CentrioHost Blog

A VPN, or Virtual Private Network, is a service that creates an encrypted tunnel between the location of your computer and a remote server.

All of your Internet traffic is routed through this tunnel, effectively masking your real location since your computer will seem to have the IP address of the VPN server.

In addition, all traffic is encrypted so your data remains safe at all times, even if intercepted by a hacker or your network administrator.

WHY DO YOU NEED A VPN?

The two main benefits of a VPN, anonymity and encryption, have made these services hugely popular. In the modern world, most aspects of our lives are transmitted in one way or another over the Internet.

Every single action that you perform online, like visiting a site or clicking on a photo, is recorded and traced back to your IP address. If you are concerned about your online privacy, using a VPN has become almost mandatory.

Anonymous browsing doesn’t only protect your privacy, but also provides a number of other benefits. Virtual private networks have been used for a long time in countries like China, in order to bypass censorship and Internet access restrictions.

They also allow users to view live streams from all around the world or elude the strict network rules of university access points.

Since the VPN tunnel is always encrypted, you no longer have to worry about using unsecured networks. You can connect to any public WiFi hotspot and do online banking for example, without any risks.

VPN ALTERNATIVES

If you need a VPN, there are three main options: using a free service, a paid one or setting up your own VPN server.

Free services are a bad idea because they are not really secure and have serious limitations, we have already detailed why you should avoid them in a previous article.

Paid VPNs are more reliable but even these are not fully secure and there have been cases when the providers were forced to disclose client data to investigators.

In addition, a monthly VPN subscription is usually more expensive that the cost of setting up your own server. Today, you can provision a VPS (Virtual Private Server) for a really low price and configure it as a VPN in order to hide and secure your Internet traffic. While setting up a VPN is not an easy task, we will guide you through all the steps in this article.

PREREQUISITES

There are several applications that can be used to install a VPN server. In this article, we will use OpenVPN, which provides a very flexible solution.

OpenVPN can be installed on various operating systems, from Windows to Linux or MacOS. It has very low system requirements, so the Host SEO has enough resources to run it effectively. Your server must have a dedicated static IP address.

We will use a CentOS 7.6 VPS with 2 CPU cores and 2 GB RAM but you can go even lower if you want. Before the installation, run a general system update in order to make sure that all packages are upgraded to their latest version.

GETTING YOUR VPS SERVER

Make sure you have a VPS you can run your VPN service on. You can get the best service quality for the lowest price point by getting one of our Host SEO servers.

INSTALLING OPENVPN

The installation process is pretty straightforward. Since OpenVPN is not available from the standard CentOS repositories, the first step is to install EPEL and refresh the list of available packages:

You can now install OpenVPN:

We will also install EasyRSA, a tool that simplifies the setup of an internal certificate authority (CA) on the server and SSL key generation. The package is also available in the EPEL repository and can be easily installed with yum:

CONFIGURING OPENVPN

Open VPN has many configuration options, which can be quite complex. Fortunately, a sample configuration file is provided, with comments that explain the functions of each line. Copy it to the default configuration folder and use it as a basis for your own settings file:

Open the file with your favorite text editor; we will use vim in this example. Since vim’s default color scheme makes comments difficult to read, you can switch to a different one (with a command like :colorscheme desert):

Start by changing the default port and protocol to 443 tcp:

Next, you have to modify the location of the certificates that will be used by the server:

The next two lines that have to be uncommented are:

These will create a subnetwork that allocates addresses to client machines. The server will use the first address in the subnet (10.8.0.1), while the first client will be assigned the IP 10.8.0.2.

The most important line that must be uncommented is this one:

It basically instructs client machines to redirect all their traffic through the VPN, instead of their local gateway. Since using this route will ignore the local network’s DNS servers, new ones have to be defined. In this example, we will use the most popular public DNS servers, provided by Google and Cloudflare:

In order to improve security and follow official OpenVPN guidelines, enable TLS authentication. Comment the line that begins with tls-auth and define an encryption key that you’ll generate with the name of your choice (mykey.tls in this example):

Adding this line will harden security checks even further:

You can also enable compression by uncommenting these two options:

Finally, configure OpenVPN to run with the user and group nobody, so the service doesn’t have any privileges after it starts. The lines that have to be uncommented are:

The last line of the file also has to be changed, because this option is not compatible with the TCP protocol:

You now have a solid basic configuration in place, so save the file and exit. Since all directives are very well documented in the file, you can tweak other parameters if you want.

Don’t forget to generate the static encryption key by executing this command:

GENERATE SSL KEYS AND CERTIFICATES

While keys and certificates can be generated in several ways, the scripts installed by EasyRSA make this task very simple.

Create a folder in order to store the keys and certificates that will be generated:

Copy the EasyRSA scripts from their initial location to this folder:

Navigate to the configuration folder and run the scripts in order to initialize a new PKI and build a certificate authority (CA):

In order to build the CA, you have to enter a PEM pass phrase as well as a Common Name (CN) for your server, or just press Enter for the default value. Make sure that you remember the PEM password, since you will need it later.

The next step is to generate the keys and certificates of the actual OpenVPN server, in this example we will use “server” as the filename. The PEM password is required by the signing request script:

The DH parameters used during the TLS handshake with clients are generated by the following command, which takes some time to finish:

Every client also needs a certificate in order to connect to the server. It is very important to keep this certificate safe and not share it with others, in order to avoid a massive security risk. If you want to allow other people to use your OpenVPN server, generate a separate certificate for them using the same procedure.

In this example, we will generate a key and certificate for client1, the PEM password is needed again:

Congratulations, all certificates have been generated. You will need the following four files in order to configure the client side of the VPN: