OpenVPN Configuration: #management localhost 7505.

yannick Coffi -


This is a series of posts focusing on useful OpenVPN server configuration options such as: #the use of secure cryptographic algorithms; #client-to-client communication and so forth …

Ensure that all options are included and saved in your OpenVPN server configuration file. ie: /etc/openvpn/server.conf

🎧


The management interface allows administrators to interact with and control the OpenVPN server in real time. It provides a way to issue commands, retrieve status information, monitor the server, query its status, and even dynamically update its configuration.

Add the following line to enable the management interface on localhost (127.0.0.1) port 7505 with password authentication and specify the path to the password file:

#Enable management interface for administrative purposes (optional)
management localhost 7505 /etc/openvpn/mgmt-pass

In this instance:

management localhost 7505: Specifies that the management interface should listen on localhost (127.0.0.1) on port 7505.

/etc/openvpn/mgmt-pass: Specifies the path to the password file (/etc/openvpn/mgmt-pass) containing the management interface password.


Create Password File

Create a password file (/etc/openvpn/mgmt-pass) and set the password. Ensure the file has appropriate permissions to protect the password:

$ sudo nano /etc/openvpn/mgmt-pass

Add your password in plaintext. For security reasons, ensure that the file has strict permissions (600 or 400) so that only the OpenVPN process can read it:

$ sudo chmod 600 /etc/openvpn/mgmt-pass


Restart OpenVPN Service

After making changes, restart the OpenVPN service to apply the new configuration:

$ sudo systemctl restart openvpn@server.service


Telnet

We will be using Telnet to manage the Interface.
Telnet is a simple text-based network protocol that allows you to connect to and manage devices remotely.


Check if Telnet is present:
Simply type the following command and press Enter

$ telnet
  • If Telnet is installed, you will see the Telnet prompt, indicating that the command is ready to accept Telnet connections.
    It typically looks like this:
telnet>

type QUIT/EXIT or CTRL+C to exit

  • If Telnet is not installed, you will likely see a message indicating that the command was not found or suggesting installation instructions

Installing Telnet (if not installed)

$ sudo apt update

$ sudo install telnet


However, please note that telnet is considered insecure because it transmits data, including passwords, in plaintext. Instead, it's recommended to use SSH for secure remote access whenever possible.


Configure SSH Port Forwarding

Now, set up SSH port forwarding to securely access the OpenVPN management interface via SSH:

SSH Port Forwarding

From your local machine or terminal, initiate an SSH connection to your OpenVPN server with port forwarding enabled:

$ ssh -L 7505:localhost:7505 user@your_server_ip


Replace user with your SSH username and your_server_ip with the IP address or hostname of your OpenVPN server.
Enter your SSH password when prompted

  • -L 7505:localhost:7505: Sets up local port forwarding. It listens on the port 7505 on your local machine (localhost) and forwards traffic to the port 7505 on the OpenVPN server’s localhost.

Access OpenVPN Management Interface

Once the SSH connection and port forwarding are established, you can access the OpenVPN management interface securely from your local machine.

Using Telnet 

$ telnet localhost 7505

OUTPUT

Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
ENTER PASSWORD:

SUCCESS: password is correct
>INFO:OpenVPN Management Interface Version 3 -- type 'help' for more info


Basic Commands

Once connected to the OpenVPN Management Interface, you can use various commands to manage and monitor your OpenVPN server. Here are some basic commands:

  • help: Displays help information, including a list of available commands.
  • status: Displays a summary of the current OpenVPN server status, including active client connections.
  • load-stats: Loads and displays detailed statistics about the server and client connections.
  • log [on|off] [N|all] : Displays recent log messages from the OpenVPN server.
  • kill: Terminates a specific client session. You'll need to provide the session ID or client name.
  • quit or exit: Closes the Telnet session and disconnects from the OpenVPN management interface.

    and for more information;
  • help: Displays help information, including a list of available commands.

By using the OpenVPN Management Interface Version 3, administrators can efficiently monitor and manage their OpenVPN servers, ensuring optimal performance and security for VPN deployments.



We hope this was of great use!