OpenVPN Config Generator in Bash

👤 Rafał Rusin 📆 2025-04-03 20:33 🏷️ openvpn bash

Playful Cat

OpenVPN: A Well-Known VPN Solution

OpenVPN is a very popular choice for VPN solutions. It is available for all major Linux distributions, Android, Windows, and macOS. It is relatively simple to use, and there are many tutorials available on how to configure it.

This guide, however, takes a different approach. The provided script generates certificates, keys, and ready-to-use configurations for both servers and clients.

Highlights

  • Uses ECDSA for private keys, which is faster than RSA.
  • Supports CHACHA20 for CPUs without AES instructions or AES256 if AES instructions are available.
  • Generates configurations confirmed to work with OpenVPN 2.6.13.

Generating Certificates and Final Configuration

Executing the attached script will create a directory containing all certificates and the final OpenVPN configuration. Below is an example of a generated client configuration:

$ cat client10.ovpn 
client
dev tun
proto udp
remote rafal.rusin.eu.org 3478
resolv-retry infinite
nobind
persist-key
persist-tun
# Encryption ciphers
cipher CHACHA20-POLY1305
data-ciphers CHACHA20-POLY1305
# Test connection every 10 seconds, 120 seconds timeout
ping 10
ping-restart 120
# Verification common name of server
# set field to "server1" for CN=server1
verify-x509-name "server1" name
# Be verbose
verb 2
# key-direction 0 for server and 1 for client
key-direction 1
<tls-auth>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
d413b9d8efc126f56050e7ccb1bc0809
362a2da05549e8a27350cd0bc344d160
8d6c05ebf2e4ab2c80ca85debdffed92
29df4f91abb357fc84efb4dce2ec47be
a647fc7996dd8b32b6ef1275b3876f6e
a5cd74b4a6ba2cf840a23380d7aafa04
deff5b615634c78928d3d2459bfea6f1
91509645283a8f2e5501a92f24759258
7443483eb066479dc205ea4f32d4c998
aca6717cca296f46c0d10ca09ed71398
2f53565f0e13960d526f91f202f06090
a075c6de35715b677283b5dda3418d7f
1d2e46ebb7283344c0a5af80df341370
29f94fb66e81fc554693292a7aa2729f
1c035ac0d17da208a0231a07752d9615
7a9e2adf7477bee13119ccb8cd5c7cc4
-----END OpenVPN Static key V1-----
</tls-auth>
<cert>
-----BEGIN CERTIFICATE-----
MIIBazCCARKgAwIBAgIUC6ZpoynxXAWYvHKoP9UyGewo69UwCgYIKoZIzj0EAwIw
FTETMBEGA1UEAwwKT3BlblZQTi1DQTAeFw0yNTA0MDMyMDIxNTBaFw0zNTA0MDEy
MDIxNTBaMBMxETAPBgNVBAMMCGNsaWVudDEwMFkwEwYHKoZIzj0CAQYIKoZIzj0D
AQcDQgAEJGMWtaQHwE2htOuusWyUirDOqjIb3yD08Q1xUENdnWwXUmW+0oGJsDRj
In0198lNSWNcaLHcnrXEq6IYl+xClKNCMEAwHQYDVR0OBBYEFMw9okt4DxlIJIhb
BZrMU/5G/BH0MB8GA1UdIwQYMBaAFPYjKAIVsciyK7rW1bKC2hUes5xvMAoGCCqG
SM49BAMCA0cAMEQCIBcQyNSxbok3654mFQwjV5l4rCvFpvt1g4uNzLZBrTbyAiBD
qDn/ZnI9MYZ1h1/Gdmsil4yUw/8+Et3dsho0okC4Ig==
-----END CERTIFICATE-----
</cert>
<ca>
-----BEGIN CERTIFICATE-----
MIIBfjCCASWgAwIBAgIUCADBnaW9DjlDONqBxl520juJMNcwCgYIKoZIzj0EAwIw
FTETMBEGA1UEAwwKT3BlblZQTi1DQTAeFw0yNTA0MDMyMDIxMzZaFw0zNTA0MDEy
MDIxMzZaMBUxEzARBgNVBAMMCk9wZW5WUE4tQ0EwWTATBgcqhkjOPQIBBggqhkjO
PQMBBwNCAAQGfpDt33hhO/yNPH/WJLjfiRg7dVud5H0daafJLhXdniqJ9pS+6t6Y
bTr53+2creFCpOTcrNmLgPO0KyLwe/4ho1MwUTAdBgNVHQ4EFgQU9iMoAhWxyLIr
utbVsoLaFR6znG8wHwYDVR0jBBgwFoAU9iMoAhWxyLIrutbVsoLaFR6znG8wDwYD
VR0TAQH/BAUwAwEB/zAKBggqhkjOPQQDAgNHADBEAiBM3LJPsbE/FJPBs7sXFETe
igqUrPVM82bOeJYkR+gfgwIgHjcJaZj61GJTDvLSLKUXJoOyMLPTAKrNuwMwJcuv
KZ8=
-----END CERTIFICATE-----
</ca>
<key>
-----BEGIN EC PARAMETERS-----
BggqhkjOPQMBBw==
-----END EC PARAMETERS-----
-----BEGIN EC PRIVATE KEY-----
MHcCAQEEICByCfmFIv9W8bgFM62GFoAtP6w6eQ46CQcRrgDD4feFoAoGCCqGSM49
AwEHoUQDQgAEJGMWtaQHwE2htOuusWyUirDOqjIb3yD08Q1xUENdnWwXUmW+0oGJ
sDRjIn0198lNSWNcaLHcnrXEq6IYl+xClA==
-----END EC PRIVATE KEY-----
</key>

Script Overview

The script is short and allows customization of settings before generating a complete directory of configurations.

#!/bin/bash

# Set variables for certificates
days_valid=3650  # Certificate validity in days
ecdsa_curve=prime256v1  # ECDSA curve to use
dir="openvpn-ecdsa"
servers_no=3
clients_no=30

# set variables for openvpn
# Ciphers for CPU with AES support
#ovpn_ciphers="AES-256-GCM"
# Ciphers for CPU without AES
ovpn_ciphers="CHACHA20-POLY1305"
ovpn_port="3478"
ovpn_host="rafal.rusin.eu.org"
ovpn_maxclients="100"

# Function for generating openvpn configurations
generate_ovpn_server() {
cat > server${1}.ovpn << EOFF
port ${ovpn_port}
proto udp
dev tun0
# Network specified for this configuration
# peers will get IP from there
server 192.168.4.0 255.255.254.0
# Keep IP information in this file
ifconfig-pool-persist server${1}-ipp.txt
# Push routes configuration to clients
# so they will know this network is on this server
push "route 192.168.100.0 255.255.255.0"
push "route 192.168.55.0 255.255.255.0"
push "route 192.168.4.0 255.255.254.0"
# Server set this route locally on server
# so it will know this comes from openvpn
route 192.168.55.0 255.255.255.0
# Configuration from specified clients
# so they can have a peer specific config
# like iroute or something else
client-config-dir ccd
topology subnet
# Test connection every 10 seconds, 120 seconds timeout
keepalive 10 120
# Encryption ciphers
cipher ${ovpn_ciphers}
data-ciphers ${ovpn_ciphers}
# Maximum amount of clients connected
max-clients ${ovpn_maxclients}
# Effective ID and GID for openvpn process
# Have to be removed on some distros like Archlinux
user openvpn
group openvpn
persist-key
persist-tun
status server${1}-status.log
# Be verbose
verb 2
# key-direction 0 for server and 1 for client
key-direction 0
<tls-auth>
$(cat ta.key)
</tls-auth>
<cert>
$(cat server${1}.crt)
</cert>
<ca>
$(cat ca.crt)
</ca>
<key>
$(cat server${1}.key)
</key>
<dh>
$(cat dh.pem)
</dh>
EOFF
}

# Function for generating openvpn configurations
generate_ovpn_client() {
cat > client${1}.ovpn << EOFF
client
dev tun
proto udp
remote ${ovpn_host} ${ovpn_port}
resolv-retry infinite
nobind
persist-key
persist-tun
# Encryption ciphers
cipher ${ovpn_ciphers}
data-ciphers ${ovpn_ciphers}
# Test connection every 10 seconds, 120 seconds timeout
ping 10
ping-restart 120
# Verification common name of server
# set field to "server1" for CN=server1
verify-x509-name "server1" name
# Be verbose
verb 2
# key-direction 0 for server and 1 for client
key-direction 1
<tls-auth>
$(cat ta.key)
</tls-auth>
<cert>
$(cat client${1}.crt)
</cert>
<ca>
$(cat ca.crt)
</ca>
<key>
$(cat client${1}.key)
</key>
EOFF
}

# Create a directory for storing keys and certificates
mkdir -p "$dir"
cd "$dir" || exit 1

# Generate CA key and certificate
openssl ecparam -genkey -name "$ecdsa_curve" -out ca.key
openssl req -new -x509 -days "$days_valid" -key ca.key -out ca.crt -subj "/CN=OpenVPN-CA"

# Generate Diffie-Hellman parameters (not strictly required for ECDSA, but OpenVPN won't start without it)
openssl dhparam -out dh.pem 2048

# Generate TLS authentication key (optional, but recommended for extra security)
openvpn --genkey secret ta.key

for ((i=1; i<=servers_no; i++)); do
    # Generate server key, CSR, and certificate
    openssl ecparam -genkey -name "$ecdsa_curve" -out server${i}.key
    openssl req -new -key server${i}.key -out server${i}.csr -subj "/CN=server${i}"
    openssl x509 -req -in server${i}.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server${i}.crt -days "$days_valid"
    generate_ovpn_server ${i}
done

for ((i=1; i<=clients_no; i++)); do
    # Generate client key, CSR, and certificate
    openssl ecparam -genkey -name "$ecdsa_curve" -out client${i}.key
    openssl req -new -key client${i}.key -out client${i}.csr -subj "/CN=client${i}"
    openssl x509 -req -in client${i}.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out client${i}.crt -days "$days_valid"
    generate_ovpn_client ${i}
done

# Cleanup
rm -f *.csr

How to Use

  1. Run the script to generate the required certificates and configurations.
  2. Distribute the generated .ovpn files to the respective clients and servers.
  3. Use tools like Ansible, Bash, or manual methods to deploy the configurations.

This approach saves significant time and ensures consistency across configurations.