How to Set Up OpenVPN on Linux Debian via Terminal

Please make sure the following requirements are met:

• Linux Debian (instructions might work for different versions, but steps can differ in details)
• Updated software packages
• Installed OpenVPN software
• A CyberGhost account
     Here's how to create a CyberGhost account online
     Here's how to manage your CyberGhost account
  
• A CyberGhost subscription
     How to purchase or upgrade a subscription
     Only prepaid subscribers: How to enter an activation key

Disclaimer: Please keep in mind that, although the technical process is as thoroughly documented as possible, you need to have at least some technical understanding. There's always a chance for an overseen mistake and/or things have changed and the article is not updated yet. 

Step 1

Visit your CyberGhost VPN online account.

Click on 'My Devices' and in the 'Add a new device' section > click 'Other'.

lick Configure new device and in the new window, choose your desired protocol, in our example: OpenVPN and your preferred country and server group, as described below:

• Protocol: OpenVPN
  
• Server group: Choose the server group and the OpenVPN protocol (UDP or TCP) you want to use
• Country: Since native protocol connections may only be used with exactly one server you now have to choose the country you want to surf from; the server to be used in this country will be chosen by CyberGhost automatically.

Note: For the OpenVPN 2.3.x version, you need to choose the server group accordingly, after that you can proceed to the next step by selecting the country of your choice.

OpenVPN 2.3.x with UDP configuration:

OpenVPN 2.3.x with TCP configuration:

UDP allows higher speed than the TCP version but can result in broken downloads in some cases. This is the default setting.
TCP allows more stable connections than the UDP version but is a bit slower. Choose this version, if you have recurrent connection issues such as sudden disconnections.

Once the desired parameters are chosen, save them with Save Configuration

To view the OpenVPN credentials that are generated for you on the configuration dashboard, press View Configuration. 

After setting up your connection preferences please make a note of the following:

• Server: This is the address of the country (server) you want to be connected with, e.g. '12345-1-ca.cg-dialup.net'. This address changes with every country you have chosen in the step before. The actual single server to be used will be chosen automatically by CyberGhost.
• User name: A solely for this protocol generated user name. This is NOT your regular CyberGhost account user name, it's used only to authenticate with our servers via Manual Configurations.
• Password (you need to check the "Show Password" option in order to see it): A solely for protocol usage generated password. This is NOT your regular CyberGhost account password, it's used only to authenticate with our servers via Manual Configurations.

Once done, please download the configuration file. For that please click on 'Download Configuration' and download the config file to your computer (it's recommended that you create a special folder for the config, somewhere accessible like your Desktop and Extract/Copy the contents of the .zip file there). 

Now, the saved config is a ZIP file, which contains the following single files:

• ca.crt: This is the certificate of the certification authority
  
• client.crt: This is the user certification file 
• client.key: This is your private key file
• openvpn.ovpn: This is your OpenVPN configuration file

If you need to change the country you connect to, you must re-configure the location to use in your account management and download the new zipped config file.

Turn OFF IPv6

At the moment CyberGhost VPN does not support IPv6, therefore sometimes users can experience issues with connection or leaks that are related specifically to IPv6.

To disable IPv6 support on your Debian device, please visit How to disable IPv6 for Linux

 

Step 2

Extract the downloaded configuration file and rename the containing 'openvpn.ovpn' to 'CG_Country.conf'.

Copy the file into your OpenVPN configuration directory. For that you open a terminal window and move to the folder in which you extracted the configuration files by typing:

cd [path to the folder with the extracted configuration files]

Now copy the files:

sudo cp CG_XX.conf /etc/openvpn/
sudo cp ca.cert /etc/openvpn/
sudo cp client.crt /etc/openvpn/
sudo cp client.key /etc/openvpn/

If you want to surf from more than one country, download after the selection of a different country in your account management the next zipped configuration file and rename that one also from 'openvpn.ovpn' to 'CG_AnotherCountry.conf'. For two different countries, you need for example do the following steps: Specify device, protocol and operating system Choose a country, e.g. USA Download the zipped configuration file with certificates, key and OpenVPN configuration file Unzip the downloaded file and copy all files in your OpenVPN configuration folder Rename the OpenVPN configuration file from ‘openvpn.ovpn’ to ‘CG_USA.conf’. (If you need to address a single server instead of a country in general, you are to edit the OVPN file and exchange the pre-configured server address line.  Choose the next country, e.g. Romania Download the next zipped configuration file Unzip the downloaded file and copy just the file 'openvpn.ovpn' into the configuration folder  Rename it to ‘CG_RO.ovpn’. etc. ...

Step 3

Before you can begin configuring your network settings make sure you already installed the needed packages. If they are missing, please do as follows:

Download the package information by opening a console and typing ‘sudo apt-get update’.

Once done download the package with :

sudo apt-get install openvpn openssl openresolv

To be able to log in automatically, save your user name and password in a file called ‘user.txt’ and store it in your OpenVPN folder. For that first move to the OpenVPN folder:

cd /etc/openvpn

Now enter the following command to create and open a text file called 'user':

sudo nano user.txt

Type in your credentials (one in each line). In the first line type in the user name created in step 1, in the second line type in the password, also created in step 1:

YourUsername
YourPassword

DO NOT use your regular CyberGhost user name and password, which you use to login in to the client and your account management!

Save your changes with ‘CTRL+O’ and leave the editor via ‘CTRL+X’

Next, open the configuration file ‘CG_XX.conf’ by typing

sudo nano CG_XX.conf

Extend the line ‘auth-user-pass’ …

[...]
auth-user-pass
[...]

… with the path to your credentials file:

[...]
auth-user-pass /etc/openvpn/user.txt
[...]

At the bottom of the configuration passage (after 'verb 4') add the following two lines:

up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf

Save via ‘CTRL+O’ and leave the editor with ‘CTRL+X’.

Then get the file autoloaded by typing

sudo nano /etc/default/openvpn

and adding the following line:

AUTOSTART="CG_XX"  (the name of the file WITHOUT the file extension ‘.conf’)

Again, save with ‘CTRL+O’ and leave the editor with ‘CTRL+X’.

At last type in your console

sudo update-rc.d openvpn enable

Step 4

Before starting OpenVPN check your configuration with …

cat /etc/resolv.conf

… and have a look, if the last line (‘nameserver’) shows the IP of the router. If not, change it.

Now start OpenVPN:

sudo service openvpn start

Wait a few seconds and then test, if everything works fine.

Furthermore, you might want to open the website https://dnsleaktest.com/ and test on leaks. For that choose ‘Standard Test’ or ‘Extended Test’.

---

*Many thanks to ‘Haudrauf’ for the original tutorial!