How to Install OpenVPN Server and Client on FreeBSD 12.0

OpenVPN is an open-source application that allows you to create a secure private network over the public internet. OpenVPN implements a virtual private network (VPN) to create a secure connection. OpenVPN Uses the OpenSSL library to provide the encryption and it provides several authentication mechanisms, such as certificate-based, pre-shared keys, and username/password authentication.

In this tutorial, we will show you how to step-by-step install and configure OpenVPN on FreeBSD 12.0. We will create the VPN server with the FreeBSD system and implement the certificate-based OpenVPN authentication.


For this guide, you will need the latest FreeBSD 12.0 with the minimal 512 MB of RAM and 1 CPUs. And you will need the root privileges and the pf firewall.

What we will do:

  • Install OpenVPN on FreeBSD 12.0
  • Setup Variables for Certificates
  • Generate Certificates
  • Configure OpenVPN
  • Setup PF Firewall
  • Enable Port-Forwarding on FreeBSD
  • Testing

Step 1 - Install OpenVPN

Firstly, we will update the binary packages repository and install the OpenVPN packages to the FreeBSD system using the pkg command below.

pkg update
pkg install openvpn

Once the installation is complete, add the OpenVPN service to the system boot and define the OpenVPN tunnel interface 'tun' using the sysrc command below.

sysrc openvpn_enable="YES"
sysrc openvpn_if="tun"

Now the OpenVPN package has been installed on the FreeBSD 12.0 system.

Step 2 - Setup Variables for Certificate

In this step, we're going to set up the 'easy-rsa' variables for generating OpenVPN certificates.

Create a new openvpn directory '/usr/local/etc/openvpn/' and copy the 'easy-rsa' directory into it.

mkdir -p /usr/local/etc/openvpn/
cp -R /usr/local/share/easy-rsa /usr/local/etc/openvpn/

Now goto the '/usr/local/etc/openvpn/easy-rsa/' directory and edit the 'vars' file using vim editor.

cd /usr/local/etc/openvpn/easy-rsa/
vim vars

Change details with your own and paste into it.

set_var EASYRSA                 "$PWD"
set_var EASYRSA_PKI             "$EASYRSA/pki"
set_var EASYRSA_DN              "cn_only"
set_var EASYRSA_REQ_PROVINCE    "Frankfurt"
set_var EASYRSA_REQ_CITY        "Frankfurt"
set_var EASYRSA_REQ_ORG         "hakase-labs CERTIFICATE AUTHORITY"
set_var EASYRSA_REQ_EMAIL       "[email protected]"
set_var EASYRSA_KEY_SIZE        2048
set_var EASYRSA_ALGO            rsa
set_var EASYRSA_CA_EXPIRE       7500
set_var EASYRSA_CERT_EXPIRE     365
set_var EASYRSA_NS_SUPPORT      "no"
set_var EASYRSA_EXT_DIR         "$EASYRSA/x509-types"
set_var EASYRSA_SSL_CONF        "$EASYRSA/openssl-1.0.cnf"
set_var EASYRSA_DIGEST          "sha256"

Save and close.

Now make the 'vars' file an executable.

chmod +x vars

And we're ready to generate VPN certificates.

Step 3 - Generate Certificates

In this step, we're going to generate some certificates for the OpenVPN server. We will generate a CA, client and server certificates, DH-PARAM, and the CRL (Certificate Revocation List) certificate.

Go to the '/usr/local/etc/openvpn/easy-rsa/' directory and initialize the Public Key Infrastructure (PKI) directory using the 'easyrsa.real' command as below.

cd /usr/local/etc/openvpn/easy-rsa/
./easyrsa.real init-pki

- Generate CA

Now generate the CA certificate and key.

./easyrsa.real build-ca

And you will be asked for the password of the CA key. Type your password and the CA certificate and key has been generated.

Next, we will generate and sign the server certificate and key using our new CA.

- Generate and Sign Server Certificate

Generate the VPN server certificate and key using the following command.

./easyrsa.real gen-req openvpn-bsd nopass

After that, sign the server certificate using the CA key.

./easyrsa.real sign-req server openvpn-bsd

Type the passphrase for the CA key and the server certificate and key has been created.

Verify the server certificate and keys using the following command.

openssl verify -CAfile pki/ca.crt pki/issued/openvpn-bsd.crt

And make sure you get no error.

- Generate and Sign Client Certificate

After generating the certificate for the server, we will generate a new certificate for the client and sign it with the CA key.

Generate new certificate and key 'client01' using the following command.

./easyrsa.real gen-req client01 nopass

Then sign the certificate with the CA key.

./easyrsa.real sign-req client client01

Type the passphrase for the CA key and the client certificate and key has been created.

Verify the client certificate and key using the openssl command as below.

openssl verify -CAfile pki/ca.crt pki/issued/client01.crt

And you will get the result as below.

The client certificate and key have been generated without any error.

- Generate DH-PARAM and CRL Certificate

The DH-PARAM certificated is needed for additional security. And the CRL (Certificate Revocation List) will be used to list all client certificate that you want to remove from accessing the VPN server.

Generate a new CRL and DH-PARAM certificate using the following command.

./easyrsa.real gen-crl
./easyrsa.real gen-dh

Once it's complete, all basic certificates that needed for our VPN server has been generated.

- Copy all Certificates

Next, we need to copy all certificates to the OpenVPN directory. Create a new directory 'server' and 'client' inside the OpenVPN directory.

mkdir -p /usr/local/etc/openvpn/{server,client}

Copy the CA certificate, server certificate and key to the 'server' directory.

cp pki/ca.crt /usr/local/etc/openvpn/server/
cp pki/issued/openvpn-bsd.crt /usr/local/etc/openvpn/server/
cp pki/private/openvpn-bsd.key /usr/local/etc/openvpn/server/

Copy the CA certificate, client01 certificate and key to the 'client' directory.

cp pki/ca.crt /usr/local/etc/openvpn/client/
cp pki/issued/client01.crt /usr/local/etc/openvpn/client/
cp pki/private/client01.key /usr/local/etc/openvpn/client/

Copy the DH-PARAM and CRL certificates to the 'server' directory.

cp pki/dh.pem /usr/local/etc/openvpn/server/
cp pki/crl.pem /usr/local/etc/openvpn/server/

And now we're ready to configure the OpenVPN server.

Step 4 - Configure OpenVPN

Go to the '/usr/local/etc/openvpn' directory and create a new openvpn configuration called 'openvpn.conf' using editor.

cd /usr/local/etc/openvpn/
vim openvpn.conf

Change the configuration as you need and paste into it.

# OpenVPN Port, Protocol, and the Tun
port 1194
proto udp
dev tun

# OpenVPN Server Certificate - CA, server key and certificate
ca /usr/local/etc/openvpn/server/ca.crt
cert /usr/local/etc/openvpn/server/openvpn-bsd.crt
key /usr/local/etc/openvpn/server/openvpn-bsd.key

#DH and CRL key
dh /usr/local/etc/openvpn/server/dh.pem
crl-verify /usr/local/etc/openvpn/server/crl.pem

# Network Configuration - Internal network
# Redirect all Connection through OpenVPN Server
push "redirect-gateway def1"

# Using the DNS from
push "dhcp-option DNS"
push "dhcp-option DNS"

#Enable multiple clients to connect with the same certificate key

# TLS Security
cipher AES-256-CBC
tls-version-min 1.2
auth SHA512

# Other Configuration
keepalive 20 60
explicit-exit-notify 1
comp-lzo yes
user nobody
group nobody

# OpenVPN Log
log-append /var/log/openvpn.log
verb 3

Save and close.

Now start the OpenVPN service and check it's status.

service openvpn start
service openvpn status

You will get the OpenVPN service is up and running on PID '14490'.

Check the OpenVPN port using the sockstat command below.

sockstat -l4

And you will get the result as below.

The OpenVPN service is running on default UDP port '1194'.

Step 5 - Setup pf Firewall

In this step, we're going to set up the pf firewall for the VPN server. We will create the nat rule for the OpenVPN interface 'tun0' and allows all connection to be redirected to the external network interface 'vtnet0'.

Before going any further, make sure the pf firewall is configured on the system. Or you can use the link below to configure it.

How to Setup pf Firewall on FreeBSD 12.0

Now go to the '/usr/local/etc' directory and edit the pf configuration file 'pf.conf' using vim editor.

cd /usr/local/etc/
vim pf.conf

Define the OpenVPN interface and local IP address.

# vpn interface
vpn_net = ""

Reassemble all fragmented packets on the external interface before filtering them.

# reassemble all fragmented packets before filtering them
scrub in on $ext_if all fragment reassemble

Enable the nat from the OpenVPN IP address to the external interface.

# route traffic from VPN interface out to the internet
nat on ! $vpn_if from $vpn_net to any -> $ext_ip

Now pass all connections to the UDP protocol on the OpenVPN port '1194' and pass all connection on the OpenVPN interface 'tun0'.

# Allow Connection to VPN Server
pass in on $ext_if proto udp from any to ($ext_if) port 1194 keep state

# Pass all connection on the VPN Interface
pass in on $vpn_if from any to any

Save and close.

Now check the pf firewall configuration and make sure there is no error, then reload the pf rules.

service pf check
service pf reload

As a result, the pf firewall configuration has been completed.

You can check the pf firewall rules using the following command.

pfctl -sr
pfctl -sn

And you will be shown the result as below.

Step 6 - Setup and Enable Port Forwarding

In this step, we're going to enable the port forwarding on the FreeBSD system.

Edit the '/etc/sysctl.conf' file using vim editor.

vim /etc/sysctl.conf

Paste the following configuration.


Save and close.

Now check the sysctl config file using the following command.

sysctl -f /etc/sysctl.conf

Next, enable the FreeBSD system as a gateway by adding the configuration to the '/etc/rc.conf' using the following command.

sysrc gateway_enable="YES"

Then reboot the server.


Now the port forwarding on the FreeBSD system has been enabled.

Step 7 - Setup Client

In this step, we're going to create a new configuration '.ovpn' fro the client.

Go to the '/usr/local/etc/openvpn/client' directory and create a new configuration 'client01.ovpn'.

cd /usr/local/etc/openvpn/client/
vim client01.ovpn

Change the remote IP address and other details with your own and paste into it.

dev tun
proto udp

remote 1194

ca ca.crt
cert client01.crt
key client01.key

cipher AES-256-CBC
auth SHA512
tls-version-min 1.2

resolv-retry infinite
compress lzo
verb 3

Save and close.

Now download all certificates, key, and the configuration inside the '/usr/local/etc/openvpn/client' directory to your local computer.

Step 8 - Testing

In this step, we''re going to connect to the VPN server using the 'client01.ovpn' configuration from the local computer.

After downloading certificates and configuration, go to the download directory and connect to the openvpn server using the command as below.

openvpn --config client01.ovpn

Once the connection is complete, open new terminal tab and checks the 'tun0' interface.

ifconfig tun0

And you will get the internal IP address from the OpenVPN server.

Next, we will test to ping the OpenVPN server using its internal IP address.

ping -c3

And you will get an ICMP answer from the server.

After that, check the internet connection using the curl command below.


Now you will be shown the external IP address of the server.

As a result, the installation and configuration of OpenVPN server on FreeBSD 12.0 has been completed successfully.


Share this page:

0 Comment(s)