The OpenVPN Server Role install and configure OpenVPN with help of Ansible. The Server role should be run in combination with the OpenVPN Client Role.

The OpenVPN module requires that an Ubuntu machine is running with a public IP-address.

For AWS there is an OpenVPN terraform module that provision an Ubuntu machine in the public subnet of the VPC.

• Ansible is requred in order to use the OpenVPN roles
• SSH key pair

Ansible automatically install OpenVPN with all dependencies and configurations.

Run the following commands in order to install the server role and the client role

ansible-galaxy install git+https://github.com/tieto-cem/openvpn-server-role.git,v1.2.0
ansible-galaxy install git+https://github.com/tieto-cem/openvpn-client-role.git,v1.1.0

Create the playbook, e.g. with this example. The project structure for the example look like this:

.
├── inventory
|   └── project_inventory
├── group_vars
|   └── project_vars
├── install-openvpn.yml
├── install.sh
└── obtain-keys.sh

Redefine the inventory file, project_inventory, use the public IP address of the Ubuntu machine. Also modify the location to the projects private SSH key.

[example-project]
34.100.10.1

[all:vars]
ansible_connection=ssh
ansible_ssh_private_key_file=~/.ssh/example-project.pem
ansible_ssh_user=ubuntu
ansible_python_interpreter=/usr/bin/python3.5

Redefine the group variables in the group_vars file, project_vars.

Run the playbook in order to install OpenVPN and create user keys (you can also use the install.sh in the example directory).

ANSIBLE_HOST_KEY_CHECKING=false ansible-playbook install-openvpn.yml -i inventory

The client keys exist on the server and can only be obtain with sudo rights.

Run the following command to obtain client keys (obtain-keys.sh is located in the example directory)

./obtain-keys.sh -i /location/to/private/example-project.pem -s ubuntu@IP_ADDRESS -c username

Install stable version of Tunnelblick.

Extract your key file (your-name.tar.gz) into an empty directory e.g. vpn. Run the commands in a terminal window

mkdir ~/Documents/vpn && cd ~/Documents/vpn
tar zxf /location/to/your-name.tar.gz

Open Finder and locate the folder ~/Documents/vpn.

Double click on the the conf file e.g. cem-openvpn-your-name.conf and choose to install for "Only Me".

Click on the small Tunnelblick icon in the top menu bar and choose "Connect cem-openvpn-your-name".

Install OpenVPN

wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | sudo apt-key add -
echo "deb http:https://build.openvpn.net/debian/openvpn/release/2.4 xenial main" | sudo tee /etc/apt/sources.list.d/openvpn-aptrepo.list
sudo apt update && sudo apt install openvpn

Extract your key file (your-name.tar.gz) into /etc/openvpn.

cd /etc/openvpn/
sudo tar zxf /location/to/your-name.tar.gz

Start OpenVPN client

sudo systemctl status openvpn@cem-openvpn-your-name

Stop OpenVPN client

sudo systemctl stop openvpn@cem-openvpn-your-name

Install latest version of OpenVPN for Windows.

Extract Extract your key file (your-name.tar.gz) into C:\Program Files\OpenVPN\config. WinZip can be used for extracting .tar.gz files.

Right click on the small OpenVPN icon in the windows taskbar on the right hand bottom corner and select connect.

MIT © Tieto CEM