How to Setup OpenVPN On Windows Server 2019

In this video guide, we are learning the steps for Setting Up OpenVPN on Windows Server 2019. OpenVPN is a full-featured SSL VPN. OpenVPN uses OSI layer 2 or 3 secure network extension using the industry standard SSL/TLS protocol.
I have also prepared a blog post with screenshots and its available in below link.
supporthost.in/how-to-setup-o...
Chapters:
00:00 Introduction
2:16 Installing openVPN server
6:25 Install and setup openssl toolkit
13:23 Configure openssl
20:18 Setup CA and generate certificates for openVPN server and clients
26:14 Enable NAT on OpenVPN Server
29:21 Create Configuration file for OpenVPN server
35:56 Setup OpenVPN Client and testing the Openvpn connection

[@mathbloxiano2024]

your tutorial worked perfectly for me, I'm a beginner, you helped me a lot. Thank you for sharing

[@tomgrow2950]

It is an excellent tutorial, very well explained for beginners like me. Please keep the good work!

[@SupportHostIN]

Thanks, will do!

[@TAURO285000]

@@SupportHostIN podrias compartir los txt?

[@jacksonbaidoo1077]

it would be a very nice idea if all these commands are in text files to download. the blog is not accessible.

[@sergeilebedev2241]

Really very useful video! Great thanks from Russia!

[@nasrollaakhlaghi6745]

great job. Thank you

[@SupportHostIN]

Thank you too!

[@gaurav09]

Very nice !! Has been explained very systematically and step wise, Also blog post is well drafted. Very rare video on youtube explaining openvpn "Server" setup on windows 👍. Also can you a please also guide me how to setup a OpenVPN server on Windows 10 home edition ? i guess it should work there too with an alternative server manager tool ?. We sometimes require it for office work for employees working remotely.

[@SupportHostIN]

Thanks a ton. In case Windows 10 home edition acting as OpenVPN server, I am not sure how to NAT. May be you need to relay on your router for that.

[@ignaciocaballero1985]

Very good 2022!!!!!!!!!!!!!!!!!

[@SupportHostIN]

Thank you

[@tzeweitan6703]

This is by far the best video I have seen, I have a question, how do revoke client certificates and also add a layer of user/password to client when connecting? Thanks in Advance!

[@SupportHostIN]

Revoke client certificate can be done through easy-ras scripts like "revoke-full" along with "crl-verify" scripts. Another option is use openssl commands like openssl ca -revoke client1.crt -keyfile certs\ca.key -cert certs\ca.crt -config C:\OpenSSL-Win64\bin\openssl.cfg Additionally The openvpn scripts plugins like auth-pam.pl can be used for user/pass client authentication along with other necessary changes needed.

[@tzeweitan6703]

@@SupportHostIN Thank you very much for your reply. Could you possibly do a video on this? I am thinking it could beneficial for others to know how to revoke a list of clients.

[@gabordemeter4301]

Hi! really awesome guide i just have a question: Is it possible to do all this in a way that my coworkers (i.e. the clients) can access the LAN IP addresses like a NAS, but would not pass through all their other internet traffic on my network?

[@SupportHostIN]

By default, when an OpenVPN client is active, only network traffic to and from the OpenVPN server site will pass over the VPN. General web browsing, for example, will be accomplished with direct connections that bypass the VPN unless we enabled to route all client traffic towards OpenVPN server.

[@cupio9136]

Hi my issue is : I made this folder : C:\Program Files\OpenSSL-Win64\bin\demoCA ewcerts and when I run this command : openssl ca -days 3650 -extensions usr_cert -cert certs\ca.crt -keyfile certs\ca.key -out client1.crt -infiles certs\client1.csr My Error is : Using configuration from C:\Program Files\OpenSSL-Win64\bin\openssl.cfg ca: ./demoCA/newcerts is not a directory ./demoCA/newcerts: No error but I have that directory !

[@BuruhKoding]

When i try connect openvpn at client, i got message : TLS handshake failed, maybe can you tell me where is wrong? Thanks

[@amilcargutierrez5501]

Error adding request extensions from section v3_req F0000000:error:11000079:X509 V3 routines:v2i_AUTHORITY_KEYID:no issuer certificate:crypto\x509\v3_akid.c:145: F0000000:error:11000080:X509 V3 routines:X509V3_EXT_nconf_int:error in extension:crypto\x509\v3_conf.c:48:section=v3_req, name=authorityKeyIdentifier, value=keyid:always,issuer I get this error when I input "openssl req -days 3650 -nodes -new -keyout certs\server.key -out certs\server.csr -config C:\OpenSSL-Win64\bin\openssl.cfg" I've gone over your steps and looked up for some help online but can't fix the issue

[@youssefk1730]

I installed openSSL as in the video, however, i cant find the openssl,cfg. any suggestions?

[@TBMODS_APK_IPA]

Me tooo

[@TravelThrive154]

Sorry I mean you have a blog where you posted material on the subject, Is it fine by you if I use your screenshots for my own work where I need to describe but do not have the time to perform implementation right now.

[@SupportHostIN]

Sorry, Please don't

[@TravelThrive154]

@@SupportHostIN Mr I need your work as a reference and will refer to where I took the screenshots from which is the link to your blog and I ask you because I need your permission please.

[@arnaldoreginato]

When i run the command "openssl req -days 3650 -nodes -new -x509 -extensions v3_ca -keyout certs\ca.key -out certs\ca.crt -config C:\OpenSSL-Win64\bin\openssl.cfg" The output is like this: "req: Use -help for summary"

[@SupportHostIN]

Normally such output will get if there any syntax error in the command. Some characters or symbols have entered wrongly on your end.

[@TAURO285000]

Could you share the txt?

[@TravelThrive154]

hi, it's ok if I use your screenshots in the video for further work?

[@SupportHostIN]

sorry, I didn't get you

[@tiagocorreia-jcccomputador6281]

tks tks tks

[@SupportHostIN]

You're welcome!

[@ahmeduddin222]

sir, at time line 21:08 you copy paste the command lines to create CA certificate. but for me it's giving error 'openssl' is not recognized as internal or external command, openable program or batch file. donno how you got this. please explain.

[@SupportHostIN]

looks like somehow the openssl binary path is not defined correctly at Windows environment PATH. If its correctly defined try to reboot your OpenVPN server and see if that helps.

[@AmatoryFender]

@@SupportHostIN did not help

[@jpbacilio]

@@SupportHostIN For sure, you need to set correct value path after add OPENSSL_CONF (pointing to 'openssl.cfg' bin directory).

[@lukabrecelj4999]

Is it also possible to ping local network on network side (computers)?

[@SupportHostIN]

yes, its possible. Advertise your local network through VPN Server.

[@lloydstott7179]

Hi. Please assist openssl req -days 3650 -nodes -new -x509... Error checking x509 extension section v3_ca

[@SupportHostIN]

looks like some kind of syntax issue at v3_ca section.

[@hareeshubx3071]

The video is so good. It's really awesome. Please help me for the below When i run the command "openssl req -days 3650 -nodes -new -x509 -extensions v3_ca -keyout certs\ca.key -out certs\ca.crt -config C:\OpenSSL-Win64\bin\openssl.cfg" The output is like this: "req: Use -help for summary"

[@SupportHostIN]

okay, it could be the - character which become some en dashes instead of hyphens while you copy/pasted. Try to manually type it and see if that helps.

[@hareeshubx3071]

@@SupportHostIN I have typed the command manually "openssl req -days 3650 -nodes -x509 -extensions v3_ca -keyout certs\ca.key -out certs\ca.crt -config C:\Program Files\OpenSSL-Win64\bin\openssl.cfg" again facing the same error. Please help me on this. (Note: I have used the OpenSSL path inside of program files that's why I have changed the same in command).

[@SupportHostIN]

ho ok. It could be because of the space in the program files folder name.

[@aimen.medjadder]

@@hareeshubx3071 any solution !

[@danilozama4252]

When i run the command "C:\OpenSSL-Win64\bin\demoCA>openssl ca -days 3650 -extensions usr_cert -cert certs\ca.crt -keyfile certs\ca.key -out server.crt -infiles certs\server.csr" i have this error "Unable to load certificate request C0110000:error:0480006C:PEM routines:get_name:no start line:crypto\pem\pem_lib.c:763:Expecting: CERTIFICATE REQUEST" , can help me ?

[@exo4tic698]

were you able to fix the issue? I too facing the same exact problem.

[@AmatoryFender]

Options error: Unrecognized option or missing or extra parameter(s) in server.ovpn:191: push (2.5.3) Use --help for more information. Help pls....

[@temamorg]

similar error after connection openvpn Options error: Unrecognized option or missing or extra parameter(s) in server.ovpn:78: ca (2.5.5) supporthost please help

[@temamorg]

error due to quotes, use " , not “

[@SupportHostIN]

As per the error, there will be an invalid entry at line number 191. Check the entry and see if there any invalid character

[@AmatoryFender]

@@SupportHostIN thanks

[@mayahamdan6732]

@@temamorg can u please help me an give the ovpn file .. i facing the same error and its not going away even when change the "

[@macky10229]

How can I connect using more than 3 clients?

[@SupportHostIN]

I don't think any such limitation exits for the community edition.

[@nienbientan4849]

I get Error when connect on server: 2022-05-28 10:31:32 WARNING: --topology net30 support for server configs with IPv4 pools will be removed in a future release. Please migrate to --topology subnet as soon as possible. 2022-05-28 10:31:32 --cipher is not set. Previous OpenVPN version defaulted to BF-CBC as fallback when cipher negotiation failed in this case. If you need this fallback please add '--data-ciphers-fallback BF-CBC' to your configuration and/or add BF-CBC to --data-ciphers. 2022-05-28 10:31:32 --pull-filter ignored for --mode server Options error: You must define CA file (--ca) or CA path (--capath) Use --help for more information. Please help

[@SupportHostIN]

looks like you haven't set cipher values and ca file locations on your config file.

[@oTu5894]

I can't see open.cfg file in C:\OpenSSL-Win64\bin any idea?

[@SupportHostIN]

Did you mean openssl.cfg ?. Normally it should be there

[@oTu5894]

@@SupportHostIN I have problem with persmsion when edit file opvn. Do you have any idea to fix?

[@SupportHostIN]

try to run the file editor program as administrator.

[@oTu5894]

@@SupportHostIN How to find username and password about Remote access management. I have type username and password about VPS but it wrong

[@SupportHostIN]

@@oTu5894 Logins need to be created

[@divedmoran9080]

or pls put your openssl.cfg for download direct pls

[@SupportHostIN]

Okay, I will

[@divedmoran9080]

@@SupportHostIN thank

[@AmatoryFender]

C:\OpenSSL-Win64\bin\demoCA>openssl req -days 3650 -nodes -new -x509 -extensions v3_ca -keyout certs\ca.key -out certs\ca.crt -config C:\OpenSSL-Win64\bin\openssl.cfg "openssl" is not an internal or external command, operable program, or batch file.

[@SupportHostIN]

somehow your openssl binary path not updated in windows environment section. Try to reboot your VPN server and see if that helps.

[@AmatoryFender]

@@SupportHostIN does not work

[@AmatoryFender]

server : Wed Mar 09 20:04:31 2022 WARNING: --topology net30 support for server configs with IPv4 pools will be removed in a future release. Please migrate to --topology subnet as soon as possible. Wed Mar 09 20:04:31 2022 --cipher is not set. Previous OpenVPN version defaulted to BF-CBC as fallback when cipher negotiation failed in this case. If you need this fallback please add '--data-ciphers-fallback BF-CBC' to your configuration and/or add BF-CBC to --data-ciphers. Wed Mar 09 20:04:31 2022 --pull-filter ignored for --mode server client: Wed Mar 09 20:09:55 2022 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) Wed Mar 09 20:09:55 2022 TLS Error: TLS handshake failed

[@SupportHostIN]

ok, in the openvpn config file at the ciphers defined section use "data-ciphers-fallback BF-CBC" as the error mentioned itself. After that OpenVPN service will start.

[@AmatoryFender]

@@SupportHostIN client TLS Error: TLS key ? modem open port? huawei HG8245H

[@letmeshowyoutv9451]

For Godsake dude use AI to do voice overs. PLEASE