Connection to openVPN Access Server

Question

we are using an openVPN Access Server and I would like to connect to it via the VPN network setting (network-manager-openvpn).

I downloaded the client.ovpn and I can connect to the server via the command line: openvpn --script-security 2 --config client.ovpn

How can I add the connection to the network manager? Which (key) entry is which? User Cert, CA Cert, Private Key?

Here is an example of the client.ovpn http://nopaste.info/c10ec207f2.html

Thanks in advance.

Answer 1

• the certificate below OVPN_ACCESS_SERVER_WEB_CA_BUNDLE_START, is your CA certificate
• the -----BEGIN RSA PRIVATE KEY--- , is your private key

copy the content of these certificates into separate files. including everything from the ---BEGIN---- , to ----END---- part and add the in the corresponding entry in the vpn tab of network manager

I cant really tell from your configuration file which cert is the user certificate. But it's not the openvpn static key. copy and save the ones left to separate files, and try them one by one by one until you manage to connect

Answer 2

To set up the VPN via the gui network-manager, you need to provide a key and some certificates. They are actually all in the client.ovpn file that you can download via a web browser connection to your access server. It is then a matter of copying them out of that text file and pasting them into separate files. But there is an easier way because the installation of the server includes a script which does that for you.

Instructions are here at the time of writing: http://openvpn.net/index.php/access-server/docs/admin-guides/228-how-to-extract-the-ca-cert-and-key-from-openvpn-as-certificates.html

This is what I did:

I have openvpn_as installed on Ubuntu Server 14.04. The scripts directory is therefore /usr/local/openvpn_as/scripts

as root or sudo run (on the server)

./sacli -a 'openvpn' -o OUTPUT_DIRECTORY --cn 'your user' get5

The first user, 'openvpn', needs to be an admin user. I didn't change the default when I set up my server, so I provided "openvpn" to this command.

'your user' is one of the users you have set up. I used /tmp as the output directory since I'm the only user on this machine.

What I did was then copy those five files into a directory back on my client machine (which also happens to be Ubuntu, this time 14.10). I called it "openvpn_config". You will have five files: a client.ovpn file, and four certificate-type files.

Now repeat the process of importing a client.ovpn file to a new VPN connection via the gui network manager. You can now assign the secret key (the client.key file) , ca.crt and client.crt files on the main dialog.

You still need to find a home for the ta.key file.

For this, you need to go into the advanced settings folder and set the TLS key file as well (to ta.key). Make the direction setting "1".

provide the user and password, and save. You may need to log out and log in again. Then try your connection.

messages are written to syslog to sudo tail -f /var/log/syslog will show you what's happening as the connection is attempted. You will notice permission warnings.