Paranoid Networking: Building a Bulletproof OpenVPN Gateway on CentOS 6

The Coffee Shop Attack Vector

It happens every day in Oslo. You sit down at a cafe in Grünerløkka, connect to the open Wi-Fi, and SSH into your production server. If you aren't tunneling that traffic, you are trusting the cafe owner's router—and everyone else connected to it—with your metadata. Tools like Firesheep proved two years ago just how trivial session hijacking is. If you are managing infrastructure without a VPN, you are negligent. Period.

We are going to build a private VPN gateway. We aren't using PPTP; it's broken and insecure. We are using OpenVPN. It is the industry standard for SSL-based VPNs. It is robust, it handles NAT traversal gracefully, and it works over UDP.

Why Most VPS Providers Fail at VPNs

Here is the dirty secret of the hosting industry in 2012: Overselling.

Many budget hosts pack thousands of customers onto a single physical server using OpenVZ virtualization. In those containers, you share the host's kernel. Often, the host disables the tun/tap device to save resources. Without a TUN device, OpenVPN cannot route packets. It simply won't start.

Pro Tip: Always verify your virtualization technology. At CoolVDS, we use KVM (Kernel-based Virtual Machine). You get your own dedicated kernel. The tun module is yours to load or unload. It mimics bare metal behavior, which is critical for network appliances.

Prerequisites

• A CoolVDS KVM instance (512MB RAM is plenty for a VPN).
• CentOS 6.2 (Minimal install).
• Root access.
• Coffee (Black).

Step 1: The Foundation & PKI

First, we need the EPEL repository because CentOS base repos are too conservative to include OpenVPN.

rpm -Uvh http://download.fedoraproject.org/pub/epel/6/i386/epel-release-6-5.noarch.rpm
yum update -y
yum install openvpn easy-rsa -y

Encryption is only as good as the keys. We are going to generate a 2048-bit Diffie-Hellman parameter. This will take time. On a standard shared host, this entropy generation can stall for minutes. On CoolVDS high-performance SSD storage, it's significantly faster, but be patient.

Copy the easy-rsa generation scripts to a safe working directory:

mkdir -p /etc/openvpn/easy-rsa/2.0
cp -r /usr/share/easy-rsa/2.0/* /etc/openvpn/easy-rsa/2.0/
cd /etc/openvpn/easy-rsa/2.0
chmod 755 *

Edit the vars file. Don't leave the defaults. If you leave KEY_ORG=