Configure an OpenVPN server

Required configuration items

Enable the OpenVPN server.
The OpenVPN server is enabled by default.
The mode used by the OpenVPN server, one of:
- TUN (OpenVPN managed)—Also known as routing mode. Each OpenVPN client is assigned a different IP subnet from the OpenVPN server and other OpenVPN clients. OpenVPN clients use Network Address Translation (NAT) to route traffic from devices connected on its LAN interfaces to the OpenVPN server.
- TAP - OpenVPN managed—Also know as bridging mode. A more advanced implementation of OpenVPN. The EX15 device creates an OpenVPN interface and uses standard interface configuration (for example, a standard DHCP server configuration).
- TAP - Device only—An alternate form of OpenVPN bridging mode, in which the device, rather than OpenVPN, controls the interface configuration. If this method is is, the OpenVPN server must be included as a device in either an interface or a bridge.
The firewall zone to be used by the OpenVPN server.
The IP network and subnet mask of the OpenVPN server.
The server's Certificate authority (CA) certificate, and public, private and Diffie-Hellman (DH) keys.
An OpenVPN authentication group and an OpenVPN user.
Determine the method of certificate management:
- Certificates managed by the server.
- Certificates created externally and added to the server.
If certificates are created and added to the server, determine the level of authentication:
- Certificate authentication only.
- Username and password authentication only.
- Certificate and username and password authentication.
If username and password authentication is used, you must create an OpenVPN authentication group and user. See Configure an OpenVPN Authentication Group and User for instructions.
Certificates and keys:
- The CA certificate (usually in a ca.crt file).
- The Public key (for example, server.crt)
- The Private key (for example, server.key).
- The Diffie Hellman key (usually in dh2048.pem).
Active recovery configuration. See Configure SureLink active recovery for OpenVPN for information about OpenVPN active recovery.

Additional configuration items

The route metric for the OpenVPN server.
The range of IP addresses that the OpenVPN server will provide to clients.
The TCP/UDP port to use. By default, the EX15 device uses port 1194.
Access control list configuration to restrict access to the OpenVPN server through the firewall.
Additional OpenVPN parameters.

 Web

Log into Digi Remote Manager, or log into the local Web UI as a user with full Admin access rights.
Access the device configuration:
Remote Manager:
1. Locate your device as described in Use Digi Remote Manager to view and manage your device.
2. Click the Device ID.
3. Click Settings.
4. Click to expand Config.
Local Web UI:
1. On the menu, click System. Under Configuration, click Device Configuration.
  The Configuration window is displayed.
Click VPN > OpenVPN > Servers.
For Add, type a name for the OpenVPN server and click .
The new OpenVPN server configuration is displayed.
The OpenVPN server is enabled by default. To disable, toggle off Enable.
For Device type, select the mode used by the OpenVPN server, either:
- TUN (OpenVPN managed)
- TAP - OpenVPN managed
- TAP - Device only
See OpenVPN for information about OpenVPN server modes.
If TUN (OpenVPN managed) or TAP - OpenVPN managed is selected for Device type:
1. For Zone, select the firewall zone for the OpenVPN server. For TUN device types, this should be set to Internal to treat clients as LAN devices.
2. (Optional) Select the Metric for the OpenVPN server. If multiple active routes match a destination, the route with the lowest metric will be used. The default setting is 0.
3. For Address, type the IP address and subnet mask of the OpenVPN server.
4. (Optional) For First IP address and Last IP address, set the range of IP addresses that the OpenVPN server will use when providing IP addresses to clients. The default is from 80 to 99.
(Optional) Set the VPN port that the OpenVPN server will use. The default is 1194.
For Server managed certificates, determine the method of certificate management. If enabled, the server will manage certificates. If not enabled, certificates must be created externally and added to the server.
If Server managed certificates is not enabled:
1. Select the Authentication type:
  - Certificate only: Uses only certificates for client authentication. Each client requires a public and private key.
  - Username/password only: Uses a username and password for client authentication. You must create an OpenVPN authentication group and user. See Configure an OpenVPN Authentication Group and User for instructions.
  - Certificate and username/password: Uses both certificates and a username and password for client authentication. Each client requires a public and private key, and you must create an OpenVPN authentication group and user. See Configure an OpenVPN Authentication Group and User for instructions.
2. Paste the contents of the CA certificate (usually in a ca.crt file), the Public key (for example, server.crt), the Private key (for example, server.key), and the Diffie Hellman key (usually in dh2048.pem) into their respective fields. The contents will be hidden when the configuration is saved.
(Optional) Click to expand Access control list to restrict access to the OpenVPN server:
- To limit access to specified IPv4 addresses and networks:
  1. Click IPv4 Addresses.
  2. For Add Address, click .
  3. For Address, enter the IPv4 address or network that can access the device's service-type. Allowed values are:
    A single IP address or host name.
    A network designation in CIDR notation, for example, 192.168.1.0/24.
    any: No limit to IPv4 addresses that can access the service-type.
  4. Click  again to list additional IP addresses or networks.
- To limit access to specified IPv6 addresses and networks:
  1. Click IPv6 Addresses.
  2. For Add Address, click .
  3. For Address, enter the IPv6 address or network that can access the device's service-type. Allowed values are:
  4. Click  again to list additional IP addresses or networks.
- To limit access to hosts connected through a specified interface on the device:
  1. Click Interfaces.
  2. For Add Interface, click .
  3. For Interface, select the appropriate interface from the dropdown.
  4. Click  again to allow access through additional interfaces.
- To limit access based on firewall zones:
  1. Click Zones. By default, there are three firewall zones already configured: Internal, Edge, and IPsec.
  2. For Add Zone, click .
  3. For Zone, select the appropriate firewall zone from the dropdown.
    See Firewall configuration for information about firewall zones.
  4. Click  again to allow access through additional firewall zones.
(Optional) Click to expand Advanced Options to manually set additional OpenVPN parameters.
1. Click Enable to enable the use of additional OpenVPN parameters.
2. Click Override if the additional OpenVPN parameters should override default options.
3. For OpenVPN parameters, type the additional OpenVPN parameters.
Click Apply to save the configuration and apply the change.

 Command line

Select the device in Remote Manager and click Actions > Open Console, or log into the EX15 local command line as a user with full Admin access rights.
Depending on your device configuration, you may be presented with an Access selection menu. Type admin to access the Admin CLI.
At the command line, type config to enter configuration mode:
```
> config
(config)>
```

At the config prompt, type:

(config)> add vpn openvpn server name
(config vpn openvpn server name)>

where name is the name of the OpenVPN server.

The OpenVPN server is enabled by default. To disable the server, type:

(config vpn openvpn server name)> enable false
(config vpn openvpn server name)>

Set the mode used by the OpenVPN server:
```
(config vpn openvpn server name)> device_type value
(config vpn openvpn server name)>
```
where value is one of:
- TUN (OpenVPN managed)—Also known as routing mode. Each OpenVPN client is assigned a different IP subnet from the OpenVPN server and other OpenVPN clients. OpenVPN clients use Network Address Translation (NAT) to route traffic from devices connected on its LAN interfaces to the OpenVPN server.
- TAP - OpenVPN managed—Also know as bridging mode. A more advanced implementation of OpenVPN. The EX15 device creates an OpenVPN interface and uses standard interface configuration (for example, a standard DHCP server configuration).
- TAP - Device only—An alternate form of OpenVPN bridging mode, in which the device, rather than OpenVPN, controls the interface configuration. If this method is is, the OpenVPN server must be included as a device in either an interface or a bridge.
See OpenVPN for information about OpenVPN modes. The default is tun.
If tap or tun are set for device_type:
1. Set the IP address and subnet mask of the OpenVPN server.
```
(config vpn openvpn server name)> address ip_address/netmask
(config vpn openvpn server name)>
```
2. Set the firewall zone for the OpenVPN server. For TUN device types, this should be set to internal to treat clients as LAN devices.
```
(config vpn openvpn server name)> zone value
(config vpn openvpn server name)>
```
  To view a list of available zones:
```
(config vpn openvpn server name)> firewall zone ?

Zone: The zone for the local TUN interface. To treat clients as LAN devices this would usually be
set to internal.
Format:
  any
  dynamic_routes
  edge
  external
  hotspot
  internal
  ipsec
  loopback
  setup
Current value:

(config vpn openvpn server name)>
```
3. (Optional) Set the route metric for the OpenVPN server. If multiple active routes match a destination, the route with the lowest metric will be used.
```
(config vpn openvpn server name)> metric value
(config vpn openvpn server name)>
```
  where value is an interger between 0 and 65535. The default is 0.
4. (Optional) Set the range of IP addresses that the OpenVPN server will use when providing IP addresses to clients:
  1. Set the first address in the range limit:
```
(config vpn openvpn server name)> server_first_ip value
(config vpn openvpn server name)>
```
    where value is a number between 1 and 255. The number entered here will represent the first client IP address. For example, if address is set to 192.168.1.1/24 and server_first_ip is set to 80, the first client IP address will be 192.168.1.80.
    The default is from 80.
  2. Set the last address in the range limit:
```
(config vpn openvpn server name)> server_last_ip value
(config vpn openvpn server name)>
```
    where value is a number between 1 and 255. The number entered here will represent the last client IP address. For example, if address is set to 192.168.1.1/24 and server_last_ip is set to 99, the last client IP address will be 192.168.1.80.
    The default is from 80.

(Optional) Set the port that the OpenVPN server will use:

(config vpn openvpn server name)> port port
(config vpn openvpn server name)>

The default is 1194.

Determine the method of certificate management:
1. To allow the server to manage certificates:
```
(config vpn openvpn server name)> autogenerate true
(config vpn openvpn server name)>
```
2. To create certificates externally and add them to the server
```
(config vpn openvpn server name)> autogenerate false
(config vpn openvpn server name)>
```
The default setting is false.
1. If autogenerate is set to false:
  1. Set the authentication type:
```
(config vpn openvpn server name)> authentication value
(config vpn openvpn server name)>
```
  2. Paste the contents of the CA certificate (usually in a ca.crt file) into the value of the cacert parameter:
```
(config vpn openvpn server name)> cacert value
(config vpn openvpn server name)>
```
  3. Paste the contents of the public key (for example, server.crt) into the value of the server_cert parameter:
```
(config vpn openvpn server name)> server_cert value
(config vpn openvpn server name)>
```
  4. Paste the contents of the private key (for example, server.key) into the value of the server_key parameter:
```
(config vpn openvpn server name)> server_key value
(config vpn openvpn server name)>
```
  5. Paste the contents of the Diffie Hellman key (usually in dh2048.pem) into the value of the diffie parameter:
```
(config vpn openvpn server name)> diffie value
(config vpn openvpn server name)>
```
(Optional) Set the access control list to restrict access to the OpenVPN server:
- To limit access to specified IPv4 addresses and networks:
```
(config vpn openvpn server name)> add acl address end value
(config vpn openvpn server name)>
```
  Where value can be:
  - A single IP address or host name.
  - A network designation in CIDR notation, for example, 192.168.1.0/24.
  - any: No limit to IPv4 addresses that can access the service-type.
  Repeat this step to list additional IP addresses or networks.
- To limit access to specified IPv6 addresses and networks:
```
(config vpn openvpn server name)> add acl address6 end value
(config vpn openvpn server name)>
```
  Where value can be:
  - A single IP address or host name.
  - A network designation in CIDR notation, for example, 2001:db8::/48.
  - any: No limit to IPv6 addresses that can access the service-type.
  Repeat this step to list additional IP addresses or networks.
- To limit access to hosts connected through a specified interface on the EX15 device:
```
(config vpn openvpn server name)> add acl interface end value
(config vpn openvpn server name)>
```
  Where value is an interface defined on your device.
  Display a list of available interfaces:
  Use ... network interface ? to display interface information:
  (config vpn openvpn server name)> ... network interface ? Interfaces Additional Configuration ------------------------------------------- setupip Setup IP setuplinklocalip Setup Link-local IP lan LAN loopback Loopback modem Modem config vpn openvpn server name)>
  Repeat this step to list additional interfaces.
- To limit access based on firewall zones:
```
(config vpn openvpn server name)> add acl zone end value
(config vpn openvpn server name)>
```
  Where value is a firewall zone defined on your device, or the any keyword.
  Display a list of available firewall zones:
  Type ... firewall zone ? at the config prompt:
  (config vpn openvpn server name)> ... firewall zone ? Zones: A list of groups of network interfaces that can be referred to by packet filtering rules and access control lists. Additional Configuration ------------------------------------------------------------------------------- any dynamic_routes edge external hotspot internal ipsec loopback setup (config vpn openvpn server name)>
  Repeat this step to include additional firewall zones.

Save the configuration and apply the change.
```
(config)> save
Configuration saved.
>
```
Type exit to exit the Admin CLI.
Depending on your device configuration, you may be presented with an Access selection menu. Type quit to disconnect from the device.