Setting up an OpenVPN server with Sophos UTM and Viscosity
This guide will walk you through the steps involved in setting up an OpenVPN server on a Sophos UTM host that allows you to securely access your home/office network from a remote location and optionally send all of your network traffic through it so you can access the internet securely as well.
Before using this guide, we highly recommend you read through our Introduction to Running an OpenVPN Server Article.
Preparation
For this guide, we assume:
- You have already installed the latest version of Sophos UTM (9.5 at time of writing)
- Sophos UTM has been set up with at least a WAN interface and a LAN interface
- You are connected with your client device to the Sophos UTM server via its LAN interface during this guide
- This installation of Sophos UTM is a fresh install
- You already have a copy of Viscosity installed on your client device
If you need to download and install a copy of Sophos UTM, information can be found at https://www.sophos.com/en-us/support/utm-downloads.aspx. We won't be covering the details of setting up a Sophos UTM instance, many guides can be found online. If you are running a different version of Sophos UTM, it's very likely that many or even all of the steps outlined in this guide will still apply. If you are looking to setup an OpenVPN server on a different operating system, please check out our other guides.
Your client device needs to be connected to the Sophos UTM server via the LAN interface. This is necessary so that you can access the WebAdmin portal to set up the Sophos UTM configuration. The specifics of how you can achieve this depend on your particular network configuration.
If you don't have a copy of Viscosity already installed on your client machine, then please check out this setup guide for installing Viscosity (Mac | Windows).
Support
Unfortunately we cannot provide any direct support for setting up your own OpenVPN server. We provide this guide as a courtesy to help you get started with, and make the most of, your copy of Viscosity. We've thoroughly tested the steps in this guide to ensure that, if you follow the instructions detailed below, you should be well on your way to enjoying the benefits of running your own OpenVPN server.
Sophos offer technical support for UTM at https://secure2.sophos.com/en-us/support.aspx
Getting Started
First you need to log in to the WebAdmin portal from your client device connected to the LAN interface of the Sophos UTM server. Open a browser on your client and navigate to the IP address of the LAN interface of your Sophos UTM server (something like https://10.0.0.1:4444
or https://192.168.0.1:4444
). You will need to login. The password for the admin user should have been configured when you set up your Sophos UTM instance.
Create Users
Authentication Services
If you are using a user authentication system, such as LDAP, you will need to add those settings to authenticate your users.
- On the side bar, click
Definitions & Users
>Authentication Services
. - In the Automatic User Creation section of the Global Settings tab, check the Create users automatically checkbox.
- Click
Apply
to save this change. - In the Automatic User Creation for Facilities section below, check the Client Authentication option.
- Click
Apply
to save this change.
- Click on the Servers tab and then click on the
New Authentication Server...
button. - Enter the details of your user authentication system and click
Save
when done.
Local User Authentication
If you are not using an authentication system, you will need to create a local user account for each user so that they can access the User Portal and connect to the VPN.
- On the side bar, click
Definitions & Users
>Users & Groups
. - In the Users tab, click
+ New User...
. - Fill in the user's details, including Username. Set the Authentication to
Local
and provide a password. - Leave the Use static remote access IP unchecked.
- When you are done, click
Save
.
Network Access
Next we need to define the VPN subnet, so that users can be assigned IP addresses:
- Still in the
Definitions & Users
section of the side bar, click theNetwork Definitions
subsection. - In the Network Definitions tab, click
+ New Network Definition...
. - Give the network a name, we will use "VPN Network".
- Leave the type as
Network
and set the IPv4 address to 10.8.0.0. - Leave the Netmask as
/24 (255.255.255.0)
. - When you are done, click
Save
.
To allow users to log in to the User Portal:
- On the side bar, click
Management
>User Portal
. - In the Global tab, click the grey power button in the top right. It will change to yellow as it starts up.
- In the Allowed Networks box, click the folder icon.
- From the side bar, drag
Internal (Network)
into the Allowed Networks box to allow users to connect to the User Portal via the internal network. - Click
Apply
to save these changes. The power icon should subsequently turn green.
DNS Server
To allow VPN users to pass their DNS requests through the VPN:
- On the side bar, click
Network Services
>DNS
. - In the Global tab, click on the folder icon in the Allowed Networks box.
- Click and drag the VPN Network created above into the Allowed Networks box.
- Click
Apply
to save this change.
- Click on the Forwarders tab.
- Deselect the Use forwarders assigned by ISP checkbox.
- In the DNS Forwarders box, click on the
+
icon to add a network definition. - Give the network a name. We will be using Google's DNS servers, but you're free to use a different DNS server.
- Leave the type as
Host
. - Set the IPv4 address to the DNS server of your choice, 8.8.8.8 in our example using Google.
- Click
Save
to add the DNS server.
- If you want more than one DNS server, add it now, repeating the steps above.
- When you are done, click
Apply
to save the changes.
SSL Settings
To configure the OpenVPN server:
- On the side bar, click
Remote Access
>SSL
. - In the Profiles tab, click
+ New Remote Access Profil...
. - Enter a name in the Profile name input, we will call our server "OpenVPN server".
- In the Users and Groups box, click the folder icon. A list of available users and groups will appear in the side bar. Click and drag the user created above (or the authentication service users, i.e. LDAP Users) into the Users and Groups box.
- In the Local Networks box, click the folder icon. A list of local networks will appear in the side bar. Drag any networks that should be reachable by the user into the Local Networks box. To allow users to access the local network, drag in
Internal (Network)
. To allow users to access the internet via the Sophos UTM server, drag inExternal (WAN) (Network)
. - Uncheck the Automatic firewall rules option, we will set out own firewall rules.
- Click
Save
.
Next click on the Settings tab at the top:
- In the Interface address input, click the trash icon to remove the current value.
- Click the folder icon to show a list of available networks. Drag any networks that the client is allowed to connect via into the input box. In our case, we will drag in
Internal (Address)
. - Set the Protocol to
UDP
. - Set the Port to 1194.
- In the Override hostname input, enter the local network address of the Sophos UTM server, 10.0.0.1 in our example.
- Click
Apply
to save these changes. - In the Virtual IP Pool section, click on the Pool network folder icon.
- Drag in the VPN Network we created earlier.
- Click
Apply
to save these changes.
If you wish to allow users to maintain simultaneous connections to the OpenVPN server, leave the Allow multiple concurrent connections per user option selected. Otherwise, deselect it and click Apply
to save that change.
Now click on the Advanced tab at the top:
- Change the Encryption algorithm to
AES-256-CBC
. - Leave the Authentication algorithm as
SAH1
. - Leave the Key size as
2048 bit
. - If you have a local SSL certificate to identify the server to the clients, select it in the Server certificate drop down.
- Leave the Key lifetime as 28800.
- Click
Apply
to save these changes. - Under Compression Settings, untick 'Compress SSL VPN traffic', then click
Apply
.
To ensure the connected clients will use the server for DNS resolution:
- Still in the
Remote Access
section of the side bar, click theAdvanced
subsection. - Set the DNS server #1 to 10.8.0.1, which will be the OpenVPN server's IP address.
- Click
Apply
when done.
Firewall Rules
The firewall needs to be configured to allow our VPN and User Portal traffic.
- On the side bar, click
Network Protection
>Firewall
. - In the Rules tab, click
+ New Rule...
. - In the Sources box, click the folder icon.
- Drag in from the side bar any users we created previously that we want to be able to access the User Portal.
- Click on the folder icon in the Services box.
- Drag in
HTTPS
to allow the users to access the User Portal via HTTPS. - Click on the folder icon in the Destinations box.
- Drag in
Internal (Network)
to allow users to access the User Portal via the local network. - Leave the Action as
Allow
. - Click
Save
when done.
Now enable this rule by clicking the small grey power switch icon next to our new rule. It should change to green to indicate the firewall rule is now applied.
Next we need to create a masquerade rule, so that we can pass traffic through the VPN and out onto the external network interface.
- Still in the
Network Protection
section of the side bar, click theNAT
subsection. - In the Masquerading tab, click
+ New Masquerading Rule...
. - Click the folder icon next to the Network input.
- Click and drag in the VPN Network we created earlier.
- Change the Interface input to
External (WAN)
. - Leave the Use address input as
<< Primary address >>
. - When you are done, click
Save
to create the rule.
- To activate the rule, click the greyed out button next to the rule so that it changes to green.
Client Configuration
To connect to our OpenVPN server, we need to download the client configuration for our user. On the client machine:
- Open a browser and navigate to
https://your-server-ip
. - Enter the Username and Password for the user and log in.
- Click on the Remote Access tab.
- Click on the
Download
button next to "Click here to download the configuration file to set up SSL VPN on Linux, MacOS X, BSD or Solaris". - It should download a file called "[email protected]".
Setting Up Viscosity
If you do not have Viscosity already running, start Viscosity now. In the Mac version you will see the Viscosity icon appear in the menu bar. In the Windows version you will see the Viscosity icon appear in the system tray.
Click the Viscosity icon in the menu bar (Windows: system tray) and select 'Preferences...':
This shows you the list of available VPN connections. We assume you recently installed Viscosity, so this list is empty. Click on the '+' button and select Import Connection
> From File...
:
Navigate to the location of the "[email protected]" file and open it. You will see a pop up message to indicate that the connection has been imported.
(Optional) Allowing Access to the Internet
By default the VPN connection will allow access to the file server and other computers on the home/office (LAN) network. However if you also wish to have all internet traffic sent through the VPN connection it's necessary to make a final edit to the connection:
- Double-click on your connection in the Viscosity Preferences window to open the connection editor
- Click on the Networking tab.
- Click the "All Traffic" drop down and select the "Send all traffic over VPN connection" option. It is not necessary to enter a Default Gateway.
- Click the
Save
button.
Connecting and Using Your VPN Connection
You are now ready to connect. Click on the Viscosity icon in the macOS menu bar or Windows system tray to open the Viscosity Menu, select the connection you imported, and Viscosity will connect.
To check that the VPN is up and running, you can open the Details window from the Viscosity Menu. This will allow you to view connection details, traffic and the OpenVPN log.
That's it, you've set up your very own OpenVPN server. Congratulations, you are now free to enjoy the benefits of operating your own OpenVPN server!