Skip links

TCP Configuration for OpenVPN

In this guide, we will show you how to configure TCP for OpenVPN tested with Centos 5 & 6 only

We do recommend setting up OpenVPN using this guide if you haven’t already:
https://vpnmodule.net/installing-openvpn-on-centos-5-and-centos-6/

Create your TCP configuration:

touch /etc/openvpn/tcp.conf
nano /etc/openvpn/tcp.conf

And enter the following:

port 443
proto tcp
dev tun
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
plugin /usr/share/openvpn/plugin/lib/openvpn-auth-pam.so /etc/pam.d/login
client-cert-not-required
username-as-common-name
server 10.9.0.0 255.255.255.0 #- must be different with tcp config
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
push "block-outside-dns"
keepalive 5 30
comp-lzo
persist-key
persist-tun
status server-tcp.log
verb 3 #- change to 0 if you want disable logging

Save it.

Route Iptables:

The rule below will work fine on Xen and KVM based VPS’s but for OpenVZ use the OpenVZ iptable rule instead:

iptables -t nat -A POSTROUTING -s 10.9.0.0/24 -o eth0 -j MASQUERADE

OpenVZ iptable rules:

iptables -t nat -A POSTROUTING -s 10.9.0.0/24 -j SNAT --to-source 123.123.123.123

Make sure you change 123.123.123.123 to your server IP.

Then run…

service iptables save

Optional step:

Now create a server.ovpn config file and enter the following:

client
dev tun
proto tcp
remote 123.123.123.123 443 # - Your server IP and OpenVPN Port
resolv-retry infinite
nobind
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
persist-key
persist-tun
ca ca.crt
auth-user-pass
comp-lzo
reneg-sec 0
verb 3

Make sure you change 123.123.123.123 to your server IP.

Join the Discussion