This recipe uses OpenVPN secret keys to secure the VPN tunnel. It is very similar to the previous recipe, but this time, we will use a shared secret key to encrypt the traffic between the client and the server.
Install OpenVPN 2.3.9 or higher on two computers. Make sure the computers are connected over a network. For this recipe, the server computer was running CentOS 6 Linux and OpenVPN 2.3.9 and the client was running Windows 7 64 bit and OpenVPN 2.3.10.
- First, generate a secret key on the server (listener):
[root@server]# openvpn --genkey --secret secret.key - Transfer this key to the client side over a secure channel (for example, using
scp). - Next, launch the server-side (listening) OpenVPN process:
[root@server]# openvpn --ifconfig 10.200.0.1 10.200.0.2 --dev tun --secret secret.key
- Then, launch the client-side OpenVPN process:
[WinClient] C:>"Program FilesOpenVPNinopenvpn.exe" --ifconfig 10.200.0.2 10.200.0.1 --dev tun --secret secret.key --remote openvpnserver.example.com
The connection is now established, as shown in the following screenshot:
This example works exactly as the first one: the server listens to the incoming connections on UDP port 1194. The client connects to the server on this port. After the initial handshake, the server configures the first available TUN device with the IP address 10.200.0.1 and it expects the remote end (Peer address) to be 10.200.0.2. The client does the opposite.
By default, OpenVPN uses two symmetric keys when setting up a point-to-point connection:
- A cipher key to encrypt the contents of the packets being exchanged.
- An HMAC key to sign packets. When packets arrive that are not signed using the appropriate HMAC key, they are dropped immediately. This is the first line of defense against a "denial-of-service" attack.
- The same set of keys are used on both ends and both keys are derived from the file specified using the
--secretparameter.
An OpenVPN secret key file is formatted as follows:
# # 2048 bit OpenVPN static key # -----BEGIN OpenVPN Static key V1----- <16 lines of random bytes> -----END OpenVPN Static key V1-----
From the random bytes, the OpenVPN Cipher and HMAC keys are derived. Note that these keys are the same for each session.