • @mingass1
    @mingass1 8 лет назад

    How to deal in this case with dynamic public IP address. When public IP address will be changed this VPN server will work or not???

  • @madtec3348
    @madtec3348 7 лет назад

    Hi I was wandering if you can copy vm openvpn setup to a pi ????

  • @jamessanders7357
    @jamessanders7357 7 лет назад

    TCP/UDP: Socket bind failed on local address [undef]: Address already in use
    help someone?