准备工作

# 关闭防火墙

[root@localhost ~]# systemctl stop firewalld

[root@localhost ~]# systemctl disable firewalld

# 关闭selinux

[root@localhost ~]# sed -i 's/enforcing/disabled/' /etc/selinux/config

[root@localhost ~]# setenforce 0

————————————————

一、证书制作

1.下载并解压easy-rsa软件包

[root@localhost ~]# yum -y install wget unzip net-tools

[root@localhost ~]# wget -P /root http://down.i4t.com/easy-rsa.zip

[root@localhost ~]# cd /root

[root@localhost ~]# ls

anaconda-ks.cfg  easy-rsa.zip

[root@localhost ~]# unzip -d ./ easy-rsa.zip

[root@localhost ~]# ls

anaconda-ks.cfg  easy-rsa-old-master  easy-rsa.zip

2.制作CA证书之前，需要编辑vars文件，修改相关选项

[root@localhost ~]# cd /root/easy-rsa-old-master/easy-rsa/2.0/

[root@localhost ~]# vi vars

修改后：

3.使环境变量生效

[root@localhost 2.0]# source vars

[root@localhost 2.0]# ./clean-all

4.生成根证书和秘钥（ca.crt，ca.key）

[root@localhost 2.0]# cd /root/easy-rsa-old-master/easy-rsa/2.0/

[root@localhost 2.0]# ./build-ca

[root@localhost 2.0]# ls keys/

5.生成服务证书和秘钥（server.crt，server.key）

[root@localhost 2.0]# ./build-key-server server

6.生成客户端证书和秘钥（client.crt，client.key）

[root@localhost 2.0]# ./build-key client

7.生成秘钥交换文件（dh2048.pem）

[root@localhost 2.0]# ./build-dh

二、配置服务端

1.安装

[root@localhost 2.0]# cd /etc/yum.repos.d/

[root@localhost yum.repos.d]# curl -o epel.repo http://mirrors.aliyun.com/repo/epel-7.repo

[root@localhost yum.repos.d]# yum clean all

[root@localhost yum.repos.d]# yum makecache

[root@localhost yum.repos.d]# yum -y install openvpn

2.配置

[root@localhost yum.repos.d]# cd /etc/openvpn/

[root@localhost openvpn]# mkdir keys

[root@localhost openvpn]# cd /root/easy-rsa-old-master/easy-rsa/2.0/keys/

[root@localhost keys]# cp {ca.crt,server.crt,server.key,dh2048.pem} /etc/openvpn/keys/

[root@localhost keys]# cd /etc/openvpn/

[root@localhost openvpn]# cp /usr/share/doc/openvpn-2.4.12/sample/sample-config-files/server.conf ./

[root@localhost openvpn]# vi server.conf

 server.conf修改后：

 

（说明：push后面的内网网段，有多少写多少个）

3.启用路由转发功能

[root@localhost openvpn]# echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf

[root@localhost openvpn]# sysctl -p

4.建立ta.key文件（拒绝服务攻击证书）

[root@localhost openvpn]# cd /etc/openvpn/keys

[root@localhost keys]# openvpn --genkey --secret ta.key

 

5.启动服务

[root@localhost keys]# cd /etc/openvpn/

[root@localhost openvpn]# openvpn --daemon --config server.conf

[root@localhost openvpn]# netstat -lntup | grep 1194

三、配置客户端

1.客户端配置

[root@localhost openvpn]# cp /usr/share/doc/openvpn-2.4.12/sample/sample-config-files/client.conf /root/

[root@localhost openvpn]# cd /root

[root@localhost ~]# mkdir client

[root@localhost ~]# mv client.conf client

[root@localhost ~]# cd client/

[root@localhost client]# vi client.conf

 client.conf修改后：

（说明：remote 公网地址 1194）

2.客户端证书文件

[root@localhost client]# cp /root/easy-rsa-old-master/easy-rsa/2.0/keys/{client.key,client.crt,ca.crt} /root/client/

[root@localhost client]# cp /etc/openvpn/keys/ta.key /root/client/

 [root@localhost client]# mv client.conf client.ovpn

[root@localhost client]# cd ..

[root@localhost ~]# tar -zcvf client.tar.gz client

四、Windows客户端测试

1.右击管理员安装

2.下载client文件夹下文件到本地config

3.openvpn配置--高级--config和log目录设置

配置iptables的nat功能：

[root@localhost client]# iptables -t nat -A POSTROUTING -s 10.0.1.0/24 -j MASQUERADE

查看：

[root@localhost client]# iptables -t nat -L

五、需要把内网主机，映射到公网，这一步需要路由器或者防火墙有映射功能。

六、如果vpn设置账号密码登录需要进行以下操作

1.修改配置文件server.conf。（添加下列配置）

script‐security 3 #加入script‐security消除以下警告 不是很了解，不加拨号失败

（允许OPenvpn使用用户自动以脚本）

 client‐cert‐not‐required #取消客户端的证书认证 如果双重验证注释掉此行，客户

端配置文件证书路径保留。

username‐as‐common‐name

auth‐user‐pass‐verify /etc/openvpn/checkpsw.sh via‐env #开启用户密码脚本

新增内容：

script-security 3

username-as-common-name

auth-user-pass-verify /usr/local/openvpn/server/checkpsw.sh via-env

找到server.conf

[root@localhost client]# find / -name server.conf

/usr/share/doc/NetworkManager/examples/server.conf

/usr/share/doc/openvpn-2.4.12/sample/sample-config-files/server.conf

/usr/local/openvpn/server/server.conf

[root@localhost client]# cd /usr/local/openvpn/server

2.添加验证脚本，密码文件

[root@localhost server]# vi checkpsw.sh

[root@localhost server]# chmod +x checkpsw.sh

脚本内容：

#!/bin/sh

###########################################################

# checkpsw.sh (C) 2004 Mathias Sundman <mathias@openvpn.se>

#

# This script will authenticate OpenVPN users against

# a plain text file. The passfile should simply contain

# one row per user with the username first followed by

# one or more space(s) or tab(s) and then the password.

PASSFILE="/etc/openvpn/psw-file"

LOG_FILE="/etc/openvpn/openvpn-password.log"

TIME_STAMP=`date "+%Y-%m-%d %T"`

###########################################################

if [ ! -r "${PASSFILE}" ]; then

  echo "${TIME_STAMP}: Could not open password file \"${PASSFILE}\" for reading." >> ${LOG_FILE}

  exit 1

fi

CORRECT_PASSWORD=`awk '!/^;/&&!/^#/&&$1=="'${username}'"{print $2;exit}' ${PASSFILE}`

if [ "${CORRECT_PASSWORD}" = "" ]; then

  echo "${TIME_STAMP}: User does not exist: username=\"${username}\", password=\"${password}\"." >> ${LOG_FILE}

  exit 1

fi

if [ "${password}" = "${CORRECT_PASSWORD}" ]; then

  echo "${TIME_STAMP}: Successful authentication: username=\"${username}\"." >> ${LOG_FILE}

  exit 0

fi

echo "${TIME_STAMP}: Incorrect password: username=\"${username}\", password=\"${password}\"." >> ${LOG_FILE}

exit 1

3.密码验证文件：

[root@localhost server]# vi psw-file

[root@localhost server]# chmod 777 psw-file

密码内容：

#A

#阿里云

aliyun aly123456

4.设置客户端client.ovpn

再添加这一行，添加这行，就会提示输入用户名和密码

auth-nocache

auth-user-pass

完整内容：

client

dev tun

proto udp

resolv-retry infinite

nobind

#remote 192.168.2.69 1194

remote 公网地址 1194

comp-lzo

ca ca.crt

cert client.crt

key client.key

cipher AES-256-CBC

tls-auth ta.key 1

keepalive 10 120

persist-key

persist-tun

verb 3

status client-status.log

log-append client.log

auth-nocache

auth-user-pass