Skip to content

Commit fffc74f

Browse files
bene2k1nerda-codesjcirinosclwy
authored
chore(tuto): tutorial content review (#4174)
* chore(tuto): tutorial content review * fix(tuto): typo * Apply suggestions from code review Co-authored-by: Néda <[email protected]> * fix(tuto): update content * Apply suggestions from code review Co-authored-by: Jessica <[email protected]> --------- Co-authored-by: Néda <[email protected]> Co-authored-by: Jessica <[email protected]>
1 parent 8ff85a9 commit fffc74f

File tree

4 files changed

+147
-110
lines changed

4 files changed

+147
-110
lines changed

‎tutorials/easydeploy-gitlab-runner/index.mdx

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,14 @@
11
---
22
meta:
33
title: Deploy GitLab Runner on Scaleway Kubernetes clusters using Easy Deploy
4-
description: Learn how to deploy GitLab Runner on Scaleway Kubernetes clusters using the Easy Deploy feature.
4+
description: Learn how to deploy GitLab Runner on Scaleway Kubernetes clusters using the Easy Deploy feature.
55
content:
66
h1: Deploy GitLab Runner on Scaleway Kubernetes clusters using Easy Deploy
7-
paragraph: Learn how to deploy GitLab Runner on Scaleway Kubernetes clusters using the Easy Deploy feature.
7+
paragraph: Learn how to deploy GitLab Runner on Scaleway Kubernetes clusters using the Easy Deploy feature.
88
categories:
99
- containers
1010
dates:
11-
validation: 2024-06-20
11+
validation: 2025-01-06
1212
posted: 2024-06-20
1313
---
1414

‎tutorials/install-openvpn/index.mdx

Lines changed: 142 additions & 105 deletions
Original file line numberDiff line numberDiff line change
@@ -1,95 +1,94 @@
11
---
22
meta:
3-
title: Installing OpenVPN on Ubuntu 20.04 or later
4-
description: Discover how to install OpenVPN on Ubuntu 20.04 and later versions with this detailed tutorial. Follow our step-by-step guide to set up a secure VPN connection effortlessly.
3+
title: Installing OpenVPN on a Scaleway Instance running Ubuntu 24.04
4+
description: Discover how to install OpenVPN on Ubuntu 24.04 and later versions with this detailed tutorial. Follow our step-by-step guide to set up a secure VPN connection effortlessly.
55
content:
6-
h1: Installing OpenVPN on Ubuntu 20.04 or later
7-
paragraph: Discover how to install OpenVPN on Ubuntu 20.04 and later versions with this detailed tutorial. Follow our step-by-step guide to set up a secure VPN connection effortlessly.
8-
tags: vpn OpenVPN Ubuntu Bionic-Beaver
6+
h1: Installing OpenVPN on a Scaleway Instance running Ubuntu 24.04
7+
paragraph: Discover how to install OpenVPN on Ubuntu 24.04 and later versions with this detailed tutorial. Follow our step-by-step guide to set up a secure VPN connection effortlessly.
8+
tags: vpn OpenVPN Ubuntu
99
categories:
1010
- instances
1111
dates:
12-
validation: 2024-07-02
12+
validation: 2025-01-06
1313
posted: 2019-01-16
1414
---
1515

16-
OpenVPN is an open-source software to run a virtual Private Network (VPN) to create secure point-to-point or site-to-site connections in routed or bridged configurations. The software uses a proprietary security protocol that uses SSL/TLS for key exchange.
16+
Learn how to install and configure OpenVPN on Ubuntu 24.04 LTS with this comprehensive guide. Follow our step-by-step instructions to establish a secure VPN connection via your Scaleway Instance with ease.
1717

1818
<Macro id="requirements" />
1919

2020
- A Scaleway account logged into the [console](https://console.scaleway.com)
2121
- [Owner](/identity-and-access-management/iam/concepts/#owner) status or [IAM permissions](/identity-and-access-management/iam/concepts/#permission) allowing you to perform actions in the intended Organization
2222
- An [SSH key](/identity-and-access-management/organizations-and-projects/how-to/create-ssh-key/)
23-
- An [Instance](/compute/instances/how-to/create-an-instance/) running on Ubuntu 20.04 or later
23+
- An [Instance](/compute/instances/how-to/create-an-instance/) running on Ubuntu 24.04 LTS
2424

25-
## Installing Easy-RSA
25+
## Installing OpenVPN and Easy-RSA
2626

27-
The first step in building an OpenVPN configuration is to establish a PKI (Public Key Infrastructure). It is composed of the following elements:
28-
29-
- a public and private key for the server and each client
30-
- the certification authority (CA) and the key used to identify servers as well as the client certificate
31-
32-
OpenVPN supports two-way certificate-based authentication, this means that the client must authenticate the server certificate and the server must authenticate the client certificate before mutual trust is established.
33-
34-
Both the server and the client will authenticate each other. First, the certificate needs to be signed by the certification authority (CA) then, the information in the header (common name of the certificate or the certificate type) of the authenticated certificate can be tested.
35-
36-
1. [Connect to your Instance](/compute/instances/how-to/connect-to-instance/) via SSH.
37-
2. Update the package List:
27+
1. Connect to your Instance via SSH.
28+
```sh
29+
root@<YOUR_INSTANCE_IP>
30+
```
31+
2. Update the package list and upgrade already installed packages:
3832
```sh
3933
apt update
4034
apt upgrade -y
4135
```
42-
43-
3. Install OpenVPN and Easy-RSA:
36+
3. Install OpenVPN and Easy-RSA using `apt`:
4437
```sh
4538
apt install -y openvpn easy-rsa
4639
```
4740

48-
4. Set Up the CA Directory:
41+
## Setting up the Certificate Authority (CA)
42+
43+
1. Create a directory for Easy-RSA and navigate to it:
4944
```sh
50-
make-cadir ~/openvpn-ca
45+
mkdir -p ~/openvpn-ca
5146
cd ~/openvpn-ca
5247
```
53-
54-
5. Initialize the PKI:
48+
2. Initialize the Public Key Infrastructure (PKI):
5549
```sh
50+
cp -r /usr/share/easy-rsa/* /etc/openvpn/easy-rsa/
51+
cd /etc/openvpn/easy-rsa/
5652
./easyrsa init-pki
5753
```
54+
3. Build the Certificate Authority (CA):
5855

59-
6. Build the Certificate Authority:
6056
```sh
61-
./easyrsa build-ca nopass
57+
./easyrsa build-ca
6258
```
59+
You will be prompted to set a passphrase and provide a Common Name (e.g., "OpenVPN-CA").
60+
61+
## Generating server and client certificates
6362

64-
7. Generate the server certificate and key:
63+
1. Generate the server certificate and key:
6564
```sh
6665
./easyrsa gen-req server nopass
6766
./easyrsa sign-req server server
6867
```
69-
70-
8. Generate the Diffie-Hellman parameters:
68+
Approve the signing request when prompted.
69+
2. Generate Diffie-Hellman parameters:
7170
```sh
7271
./easyrsa gen-dh
7372
```
74-
75-
9. Generate a shared secret:
73+
3. Generate a shared secret for additional security:
7674
```sh
77-
openvpn --genkey secret ta.key
75+
openvpn --genkey secret /etc/openvpn/ta.key
7876
```
7977

80-
## Configuring the OpenVPN server
78+
## Configuring the OpenVPN Server
8179

82-
1. Copy the server certificate and key files:
80+
1. Copy the necessary files to the OpenVPN directory:
8381
```sh
84-
cp pki/ca.crt pki/private/server.key pki/issued/server.crt ta.key /etc/openvpn/
82+
cp pki/ca.crt pki/private/server.key pki/issued/server.crt /etc/openvpn/
83+
cp /etc/openvpn/easy-rsa/pki/dh.pem /etc/openvpn/
84+
cp /etc/openvpn/ta.key /etc/openvpn/
8585
```
86-
87-
2. Create the OpenVPN Server configuration file:
86+
2. Create the OpenVPN server configuration file:
8887
```sh
8988
nano /etc/openvpn/server.conf
9089
```
91-
Add the following configuration, save the file and quit `nano`:
92-
```conf
90+
3. Add the following configuration:
91+
```
9392
port 1194
9493
proto udp
9594
dev tun
@@ -105,7 +104,7 @@ Both the server and the client will authenticate each other. First, the certific
105104
push "dhcp-option DNS 8.8.8.8"
106105
push "dhcp-option DNS 8.8.4.4"
107106
keepalive 10 120
108-
cipher AES-256-CBC
107+
cipher AES-256-GCM
109108
user nobody
110109
group nogroup
111110
persist-key
@@ -114,120 +113,158 @@ Both the server and the client will authenticate each other. First, the certific
114113
log-append /var/log/openvpn.log
115114
verb 3
116115
```
116+
Save and exit the editor.
117117

118-
## Setting up a Let's Encrypt TLS certificate
119-
120-
1. Install Certbot:
121-
```sh
122-
apt install -y certbot
123-
```
124-
125-
2. Obtain the TLS certificate:
126-
```sh
127-
certbot certonly --standalone -d your_domain
128-
```
129-
<Message type="tip">
130-
Make sure to replace `your_domain` with your actual domain name. **You need to ensure that your domain points to the IP address of your Scaleway Instance.**
131-
</Message>
132-
133-
3. Configure OpenVPN to use the Let's Encrypt certificate:
134-
- Update the `server.conf` file to use the Let's Encrypt certificate and key:
135-
```conf
136-
ca /etc/letsencrypt/live/your_domain/fullchain.pem
137-
cert /etc/letsencrypt/live/your_domain/cert.pem
138-
key /etc/letsencrypt/live/your_domain/privkey.pem
139-
```
140-
141-
## Enabling IP forwarding and adjusting the firewall
118+
## Enabling IP forwarding and configuring the firewall
142119

143120
1. Enable IP forwarding:
144121
```sh
145-
echo 1 > /proc/sys/net/ipv4/ip_forward
122+
echo 'net.ipv4.ip_forward=1' | tee -a /etc/sysctl.conf
123+
sysctl -p
146124
```
147-
- Make the change permanent by editing the `sysctl.conf` file:
148-
```sh
149-
nano /etc/sysctl.conf
150-
```
151-
Uncomment the following line:
152-
```sh
153-
net.ipv4.ip_forward=1
154-
```
155-
156-
2. Configure the firewall of the Instance (UFW):
125+
2. Configure the firewall ([UFW](/tutorials/installation-uncomplicated-firewall/)):
157126
```sh
158127
ufw allow 1194/udp
159128
ufw allow OpenSSH
160-
ufw enable
161129
```
162-
163-
Add the following rules to `before.rules` to allow forwarding:
130+
3. Edit the UFW configuration to allow forwarding:
164131
```sh
165132
nano /etc/ufw/before.rules
166133
```
167-
Add these lines before the `*filter` line:
168-
```sh
134+
4. Add the following lines before the `*filter` line:
135+
```
169136
*nat
170137
:POSTROUTING ACCEPT [0:0]
171-
-A POSTROUTING -s 10.8.0.0/8 -o eth0 -j MASQUERADE
138+
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
172139
COMMIT
173140
```
141+
5. Save and exit, then reload UFW:
142+
```sh
143+
ufw disable
144+
ufw enable
145+
```
174146

175147
## Starting the OpenVPN server
176148

177-
1. Start and enable OpenVPN:
149+
1. Start and enable the OpenVPN service:
178150
```sh
179151
systemctl start openvpn@server
180152
systemctl enable openvpn@server
181153
```
154+
2. Check the status of the OpenVPN service:
182155

183-
2. Check the status of the OpenVPN server:
184156
```sh
185157
systemctl status openvpn@server
186158
```
159+
Ensure it is active and running.
187160

188-
## Setting up client configuration
161+
## Generating client configuration
189162

190163
1. Generate client certificates:
164+
191165
```sh
192-
cd ~/openvpn-ca
166+
cd /etc/openvpn/easy-rsa/
193167
./easyrsa gen-req client1 nopass
194168
./easyrsa sign-req client client1
195169
```
170+
Approve the signing request when prompted.
196171

197172
2. Create the client configuration file:
173+
On your server, create a new client configuration file named `client1.ovpn`:
198174
```sh
199175
nano ~/client1.ovpn
200176
```
201-
Add the following configuration:
202-
```conf
177+
3. Add the following configuration in the file, replacing `your_server_ip_or_domain` with your server's IP address or domain name:
178+
```
203179
client
204180
dev tun
205181
proto udp
206-
remote your_domain 1194
182+
remote your_server_ip_or_domain 1194
207183
resolv-retry infinite
208184
nobind
209185
persist-key
210186
persist-tun
211-
ca ca.crt
212-
cert client1.crt
213-
key client1.key
214-
tls-auth ta.key 1
215-
cipher AES-256-CBC
187+
remote-cert-tls server
188+
auth SHA256
189+
cipher AES-256-GCM
216190
verb 3
191+
<ca>
192+
-----BEGIN CERTIFICATE-----
193+
# Insert the content of /etc/openvpn/ca.crt here
194+
-----END CERTIFICATE-----
195+
</ca>
196+
<cert>
197+
-----BEGIN CERTIFICATE-----
198+
# Insert the content of /etc/openvpn/easy-rsa/pki/issued/client1.crt here
199+
-----END CERTIFICATE-----
200+
</cert>
201+
<key>
202+
-----BEGIN PRIVATE KEY-----
203+
# Insert the content of /etc/openvpn/easy-rsa/pki/private/client1.key here
204+
-----END PRIVATE KEY-----
205+
</key>
206+
<tls-auth>
207+
-----BEGIN OpenVPN Static key V1-----
208+
# Insert the content of /etc/openvpn/ta.key here
209+
-----END OpenVPN Static key V1-----
210+
</tls-auth>
211+
key-direction 1
217212
```
213+
<Message type="note">
214+
Replace the placeholder text (e.g., `# Insert the content of /etc/openvpn/ca.crt here`) with the actual contents of the respective files. You can use the `cat` command to display the contents of each file and then copy and paste them into the appropriate sections of the `client1.ovpn` file.
215+
- For example:
216+
```sh
217+
cat /etc/openvpn/ca.crt
218+
```
219+
Copy the output and paste it between the `<ca>` and `</ca>` tags in the `client1.ovpn` file.
220+
</Message>
218221

219-
3. Transfer the client configuration files to the remote (client) machine:
222+
4. Transfer the client configuration file to the client device:
223+
Use a secure method to transfer the `client1.ovpn` file to the device you intend to use as a client. You can use `scp` (secure copy) for this purpose:
220224
```sh
221-
scp ~/openvpn-ca/pki/ca.crt ~/openvpn-ca/pki/issued/client1.crt ~/openvpn-ca/pki/private/client1.key ta.key user@your_client_machine:~/client1/
222-
scp ~/client1.ovpn user@your_client_machine:~/client1/
225+
scp ~/client1.ovpn user@client_device_ip:/path/to/destination/
223226
```
227+
Replace `user` with your username on the client device, `client_device_ip` with the client's IP address, and `/path/to/destination/` with the desired directory on the client device.
228+
5. Install OpenVPN on the client device:
229+
Ensure that the OpenVPN client is installed on your client device. Installation methods vary depending on the operating system:
230+
231+
- **Linux:**
232+
```sh
233+
apt update
234+
apt install -y openvpn
235+
```
236+
237+
- **Windows:**
238+
239+
Download and install the OpenVPN client from the [official website](https://openvpn.net/community-downloads/).
240+
241+
- **macOS:**
242+
243+
Download and install [Tunnelblick](https://tunnelblick.net/), a free OpenVPN client for macOS.
244+
245+
6. Connect to the VPN:
246+
247+
- **Linux:**
248+
249+
Use the following command to start the VPN connection:
250+
```sh
251+
openvpn --config /path/to/client1.ovpn
252+
```
253+
254+
- **Windows/macOS:**
255+
256+
Import the `client1.ovpn` file into your OpenVPN client application and initiate the connection through the application's interface.
257+
258+
7. Verify the connection:
259+
Once connected, verify that your public IP address matches the VPN server's IP address, indicating that your internet traffic is being routed through the VPN. You can check your public IP address by visiting [WhatIsMyIP.com](https://www.whatismyip.com/) or a similar service.
260+
261+
Your OpenVPN server is now configured on your Ubuntu 24.04 LTS instance, and your client device is set up to connect securely.
224262

225-
Your OpenVPN server is now set up on your Scaleway Instance, secured with a Let's Encrypt certificate, and ready for clients to connect. Follow the client configuration steps for each device you want to connect to your VPN.
263+
## Maintenance
226264

227-
<Message type="tip">
228-
For ongoing maintenance, remember to renew your Let's Encrypt certificates regularly (they expire every 90 days), and you can automate this with a cron job:
229-
```sh
230-
echo "0 0 1 */2 * certbot renew --quiet" | crontab -
231-
```
232-
</Message>
265+
For ongoing maintenance, remember to renew your Let's Encrypt certificates regularly (they expire every 90 days). You can automate this process with a cron job:
266+
```sh
267+
echo "0 0 1 */2 * certbot renew --quiet" | tee -a /etc/crontab
268+
```
269+
This cron job runs the `certbot renew` command on the first day of every second month at midnight.
233270

‎tutorials/set-up-spf-dkim-for-dns-providers/index.mdx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ categories:
1010
- transactional-email
1111
- domains-and-dns
1212
dates:
13-
validation: 2024-07-02
13+
validation: 2025-01-06
1414
posted: 2022-11-07
1515
---
1616

0 commit comments

Comments
 (0)