前言
為了方便遠程辦公時訪問公司的內部系統，如：svn、OA、wiki、禪道等等；通通在防火墻上做了端口映射。發現有時也不好用，所有開始弄OPENVPN。
openvpn簡介
官方網站：https://openvpn.net 打不開請爬墻
openssl原理：http://www.www58058.com/archives/2704 參考書生的博客，哈哈
openvpn原理：http://freeloda.blog.51cto.com/2033581/1354768 參考往期學員的博客，此處就不贅述了。
安裝配置步驟
1、安裝openvpn軟件
2、生成服務器證書
3、修改主配置文件
4、生成并簽署客戶端證書
4、客戶端配置并連接
一、安裝openvpn軟件
安裝epel源
# rpm -ivh http://mirrors.zju.edu.cn/epel/6/i386/epel-release-6-8.noarch.rpm Retrieving http://mirrors.zju.edu.cn/epel/6/i386/epel-release-6-8.noarch.rpm Preparing... ########################################### [100%] 1:epel-release ########################################### [100%]
安裝openvpn
先安裝依賴包：# yum -y localinstall pkcs11-helper-1.11-3.el6.x86_64.rpm 之后安裝vpn： # yum -y install openvpn-2.3.8-1.el6.x86_64.rpm
下載easyesa，創建CA、生成證書都需要它
# wget https://github.com/OpenVPN/easy-rsa/archive/master.zip # unzip master.zip # mv easy-rsa-master/ /etc/openvpn
二、生成服務器證書
先切換目錄到/etc/openvpn/easy-rsa-master/easyrsa3以便生成證書
# cd /etc/openvpn/easy-rsa-master/easyrsa3/ # pki目錄初始化，此動作會刪除pki目錄下所有證書及密鑰文件 # ./easyrsa init-pki init-pki complete; you may now create a CA or requests. Your newly created PKI dir is: /etc/openvpn/easy-rsa-master/easyrsa3/pki # 創建根證書，密鑰文件需要設置密碼保護，并指定一個名稱 # ./easyrsa build-ca Generating a 2048 bit RSA private key .............................+++ .......................................................+++ writing new private key to '/etc/openvpn/easy-rsa-master/easyrsa3/pki/private/ca.key.NgXw582N1L' Enter PEM pass phrase: Verifying - Enter PEM pass phrase: #這塊需要輸入密碼 ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Common Name (eg: your user, host, or server name) [Easy-RSA CA]:hzcf #可以自定義 CA creation complete and you may now import and sign cert requests. Your new CA certificate file for publishing is at: /etc/openvpn/easy-rsa-master/easyrsa3/pki/ca.crt 生成一個服務器端的證書請求文件，不需要密碼保護 # ./easyrsa gen-req server no pass Ignoring unknown command option: 'no' Ignoring unknown command option: 'pass' Generating a 2048 bit RSA private key ...+++ ......+++ writing new private key to '/etc/openvpn/easy-rsa-master/easyrsa3/pki/private/server.key.Q4us0AebEk' Enter PEM pass phrase: #需要輸入密碼 Verifying - Enter PEM pass phrase: ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Common Name (eg: your user, host, or server name) [server]:server Keypair and certificate request completed. Your files are: req: /etc/openvpn/easy-rsa-master/easyrsa3/pki/reqs/server.req key: /etc/openvpn/easy-rsa-master/easyrsa3/pki/private/server.key # 簽署服務器端的請求證書，需要輸入根證書的密碼授權 # ./easyrsa sign-req server server You are about to sign the following certificate. Please check over the details shown below for accuracy. Note that this request has not been cryptographically verified. Please be sure it came from a trusted source or that you have verified the request checksum with the sender. Request subject, to be signed as a server certificate for 3650 days: subject= commonName = server Type the word 'yes' to continue, or any other input to abort. Confirm request details: yes #輸入yes Using configuration from /etc/openvpn/easy-rsa-master/easyrsa3/openssl-1.0.cnf Enter pass phrase for /etc/openvpn/easy-rsa-master/easyrsa3/pki/private/ca.key: #這塊需要輸入CA生成的密碼 Check that the request matches the signature Signature ok The Subject's Distinguished Name is as follows commonName :PRINTABLE:'server' Certificate is to be certified until Dec 18 07:55:09 2025 GMT (3650 days) Write out database with 1 new entries Data Base Updated Certificate created at: /etc/openvpn/easy-rsa-master/easyrsa3/pki/issued/server.crt
#生成 Diffie Hellman 參數 # ./easyrsa gen-dh Generating DH parameters, 2048 bit long safe prime, generator 2 This is going to take a long time .......................................+............................................................................+. ..................................................+................................................................. ...........................+..............++*++* DH parameters of size 2048 created at /etc/openvpn/easy-rsa-master/easyrsa3/pki/dh.pem # 查看服務器端生成的所有證書及密鑰文件 # yum -y install tree # tree pki pki ├── ca.crt ├── certs_by_serial │ └── 01.pem ├── dh.pem ├── index.txt ├── index.txt.attr ├── index.txt.old ├── issued │ └── server.crt ├── private │ ├── ca.key │ └── server.key ├── reqs │ └── server.req ├── serial └── serial.old 4 directories, 12 files # 為方便查看及配置，把服務器端需要用到的證書及密鑰文件放到/etc/openvpn目錄下 # cp pki/ca.crt /etc/openvpn # cp pki/private/server.key /etc/openvpn # cp pki/issued/server.crt /etc/openvpn # cp pki/dh.pem /etc/openvpn
三、修改主配置文件，
默認沒有主配置文件，需要從/usr/share/doc下復制一個模版文件過來
# cp /usr/share/doc/openvpn-2.3.8/sample/sample-config-files/server.conf /etc/openvpn # egrep -v "^(#|;)|^$" server.conf port 1194 proto udp dev tun ca ca.crt cert server.crt key server.key # This file should be kept secret dh dh2048.pem server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt keepalive 10 120 comp-lzo persist-key persist-tun status openvpn-status.log verb 3 # egrep -v "^(#|;)|^$" server.conf >> server.conf.2 # rm -rf server.conf # mv server.conf.2 server.conf # vim server.conf local 0.0.0.0 port 51194 proto tcp dev tun ca /etc/openvpn/ca.crt cert /etc/openvpn/server.crt key /etc/openvpn/server.key # This file should be kept secret dh /etc/openvpn/dh.pem server 10.38.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt push "redirect-gateway def1 bypass-dhcp" #啟用后，客戶端連接后所有上網請求都走VPN網關 push "route 10.0.1.0 255.255.0.0" push "route 10.0.2.0 255.255.0.0" push "dhcp-option DNS 114.114.114.114" keepalive 10 120 comp-lzo max-clients 100 persist-key persist-tun status /var/log/openvpn-status.log log /var/log/openvpn.log log-append /var/log/openvpn.log client-to-client verb 3
需要啟用路由轉發
# sysctl -w net.ipv4.ip_forward=1 # 修改配置文件使其永久生效 # # vim /etc/sysctl.conf net.ipv4.ip_forward = 1 # sysctl -p 重讀配置文件 # 防火墻開啟路由功能 # iptables -t nat -A POSTROUTING -s 10.38.0.0/24 -j MASQUERADE
服務啟動后會生成一個VPN網關
# openvpn --config server.conf & # # ifconfig tun0 tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 inet addr:10.28.0.1 P-t-P:10.28.0.2 Mask:255.255.255.255 UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)
四、生成并簽署客戶端證書
生成一個證書請求文件，在服務器端或客戶端都可以生成；設置密碼保護并指定一個名稱
# cp -r /etc/openvpn/easy-rsa-master/ /tmp # cd /tmp/easy-rsa-master/easyrsa3/ # ./easyrsa init-pki # ./easyrsa gen-req pandong Generating a 2048 bit RSA private key ...................................+++ ...........+++ writing new private key to '/tmp/easy-rsa-master/easyrsa3/pki/private/pandong.key.eBhsiM5QVM' Enter PEM pass phrase: Verifying - Enter PEM pass phrase: ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Common Name (eg: your user, host, or server name) [pandong]:pandong Keypair and certificate request completed. Your files are: req: /tmp/easy-rsa-master/easyrsa3/pki/reqs/pandong.req key: /tmp/easy-rsa-master/easyrsa3/pki/private/pandong.key # 導入客戶端證書請求文件 # cd /etc/openvpn/easy-rsa-master/easyrsa3/ # ./easyrsa import-req /tmp/easy-rsa-master/easyrsa3/pki/reqs/pandong.req pandong The request has been successfully imported with a short name of: pandong You may now use this name to perform signing operations on this request. # 簽署客戶端證書，同樣，需要需要輸入根證書密碼授權 # ./easyrsa sign-req client pandong You are about to sign the following certificate. Please check over the details shown below for accuracy. Note that this request has not been cryptographically verified. Please be sure it came from a trusted source or that you have verified the request checksum with the sender. Request subject, to be signed as a client certificate for 3650 days: subject= commonName = pandong Type the word 'yes' to continue, or any other input to abort. Confirm request details: yes # 輸入：yes Using configuration from /etc/openvpn/easy-rsa-master/easyrsa3/openssl-1.0.cnf Enter pass phrase for /etc/openvpn/easy-rsa-master/easyrsa3/pki/private/ca.key: # 輸入密碼 Check that the request matches the signature Signature ok The Subject's Distinguished Name is as follows commonName :PRINTABLE:'pandong' Certificate is to be certified until Dec 18 09:51:35 2025 GMT (3650 days) Write out database with 1 new entries Data Base Updated Certificate created at: /etc/openvpn/easy-rsa-master/easyrsa3/pki/issued/pandong.crt
五、客戶端配置并連接
到官網下載相應的軟件 https://openvpn.net/index.php/open-source/downloads.html
默認會安裝到 C:\Program Files\OpenVPN 下
下載根證書、客戶端證書、客戶端密鑰這三個文件，放到 C:\Program Files\OpenVPN\config下
# sz /etc/openvpn/easy-rsa-master/easyrsa3/pki/ca.crt # sz /etc/openvpn/easy-rsa-master/easyrsa3/pki/issued/pandong.crt # sz /tmp/easy-rsa-master/easyrsa3/pki/private/pandong.key
修改客戶端配置文件，默認沒有此文件，需要從 C:\Program Files\OpenVPN\sample-config\client.ovpn 復制一份到config目錄下
client dev tun proto tcp remote 211.103.153.157 56794 resolv-retry infinite nobind persist-key persist-tun ca ca.crt cert pandong.crt key pandong.key comp-lzo verb 3
有配置文件和證書后，點擊connect并輸入liuliang.key的密鑰密碼后即可連接，如圖
原創文章，作者：oranix，如若轉載，請注明出處：http://www.www58058.com/10334
