--- title: "Configuring an OpenVPN Server in the Router - icom OS Routers" slug: "configuring-an-openvpn-server-in-the-router-en" updated: 2024-12-20T10:23:18Z published: 2024-12-20T10:23:18Z canonical: "docs.insys-icom.com/configuring-an-openvpn-server-in-the-router-en" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.insys-icom.com/llms.txt > Use this file to discover all available pages before exploring further. # Configuring an OpenVPN Server in the Router - icom OS Routers The routers of INSYS icom can act as OpenVPN server and/or establish connections to an OpenVPN server as OpenVPN client. This Configuration Guide shows how to configure an INSYS icom router as OpenVPN server. ## Situation The router shall be configured as a server for an OpenVPN network with two clients. The OpenVPN server has the local network 192.168.10.0/24 in this example. The OpenVPN client with the Common Name **Client1** has the local network 192.168.20.0/24 and the OpenVPN client with the Common Name **Client2** has the local network 192.168.30.0/24. ![cg de m3 openvpn server](https://docs.insys-icom.de/assets/cg_de_m3_openvpn_server.png) ## Solution The Startup wizard of the router permits to prepare an optional OpenVPN connection besides the configuration of Internet access. The necessary certificate structure must be generated in advance. The [Configuration Guide for Creating a Certificate Structure Using XCA](/kb/docs/en/creating-a-certificate-structure-using-xca-en) provides instructions for this. The following certificates and keys are necessary: | File | Upload to | secret | Common Name for this example | | --- | --- | --- | --- | | CA certificate | Server, clients | No | | | CA key | – | Yes | | | Server certificate | Server | No | Server | | Server key | Server | Yes | | | Client certificate (separate for each client) | Client | No | Client1, Client2 | | Client key (separate for each client) | Client | Yes | | > [!WARNING] > Keep your CA key secure! > > Never upload the CA key anywhere; it must always remain protected. We act on the assumption that the router is in default settings for the following proceeding. > [!WARNING] > Please note! > > If you configure an OpenVPN server on your router, you make its network accessible from the outside. Even if an OpenVPN network allows a high degree of security, it may pose a security vulnerability in case of an inadequate configuration. The following proceeding provides assistance for the easy configuration of a server for an OpenVPN network. You are solely responsible for the protection of the OpenVPN network! > [!WARNING] > Keep your router up-to-date! > > Update your router to **iom OS 7.3** or later first! All encryption algorithms that are no longer considered sufficiently secure have been removed starting with this version, which eliminates the possibility of such algorithms being used inadvertently. 1. Open the user interface of the router: [https://insys.icom](https://insys.icom) 2. Click *To Startup Wizard* on the startup screen under **Startup Wizard**. 3. Click in the *Wizards* → *Startup wizard* menu on START . 4. If necessary, change the time and synchronisation settings and click on NEXT . 5. Enter the credentials required for authentication (or configure an *Authentication through certificates*) and click on NEXT . 6. Configure the Internet connection and click on NEXT . 7. Activate the *Configure VPN* switch and select **OpenVPN server** under *Type of VPN connection*. 8. Optional: check the checkbox *Allow communication between clients* if this should be possible. ![cg en m3 openvpn server v2 01](https://docs.insys-icom.de/assets/cg_en_m3_openvpn_server_v2_01.png) 9. Upload the required certificates and keys. > [!NOTE] > Please note! > > For the server, these are the CA certificate, the secret CA key, the server certificate and the secret server key. The certificates and keys can also be bundled in a PKCS12 container. It may be possible that a password is necessary for import. ![cg en m3 openvpn server v2 02](https://docs.insys-icom.de/assets/cg_en_m3_openvpn_server_v2_02.png) 10. Click on behind *OpenVPN server routes* to add a route that informs the server that the network 192.168.20.0 is located behind the client Client1 in the OpenVPN network: - *Network address*: 192.168.20.0 / 24 - *Common name*: Client1 11. Click on behind *OpenVPN server routes* to add a route that informs the server that the network 192.168.30.0 is located behind the client Client2 in the OpenVPN network: - *Network address*: 192.168.30.0 / 24 - *Common name*: Client2 > [!NOTE] > Please note! > > Thes two routes also add push routes that informs the other client routers that the networks 192.168.20.0 and 192.168.30.0 can be reached via the OpenVPN network. ![cg en m3 openvpn server v2 03](https://docs.insys-icom.de/assets/cg_en_m3_openvpn_server_v2_03.png) 12. Click on NEXT . 13. Click on behind *LAN settings* to add an IP network: - *IP address*: 192.168.10.1 / 24 - *Ports*: check Port **1.2** - Uncheck *DHCP server* or specify the range of addresses to be assigned if the router is supposed to act as a DHCP server in the local network. > [!NOTE] > Please note! > > This assigns the address 192.169.10.1 in the local system network to the router and assigns port 1.2 to this network. At the same time, a push route is added that informs the other client routers that the network 192.168.10.0 can be reached via the OpenVPN network. ![cg en m3 openvpn server v2 04](https://docs.insys-icom.de/assets/cg_en_m3_openvpn_server_v2_04.png) 14. Click on NEXT . 15. Optional: Activate the *Configure icom Router Management* switch and load a configuration for icom Router Management onto the router. 16. Click on RUN WIZARD. 17. Observe the execution of the wizard and click on EXIT WIZARD. > [!NOTE] > Please note! > > There are further options for configuring the OpenVPN server that might be adjusted accordingly. The tunnel addresses are only used for internal VPN routing and must only be adjusted, if they overlap with already used IP ranges. > > Since several tunnels are possible at the same time, the server must know the networks of the clients and add the according local routes. With the help of these routes, the server will determine, which data packets are to be sent through which tunnel to the correct client. To differentiate the tunnels, the routes are determined using the Common Name of the client certificate, which has been sent to the server during authentication. These routes appear in the routing table of the router The push routes are communicated to the client routers so that they know which networks are behind the tunnel on the OpenVPN server side. The clients will enter these routes in their local routing table. The routes will not be checked for their plausibility. ## Functional test - Open the ![view dashboard outline](https://docs.insys-icom.de/assets/icons/view-dashboard-outline.png) *Status* → *Dashboard* page in the menu and observe the establishment of the WAN chain with the OpenVPN tunnel in the *WAN chain* section. - Open the *Administration* → *Debugging* page in the menu and click on OPEN DEBUG TOOLS . Select the **Ping** tool and try to ping the IP addresses defined in the local routes. ## Troubleshooting - The status of the WAN chain and their interfaces is displayed on the ![view dashboard outline](https://docs.insys-icom.de/assets/icons/view-dashboard-outline.png) *Status* → *Dashboard* page. If an interface does not achieve the **online** condition, its condition can also be examined on this page. - Check in the ![view dashboard outline](https://docs.insys-icom.de/assets/icons/view-dashboard-outline.png) *Status* → *Log-View* menu the messages in the *OpenVPN* log. - Disable the IP filters for IPv4 in the *Network* → *Firewall / NAT* menu under *Settings IP filter* to check whether incorrect filter settings are the reason for connection problems. Standard IP address: https://192.168.1.1; login depending on configuration; default for earlier firmware versions: *User name*: **insys**, *Password*: **icom**