The text in the client log file mentions port 1194, which is officially designated to OpenVPN by IANA (the governing body for port numbers). So that would be the port you use in the port forwarding section of your router.-Shades
For me personally, this would be one reason to change it away from 1194 into the higher reaches, say >33000. Having a port open that's designated as an 'access' point to a network is like sticking up a sign saying "Break this Window" in front of a Liquor Store
Because of the certificates you have already put up quite a hurdle for 'drive-by attackers'. If you use strong passwords with your (Windows and/or Linux) user login then you already have quite a decent security perimeter setup.
Having a certificate that asks for a password is good in case your laptop is used without your knowledge, (when you're outside your LAN area), because it will ask for the password before the connection is completed.
It's easy enough to get a certificate that asks for a password, (as I found out by accident), when you install OpenVPN on a client mark the box to install the
OpenVPN Certificate Wizard.
Run the wizard:
1) Fill out the info as per a normal key, Common Name (what this client will be called), location, etc (location/org/unit has to match server info).
2) Enter a passphrase and again to verify it.
3) Then hit the Create Request button.
This will create a
{client}.key and a
{client}.req in the C:\Program Files\OpenVPN\config directory - where
{client} is the
Common Name you entered for that client.
Rename
{client}.req to
{client}.csr (Certificate Signing Request).
Copy the file
{client}.csr to the
C:\Program Files\OpenVPN\easy-rsa\keys directory on the key signing PC, (the
server in this case). If the directory doesn't exist, create it and copy the contents of the server's config directory into it except for the server.ovpn file.
Open a CLI in the easy-rsa directory and enter the following commands:
vars.batsign-cert.bat {client} <- where {client} matches the prefix of the .csr file
vars.bat already exists, so all you need is the part of build-key.bat that actually signs the CSR, thus:
sign-cert.bat
@echo off
cd %HOME%
rem sign the cert request with our ca, creating a cert/key pair
openssl ca -days 3650 -out %KEY_DIR%\%1.crt -in %KEY_DIR%\%1.csr -config %KEY_CONFIG%
rem delete any .old files created in this process, to avoid future file creation errors
del /q %KEY_DIR%\*.old
This will generate a {client}.crt certificate file.
Copy
{client}.crt and the
ca.crt from the server back to the config directory on the client.
Everytime the client now tries to connect to the VPN it will ask for the passphrase you gave when you generated it in the wizard.
Although the above seems rather involved, it isn't really......honest
ADDENDUM: Also, when you issue the
build-key command to initially create the client keys there is the following optional response:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
Just enter a passphrase and verify in the next prompt.
