How to setup OpenVPN server for iPhone

This is not a full tutorial but rather examples of working configuration files. Still, some commands will be mentioned but it is up to you to read properly OpenVPN documentation. Server part was done on Debian. Probably the client configuration can be used for Android too. However, I have tested only iPhone here. 1. Install Openvpn. Details you can find here. 2. Create a directory in /etc/openvpn (in my example mobile-easy-rsa) and copy files as follows:

core:~# mkdir /etc/openvpn/mobile-easy-rsa/
core:~# cp -R /usr/share/doc/openvpn/examples/easy-rsa/2.0* /etc/openvpn/mobile-easy-rsa/
core:~# cd /etc/openvpn/mobile-easy-rsa/2.0/

3. Edit vars files according to your specifications. Pay special attention to the following:

export KEY_COUNTRY="US"
export KEY_PROVINCE="California"
export KEY_CITY="San Fransisco"
export KEY_ORG="My Company"
export KEY_EMAIL="my@mail.com"
export KEY_CN=server
export KEY_NAME=server
export KEY_OU=home

4. Create the server and Diffie-Helman certificates:

core:2.0# source ./vars
core:2.0# ./clean-all
core:2.0# ./build-ca
core:2.0# ./build-dh
core:2.0# ./build-key-server server

5. Create the client certificate (one for each client - in our example it will be only one):

core:2.0# ./build-key iPhone

At this point, all your needed keys should be in /etc/openvpn/mobile-easy-rsa/2.0/keys/. 6. Server configuration working example. You will have to modify port, server and certificates path accordind to your needs:

core:openvpn# cat mobile.conf
dev tun2
tls-server
dh [color=red]mobile-easy-rsa/2.0/keys/[/color]dh1024.pem
ca [color=red]mobile-easy-rsa/2.0/keys/[/color]ca.crt
cert [color=red]mobile-easy-rsa/2.0/keys/[/color]server.crt
key [color=red]mobile-easy-rsa/2.0/keys/[/color]server.key
server [color=red]10.10.10.0 255.255.255.248[/color]
comp-lzo
script-security 2
route-up "/sbin/ifconfig tun2 up"
port [color=red]1196[/color]
proto tcp-server
keepalive 30 120
client-config-dir mobile-custom
client-to-client
[color=blue]push "redirect-gateway def1"
domain-name-servers 10.10.10.1[/color]

The parameters in blue are needed if you want to drive all traffic on your client via VPN. 7. Restart the openvn server:

core:~# /etc/init.d/openvpn restart
Stopping virtual private network daemon: mobile.
Starting virtual private network daemon: mobile.

8. iPhone client configuration working example. Again, you will have to modify some parameters based on your specifications:

flmbp:~ $ cat config.ovpn
tls-client
remote [color=red]server_hostname_or_ip 1196[/color]
ca [color=red]ca.crt[/color]
cert [color=red]iPhone.crt[/color]
key [color=red]iPhone.key[/color]
comp-lzo
proto tcp

9. Install OpenVPN from App Store and copy the following configuration files via itunes (There are other ways to do this, iTunes is the easiest): - configuration file from point 8:

config.ovpn

-

/etc/openvpn/mobile-easy-rsa/2.0/keys/iPhone.key

-

/etc/openvpn/mobile-easy-rsa/2.0/keys/iPhone.crt

-

/etc/openvpn/mobile-easy-rsa/2.0/keys/ca.crt

10. Start OpenVPN aplication and follow the instructions. It is quite easy. END!