OpenVPN部署
1. 前期准备
1.1 安装epel仓库源
bash
[root@localhost ~]# yum -y install epel-release
2. OpenVPN服务端搭建
2.1 安装openvpn
bash
[root@localhost ~]# yum -y install openvpn
2.2 安装easy-rsa
使用wegt命令获取压缩包:
bash
[root@localhost ~]# wget https://gitcode.net/mirrors/OpenVPN/easy-rsa/-/archive/master/easy-rsa-master.tar.gz
解压缩:
bash
[root@localhost ~]# mkdir openvpn
[root@localhost openvpn]# tar -xzvf easy-rsa-master.tar.gz
[root@localhost openvpn]# mv easy-rsa-master easy-rsa
在解压缩的使用遇见问题:
bash
[root@localhost ~]# tar -xzvf easy-rsa-master.tar.gz
gzip: stdin: not in gzip format
tar: Child returned status 1
tar: Error is not recoverable: exiting now
解决这个问题可以在github上下载最新的easy-rsa.zip压缩包再进行解压
下载网址: https://github.com/OpenVPN/easy-rsa
bash
[root@localhost ~]# unzip easy-rsa-master.zip
[root@localhost ~]# mkdir openvpn/
[root@localhost ~]# mv easy-rsa-master openvpn/
[root@localhost ~]# cd openvpn/
[root@localhost openvpn]# mv easy-rsa-master easy-rsa
2.3 配置openvpn
创建/etc/openvpn/目录,将easy-rsa放进去
bash
[root@localhost ~]# mkdir -p /etc/openvpn/
[root@localhost ~]# cd openvpn/
[root@localhost openvpn]# cp -Rp easy-rsa /etc/openvpn/
配置easyrsa3/中的vars文件
bash
[root@localhost ~]# cd /etc/openvpn/easy-rsa/easyrsa3/
[root@localhost easyrsa3]# cp vars.example vars
[root@localhost easy-rsa3]# vim vars
添加:
set_var EASYRSA_REQ_COUNTRY "CN"
set_var EASYRSA_REQ_PROVINCE "Shanghai"
set_var EASYRSA_REQ_CITY "Shanghai"
set_var EASYRSA_REQ_ORG "username"(自己选)
set_var EASYRSA_REQ_EMAIL "1111@qq.com"(自己选)
set_var EASYRSA_REQ_OU "My OpenVPN"
2.4 创建服务端证书等
初始化程序:
bash
[root@localhost ~]# cd /etc/openvpn/easy-rsa/easyrsa3/
[root@localhost easyrsa3]# ./easyrsa init-pki
创建根证书:
bash
[root@localhost easyrsa3]# ./easyrsa build-ca
这里需要输入根证书密码 ,如果不想输入密码,可以在创建根证书的命令中加nopass
,之后的创建命令也是一样,就不再过多赘述了。
例:
bash
[root@localhost easyrsa3]# ./easyrsa build-ca nopass
在创建根证书的时候,还需要输入一个Common Name
用户名,我这里使用的是Dai
。
创建服务端证书:
bash
[root@localhost easyrsa3]# ./easyrsa gen-req server nopass
# 我这里就没有设置密码了,如果需要设置去除nopass,步骤和上面一样。
同样的,在创建服务端证书的时候也需要输入一个Common Name用户名,注意与根证书用户名不一样。
签约服务端证书:
bash
[root@localhost easyrsa3]# ./easyrsa sign server server
创建过程中需要提供创建根证书的密码
创建DH(Diffie-Hellman):
bash
[root@localhost easyrsa3]# ./easyrsa gen-dh
2.5 创建客户端证书等
2.5.1 创建client/目录,拷贝easy-rsa文件
bash
[root@localhost ~]# mkdir client
[root@localhost ~]# cp /etc/openvpn/easy-rsa client -Rp
[root@localhost ~]# cd client/easy-rsa/easyrsa3/
2.5.2 初始化程序:
bash
[root@localhost easyrsa3]# ./easyrsa init-pki
2.5.3 创建客户端证书:
bash
[root@localhost easyrsa3]# ./easyrsa gen-req client
这里的密码是客户端登录连接时候需要输入的密码,所以需要记录下来
我这里在二次输入密码的时候输入不一致所以报错了,正常情况下不会出现failure
。
2.5.4 将用户req导入
bash
[root@localhost easyrsa3]# cd /etc/openvpn/easy-rsa/easyrsa3/
[root@localhost easyrsa3]# ./easyrsa import-req /root/client/easy-rsa/easyrsa3/pki/reqs/client.req client_username
2.5.5 签约证书
bash
[root@localhost easyrsa3]# ./easyrsa sign client client_username
签约证书需要输入根证书的密码,与签约服务端证书时的过程一样。
2.6 整理相关证书文件
2.6.1 将服务端所需的必要文件放到/etc/openvpn/中
bash
[root@localhost ~]# cp /etc/openvpn/easy-rsa/easyrsa3/pki/ca.crt /etc/openvpn/
[root@localhost ~]# cp /etc/openvpn/easy-rsa/easyrsa3/pki/private/server.key /etc/openvpn/
[root@localhost ~]# cp /etc/openvpn/easy-rsa/easyrsa3/pki/issued/server.crt /etc/openvpn/
[root@localhost ~]# cp /etc/openvpn/easy-rsa/easyrsa3/pki/dh.pem /etc/openvpn/
2.6.2 将客户端所需的必要文件放到/root/client/中
[root@localhost ~]# cp /etc/openvpn/easy-rsa/easyrsa3/pki/ca.crt /root/client/
[root@localhost issued]# cp /etc/openvpn/easy-rsa/easyrsa3/pki/issued/client_username.crt /root/client/
[root@localhost ~]# cp /root/client/easy-rsa/easyrsa3/pki/private/client.key /root/client
2.7 修改配置文件
2.7.1 查看文件
bash
[root@localhost ~]# rpm -ql openvpn |grep server.conf
2.7.2 根据这个拷贝server.conf配置文件到/etc/openvpn/
bash
[root@localhost issued]# cp /usr/share/doc/openvpn-2.4.12/sample/sample-config-files/server.conf /etc/openvpn/
2.7.3 修改配置文件
bash
[root@localhost ~]# vim /etc/openvpn/server.conf
local 0.0.0.0
port 1194
proto tcp
dev tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key
dh /etc/openvpn/dh.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
client-to-client
keepalive 10 120
cipher AES-256-GCM
comp-lzo
max-clients 100
user openvpn
group openvpn
persist-key
persist-tun
status /var/log/openvpn/openvpn-status.log
log /var/log/openvpn/openvpn.log
verb 3
2.7.4 修改配置文件检查脚本
bash
[root@localhost ~]# vim /etc/openvpn/checkpw.sh
sh
#!/bin/sh
###########################################################
# checkpsw.sh (C) 2004 Mathias Sundman <mathias@openvpn.se>
#
# This script will authenticate OpenVPN users against
# a plain text file. The passfile should simply contain
# one row per user with the username first followed by
# one or more space(s) or tab(s) and then the password.
PASSFILE="/etc/openvpn/pw-file"
LOG_FILE="/var/log/openvpn/openvpn-password.log"
TIME_STAMP=`date "+%Y-%m-%d %T"`
###########################################################
if [ ! -r "${PASSFILE}" ]; then
echo "${TIME_STAMP}: Could not open password file \"${PASSFILE}\" for reading." >> ${LOG_FILE}
exit 1
fi
CORRECT_PASSWORD=`awk '!/^;/&&!/^#/&&$1=="'${username}'"{print $2;exit}' ${PASSFILE}`
if [ "${CORRECT_PASSWORD}" = "" ]; then
echo "${TIME_STAMP}: User does not exist: username=\"${username}\", password=\"${password}\"." >> ${LOG_FILE}
exit 1
fi
if [ "${password}" = "${CORRECT_PASSWORD}" ]; then
echo "${TIME_STAMP}: Successful authentication: username=\"${username}\"." >> ${LOG_FILE}
exit 0
fi
echo "${TIME_STAMP}: Incorrect password: username=\"${username}\", password=\"${password}\"." >> ${LOG_FILE}
exit 1
2.7.5 编写密码文件
bash
[root@localhost ~]# vim /etc/openvpn/pw-file
user1 passwd1
user2 passwd2
2.7.6 配置权限
在日志文件/var/log/中创建一个openvpn/
bash
[root@localhost ~]# mkdir /var/log/openvpn
分配权限:
bash
[root@localhost ~]# chown -R openvpn.openvpn /var/log/openvpn/
[root@localhost ~]# chown -R openvpn.openvpn /etc/openvpn/*
2.7 iptables过滤
bash
[root@localhost ~]# iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
[root@localhost ~]# iptables -A FORWARD -i tun0 -o eth0 -j ACCEPT
[root@localhost ~]# iptables -A FORWARD -i eth0 -o tun0 -j ACCEPT
2.8 开启路由转发
bash
[root@localhost ~]# vim /etc/sysctl.conf
net.ipv4.ip_forward = 1
[root@localhost ~]# sysctl -p
2.9 开启openvpn服务
bash
[root@localhost ~]# openvpn /etc/openvpn/server.conf &
[root@localhost ~]# netstat -ntlp
3. 客户端连接
3.1 创建client.ovpn文件
client
dev tun
proto udp
remote 10.8.0.7 1194 ## openvpn服务端IP
resolv-retry infinite
nobind
## 指定ca、cert、key的路径
ca ca.crt
cert client.crt
key client.key
verb 3
persist-key
comp-lzo