How to Set Up OpenVPN Server with Routing on Windows Server 2019

Network diagram

OpenVPN Server

• OpenVPN Server Properties:
  • OS: Windows Server 2019
  • Role: OpenVPN Server
  • IP: 192.168.0.254

Prerequisites

OpenSSL

In order to create connection certificates, we need to install the OpenSSL software library. I personally use the https://slproweb.com packages.

Download OpenSSL

Download the latest OpenSSL Light version.

Install OpenSSL

• Accept the agreement:

• Select destination location:

• Select start menu folder:

• Select the OpenSSL binaries directory:

• Click to install:

• Click Finish to exit (and make a donation if you can to support the project 😊):

Add OpenSSL in Environment Variables

We need to add the OpenSSL path to the environment variables.

• Run SystemPropertiesAdvanced to open System Properties:

• Click on Environment Variables…:

• Edit Path system variable:

• Click on New and add %ProgramFiles%\OpenSSL-Win64\bin:

• Open a new Windows command and check that you can run this openssl command:

Windows Firewall

We need to open port 1194 udp to allow OpenVPN client connections.

• To do this, use the Windows Firewall Management Console or this command in an Administrator command-line console.

• Or with PowerShell:

Installing OpenVPN

Go to the official OpenVPN website here: https://openvpn.net and download the latest installer.

• As we want to install OpenVPN as a server, we will choose Customize:

• We enable the OpenVPN Service to run on startup:

• We install EasyRsa to create certificates for the server and clients:

• Finally, click on Close:

Certificates

Set up a Certificate Authority (CA) and generate certificates and keys for server and clients

Here, we're going to set up a pki to create our server and client certificates.

• Open a Command Prompt:

• Then type the following commands to enter the EasyRSA shell:

• Remove the existing configuration, just in case:

• Initialize the pki, and enter yes to confirm:

• Build the certificate authority:

• Generate server certificate and key:

• Generate Diffie Hellman parameters:

• Generate client certificates:

Copy certificates to the right folders

• Copy the following files (from the C:\Program Files\OpenVPN\easy-rsa\pki, C:\Program Files\OpenVPN\easy-rsa\pki\issued and C:\Program Files\OpenVPN\easy-rsa\pki\private folders):
  • ca.crt
  • dh.pem
  • server.crt
  • server.key
• To the C:\Program Files\OpenVPN\config-auto and C:\Program Files\OpenVPN\config folders.

Configuration File

• As administrator, edit the file C:\Program Files\OpenVPN\config-auto\server.ovpn:

Restart the OpenVPN Service

The OpenVPN service must be restarted for the configuration file to take effect.

• From the services management console:

• Right click on OpenVPNService, then restart:

• Or from an administrator's command prompt:

• Or with PowerShell:

OpenVPN Client

• OpenVPN Client:
  • OS: Windows 10
  • Role: OpenVPN Client

Installing OpenVPN

We're going to download the same package, and here install it with the default settings.

Copy certificates from the Server

• Copy from the Server the following files (from the folders C:\Program Files\OpenVPN\easy-rsa\pki, C:\Program Files\OpenVPN\easy-rsa\pki\issued and C:\Program Files\OpenVPN\easy-rsa\pki\private) :
  • ca.crt
  • client01.crt
  • client01.key
• In the folder C:\Program Files\OpenVPN\config.

Configuration File

• Edit the file C:\Program Files\OpenVPN\config\client.ovpn with administrator rights:

Establishing the connection

• Run the OpenVPN client as administrator:

• Establish connection:

• A pop-up window will confim that we are connected:

Server Access

To access the server, we'll use the IP address 10.50.8.1.

⚠️Troubleshooting: After a Windows update, I no longer had access to the server share (OpenVPN could connect, however). For this to work again, I had to repair (available by relaunching the installer) the OpenVPN program on the server side.

Enabling Routing

At this stage, we have an operational OpenVPN server that is reachable from our remote client. But do we reach the server on its private ip (192.168.0.254) or other computers on the local network? That's what we're going to find out here, by enabling routing on our OpenVPN Windows server.

OpenVPN Server

Configuration File

• As administrator, edit the file C:\Program Files\OpenVPN\config-auto\server.ovpn and add the line push "route add 192.168.0.0 255.255.255.0" to announce the network to the remote clients:

• Restart OpenVPNService, example here with PowerShell:

Installing Routing Feature

• As administrator, open a PowerShell prompt and type this command to install the routing feature:

Routing configuration

• Open the Routing and Remote Access Console by running the rrasmgmt.msc command:

• Right-click on your server name and select Configure and Enable Routing and Remote Access:

• Click on Next:

• Select Custom configuration and click Next:

• Select NAT and LAN routing services:

• Finally, click on Finish:

• Then Start the service. At this point, the remote client should be able to ping the LAN interface (here 192.168.0.254):

• To be able to access our entire local network, we need to create a NAT rule:

• Select the LAN Network Interface (here 192.168.0.254) and click OK:

• Select Public interface connected to the internet and check the Enable NAT on this interface option before confirming by clicking on OK:

OpenVPN Client

• As administrator, open a command prompt and run the route print command to check that route 192.168.0.0 has been pushed correctly:

• Check that you can reach your network: