How to configure a Digi DAL router as an OpenVPN server

Introduction

How to configure a Digi DAL router as an OpenVPN server

Prerequisites

• The DAL Router must have a Public IP on the WAN interface (or at least reachable by the Client).
• A set of Certificates (CA public cert, Server cert & Private Key, Client Cert & Private key) have been created to be used in the OpenVPN Tunnel (for example, with XCA: XCA Download)
• In this example, OpenVPN Connect on a Window machine will be used as client (that can be downloaded here: Open VPN Connect download).

Issue/Question

How can I configure a DAL router as an OpenVPN Server?

Solution

The following example provides instructions on how to configure a Digi DAL Router as an OpenVPN Server, and will show how to connect to it using Open VPN Connect on a Windows PC.

Digi DAL router Open VPN configuration:

1. Access the WEB UI of the Digi DAL router and browse to System > Device Configuration > VPN > Open VPN > Servers, chose a name and click on the + to add it:

2. Configure the options as below, copying the content of the Certificates in the proper fields. Below is shown the example of the CA certificate:

Do the same for the rest of Certificates/Keys: 

If needed, you can also add some advanced options in the proper section, for example, to push to the Clients a route to the Server LAN: 

This can be useful for example, if the Open VPN Client needs to secure access a machine behind the Open VPN Server.

More info about Open VPN Advanced options on DAL here: OpenVPN Server Advanced Options on DAL routers.

Click Apply and the Server is shown as enabled under Status > Open VPN > Servers.

There, the Open VPN Template File for the client can be also downloaded:

This File needs to be modified inserting the WAN IP address of the Digi DAL Router and the content of the Client cert & private key. The CA Certificate will be already filled in:

After the File has been modified properly, it can be uploaded to the Open VPN Connect client:

Clicking Connect the Client will connect to the server:

The successful connection can be also checked on the DAL router under Status > Open VPN > Servers:

From the Windows Open VPN Connect client, can be also verified that the routing table is updated with the Open VPN Server subnet as well as the Pushed route to reach the DAL Server LAN:

As a test, from the Windows PC, a ping to the LAN IP address of the DAL router can be performed: