Hey everyone and welcome back. So now what I want to do is to walk you through the actual
configuration of a VPN. Now the VPN that we're going to be using, or the VPN solution that
we're going to be using, is one called OpenVPN. Now there happens to be a few different solutions
that we can use for VPN connectivity on Linux, but the reality is for the examination, OpenVPN
is specified, therefore we want to have familiarity with this particular VPN solution. So with that
said, how about we dive on and then now what I actually have here is you may recall I have one
server which is server one and this is a Ubuntu based machine and I also have a server two which is
again also an Ubuntu based machine. Now here is the problem with what we're going to do. There's
going to be some type of limitation here because like I say these two machines are actually within
the same network virtualized by VMware. As it transpires, both of these machines happen to be
on the 192.1684.0 slash 22 network, I believe I have, meaning that this device here can already see
this device here like they're on the same network because they're on the same network. So whilst
we're going to try to build a VPN connection between these two devices so that they appear like
they're on the same network, well they actually already are on the same network. So there's a
little bit of tweaks that we're going to have to make, but we should still be able to create our
tunnel connection and actually connect to each other, i.e. ping each other over that particular
tunnel to demonstrate that we do have that connectivity. So I just want to be upfront from
the get go is that like I say, whilst this is kind of playing fast and loose with how a VPN would
really be implemented over a vast geographical expanse, the configurations at what we're doing
are still going to be valid ultimately. I'll just point out the differences as we go along. So with
that said, how about we begin looking at our servers and so like I say server one, let's bring this up.
Here we have server one on the left. Let's grab server two and here we have server two on the
right now just for posterity. Let me just show you the IP addressing that is in play here. In fact,
let me just grip for 192. We can see here that the address of this server here is 192.1684.29
and the one on the left if I do an IP adder and I grip for 192. This is 192.1684.30. So like I say,
no problem and reality of these devices been able to connect. Server two can easily ping server one
and vice versa ping 192.1684.30. So we're going to do a little bit of pretending here. Imagine that
we did not have this type of connectivity inherent to this IP addressing. We're instead going to
imagine that both of these interfaces are public facing interfaces and they have no connectivity.
They are on entirely different networks. So the first thing we're going to do is we're going to
install something called curl. So curl is going to allow us to download what we need to download.
So I'll say sudo apt install curl and hit enter type in my password of course and I'll just say why
hit enter again and if we slide on over to server two we'll do sudo apt install curl once again and
just do a dash y here to confirm and again the password goes in. Okay cool. So we have curl
installed on both servers now. What we now want to do is you want to go to a particular website.
This is GitHub where we can actually download the script we need to begin installing open VPN. So
let me show you how to get this if I just pull up my browser here. So if you happen to search for
open VPN on GitHub if we go down to this one here I'm going to stand open VPN install if we click on
this and let me just zoom in a little bit here so we can see a little bit better. There we go.
So if you scroll on down you're going to see in the read me the top part here we see the usage and
we're going to see this script right here again using curl which we've just installed. So if you
just highlight this or even just click this link here we're going to copy this. Let's go back to
our terminal windows just minimize you. Okay so let's maximize this one. So for now all I'm going
to do is just paste this in and now if we do an LS we should now see this open VPN install.sh if we
do an LS-L if you check the permissions we're going to see that this is not executable so we
want to use our chmod command chmod plus x to add the executable on that particular file we hit
enter we do an LS-L once again we can see the executable permissions have been set so we can
now actually run this setup script. Similarly we go to the other server right here do the same thing.
Okay paste this in hit enter if we do an LS we can see once again LS-L let's make it executable
with chmod plus x open VPN and we check again now it is executable so all we can do here is if we say
sudo for super user privileges and just say open VPN with the dot slash beforehand if we hit enter
now we're going to run through this setup script. Now I'm just going to run through the defaults here
because we're really just going to be doing a quite simple connection in this case we don't have to
worry about modifying these defaults so right now we can see here the IP address it is showing here
as the internal IP address of the server in my case that is 192.1684.30 if I just hit enter I'm
just going to run through all of the defaults just hitting enter enter enable compression no
customize encryption no anti-engining continue I'll run through the installation here we're then
going to be prompted to specify a client name we're going to set up our certificates and our GPG
okay so here is the part of the client name now again I'm not going to worry about this too much so
I'll just maybe call this S2 since this is server 2 again use the defaults of enter and that is us
for server 1 if we just follow the same process on the other server so sudo dot slash open VPN
we'll run through the script just hit enter this time notice that the IP address is a little bit
different again I'm just going to hit enter through all of these settings again client name I'll just
say s1 doesn't actually matter we're not going to worry about that just now and again enter the game
so both servers now actually have the installation going and we actually see here we have this dot
o VPN file but actually not going to worry about that for our demonstration and what I want to say
here just at the get go is to say sudo service open VPN stop make sure nothing's running do the same
again on the server 2 right here so again sudo service open VPN stop hit enter cool we're doing ls
right so what we actually want to do here is we want to generate a key for our authentication
purposes so what I'm going to do is I'm going to generate the key on server 1 and then copy that
key over to server 2 and the way we're going to copy this is what we've seen very very recently
we're going to use scp which is going to transfer that server or rather transfer that certificate
to the server over ssh now we'll recall that ssh will be an encrypted connection this is very
important because we do not want to compromise the integrity of that certificate or rather of
that key so the fact that the transferral of this data is secure is of primary importance so the
first thing we'll do here is we will generate that key on server one so what we'll do is I will
clear the screen now that we've installed open vpm we'll have access to the open vpm command so if we
say open vpm and I do a dash dash gen key to generate the key and then dash dash secret this is going to
be where we specify the name of the key we want to create so all I'll do is I'll just call this
whatever you wish I'll just call this crypto dot key not that it matters choose any key name you want
to so if I hit enter now and I do an ls if I happen to cat crypto key we can actually see we have
this open vpm static key now this is the key we want to have available on the adjacent server that
means when we have the connection we can authenticate and the connection can be established now what we
want to do is to transfer that key like I say use insecure copy so I'm going to say scp and I am going
to therefore specify the key which in my case is called crypto dot key and now what I have to do is to
specify whereabouts I want to copy it to now on machine to the server to the username is still ipv0
so that is the same I'm going to have to type in the ip address of the adjacent server which is 192
1684 dot 30 and now I have to specify the path in which in that directory I want to transfer this
file now I'm just going to put this in the user's home directory so that'll be forward slash home
forward slash ipv0 forward slash if I hit enter I'm going to have to accept the fingerprint of
that server say yes and now I'm going to have to type in the password for that user on the remote
server so if I hit enter now we can see here that the transfer of that key has been successful
if we move on over to the other server let's confirm that at the opposite end so we'll open
this maximize to an ls within the home directory of server 2 we can now see the presence of that
key and if we cat that key we can actually see that the open vpn static key one is indeed the same
on both sides of the connection now we can actually begin looking at configuring the connection them
so if we now go back to machine one what we're going to do is to create a particular configuration
file now this doesn't actually have to be of any particular name although because this happens
to be acting as a server where we generated the actual key we'll just call this server.conf that
is a well known convention but you can reference any particular file you wish so I'll say sudo nano
and I'll just call this server.conf I'm putting this within my home directory but again you can put
it in any directory you want to so check this out remember in our introduction to VPNs we talked
about how we want to create an actual tunnel connection in fact let me just briefly draw this
for you once again to refresh this can be our server one right here and we're going to have
server two over here and we want this tunnel connection remember this interface here is not
going to be a physical interface that actually exists it's going to be just a logical construct
so right here this interface is going to be called in our case ton zero this is what we're going to
create and we want to give it an IP address and again this can be an arbitrary IP address you
choose I believe in the example I said 102030.1 and adjacent on server two but also going to create
a ton zero interface and again we're going to make sure that the tunnel interfaces on each
server adjacent to one another is going to be in the same network so we're going to put this in 10
2030.2 so if they're not in the same network we're not going to have connectivity over the tunnel
this part is clearly very crucial so let's generate ton zero and we will specify the IP address of the
tunnel of our local interface and we're going to specify the tunnel address of the adjacent
interface to which we're going to connect to cool so that's exactly what we'll do just now let's
clear the screen go back and begin typing so the way we generate our tunnel interface we just say
dev ton so the device will be a tunnel we're going to use ifconfig and now we're going to specify the
IP address of our tunnel interface now the first address we give is going to be our local interface
the second one will be the remote try not to get these mixed up because you will confuse your connection
and probably will make a mistake so just be careful so 10 20 30.1 that is the local interface of
this actual server and it's going to connect to 10 20 30.2 the adjacent interface now that is not
all we need this is just simply the connection of the interface we need to have our authentication
in place so we're going to use the keyword secrets and now we're going to point to that particular
key that we just generated using the open SSH command or rather the open VPN command so check
this out now the actual path we're going to do is going to be in the home directory that is where
the key actually resides and I believe I called the key crypto dot key again the key name doesn't
matter as long as you reference the actual path and the correct file which has the information
within it that's all you need so all I'm going to do is write this out save you exit back cool
now what I'm going to do is I'm actually going to start up this particular server then the way I can
do this is by saying pseudo open VPN I'll then do a dash dash config to specify the config
and the config I'm going to specify is the name of the file which actually has those
configurations now remember what it's called it's going to be called server dot conf so all this
stuff here so I'll say pseudo open VPN dash dash config and because I'm within the directory in which
this configuration file exists I can just give the relative path which is this here or alternatively
I can provide the absolute path which would be home IPv0 server dot conf either which way is fine
so if I enter now we're going to see that the connection has began to open we have device
turn zero opened we can see the IP address has been set for the local interface is 10 2031 and the
peer meaning that what we're going to connect to is going to have the IP address of 10 2032 now this
is only one side of the connection we're going to have to do the same thing on server 2 so let's
slide on over to that so if I just minimize this and we grab server 2 cool so we don't actually
have to generate a key here because we have the key copied over from machine one what we do though
is we're going to have to create a configuration file again you can call this any name you wish
because we're going to reference it specifically I'm just going to call this client dot conf so
so the nano client dot conf let's go in once again now here is the part which is going to be a little
bit different so what we're going to have to do is to specify the IP address of the remote server now
this is the part that's going to be confusing because I'm going to say remotes and then the IP
address of that server now because I just happen to be within the same local network on my two virtual
machines this is where I'm going to specify the adjacent machines private IP address which if you
recall is 192 1684 dot 29 remember this server here I'm on is 4 dot 30 so I'm specifying the
opposite servers IP address the problem here is that this happens to be a local address so we're
not really providing much magic but if you happen to be able to find a path to an external IP address
such as a knotted address on a router which would be a global public interface that you could reach
via the internet you could specify this address here as long as you can reach this address you
can begin to establish the connection and then build the tunnel so that's the part here which is
a little bit confusing because again we happen to be using already accessible local addresses to
ultimately establish a local connection via the tunnel which again is the problem with the demos
we don't always get perfity environments but we do what we can so okay so like I say that's going to
be the opposite side of the connection now we're going to create our tunnel by saying dev tun
just as we did on the server and then I'm going to specify if config now remember the order we
did it's in the first server it's going to be the same order but because this is the different server
the numbers are going to be reversed so this time we still start with the local IP address so it's
going to be 10 2032 on the tunnel here and from this vantage point the adjacent server will be 10
2031 which is server one now again just like we saw before we're going to have to specify the
secret for the authentication again they can provide the full path here so it's going to be home ipv0
and the key we actually transferred over here was called crypto.key and if we happen to save
this file and write it out we just exit in fact let me just save that without the backslash let's do
this again and exit back out if I cat this particular file right here catclient.conf we can see
this is the connection so what we now want to do is to use openvpn from this side to spin up this
file client.conf which has all the details we need to make that connection what I'm going to do here
is actually let you see this side by side on the left hand side here we're going to see the server
one which is just waiting for this incoming connection once I actually make the connection
from the server two side to finally establish the connection but actually see some validation on the
left hand side too so on the right hand side we'll start with sudo openvpn and again dash dash config
and now we just supply our configuration file which in this case is called client.conf so if we
just hit client.conf and hit enter notice on the left hand side we can actually see the peer connection
has been initiated and we can actually see here the initialization sequence has completed and by
the way on the right hand side we can also see the initialization sequence completed what this now
means is that we actually have this tunnel established so what I'm actually going to do here is I don't
want to close these terminal windows because that's where the process happens to be running I'm going
to create new ssh connections into both of these servers just for some validation so whilst leaving
these two windows open I'm just going to minimize them but not kill them let me just ssh into my
server this will be server one kill and over here look to the same I'm going to server two type in
the password kill let me check this out if I just fill screen this and I do an ip adder look what we
actually have here we have a regular ethernet connection with all of the ip address and just
the same but notice we have this tunnel connection and we can see here the ip address is 10 20 31
that is in server one now if we slide on over to the server two we can do the same thing ip adder
we can see our ethernet still intact but we also have built this tunnel two connection 10 20 32 so
if we try to ping our own side of the tunnel 10 20 33 or 10 20 32 sorry we can ping ourselves but
really the test is can we ping the adjacent side so from server two let's try to ping the
tunnel interface on the opposite server so I'll ping 10 20 31 hit enter and indeed we can see
we can actually ping over the tunnel connection so like I say we happen to have to play a little
bit fast and loose with the reality there because we were on the same network by virtue of having a
virtual machine or two virtual machines within the same network but as long as we can reach the
external ip address say over the internet we could ultimately build the same type of tunnel
and receive the exact same benefits of what we're seeing right here ultimately a local connection
built over a logical interface that is the tunnel interface all facilitated by open vpn now one thing
I will say is that open vpn can be way way way way more complex than what we've just seen we can
modify much more parameters we can work with certificates but the reality is for getting
used to the open vpn software these are the basic steps that you need to begin getting you up and
running so that is us for open vpn I hope it's been informative for you I'd like to thank you for viewing