Manuale Utente (Inglese)

Go to C:\Program Files\OpenVPN\easy-rsa and run:

init-config.bat

As a result, we will get a vars.bat file that configures the environment for generating your keys and certificates.

Open this file in Windows Notepad and specify a folder to store them; by default, it's 'keys':

set KEY_DIR=keys

as well as the default values of your certificate owner's fields, for example:

set KEY_COUNTRY=GB
set KEY_PROVINCE=YourProvince
set KEY_CITY=YourCity
set KEY_ORG=YourOrganisation
set KEY_EMAIL=mail@example.com
set KEY_CN=CommonName
set KEY_NAME=KeyName
set KEY_OU=OrganisationUnit

Save the changed file.

Create new index.txt and serial auxiliary files by executing (once) in the Windows command line:

vars
clean-all

Create a private key and certificate for your certificate authority by doing the following:

vars
build-ca

The generated ca.key and ca.cert files of your certification authority will appear in the C:\Program Files\OpenVPN\easy-rsa\keys folder.

Create a Diffy-Helman file to protect your traffic from decryption. The TLS server will use it. In some cases, the procedure may take some time ( for example, when the key size is 4096 bits, it takes tens of minutes), but it has to be done only once:

vars
build-dh

The file dh2048.pem (or dh4096.pem when using a 4096-bit key size) will appear in the C:\Program Files\OpenVPN\easyrsa\keys folder.

Create a private key and certificate for the OpenVPN TLS server (Keenetic-1) by executing:

vars
build-key-server Keenetic-1

When the script asks for Common Name (CN), enter the server name, such as Keenetic-1. In the end, double confirm (y) that you are signing the certificate.

Create the private key, PEM request and certificate for the first OpenVPN TLS client (Keenetic-2) by executing:

vars
build-key Keenetic-2

When the script asks for Common Name (CN), enter the name of the first client — Keenetic-2. Confirm twice (y) that you are signing the certificate.

Repeat the previous step for the second client (Keenetic-3):

vars
build-key Keenetic-3

When the script will ask for Common Name (CN), enter the name of the second client — Keenetic-3. Confirm twice (y) that you sign the certificate.

Similarly, you can create keys, queries, and certificates for any number of clients.

Create an HMAC key for additional protection against DoS attacks and flooding by executing:

vars
openvpn.exe --genkey --secret keys\ta.key

At this point, all the necessary files are created:

The following files are required for use in OpenVPN server and clients configs:

The only thing left to do is to add their contents to the server and client configuration text files.

To create an OpenVPN server configuration file, use the example server.ovpn located in the C:\Program Files\OpenVPN\sample-config\. You will need to insert the keys and certificates into it as follows:

To create the configuration file for the first OpenVPN client, use the example of client.ovpn located in the C:\Program Files\OpenVPN\sample-config\ . You will need to insert the keys and certificates into it as follows:

Repeat the same actions for the second client by taking the data from Keenetic-3.crt and Keenetic-3.key files, respectively.

Examples of such configuration files for three Keenetic clients are attached at the end of the article:

You can use them by replacing the KEENETIC-1.mykeenetic.co.uk client name in the clients' files with the domain name or public IP address of your Keenetic-1 server and certificates and keys to the files generated by you.

Now all you need to do is download them to Keenetic routers in the same way as in 1.5, 1.6 and perform the actions described in 1.7, 1.8 of this manual.

This is the end of the setup. Check that the tunnels are set up.

To do this, run ping the server's tunnel address from the client's side:

ping 10.1.0.1

and the server's address on its home network:

ping 192.168.1.1