1. Download the script and change permission<\/h3>\r\n\r\n\r\n\r\ncd \/opt\r\ncurl -O https:\/\/raw.githubusercontent.com\/Angristan\/openvpn-install\/master\/openvpn-install.sh\r\nchmod +x openvpn-install.sh<\/pre>\r\n\r\n\r\n\r\n2. Running the script<\/h3>\r\n\r\n\r\n\r\n
Once downloaded and correct permissions have been applied, we can activate the script by typing:<\/p>\r\n\r\n\r\n\r\n
.\/openvpn-install.sh<\/pre>\r\n\r\n\r\n\r\nDuring installation, several questions will be asked and we will tackle them one by one.<\/p>\r\n\r\n\r\n\r\n
1. IP address<\/strong> – this will be your server’s public IP address.<\/p>\r\n\r\n\r\n\r\n2. Do you want to enable IPv6 support (NAT)? [y\/n]:<\/strong> n<\/strong> – For now, IPv4 will do.<\/p>\r\n\r\n\r\n\r\n3. What port do you want OpenVPN to listen to? [1-3]:<\/strong> 1<\/strong> – the default port for the OpenVPN server is 1194.<\/p>\r\n\r\n\r\n\r\n4. What protocol do you want OpenVPN to use? [1-2]:<\/strong> 1<\/strong> – Both TCP and UDP are protocols for sending packets on the internet. The main difference is that TCP has error checking while UDP does not. UDP is recommended by the installer since it provides a faster connection. It is mostly used for streaming and gaming. For other purposes, we recommend using TCP to avoid data loss.<\/p>\r\n\r\n\r\n\r\n5. What DNS resolvers do you want to use with the VPN?: 3 <\/strong>– For this, we recommend Google’s DNS but this is a personal choice.<\/p>\r\n\r\n\r\n\r\n6. Do you want to use compression?: n <\/strong>– To avoid some vulnerabilities, it is best to disable compression.<\/p>\r\n\r\n\r\n\r\n7. Do you want to customize encryption settings? y <\/strong> – For the sake of this tutorial, we will go through the encryption settings to provide insights about encryption that will be used by our OpenVPN server.<\/p>\r\n\r\n\r\n\r\n8. Choose which cipher you want to use for the data channel: 1 [AES] <\/strong> – AES is currently the fastest cipher available for OpenVPN. The recommended value is AES-128-GCM. You may notice that AES-256-GCM is also available but that provides slower performance.<\/p>\r\n\r\n\r\n\r\n9. Choose what kind of certificate you want to use: 1 [ECDSA] <\/strong>– RSA has gained his popularity due to its performance, maturity, and compatibility for most of the applications but in today’s security, ECDSA provides a higher key size, is scalable, and is the future of certificates.<\/p>\r\n\r\n\r\n\r\n10. Choose which curve you want to use for the certificate’s key:<\/strong> 1 [prime256v1]<\/strong> – Since the release of OpenVPN 2.4, Elliptic-curve Diffie\u2013Hellman or ECDH keys are now supported.<\/p>\r\n\r\n\r\n\r\n11. Choose which cipher you want to use for the control channel: 1 [ECDHE-ECDSA-AES-128-GCM-SHA256] – <\/strong>Again, 128 bits key is secure enough and still provides better performance.<\/p>\r\n\r\n\r\n\r\n12. Choose what kind of Diffie-Hellman key you want to use: 1 [ECDH] <\/strong>– ECDH is being used by modern standards.<\/p>\r\n\r\n\r\n\r\n13. Choose which curve you want to use for the ECDH key: 1 [prime256v1] – <\/strong>A 256-bit key should be enough.<\/p>\r\n\r\n\r\n\r\n14. Which digest algorithm do you want to use for HMAC?<\/strong>: 1 [SHA256] – <\/strong>Again,<\/strong> a 256-bit key should be enough and is the sweet spot for security and performance.<\/p>\r\n\r\n\r\n\r\n15. An additional layer of security to the control channel: 1 [tls-crypt]<\/strong> – For increased security, we should choose tls-crypt over tls-auth as it also encrypts the TLS stack.<\/p>\r\n\r\n\r\n\r\n