How to Install OpenVPN on a Raspberry Pi (Step-by-Step)

Installing OpenVPN on a Raspberry Pi is a popular choice for creating a secure, private network. With OpenVPN, you can securely connect your Raspberry Pi to remote networks, or set up the Pi as a VPN server for other devices. This guide provides a step-by-step approach to installing OpenVPN on your Raspberry Pi, configuring it as a server, and ensuring it is running optimally.

Prerequisites

Before you start, ensure the following prerequisites are met:

• Raspberry Pi running Raspberry Pi OS
• Internet connection
• Terminal access to the Raspberry Pi (either locally or via SSH)
• Root or sudo access to the Raspberry Pi

Step 1: Update Your Raspberry Pi

Start by updating your Raspberry Pi’s software to ensure all packages are up to date. Open a terminal window and run the following commands:

sudo apt update && sudo apt upgrade -y

This ensures that your system is fully updated and secure before proceeding with the installation of OpenVPN.

Step 2: Install OpenVPN Software

Now, you’ll need to install the OpenVPN software package. Run the following command to install OpenVPN:

sudo apt install openvpn -y

Once installed, you can verify the installation by checking the OpenVPN version:

openvpn --version

Step 3: Set Up EasyRSA for Certificate Management

EasyRSA is a set of scripts that simplify the process of creating your own public key infrastructure (PKI) and managing certificates for OpenVPN. First, download and install EasyRSA:

sudo apt install easy-rsa -y

Now, create a new directory for EasyRSA and navigate to it:

make-cadir /easy-rsa

Navigate into the EasyRSA directory:

cd /easy-rsa

Next, initialize the Public Key Infrastructure (PKI):

./easyrsa init-pki

Step 4: Build the Certificate Authority (CA)

With EasyRSA set up, you can now build your Certificate Authority (CA). This will generate the necessary keys for secure connections. To build the CA, run:

./easyrsa build-ca

You will be prompted to enter a common name for your CA. You can use any name you like, but make it descriptive, such as “RaspberryPi-OpenVPN-CA”.

Step 5: Create Server Certificate and Key

Next, you need to generate the server certificate and key. Run the following command:

./easyrsa gen-req server nopass

This will generate a request for the server certificate. You will also need to sign the server certificate with the CA:

./easyrsa sign-req server server

After signing, the server certificate and key are created and can be found in the pki directory.

Step 6: Generate Diffie-Hellman Parameters

Diffie-Hellman parameters are used to securely exchange cryptographic keys. You can generate these parameters using EasyRSA:

./easyrsa gen-dh

It may take a few minutes for this process to complete. The generated file will be placed in the pki directory.

Step 7: Configure OpenVPN Server

Now it’s time to configure OpenVPN to use the certificates and keys you’ve created. Copy the server configuration file to the OpenVPN directory:

sudo cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz /etc/openvpn/

Then, unzip the configuration file:

sudo gzip -d /etc/openvpn/server.conf.gz

Edit the server configuration file to match the paths of the generated certificates and keys:

sudo nano /etc/openvpn/server.conf

Locate the following lines and update them with the correct paths:

• ca – Path to the CA certificate (e.g., /home/pi/easy-rsa/pki/ca.crt)
• cert – Path to the server certificate (e.g., /home/pi/easy-rsa/pki/issued/server.crt)
• key – Path to the server key (e.g., /home/pi/easy-rsa/pki/private/server.key)
• dh – Path to the Diffie-Hellman parameters (e.g., /home/pi/easy-rsa/pki/dh.pem)

Step 8: Enable IP Forwarding

To allow traffic to pass through your Raspberry Pi and to route VPN traffic, you must enable IP forwarding. Edit the sysctl configuration file:

sudo nano /etc/sysctl.conf

Uncomment the line:

#net.ipv4.ip_forward=1

Save the file and apply the changes by running:

sudo sysctl -p

Step 9: Start the OpenVPN Service

With everything configured, you can now start the OpenVPN server:

sudo systemctl start openvpn@server

To ensure that OpenVPN starts automatically on boot, enable the service:

sudo systemctl enable openvpn@server

Step 10: Verify the OpenVPN Server Status

Check the status of your OpenVPN server to ensure it is running correctly:

sudo systemctl status openvpn@server

If everything is configured correctly, the service should show as active and running.