linux下openvpn服務器搭建

#openvpn的完整文件目錄，可直接覆蓋該文件目錄

yum install -y lzo lzo-devel openssl openssl-devel pam pam-devel pkcs11-helper pkcs11-helper-devel

yum -y install rpm-build rpmdevtools

midir -p /data/soft

cd /data/soft

wget https://swupdate.openvpn.org/community/releases/openvpn-2.2.2.tar.gz

rpmbuild -tb openvpn-2.2.2.tar.gz

cd /root/rpmbuild/RPMS/x86_64

rpm -ivh openvpn-2.2.2-1.x86_64.rpm

cd /usr/share/doc/openvpn-2.2.2/easy-rsa/2.0

vim vars

exportKEY_COUNTRY="CN"   所在的國家

export KEY_PROVINCE="BJ"  所在的省份

exportKEY_CITY="Hangzhou"   所在的城市

exportKEY_ORG="aliyun"        所屬的組織

export KEY_EMAIL=[e-mail]    郵件地址

##上述參數的值可以自定義設置，對配置無影響

ln -s openssl-1.0.0.cnf openssl.cnf

## 做個軟鏈接到openssl-1.0.0.cnf配置文件 

source ./vars

./clean-all 

##清除並刪除keys目錄下的所有key 

./build-ca 

##生成CA證書，剛剛已經在vars文件中配置了默認參數值，多次回車完成就可以

./build-key-server server

##生成服務器證書，其中server是自定義的名字，一直回車，到最後會有兩次交互，輸入y確認

##完成後會在keys目錄下保存了server.key、server.csr和server.crt三個文件。 

 

./build-key user01

##創建用戶祕鑰與證書 

##創建用戶名爲user01的祕鑰和證書，一直回車，到最後會有兩次確認，只要按y確認即可

##完成後，在keys目錄下生成1024位RSA服務器密鑰aliyunuser.key、aliyunuser.crt和aliyunuser.csr三個文件

 

./build-dh

##生成Diffie Hellman參數 

##執行了./build-dh後，會在keys目錄下生成dh參數文件dh1024.pem，dh1024.pem文件客戶端驗證的時候會用到

  

 

/bin/cp -ap /usr/share/doc/openvpn-2.2.2/easy-rsa/2.0/keys/*  /etc/openvpn/

##將/usr/share/doc/openvpn-2.2.2/easy-rsa/2.0/keys目錄下的所有文件複製到/etc/openvpn下

 

/bin/cp -ap /usr/share/doc/openvpn-2.2.2/sample-config-files/server.conf  /etc/openvpn/

##複製openvpn服務端配置文件server.conf文件到/etc/openvpn/目錄下

cat > /etc/openvpn/server.conf << EOF

 

local 0.0.0.0

port 1194

proto udp

dev tun

ca ca.crt

cert server.crt

key server.key 

dh dh1024.pem

server 172.16.0.0 255.255.255.0

ifconfig-pool-persist ipp.txt

#push "redirect-gateway def1 bypass-dhcp"

push "route 192.168.0.0 255.0.0.0"

push "dhcp-option DNS 114.114.114.114" 

#push "dhcp-option DNS 10.143.22.116" 

keepalive 10 120

reneg-sec 360000

comp-lzo

user nobody

group nobody

persist-key

persist-tun

status openvpn-status.log

log openvpn.log

verb 3

auth-user-pass-verify /etc/openvpn/checkpsw.sh via-env

client-cert-not-required 

username-as-common-name

script-security 3

 

 

EOF

##修改配置文件，注意DNS的設置，例如阿里雲上只能設置他們自己的DNS地址

##後四行是啓用用戶名密碼認證的，不需要時可以註釋掉

cat > /etc/openvpn/checkpsw.sh << 'EOF'

 

#!/bin/sh

###########################################################

# checkpsw.sh (C) 2004 Mathias Sundman <[e-mail]>

#

# This script will authenticate OpenVPN users against

# a plain text file. The passfile should simply contain

# one row per user with the username first followed by

# one or more space(s) or tab(s) and then the password.

 

PASSFILE="/etc/openvpn/psw-file"

LOG_FILE="/var/log/openvpn-password.log"

TIME_STAMP=`date "+%Y-%m-%d %T"`

 

###########################################################

 

if [ ! -r "${PASSFILE}" ]; then

  echo "${TIME_STAMP}: Could not open password file \"${PASSFILE}\" for reading." >> ${LOG_FILE}

  exit 1

fi

 

CORRECT_PASSWORD=`awk '!/^;/&&!/^#/&&$1=="'${username}'"{print $2;exit}' ${PASSFILE}`

 

if [ "${CORRECT_PASSWORD}" = "" ]; then

  echo "${TIME_STAMP}: User does not exist: username=\"${username}\", password=\"${password}\"." >> ${LOG_FILE}

  exit 1

fi

 

if [ "${password}" = "${CORRECT_PASSWORD}" ]; then

  echo "${TIME_STAMP}: Successful authentication: username=\"${username}\"." >> ${LOG_FILE}

  exit 0

fi

 

echo "${TIME_STAMP}: Incorrect password: username=\"${username}\", password=\"${password}\"." >> ${LOG_FILE}

exit 1

 

EOF

cat > /etc/openvpn/psw-file << EOF

abc 123456

EOF

chmod +x /etc/openvpn/checkpsw.sh理論/

chmod 400 /etc/openvpn/psw-file

chown nobody:nobody /etc/openvpn/psw-file

##配置使用用戶名密碼認證的腳本

 

vim /etc/sysctl.conf

net.ipv4.ip_forward = 1

sysctl -p 

##開啓轉發

iptables -t nat -A POSTROUTING -s 172.16.0.0/24 -j MASQUERADE

service iptables save

##添加iptables規則確保服務器可以轉發數據包

 

/etc/init.d/openvpn start

netstat -ano | grep 1194

##啓動openvpn

Windows PC客戶端的配置 :

下載客戶端安裝包：http://oss.aliyuncs.com/aliyunecs/openvpn-2.1.3-install.rar

將雲服務器中/etc/openvpn/目錄下的user01.key、user01.crt、ca.crt文件下載到需要連接openvpn的Windows客戶端上

保存到openvpn軟件的安裝路徑下的\OpenVPN\config目錄下

配置client.opvn文件

========================================

 

client

dev tun

proto udp

remote 101.201.101.163 1194

nobind

user nobody

group nobody

persist-key

persist-tun

ca ca.crt

;cert yujianbo.crt

;key yujianbo.key

comp-lzo

verb 3

auth-user-pass

auth-nocache

reneg-sec 360000