关注小众语言、AI技术，记录、分享技术点滴！

0%

centos 7 下安装openvpn

发表于 更新于 分类于

一、环境版本
1、CentOS 7.4
2、OpenVPN 2.4.6
3、easy-rsa 3.0

二、安装

1
2
3
4
yum install epel-release
yum install -y openssl openssl-devel lzo lzo-devel pam pam-devel automake pkgconfig makecache
yum install -y openvpn
yum install -y easy-rsa

三、添加openvpn配置用户

#启动openvpn的用户

1
2
groupadd openvpn
useradd -g openvpn -M -s /sbin/nologin openvpn

四、创建配置文件

1
2
3
4
mkdir /etc/openvpn/
cp -r /usr/share/easy-rsa/ /etc/openvpn/
cp -r /usr/share/doc/easy-rsa-3.0.3/vars.example /etc/openvpn/easy-rsa/3.0/vars
cp -r /usr/share/doc/openvpn-2.4.6/sample/sample-config-files/server.conf /etc/openvpn/server.conf

五、修改easy-rsa密钥生成配置（修改第45、65、76、84-89、97、105、113、117、134、139、171、180、192行）

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
vim /etc/openvpn/easy-rsa/3.0/vars

set_var EASYRSA "$PWD"
set_var EASYRSA_PKI "$EASYRSA/pki"
set_var EASYRSA_DN "cn_only"
set_var EASYRSA_REQ_COUNTRY "CN"
set_var EASYRSA_REQ_PROVINCE "BEIJING"
set_var EASYRSA_REQ_CITY "BEIJING"
set_var EASYRSA_REQ_ORG "OpenVPN CERTIFICATE AUTHORITY"
set_var EASYRSA_REQ_EMAIL "110@qq.com"
set_var EASYRSA_REQ_OU "OpenVPN EASY CA"
set_var EASYRSA_KEY_SIZE 2048
set_var EASYRSA_ALGO rsa
set_var EASYRSA_CA_EXPIRE 7000
set_var EASYRSA_CERT_EXPIRE 3650
set_var EASYRSA_NS_SUPPORT "no"
set_var EASYRSA_NS_COMMENT "OpenVPN CERTIFICATE AUTHORITY"
set_var EASYRSA_EXT_DIR "$EASYRSA/x509-types"
set_var EASYRSA_SSL_CONF "$EASYRSA/openssl-1.0.cnf"
set_var EASYRSA_DIGEST "sha256"

六、生成ca证书

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
cd /etc/openvpn/easy-rsa/3.0
./easyrsa init-pki
./easyrsa build-ca
#设置ca密码（输入两次）：

#生成Diffie Hellman key exchange文件
./easyrsa gen-dh

#生成tls-auth key文件
cd /etc/openvpn
openvpn --genkey --secret ta.key

#使用gen-req来生成req
cd /etc/openvpn/easy-rsa/3.0
./easyrsa  gen-req wwwserver

#签发服务端证书
./easyrsa sign-req server wwwserver

#生成客户端用户
./easyrsa build-client-full www001

七、修改openvpn服务端配置

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
vim /etc/openvpn/server.conf

port 1194
proto udp
dev tun
ca /etc/openvpn/easy-rsa/3.0/pki/ca.crt
cert /etc/openvpn/easy-rsa/3.0/pki/issued/wwwserver.crt
key /etc/openvpn/easy-rsa/3.0/pki/private/wwwserver.key
dh /etc/openvpn/easy-rsa/3.0.3/pki/dh.pem
tls-auth /etc/openvpn/ta.key 0
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 223.5.5.5"
push "dhcp-option DNS 114.114.114.114"
keepalive 10 120
cipher AES-256-CBC
comp-lzo
max-clients 50
user openvpn
group openvpn
persist-key
persist-tun
status openvpn-status.log
log-append openvpn.log
verb 3
mute 20

八、服务器防火墙和路由配置

在iptables中添加一条路由转发规则, 并保存:

1
2
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j MASQUERADE
iptables-save

同时, 我们必须在sysctl中启用ip forward.
打开文件vi /etc/sysctl.conf, 并添加以下内容:

1
net.ipv4.ip_forward = 1

然后重启网络:

1
systemctl restart network.service

九、启动服务器

1
2
systemctl start openvpn@server
#启动时输入服务端证书密码：

十、客户端配置（下载客户端证书）

1
2
3
4
5
mkdir -p /etc/openvpn/client
cp -r /etc/openvpn/easy-rsa/3.0/pki/issued/www001.crt /etc/openvpn/client/
cp -r /etc/openvpn/easy-rsa/3.0/pki/private/www001.key /etc/openvpn/client/
cp -r /etc/openvpn/easy-rsa/3.0/pki/ca.crt /etc/openvpn/client/
cp -r /etc/openvpn/ta.key /etc/openvpn/client/

十一、修改客户端ovpn文件

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
client
dev tun
proto udp
remote xxx.xxx.xxx.xxx 1194 #改成外网IP
resolv-retry infinite
nobind
persist-key
persist-tun
comp-lzo
ca ca.crt
cert www001.crt
key www001.key
remote-cert-tls server
tls-auth ta.key 1
cipher AES-256-CBC
keepalive 10 120
verb 5

ps
1、如果是阿里云的专用网络，需要配置放行1194端口udp
2、如生成证书时输错密码（删除以下文件即可）

1
2
rm -rf /etc/openvpn/easy-rsa/3.0/pki/reqs/www001.req
rm -rf /etc/openvpn/easy-rsa/3.0/pki/private/www001.key

3、撤销证书

1
2
cd /etc/openvpn/easy-rsa/3.0
./easyrsa revoke www001

4、解决服务器每次都要输入Enter PEM pass phrase

1
openssl rsa -in server.key -out server.key.unsecure

服务器改用这个server.key.unsecure就不会每次提示了