OpenVPN Bash Manager

Goal

Create a small set of simple Bash scripts for basic OpenVPN setup on Debian 12, client .ovpn profile generation, and client access revocation by name.

What This Project Does

The project automates a minimal working OpenVPN flow:

• set up an OpenVPN server;
• create a CA, server certificate, and CRL with Easy-RSA;
• create a client .ovpn file;
• revoke a client certificate;
• update CRL to block revoked clients.

Requirements

• Server OS: Debian 12.
• Scripts must be run with sudo.
• The server must have access to apt to install packages.
• The system must have a TUN device: /dev/net/tun.
• The setup script uses UFW. If firewalld or nftables is already active, the firewall must be configured manually.
• The setup script refuses to continue if an existing PKI or server.conf is found.

Scripts

• bin/setup-openvpn-server - installs packages, creates PKI, CA, server certificate, CRL, server.conf, routing rules, and UFW rules.
• bin/create-openvpn-client - creates a client certificate and builds a ready client configuration file .ovpn.
• bin/revoke-openvpn-client - revokes a client certificate, updates CRL, and can restart OpenVPN to stop active sessions immediately.

Run Examples

Run the commands below from the root of this project.

Make the script executable

sudo chmod +x bin/setup-openvpn-server.sh

1. Set Up The OpenVPN Server

Run this on the Debian 12 server. You can pass the port as the first argument. If you do not pass a port, the script uses 1194.

sudo bin/setup-openvpn-server.sh 1194

During CA creation, enter and remember the password for the CA private key. After a successful run, the script creates the main files in:

• /etc/openvpn/easy-rsa - Easy-RSA and PKI;
• /etc/openvpn/server - OpenVPN server configuration and files.

2. Create A Client .ovpn Profile

Run this on the server where setup-openvpn-server was already completed. Replace client1 with the client name, and replace REAL_SERVER_IP with the public IP address or DNS name of the OpenVPN server.

sudo bin/create-openvpn-client.sh client1 REAL_SERVER_IP 1194

Result: the file client1.ovpn appears in the directory where you ran the command. Transfer this file to the client machine in a secure way.

3. Prepare The Client Machine

On a Debian client, install OpenVPN and the package for correct DNS work with systemd-resolved:

sudo apt-get update -qq
DEBIAN_FRONTEND=noninteractive apt-get install -y -qq \
    openvpn openvpn-systemd-resolved

After that, import the .ovpn profile into a VPN client, or run it from the terminal:

sudo openvpn --config client1.ovpn

4. Revoke A Client

Run this on the server. The script revokes the client certificate and updates CRL. After that, new connections from this client are blocked.

sudo bin/revoke-openvpn-client.sh client1

To drop all current VPN sessions immediately, add --restart. The revoked client will not be able to reconnect.

sudo bin/revoke-openvpn-client.sh client1 --restart

Syntax Check

bash -n bin/setup-openvpn-server.sh
bash -n bin/create-openvpn-client.sh
bash -n bin/revoke-openvpn-client.sh

Source

The DigitalOcean guide was used as a reference:

https://www.digitalocean.com/community/tutorials/how-to-set-up-and-configure-an-openvpn-server-on-ubuntu-20-04#step-2-creating-a-pki-for-openvpn