Setting up a OpenVPN server

This article describes how to set up an OpenVPN server with the Alpine Linux.
This is an ideal solution for allowing single users or devices to remotely connect to your network. \\
It is recommended you have a publicly routable static IP address in order for this to work. This means that your IP address cannot be a bogon IP address (list IPv4, list IPv6).
If your Internet-connected machine doesn't have a static IP address, No-ip can be used for resolving DNS names to IP addresses.
= Set up Alpine =
== Initial Set up ==
Follow Installation to set up Alpine Linux.
== Install programs ==
Install openvpn
Prepare autostart of OpenVPN
Enable IP Forwarding
= Certificates =
One of the first things that needs to be done is to make sure you have secure keys to work with. Alpine makes this easy by having a web interface to manage the certificates. Documentation for it can be found here: Generating SSL certs with ACF. It is a best practice not to have your certificate server be on the same machine as the router being used for remote connectivity.
You will need to create a server (ssl_server_cert) certificate for the server and one client certificate (ssl_client_cert) for each client. To use the certificates, you should download the .pfx file and extract it.
To extract the three parts of each .pfx file, use the following commands:
 
To get the ca cert out:
To get the cert file out:
To get the private key file out: (Make sure the key stays private)
On the VPN server, you can also install the acf-openvpn package, which contains a web page to automatically upload and extract the server certificate. There is also a button to automatically generate the Diffie-Hellman parameters.
If you would prefer to generate your certificates using OpenVPN utilities, see #Alternate Certificate Method
= Configure OpenVPN server =
Example configuration file for server. Place the following content in /etc/openvpn/openvpn.conf:
 local "Public Ip address"
 port 1194
 proto udp
 dev tun
 ca /etc/openvpn/easy-rsa/keys/ca.crt 
 cert /etc/openvpn/easy-rsa/keys/Server.crt # SWAP WITH YOUR CRT NAME
 key /etc/openvpn/easy-rsa/keys/Server.key # SWAP WITH YOUR KEY NAME
 dh /etc/openvpn/easy-rsa/keys/dh1024.pem # If you changed to 2048, change that here!
 server 10.0.0.0 255.255.255.0
 ifconfig-pool-persist ipp.txt
 push "route 10.0.0.0 255.0.0.0"
 push "dhcp-option DNS 10.0.0.1"
 keepalive 10 120
 comp-lzo
 user nobody
 group nobody
 persist-key
 persist-tun
 status /var/log/openvpn-status.log
 log-append /var/log/openvpn.log
 verb 3
(Instructions are based on openvpn.net/howto.html#server)
== Test your configuration ==
Test configuration and certificates
= Configure OpenVPN client =
Example client.conf:
 client
 dev tun
 proto udp
 remote "public IP" 1194
 resolv-retry infinite
 nobind
 ns-cert-type server # This means the certificate on the openvpn server needs to have this field. Prevents MitM attacks
 persist-key
 persist-tun
 ca client-ca.pem
 cert client-cert.pem
 key client-key.pem
 comp-lzo
 verb 3
(Instructions are based on openvpn.net/howto.html#client)
= Save settings =
Don't forget to save all your settings if you are running a RAM-based system.
= More than one server or client =
If you want more than one server or client running on the same Alpine box, use the standard Multiple Instances of Services process.
For example, to create a config named "AlphaBravo":
* Create an approriate /etc/openvpn/openvpn.conf file, but name it "/etc/openvpn/AlphaBravo.conf" 
* create a new symlink of the init.d script:
* Have the new service start automatically
= Alternate Certificate Method =
== Manual Certificate Commands ==
(Instructions are based on openvpn.net/howto.html#pki)
=== Initial setup for administrating certificates ===
The following instructions assume you want to save your configs, certs and keys in /etc/openvpn/keys.<BR>
Start by moving to the /usr/share/openvpn/easy-rsa folder to execute commands
If not already done, create a folder where you will save your certificates and save a copy of your /usr/share/easy-rsa/vars for later use.<BR>
For EasyRSA v3 see: https://community.openvpn.net/openvpn/wiki/EasyRSA
The instructions below are for EasyRSA v2:
If not already done, edit /etc/openvpn/keys/vars<BR>
(This file is used for defining paths and other standard settings)
* Change KEY_DIR= from "$EASY_RSA/keys" to "/etc/openvpn/keys"
* Change KEY_SIZE, CA_EXPIRE, KEY_EXPIRE, KEY_COUNTRY, KEY_PROVINCE, KEY_CITY, KEY_ORG, KEY_EMAIL to match your system.
source the vars to set properties
=== Set up a 'Certificate Authority' (CA) ===
Clean up the keys folder.
Generate Diffie-Hellman parameters
To make the CA certificates and keys
=== Set up an 'OpenVPN Server' ===
Create server certificates
=== Set up an 'OpenVPN Client' ===
Create client certificates
=== Revoke a certificate ===
To revoke a certificate
The revoke-full script will generate a CRL (certificate revocation list) file called crl.pem in the keys subdirectory.<BR>The file should be copied to a directory where the OpenVPN server can access it, then CRL verification should be enabled in the server configuration:
= OpenVPN and LXC =
Let's call this LXC "mylxc"...
On the host 
modprobe tun
mkdir /var/lib/lxc/mylxc/rootfs/dev/net
mknod /var/lib/lxc/mylxc/rootfs/dev/net/tun c 10 200
chmod 666 /var/lib/lxc/mylxc/rootfs/dev/net/tun
In /var/lib/lxc/mylxc/config 
lxc.cgroup.devices.allow = c 10:200 rwm
On the guest 
apk add openvpn
 Then config as usual.
This should work both as server and as client.
== persistent devices ==
lxc guest have their dev recreated on each restart in a tmpfs. This means all devices are reset and are not read from the rootfs dev directory. 
To make it persistent you can use an autodev script by adding the following to your lxc guest config:
# tun (openvpn)
lxc.cgroup.devices.allow = c 10:200 rwm
# audodev script to add devices
lxc.hook.autodev=/var/lib/lxc/CONTAINER/autodev
The autodev script:
#!/bin/sh
# dev is populated on earch container start.
# to make devices persistence we need to recreate them on each start.
cd ${LXC_ROOTFS_MOUNT}/dev
mkdir net
mknod net/tun c 10 200
chmod 0666 net/tun
category: VPN