How to setup OpenVPN over Stunnel

​

Guide Setting Up OpenVPN over Stunnel on Ubuntu 22.04 on your VPS

​

Introduction

​

Prerequisites

• VPS Server:
  • An EDIS Global VPS running Ubuntu 22.04.
  • Root or sudo access.
• Client Machine:
  • A computer running Ubuntu or any Linux distribution compatible with OpenVPN and Stunnel.
  • Root or sudo access.

​

Overview

1. On the VPS Server:
   • Install and configure Stunnel.
   • Install and configure OpenVPN.
2. On the Client Machine:
   • Install and configure Stunnel.
   • Configure OpenVPN to connect through Stunnel.

​

Steps on the VPS Server

​

1. Update and upgrade system packages

sudo apt update && sudo apt upgrade -y

​

2. Install Stunnel

sudo apt install stunnel4 -y

​

3. Generate SSL certificates for stunnel

cd /etc/stunnel
sudo openssl req -new -x509 -days 365 -nodes -out stunnel.pem -keyout stunnel.pem

• openssl req -new -x509 -days 365 -nodes: Generates a new X.509 certificate valid for 365 days without a passphrase (-nodes).
• -out stunnel.pem -keyout stunnel.pem: Outputs both the certificate and the private key to stunnel.pem.

​

4. Create a Log File for Stunnel

sudo mkdir -p /var/log/stunnel
sudo touch /var/log/stunnel/stunnel.log
sudo chown stunnel4:stunnel4 /var/log/stunnel/stunnel.log

• Creates a directory for Stunnel logs.
• Creates an empty log file and sets appropriate ownership.

​

5. Configure Stunnel

sudo nano /etc/stunnel/stunnel.conf

# Global options
output = /var/log/stunnel/stunnel.log

# Service-level options
[openvpn]
client = no
accept = 443
connect = 127.0.0.1:1194
cert = /etc/stunnel/stunnel.pem

• output: Specifies where to write log output.
• [openvpn]: Defines a service named “openvpn”.
• client = no: Runs Stunnel in server mode.
• accept = 443: Listens on port 443 (common HTTPS port, often allowed through firewalls).
• connect = 127.0.0.1:1194: Forwards incoming connections to the local OpenVPN service.
• cert: Specifies the SSL certificate file.

​

6. Enable and start stunnel service

sudo systemctl enable stunnel4
sudo systemctl restart stunnel4
sudo systemctl status stunnel4

• enable: Ensures Stunnel starts on system boot.
• restart: Starts or restarts the Stunnel service.
• status: Checks if Stunnel is running correctly.

​

7. Install OpenVPN

cd ~
wget https://git.io/vpn -O openvpn-install.sh
sudo bash openvpn-install.sh

​

8. Modify OpenVPN server configuration

sudo nano /etc/openvpn/server/server.conf

# Comment out if present:
# local 127.0.0.1

# Or add:
local 0.0.0.0

​

9. Restart OpenVPN service

sudo systemctl restart openvpn-server@server.service
sudo systemctl status openvpn-server@server.service

​

Steps on the Client Machine

​

1. Install Stunnel

sudo apt install stunnel4 -y

​

2. Configure Stunnel

cd /etc/stunnel
sudo nano stunnel.conf

client = yes

[openvpn]
accept = 127.0.0.1:1194
connect = VPS_IP_ADDRESS:443

• client = yes: Runs Stunnel in client mode.
• accept = 127.0.0.1:1194: Listens locally on port 1194.
• connect = VPS_IP_ADDRESS:443: Connects to the VPS server’s Stunnel service.

​

3. Enable and start stunnel service

sudo systemctl enable stunnel4
sudo systemctl restart stunnel4
sudo systemctl status stunnel4

​

4. Copy OpenVPN client configuration file

scp root@VPS_IP_ADDRESS:/root/client.ovpn ~/

​

5. Modify OpenVPN client configuration

sudo mv ~/client.ovpn /etc/openvpn/client.conf
sudo nano /etc/openvpn/client.conf

• Change the remote directive to point to the local Stunnel endpoint:
• Add or modify the following directives:
• Optionally, specify a log file:

• remote 127.0.0.1 1194: Connects OpenVPN to the local Stunnel service.
• route-nopull: Prevents automatic route changes.
• script-security 2: Allows the execution of scripts.
• route-up: Executes a script after connection is established.

​

6. Create a routing script

sudo nano /etc/openvpn/routing.sh

#!/bin/bash

SERVER_IP="VPS_IP_ADDRESS"
GATEWAY=$(ip route get 8.8.8.8 | grep -oP 'via \K\S+')
sudo ip route add $SERVER_IP/32 via $GATEWAY
sudo ip route add 0.0.0.0/1 via 10.8.0.1
sudo ip route add 128.0.0.0/1 via 10.8.0.1

• SERVER_IP: Your VPS server IP.
• GATEWAY: Determines the default gateway to route traffic to the VPS server outside the VPN tunnel.
• The ip route add commands adjust the routing table.

sudo chmod +x /etc/openvpn/routing.sh

​

7. Start OpenVPN client

sudo systemctl enable openvpn-client@client.service
sudo systemctl start openvpn-client@client.service
sudo systemctl status openvpn-client@client.service

​

Verification

​

1. Check IP address

curl ifconfig.me

​

2. Verify Services

sudo systemctl status stunnel4
sudo systemctl status openvpn-client@client.service

​

3. Test Connectivity

ping -c 4 google.com
traceroute google.com

​

Troubleshooting

• Stunnel Connection Refused:
  • Ensure the VPS firewall allows incoming connections on port 443.
  • Verify Stunnel is running on the VPS: sudo systemctl status stunnel4.
• OpenVPN Authentication Failed:
  • Check that client and server certificates match.
  • Review OpenVPN logs on both client and server for errors.
• Routing Issues:
  • Verify the routing.sh script has the correct server IP.
  • Ensure the script is executable and the path is correct in the OpenVPN config.
• Service Fails to Start:
  • Review logs: journalctl -xe or specific service logs.
  • Check for typos or syntax errors in configuration files.

​

Conclusion

​

References

• Stunnel Official Documentation
• OpenVPN Official Documentation
• Ubuntu Server Guide