openVPN学习与使用

一、安装openvpn

1.更新软件包
yum -y update
2.安装epel扩展源
yum -y install epel-release
3.安装openvpn和easy-rsa
yum -y install openvpn easy-rsa
4.复制easy-rsa文件
[root@localhost ~]# cp -r /usr/share/easy-rsa/ /etc/openvpn/easy-rsa
[root@localhost ~]# cd /etc/openvpn/easy-rsa/
[root@localhost easy-rsa]# \rm 3 3.0
[root@localhost easy-rsa]# cd 3.0.3/
[root@localhost 3.0.3]# find / -type f -name “vars.example” | xargs -i cp {} . && mv vars.example vars

二、生成CA证书

1.创建一个新的 PKI 和 CA
[root@localhost 3.0.3]# ./easyrsa init-pki
2.创建新的CA，不使用密码
[root@localhost 3.0.3]# ./easyrsa build-ca nopass
Note: using Easy-RSA configuration from: ./vars
Generating a 2048 bit RSA private key
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.’, the field will be left blank.
Common Name (eg: your user, host, or server name) [Easy-RSA CA]: 回车
CA creation complete and you may now import and sign cert requests.
Your new CA certificate file for publishing is at:
/etc/openvpn/easy-rsa/3.0.3/pki/ca.crt

三、创建服务端证书

1.创建服务端证书
[root@localhost 3.0.3]# ./easyrsa gen-req server nopass
Note: using Easy-RSA configuration from: ./vars
Generating a 2048 bit RSA private key
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
Common Name (eg: your user, host, or server name) [server]: 回车
Keypair and certificate request completed. Your files are:
req: /etc/openvpn/easy-rsa/3.0.3/pki/reqs/server.req
key: /etc/openvpn/easy-rsa/3.0.3/pki/private/server.key
2.签约服务端证书
[root@localhost 3.0.3]# ./easyrsa sign server server
Note: using Easy-RSA configuration from: ./vars
You are about to sign the following certificate.
Please check over the details shown below for accuracy. Note that this request
has not been cryptographically verified. Please be sure it came from a trusted
source or that you have verified the request checksum with the sender.
Request subject, to be signed as a server certificate for 3650 days:
subject=
commonName = server
Type the word ‘yes’ to continue, or any other input to abort.
Confirm request details: yes
Using configuration from ./openssl-1.0.cnf
Check that the request matches the signature
Signature ok
The Subject Distinguished Name is as follows
commonName :ASN.1 12:’server’
Certificate is to be certified until Apr 7 14:54:08 2028 GMT (3650 days)
Write out database with 1 new entries
Data Base Updated
Certificate created at: /etc/openvpn/easy-rsa/3.0.3/pki/issued/server.crt
3.创建 Diffie-Hellman
[root@localhost 3.0.3]# ./easyrsa gen-dh
……………………………………………………
DH parameters of size 2048 created at /etc/openvpn/easy-rsa/3.0.3/pki/dh.pem
4.整理证书
[root@localhost ~]# cd /etc/openvpn
[root@localhost openvpn]# cp easy-rsa/3.0.3/pki/dh.pem .
[root@localhost openvpn]# cp easy-rsa/3.0.3/pki/ca.crt .
[root@localhost openvpn]# cp easy-rsa/3.0.3/pki/issued/server.crt .
[root@localhost openvpn]# cp easy-rsa/3.0.3/pki/private/server.key .

四、创建客户端证书

1.复制文件
[root@localhost ~]# cp -r /usr/share/easy-rsa/ /etc/openvpn/client
[root@localhost ~]# cd /etc/openvpn/client/easy-rsa/
[root@localhost easy-rsa]# \rm 3 3.0
[root@localhost easy-rsa]# cd 3.0.3/
[root@localhost 3.0.3]# find / -type f -name “vars.example” | xargs -i cp {} . && mv vars.example vars
2.生成客户端证书
[root@localhost 3.0.3]# ./easyrsa init-pki #创建新的pki
Note: using Easy-RSA configuration from: ./vars
init-pki complete; you may now create a CA or requests.
Your newly created PKI dir is: /etc/openvpn/client/easy-rsa/3.0.3/pki
[root@localhost 3.0.3]# ./easyrsa gen-req client nopass #客户证书名，无密码
Note: using Easy-RSA configuration from: ./vars
Generating a 2048 bit RSA private key
writing new private key to ‘/etc/openvpn/client/easy-rsa/3.0.3/pki/private/client.key.FkrLzXH9Bm’
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.’, the field will be left blank.
Common Name (eg: your user, host, or server name) [client]: 回车
Keypair and certificate request completed. Your files are:
req: /etc/openvpn/client/easy-rsa/3.0.3/pki/reqs/client.req
key: /etc/openvpn/client/easy-rsa/3.0.3/pki/private/client.key
3.签约客户端证书
[root@localhost 3.0.3]# cd /etc/openvpn/easy-rsa/3.0.3/
[root@localhost 3.0.3]# pwd
/etc/openvpn/easy-rsa/3.0.3
[root@localhost 3.0.3]# ./easyrsa import-req /etc/openvpn/client/easy-rsa/3.0.3/pki/reqs/client.req client
Note: using Easy-RSA configuration from: ./vars
The request has been successfully imported with a short name of: client
You may now use this name to perform signing operations on this request.
[root@localhost 3.0.3]# ./easyrsa sign client client
Note: using Easy-RSA configuration from: ./vars
You are about to sign the following certificate.
Please check over the details shown below for accuracy. Note that this request
has not been cryptographically verified. Please be sure it came from a trusted
source or that you have verified the request checksum with the sender.
Request subject, to be signed as a client certificate for 3650 days:
subject=
commonName = client
Type the word ‘yes’ to continue, or any other input to abort.
Confirm request details: yes
Using configuration from ./openssl-1.0.cnf
Check that the request matches the signature
Signature ok
The Subject Distinguished Name is as follows
commonName :ASN.1 12:’client’
Certificate is to be certified until Apr 8 01:54:57 2028 GMT (3650 days)
Write out database with 1 new entries
Data Base Updated
Certificate created at: /etc/openvpn/easy-rsa/3.0.3/pki/issued/client.crt
4.整理证书
[root@localhost 3.0.3]# cd /etc/openvpn/client
[root@localhost client]# cp /etc/openvpn/easy-rsa/3.0.3/pki/ca.crt .
[root@localhost client]# cp /etc/openvpn/easy-rsa/3.0.3/pki/issued/client.crt .
[root@localhost client]# cp /etc/openvpn/client/easy-rsa/3.0.3/pki/private/client.key .

五、配置文件

1.服务器配置文件
[root@localhost ~]# vi /etc/openvpn/server.conf
port 1194
proto udp
dev tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key
dh /etc/openvpn/dh.pem
ifconfig-pool-persist /etc/openvpn/ipp.txt
server 10.8.0.0 255.255.255.0
push “route 10.8.0.0 255.255.255.0”
push “redirect-gateway def1 bypass-dhcp”
push “dhcp-option DNS 114.114.114.114”
push “dhcp-option DNS 8.8.8.8”
client-to-client
keepalive 20 120
comp-lzo
user openvpn
group openvpn
persist-key
persist-tun
status openvpn-status.log
log-append openvpn.log
verb 1
mute 20
2.客户端配置文件
[root@localhost ~]# vi /etc/openvpn/client/client.ovpn
client
remote 服务器IP 1194
proto udp
dev tun
comp-lzo
ca ca.crt
cert client.crt
key client.key
route-delay 2
route-method exe
redirect-gateway def1
dhcp-option DNS 8.8.8.8
dhcp-option DNS 8.8.4.4
dhcp-option DNS 4.2.2.1
dhcp-option DNS 4.2.2.2
verb 3
3.合成配置文件
[root@localhost aaa]# echo ‘‘ >>client.ovpn && cat ca.crt >>client.ovpn && echo ‘‘ >>client.ovpn && echo ‘‘ >>client.ovpn && cat client.crt >>client.ovpn && echo ‘‘ >>client.ovpn && echo ‘‘ >>client.ovpn && cat client.key >>client.ovpn && echo ‘‘ >>client.ovpn