Ubuntu Server – Installing and Configuring Zentyal & OpenVPN

Zentyal (formerly eBox) is an Ubuntu based small business server with a vast amount of functionality – including an OpenVPN server. Of course you can install OpenVPN without installing Zentyal, but Zentyal will give you web-based management of your server (which makes setting up and administering your VPN much simpler). At the time of writing Zentyal is based on Ubuntu 10.4 (Lucid).

You can download and install Zentyal from their .iso image – or you can manually install the modules that you want on Ubuntu Server. I chose to do the later.

First I Installed a minimal virtual machine from the Ubuntu Server 10.4 Lucid CD. I gave the virtual machine one virtual NIC and a static IP address on my local network.

To install Zentyal modules we need to add their repository to our /etc/apt/sources.list (we will also install the nano text editor):

sudo apt-get update
sudo apt-get install nano
sudo nano /etc/apt/sources.list

Add the following line at the end of /etc/apt/sources.list:

deb http://ppa.launchpad.net/zentyal/2.0/ubuntu lucid main

Save sources.list and then import the puiblic key to authenticate the packages from the Zentyal PPA:

sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys

Update your repositories and then install the open-vpn module from Zentyal (formerly eBox):

sudo apt-get update
sudo apt-get install ebox-openvpn

Accept the default port (443) for the Zentyal HTTPS server:

As my ISP does not provide me with a static internet address I chose to use DynDNS as my dynamic DNS provider (a basic account is free):

Enter your DynDNS username and password when prompted.

For the ddclient configuration I chose Yes as my router provides Network Address Translation (NAT):

For the DynDNS fully qualified domain name (FQDN) I entered the full host-name that I created on the DynDNS site:

At this point you will need to wait a few minutes for Zentyal for configure itself – once this is done you will be able to log in at https://<your-server-ip&gt; using Firefox (Internet Explorer is not currently supported).

Log in with the credentials that you used when installing Ubuntu Server:

The first page that you will see once you have logged in to Zentyal is Package Selection. As I am only interested in setting up an OpenVPN Server I clicked on the Skip install button at the bottom of the page.

On the main Zentyal dashboard under Module Status you will see that the VPN module is currently disabled:

Click Module Status on the left hand panel and you will see that we need to enable the Network module before we can enable the VPN module:

Check the Network module check-box and then click the Accept button to allow Zentyal to make configuration changes. Click the big red Save changes button at the top right corner of the screen.

Once this is complete click on the VPN module check-box and repeat the process. You should now see that the VPN module is running.

Now that the VPN service is running we can create our Certification Authority. Click the Certification Authority link in the left hand panel of the dashboard, complete the fields as required and click the Create button:

Next create a certificate for your VPN server using the external host-name for the common name – for me this is the host-name that I configured at DynDNS:

Note: Do not set your expiration date too high (past 2032) see here for details.

Repeat this process with user-names as the Common Name to create user certificates for each user that will connect to the VPN.

Now we have to configure our VPN server. On the left hand panel click the Servers link under the VPN heading. Click the Add new link:

Un-check the Enabled check-box, enter a name for the VPN server and then click the Add button:

Click the Configuration icon to configure the server:

The default server port is 1194, which you can change if you so desire. I don’t see any real need to change the default VPN address. For the server certificate select the external host-name certificate. Leave Network Address Translation checked (for a single NIC). If you want VPN client machines to be able to see each other then check the Allow client-to-client connections check-box. Click the Change button to commit these settings.

Note: whatever port you define as the server port must be forwarded in your router to the local IP address of your OpenVPN server. See portforward.com for details on how to do this.

Click VPN and then Servers in the left hand panel and then click on the icon for Advertised Networks. Click Add new.

To allow clients on your VPN network ( you will need to enter your Local Area Network address in the Advertised network field. My router address is so my advertised network address is Click the Add button.

Click the Save changes button.

Now that the VPN server is configured we can enable it.

Click VPN and then Servers in the left hand panel and check the Enabled check-box. Click Save changes.

I chose to also enable the Firewall module – click Module Status in the left hand panel and then check the Firewall check-box and Save changes. Make sure that the Network, Firewall and VPN modules are all enabled before proceeding.

With the server configured and running we can configure client machines to connect to the VPN. Click VPN and Server in the left hand panel and then click on the Download client bundle icon.

First select the client type from the drop-down menu – the choices are Windows, Linux, Mac OS X and Zentyal to Zentyal tunnel. For my Ubuntu laptop I selected Linux and the chose the user certificate that I created earlier. For the server address enter your external host-name. Click the Download button and save the file.

Extract the downloaded file.

For Ubuntu clients install OpenVPN Client as follows:

sudo apt-get install openvpn network-manager-openvpn

Click the Network Manager applet in the top panel, then VPN Connections and Configure VPN.

Click the Import button and browse to the location of the client bundle that you extracted earlier and select the .conf file.

This will automatically populate your settings like the screen-shot below (I have omitted the external address to my VPN server in the screen-shot):

Click the Apply button and then the Close button.

To connect to your VPN click the Network Manager applet in the top panel, then VPN Connections followed by your VPN connection name.

Once you are successfully connected to your VPN you will see a padlock on your Network Manager icon:

I have to say that I am quite impressed with Zentyal / OpenVPN so far and it worked without me having to troubleshoot anything.


6 thoughts on “Ubuntu Server – Installing and Configuring Zentyal & OpenVPN

  1. Hey dude, good tuto.

    I did the same stuff and I’ve got colleagues connected on it from foreign coutry and everything is fine.
    The problem is when I try to connect from another wifi connection in my office, different from the one zentyal is using, I connect but after about 10sec I’ve got “VPN failed to connect”
    Wifi signal strong
    no problem with certificates
    Do you have any idea?


  2. Hi, Thanks for the tuto, I try to configure Mail but I have a problem, I suscribe an external domain name mydomain.com, i try to forward internal mail to mydomain.com but it doesn’t work.
    In mail configuration, I had a smarthost relay which is smtp.mydomain.com. In Users et Groups module, I add an external mailbox.
    Is anyone can help me?


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s