{"id":5432,"date":"2020-08-18T15:51:36","date_gmt":"2020-08-18T07:51:36","guid":{"rendered":"http:\/\/39.97.231.10\/?p=5432"},"modified":"2020-08-18T15:51:36","modified_gmt":"2020-08-18T07:51:36","slug":"openvpn%e9%85%8d%e7%bd%ae%e8%af%a6%e8%a7%a3","status":"publish","type":"post","link":"http:\/\/www.weijing.co\/?p=5432","title":{"rendered":"OpenVPN\u914d\u7f6e\u8be6\u89e3"},"content":{"rendered":"

1\u3001openvpn\u4ecb\u7ecd\u4e0e\u56fe\u89e3<\/strong>
\n1.1\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0openvpn\u4ecb\u7ecd<\/strong>
\nOpenVPN\u00a0\u662f\u4e00\u4e2a\u57fa\u4e8e\u00a0OpenSSL\u5e93\u7684\u5e94\u7528\u5c42\u00a0VPN\u00a0\u5b9e\u73b0\u3002\u548c\u4f20\u7edf\u00a0VPN\u00a0\u76f8\u6bd4\uff0c\u5b83\u7684\u4f18\u70b9\u662f\u7b80\u5355\u6613\u7528\u3002vpn\u76f4\u8bd1\u5c31\u662f\u865a\u62df\u4e13\u7528\u901a\u9053\uff0c\u662f\u63d0\u4f9b\u4f01\u4e1a\u4e4b\u95f4\u6216\u8005\u516c\u53f8\u4e4b\u95f4\u5b89\u5168\u6570\u636e\u4f20\u8f93\u7684\u96a7\u9053\u3002OpenVPN\u662f\u4e00\u4e2a\u5168\u7279\u6027\u7684SSL VPN\uff0c\u5b83\u4f7f\u75282\u5c42\u62163\u5c42\u7684\u5b89\u5168\u7f51\u7edc\u6280\u672f\uff0c\u4f7f\u7528\u7684\u662f\u5de5\u4e1a\u6807\u51c6\u7684SSL\/TLS\u534f\u8bae\u3002SSL(Secure Sockets Layer\u00a0\u5b89\u5168\u5957\u63a5\u5c42),\u53ca\u5176\u7ee7\u4efb\u8005\u4f20\u8f93\u5c42\u5b89\u5168\uff08TransportLayer Security\uff0cTLS\uff09\u662f\u4e3a\u7f51\u7edc\u901a\u4fe1\u63d0\u4f9b\u5b89\u5168\u53ca\u6570\u636e\u5b8c\u6574\u6027\u7684\u4e00\u79cd\u5b89\u5168\u534f\u8bae\u3002OpenVPN\u652f\u6301\u7075\u6d3b\u7684\u5ba2\u6237\u7aef\u6388\u6743\u65b9\u5f0f\uff0c\u652f\u6301\u8bc1\u4e66\u3001\u667a\u80fd\u5361\u3001\u7528\u6237\u540d\u548c\u5bc6\u7801\uff0c\u5141\u8bb8\u7528\u6237\u53ef\u4ee5\u901a\u8fc7\u9632\u706b\u5899\u8fde\u63a5\u5230VPN\u7684\u865a\u62df\u63a5\u53e3\uff0cOpenVPN\u4e0d\u662f\u4e00\u4e2a\u57fa\u4e8eweb\u4ee3\u7406\u7684\u5e94\u7528\uff0c\u4e5f\u4e0d\u662f\u57fa\u4e8e\u6d4f\u89c8\u5668\u8bbf\u95ee\u3002
\n1.2\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0openvpn\u4f7f\u7528\u573a\u666f<\/strong>
\na)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u4f01\u4e1a\u5458\u5de5\u8fdc\u7a0b\u529e\u516c\uff0c\u901a\u8fc7\u8fdc\u7a0bVPN\u8fde\u63a5\u5230\u516c\u53f8\u7684\u670d\u52a1\u5668\uff0c\u8bbf\u95ee\u516c\u53f8ERP\u3001OA\u7b49\u7cfb\u7edf\u3002IT\u6280\u672f\u4eba\u5458\u901a\u8fc7VPN\u8fdc\u7a0b\u8fde\u63a5\u5230\u673a\u623f\u8fdb\u884c\u7cfb\u7edf\u7ef4\u62a4\u3002
\nb)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u603b\u90e8\u4e0e\u5206\u652f\u673a\u6784\u4e4b\u95f4\u8054\u901a\uff0c\u6253\u901a\u5206\u652f\u4e0e\u603b\u90e8\u7684\u8fde\u63a5
\nc)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u591aIDC\u673a\u623f\u4e4b\u95f4\u7684\u4e92\u8054\uff0c\u5b9e\u73b0\u591a\u673a\u623f\u4e4b\u95f4\u7684\u4e92\u8054\u4e92\u901a\uff0c\u6570\u636e\u5171\u4eab\uff0c\u6587\u4ef6\u4f20\u9001
\n\u6ce8\u610f\uff1aOpenVPN\u9002\u7528\u4e8e\u529f\u80fd\u6027\u5b9e\u73b0\uff0c\u5bf9\u4e8e\u5927\u6d41\u91cf\u5927\u5e26\u5bbd\u5e94\u7528\uff0c\u5efa\u8bae\u4f7f\u7528\u70b9\u5bf9\u70b9\u4e13\u7ebf\u5b9e\u73b0\u4e92\u8054<\/p>\n

\n

2\u3001openvpn\u670d\u52a1\u7aef\u5b89\u88c5\u4e0e\u914d\u7f6e<\/strong>
\n2.1\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u73af\u5883\u4ecb\u7ecd<\/strong>
\n\u5b9e\u73b0\u6a21\u62dfOpenVPN\u529f\u80fd\u7684\u5b9e\u9a8c\u73af\u5883\u4ecb\u7ecd\uff1a
\n\u4f7f\u7528\u4e24\u53f0\u5185\u7f51\u5185\u6bb5192.168.3.0\/24\u7684\u673a\u5668\u6a21\u62df\u516c\u7f51\u73af\u5883\uff0c\u5de6\u4fa7\u7684lclient\u4e0e\u53f3\u4fa7\u7684lanserver\u5728\u4e0d\u540c\u7684\u7f51\u6bb5\uff0c\u6b63\u5e38\u60c5\u51b5\u4e0b\u4e0d\u80fd\u901a\u4fe1
\n\\\"openvpn\u914d\u7f6e\\\"<\/a>
\n\u672c\u6b21\u5b9e\u9a8c\u4f7f\u7528vpnclient\u7684\u53e6\u5916\u4e00\u4e2a\u63a5\u53e3eth1\u6a21\u62dflclient,IP\u5730\u5740\u4e3a10.0.0.17
\n2.2\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u57fa\u7840\u73af\u5883\u914d\u7f6e\u53ca\u4f9d\u8d56\u5305\u5b89\u88c5<\/strong>
\n2.2.1\u00a0\u00a0\u00a0\u5f00\u542f\u5185\u6838\u53c2\u6570ip\u8f6c\u53d1
\n\u5728vpnserver\u4e0a\u5f00\u542fip\u8f6c\u53d1\u529f\u80fd\uff0c\u7f16\u8f91\/etc\/sysctl.conf,\u4fee\u6539net.ipv4.ip_forward\u4e3a1<\/p>\n

net.ipv4.ip_forward\u00a0=\u00a01<\/pre>\n
\u4f7f\u7528-p\u9009\u9879\u4f7f\u53c2\u6570\u4fee\u6539\u751f\u6548<\/p>\n
[root@vpnserver\u00a0~]#\u00a0sysctl\u00a0-p\nnet.ipv4.ip_forward\u00a0=\u00a01<\/pre>\n
2.2.2\u00a0\u00a0\u00a0\u505c\u6b62iptables
\n\u5728\u5168\u90e8\u6d4b\u8bd5\u5b8c\u6210\u524d\uff0c\u6682\u65f6\u5148\u505c\u6389iptables\uff0c\u4ee5\u9632\u6b62\u7531\u4e8eiptables\u7684\u539f\u56e0\u9020\u6210\u7684\u95ee\u9898\uff0c\u5168\u90e8\u8c03\u8bd5\u5b8c\u6210\u540e\u518d\u5bf9iptables\u8fdb\u884c\u8bbe\u7f6e<\/p>\n
[root@vpnserver\u00a0~]#\u00a0\/etc\/init.d\/iptables\u00a0stop\niptables:\u00a0Setting\u00a0chains\u00a0to\u00a0policy\u00a0ACCEPT:\u00a0filter\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0[\u00a0OK\u00a0\u00a0]\niptables:\u00a0Flushing\u00a0firewall\u00a0rules:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0[\u00a0\u00a0OK\u00a0\u00a0]\niptables:\u00a0Unloading\u00a0modules:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0[\u00a0\u00a0OK\u00a0\u00a0]\n[root@vpnserver\u00a0~]#\u00a0\/etc\/init.d\/iptables\u00a0stop<\/pre>\n
2.2.3\u00a0\u00a0\u00a0\u5b89\u88c5\u57fa\u7840\u4f9d\u8d56\u5305
\n\u5b89\u88c5openssl\u76f8\u5173\u7684\u4f9d\u8d56\u5305<\/p>\n
yum\u00a0install\u00a0openssl*\u00a0-y<\/pre>\n
2.2.4\u00a0\u00a0\u00a0\u66f4\u65b0\u7cfb\u7edf\u65f6\u95f4
\n\u4f7f\u7528ntp\u540c\u6b65\u7cfb\u7edf\u65f6\u95f4<\/p>\n
ntpdate\u00a0-u\u00a0pool.ntp.org<\/pre>\n
\u5236\u5b9a\u8ba1\u5212\u4efb\u52a1\uff0c\u6bcf\u96945\u5206\u949f\u8fdb\u884c\u65f6\u95f4\u540c\u6b65<\/p>\n
echo\u00a0\\'#sync\u00a0system\u00a0date\u00a0from\u00a0ntpserver\\'>>\/var\/spool\/cron\/root\necho\u00a0\\'*\/5\u00a0*\u00a0*\u00a0*\u00a0*\u00a0\/usr\/sbin\/ntpdate\u00a0-u\u00a0pool.ntp.org\u00a0>\/dev\/null\u00a02>&1\\'\u00a0>>\/var\/spool\/cron\/root<\/pre>\n
\u68c0\u67e5\u914d\u7f6e\u4fe1\u606f<\/p>\n
[root@vpnserver\u00a0~]#\u00a0crontab\u00a0-l\n#sync\u00a0system\u00a0date\u00a0from\u00a0ntpserver\n*\/5\u00a0*\u00a0*\u00a0*\u00a0*\u00a0\/usr\/sbin\/ntpdate\u00a0-u\u00a0pool.ntp.org\u00a0>\/dev\/null\u00a02>&1<\/pre>\n
2.3\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u5b89\u88c5lzo\u5305<\/strong>
\n\u521b\u5efa\u76f8\u5e94\u7684\u5b89\u88c5\u5305\u76ee\u5f55<\/p>\n
mkdir\u00a0-p\u00a0\/server\/tools\ncd\u00a0\/server\/tools\/<\/pre>\n
\u5c06\u76f8\u5e94\u7684\u5b89\u88c5\u5305\u4e0a\u4f20\u81f3tools\u76ee\u5f55<\/p>\n
[root@vpnserver\u00a0tools]#\u00a0ll\ntotal\u00a01476\n-rw-r--r--.\u00a01\u00a0root\u00a0root\u00a0594855\u00a0Jul\u00a05\u00a008:33\u00a0lzo-2.09.tar.gz\n-rw-r--r--.\u00a01\u00a0root\u00a0root\u00a0911158\u00a0Jul\u00a05\u00a008:33\u00a0openvpn-2.2.2.tar.gz<\/pre>\n
\u5b89\u88c5lzo\u6e90\u7801\u5305<\/p>\n
cd\u00a0\/server\/tools\/\ntar\u00a0xf\u00a0lzo-2.09.tar.gz\ncd\u00a0lzo-2.09\n.\/configure\nmake\nmake\u00a0install<\/pre>\n
2.4\u00a0\u00a0\u00a0\u5b89\u88c5openvpn\u8f6f\u4ef6<\/strong>
\n2.4.1\u00a0\u00a0\u00a0\u6e90\u7801\u5305\u5b89\u88c5
\n\u7248\u672c\u9009\u62e9\uff1a\u76ee\u524d\u6700\u65b0\u7684\u7248\u672c\u4e3a2.3.1\uff0c\u672c\u6b21\u9009\u7528Linux\u5ba2\u6237\u7aef\u548c\u670d\u52a1\u7aef\u7684\u7248\u672c\u4e3a2.2.2\uff0cwindows\u5ba2\u6237\u7aef\u8f6f\u4ef6\u4f9d\u7136\u4f7f\u7528\u7684\u662f2.3.1
\n\u89e3\u538b\u5b89\u88c5OpenVPN\u6e90\u7801\u5305<\/p>\n
mkdir\u00a0\/application\ntar\u00a0xf\u00a0openvpn-2.2.2.tar.gz\u00a0-C\u00a0\/application\/\ncd\u00a0\/application\/openvpn-2.2.2\/\n.\/configure\u00a0--with-lzo-lib=\/usr\/local\/lib--with-lzo-headers=\/usr\/local\/include\nmake\nmake\u00a0install<\/pre>\n
\u68c0\u67e5\u5b89\u88c5\u7ed3\u679c<\/p>\n
[root@vpnserver\u00a0openvpn-2.2.2]#\u00a0which\u00a0openvpn\n\/usr\/local\/sbin\/openvpn<\/pre>\n
\u751f\u6210\u8f6f\u94fe\u63a5<\/p>\n
ln\u00a0-s\u00a0\/application\/openvpn-2.2.2\/\u00a0\/application\/openvpn<\/pre>\n
2.4.2\u00a0\u00a0\u00a0\u751f\u6210CA\u8bc1\u4e66
\n\u8fdb\u5165\u5236\u4f5c\u8bc1\u4e66\u6240\u5728\u76ee\u5f55\uff0c\u540e\u7eed\u5f88\u591a\u7684\u64cd\u4f5c\u90fd\u5728\u6b64\u76ee\u5f55<\/p>\n
cd\u00a0\/application\/openvpn-2.2.2\/easy-rsa\/2.0\n[root@vpnserver\u00a02.0]#\u00a0ll\ntotal\u00a0128\n-rwxrwxr-x.\u00a01\u00a0sunny\u00a0sunny\u00a0\u00a0119\u00a0Nov\u00a025\u00a0\u00a02011\u00a0build-ca\u00a0\u00a0\u00a0#\u751f\u6210CA\u8bc1\u4e66\n-rwxrwxr-x.\u00a01\u00a0sunny\u00a0sunny\u00a0\u00a0352\u00a0Nov\u00a025\u00a0\u00a02011\u00a0build-dh\u00a0\u00a0#\u751f\u6210\u5bc6\u7801\u534f\u8bae\u4ea4\u6362\u6587\u4ef6\n-rwxrwxr-x.\u00a01\u00a0sunny\u00a0sunny\u00a0\u00a0188\u00a0Nov\u00a025\u00a0\u00a02011\u00a0build-inter\n-rwxrwxr-x.\u00a01\u00a0sunny\u00a0sunny\u00a0\u00a0163\u00a0Nov\u00a025\u00a0\u00a02011\u00a0build-key\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0#\u751f\u6210\u514d\u5bc6\u7801\u5ba2\u6237\u7aef\u5bc6\u94a5\u5bf9\n-rwxrwxr-x.\u00a01\u00a0sunny\u00a0sunny\u00a0\u00a0157\u00a0Nov\u00a025\u00a0\u00a02011\u00a0build-key-pass\u00a0\u00a0\u00a0#\u751f\u6210\u5e26\u5bc6\u7801\u5ba2\u6237\u7aef\u5bc6\u94a5\u5bf9\n-rwxrwxr-x.\u00a01\u00a0sunny\u00a0sunny\u00a0\u00a0249\u00a0Nov\u00a025\u00a0\u00a02011\u00a0build-key-pkcs12\n-rwxrwxr-x.\u00a01\u00a0sunny\u00a0sunny\u00a0\u00a0268\u00a0Nov\u00a025\u00a0\u00a02011\u00a0build-key-server\u00a0\u00a0\u00a0\u00a0#\u751f\u6210\u670d\u52a1\u7aef\u5bc6\u94a5\u5bf9\n-rwxrwxr-x.\u00a01\u00a0sunny\u00a0sunny\u00a0\u00a0213\u00a0Nov\u00a025\u00a0\u00a02011\u00a0build-req\n-rwxrwxr-x.\u00a01\u00a0sunny\u00a0sunny\u00a0\u00a0158\u00a0Nov\u00a025\u00a0\u00a02011\u00a0build-req-pass\n-rwxrwxr-x.\u00a01\u00a0sunny\u00a0sunny\u00a0\u00a0428\u00a0Nov\u00a025\u00a0\u00a02011\u00a0clean-all\u00a0\u00a0\u00a0\u00a0\u00a0#\u521d\u59cb\u5316\u914d\u7f6e\uff0c\u6e05\u7a7a\u6240\u6709keys\n-rwxrwxr-x.\u00a01\u00a0sunny\u00a0sunny\u00a01457\u00a0Nov\u00a025\u00a0\u00a02011\u00a0inherit-inter\n-rwxrwxr-x.\u00a01\u00a0sunny\u00a0sunny\u00a0\u00a0295\u00a0Nov\u00a025\u00a0\u00a02011\u00a0list-crl\n-rw-rw-r--.\u00a01\u00a0sunny\u00a0sunny\u00a0\u00a0413\u00a0Nov\u00a025\u00a0\u00a02011\u00a0Makefile\n-rwxrwxr-x.\u00a01\u00a0sunny\u00a0sunny\u00a07768\u00a0Oct\u00a021\u00a0\u00a02010openssl-0.9.6.cnf\n-rwxrwxr-x.\u00a01\u00a0sunny\u00a0sunny\u00a08325\u00a0Nov\u00a025\u00a0\u00a02011openssl-0.9.8.cnf\n-rwxrwxr-x.\u00a01\u00a0sunny\u00a0sunny\u00a08222\u00a0Nov\u00a025\u00a0\u00a02011openssl-1.0.0.cnf\n-rwxrwxr-x.\u00a01\u00a0sunny\u00a0sunny\u00a012675\u00a0Nov\u00a025\u00a0\u00a02011\u00a0pkitool\u00a0\u00a0\u00a0\u00a0#\u5404\u8bc1\u4e66\u751f\u6210\u4e3b\u8981\u8c03\u7528\u6b64\u547d\u4ee4\u6267\u884c\n-rw-rw-r--.\u00a01\u00a0sunny\u00a0sunny\u00a09299\u00a0Nov\u00a025\u00a0\u00a02011\u00a0README\n-rwxrwxr-x.\u00a01\u00a0sunny\u00a0sunny\u00a0\u00a0918\u00a0Nov\u00a025\u00a0\u00a02011\u00a0revoke-full\u00a0\u00a0\u00a0\u00a0\u00a0#\u8bc1\u4e66\u540a\u9500\n-rwxrwxr-x.\u00a01\u00a0sunny\u00a0sunny\u00a0\u00a0178\u00a0Nov\u00a025\u00a0\u00a02011\u00a0sign-req\n-rwxrwxr-x.\u00a01\u00a0sunny\u00a0sunny\u00a01841\u00a0Nov\u00a025\u00a0\u00a02011\u00a0vars\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0#\u9884\u5148\u5b9a\u4e49\u7684\u8bc1\u4e66\u57fa\u672c\u4fe1\u606f\n-rwxrwxr-x.\u00a01\u00a0sunny\u00a0sunny\u00a0\u00a0714\u00a0Nov\u00a025\u00a0\u00a02011\u00a0whichopensslcnf<\/pre>\n
\u4fee\u6539\u8bc1\u4e66\u9884\u5b9a\u4e49\u4fe1\u606fvars<\/strong>
\n\u9996\u5148\u5bf9vars\u8fdb\u884c\u5907\u4efd<\/p>\n
cp\u00a0vars\u00a0vars.sunny.ori<\/pre>\n
\u7f16\u8f91\u6700\u540e11\u884c\u4fee\u6539\u4e3a\u5982\u4e0b\u5185\u5bb9\uff1a<\/p>\n
export\u00a0KEY_COUNTRY=\\\"CN\\\"\nexport\u00a0KEY_PROVINCE=\\\"HB\\\"\nexport\u00a0KEY_CITY=\\\"WuHan\\\"\nexport\u00a0KEY_ORG=\\\"sunny\\\"\nexport\u00a0KEY_EMAIL=\\\"519209@qq.com\\\"\nexport\u00a0KEY_EMAIL=519209@qq.com\nexport\u00a0KEY_CN=sunny\nexport\u00a0KEY_NAME=sunny\nexport\u00a0KEY_OU=sunny\nexport\u00a0PKCS11_MODULE_PATH=changeme\nexport\u00a0PKCS11_PIN=1234<\/pre>\n
\u6ce8\u610f\uff1a\u5982\u679c\u662fAD\u6216\u8005ldap\u8bf7\u6839\u636e\u81ea\u8eab\u5185\u5bb9\u8fdb\u884c\u586b\u5199
\n\u8f7d\u5165vars\u914d\u7f6e\uff0c\u65b0\u5f00\u7a97\u53e3\u5236\u4f5c\u8bc1\u4e66\u65f6\uff0c\u9700\u8981\u91cd\u65b0\u52a0\u8f7dvars\u6587\u4ef6<\/p>\n
[root@vpnserver\u00a02.0]#\u00a0source\u00a0vars\nNOTE:\u00a0If\u00a0you\u00a0run\u00a0.\/clean-all,\u00a0I\u00a0will\u00a0be\u00a0doing\u00a0a\u00a0rm\u00a0-rf\u00a0on\/application\/openvpn-2.2.2\/easy-rsa\/2.0\/keys<\/pre>\n
\u7b2c\u4e00\u6b21\u4f1a\u63d0\u793a\u521d\u59cb\u5316\u914d\u7f6e\uff0c\u6309\u63d0\u793a\u64cd\u4f5c\uff0c\u540e\u7eed\u6b63\u5e38\u4f7f\u7528\u65f6\u4e0d\u53ef\u6267\u884c\u6b64\u64cd\u4f5c\uff0c\u5b83\u4f1a\u6e05\u7a7akeys\u76ee\u5f55\uff0c\u5e76\u521d\u59cb\u5316\u5e8f\u5217<\/p>\n
[root@vpnserver\u00a02.0]#\u00a0.\/clean-all\n[root@vpnserver\u00a02.0]#\u00a0ll\u00a0keys\/\ntotal\u00a04\n-rw-r--r--.\u00a01\u00a0root\u00a0root\u00a00\u00a0Jul\u00a07\u00a016:57\u00a0index.txt\n-rw-r--r--.\u00a01\u00a0root\u00a0root\u00a03\u00a0Jul\u00a07\u00a016:57\u00a0serial<\/pre>\n
\u5236\u4f5cCA\u8bc1\u4e66\uff0c\u7531\u4e8e\u5df2\u7ecf\u9884\u5148\u5b9a\u4e49\u597d\u4e86\u5404\u4e2a\u914d\u7f6e\uff0c\u4e00\u8def\u56de\u8f66\uff0c\u8868\u793a\u4f7f\u7528\u9ed8\u8ba4\u914d\u7f6e<\/p>\n
[root@vpnserver\u00a02.0]#\u00a0.\/build-ca\nGenerating\u00a0a\u00a01024\u00a0bit\u00a0RSA\u00a0private\u00a0key\n...++++++\n......................................++++++\nwriting\u00a0new\u00a0private\u00a0key\u00a0to\u00a0\\'ca.key\\'\n-----\nYou\u00a0are\u00a0about\u00a0to\u00a0be\u00a0asked\u00a0to\u00a0enter\u00a0information\u00a0that\u00a0will\u00a0beincorporated\ninto\u00a0your\u00a0certificate\u00a0request.\nWhat\u00a0you\u00a0are\u00a0about\u00a0to\u00a0enter\u00a0is\u00a0what\u00a0is\u00a0called\u00a0a\u00a0Distinguished\u00a0Nameor\u00a0a\u00a0DN.\nThere\u00a0are\u00a0quite\u00a0a\u00a0few\u00a0fields\u00a0but\u00a0you\u00a0can\u00a0leave\u00a0some\u00a0blank\nFor\u00a0some\u00a0fields\u00a0there\u00a0will\u00a0be\u00a0a\u00a0default\u00a0value,\nIf\u00a0you\u00a0enter\u00a0\\'.\\',\u00a0the\u00a0field\u00a0will\u00a0be\u00a0left\u00a0blank.\n-----\nCountry\u00a0Name\u00a0(2\u00a0letter\u00a0code)\u00a0[CN]:\nState\u00a0or\u00a0Province\u00a0Name\u00a0(full\u00a0name)\u00a0[HB]:\nLocality\u00a0Name\u00a0(eg,\u00a0city)\u00a0[WuHan]:\nOrganization\u00a0Name\u00a0(eg,\u00a0company)\u00a0[sunny]:\nOrganizational\u00a0Unit\u00a0Name\u00a0(eg,\u00a0section)\u00a0[sunny]:\nCommon\u00a0Name\u00a0(eg,\u00a0your\u00a0name\u00a0or\u00a0your\u00a0server\\'s\u00a0hostname)\u00a0[sunny]:\nName\u00a0[sunny]:\nEmail\u00a0Address\u00a0[519209@qq.com]:<\/pre>\n
\u67e5\u770b\u751f\u6210\u7684\u8bc1\u4e66\u6587\u4ef6,ca.crt\u5c31\u662f\u65b0\u751f\u6210\u7684\u8bc1\u4e66\u6587\u4ef6\uff0cca.key\u5c31\u662f\u79c1\u94a5<\/p>\n
[root@vpnserver\u00a02.0]#\u00a0ls\u00a0-l\u00a0keys\ntotal\u00a012\n-rw-r--r--.\u00a01\u00a0root\u00a0root\u00a01277\u00a0Jul\u00a07\u00a016:58\u00a0ca.crt\u00a0\u00a0\u00a0CA\u8bc1\u4e66\u6587\u4ef6\n-rw-------.\u00a01\u00a0root\u00a0root\u00a0\u00a0916Jul\u00a0\u00a07\u00a016:58\u00a0ca.key\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0CA\u7684\u79c1\u94a5\n-rw-r--r--.\u00a01\u00a0root\u00a0root\u00a0\u00a0\u00a0\u00a00Jul\u00a0\u00a07\u00a016:57\u00a0index.txt\n-rw-r--r--.\u00a01\u00a0root\u00a0root\u00a0\u00a0\u00a0\u00a03Jul\u00a0\u00a07\u00a016:57\u00a0serial<\/pre>\n
2.4.3\u00a0\u00a0\u00a0\u751f\u6210\u670d\u52a1\u7aef\u8bc1\u4e66\u4e0e\u5bc6\u94a5
\n\u751f\u6210\u670d\u52a1\u7aef\u8bc1\u4e66\u8c03\u7528\u7684\u547d\u4ee4\u4e3abuild-key-server\uff0c\u540e\u9762\u76f4\u63a5\u8ddf\u670d\u52a1\u7aef\u8bc1\u4e66\u540d\u5373\u53ef\uff0c\u8fd9\u91cc\u670d\u52a1\u7aef\u8bc1\u4e66\u540d\u53d6\u4e3aserver<\/p>\n
[root@vpnserver\u00a02.0]#\u00a0.\/build-key-server\u00a0server\nGenerating\u00a0a\u00a01024\u00a0bit\u00a0RSA\u00a0private\u00a0key\n....................++++++\n............................................++++++\nwriting\u00a0new\u00a0private\u00a0key\u00a0to\u00a0\\'server.key\\'\n-----\nYou\u00a0are\u00a0about\u00a0to\u00a0be\u00a0asked\u00a0to\u00a0enter\u00a0information\u00a0that\u00a0will\u00a0beincorporated\ninto\u00a0your\u00a0certificate\u00a0request.\nWhat\u00a0you\u00a0are\u00a0about\u00a0to\u00a0enter\u00a0is\u00a0what\u00a0is\u00a0called\u00a0a\u00a0Distinguished\u00a0Nameor\u00a0a\u00a0DN.\nThere\u00a0are\u00a0quite\u00a0a\u00a0few\u00a0fields\u00a0but\u00a0you\u00a0can\u00a0leave\u00a0some\u00a0blank\nFor\u00a0some\u00a0fields\u00a0there\u00a0will\u00a0be\u00a0a\u00a0default\u00a0value,\nIf\u00a0you\u00a0enter\u00a0\\'.\\',\u00a0the\u00a0field\u00a0will\u00a0be\u00a0left\u00a0blank.\n-----\nCountry\u00a0Name\u00a0(2\u00a0letter\u00a0code)\u00a0[CN]:\nState\u00a0or\u00a0Province\u00a0Name\u00a0(full\u00a0name)\u00a0[HB]:\nLocality\u00a0Name\u00a0(eg,\u00a0city)\u00a0[WuHan]:\nOrganization\u00a0Name\u00a0(eg,\u00a0company)\u00a0[sunny]:\nOrganizational\u00a0Unit\u00a0Name\u00a0(eg,\u00a0section)\u00a0[sunny]:\nCommon\u00a0Name\u00a0(eg,\u00a0your\u00a0name\u00a0or\u00a0your\u00a0server\\'s\u00a0hostname)\u00a0[server]:\nName\u00a0[sunny]:\nEmail\u00a0Address\u00a0[519209@qq.com]:\nPlease\u00a0enter\u00a0the\u00a0following\u00a0\\'extra\\'\u00a0attributes\nto\u00a0be\u00a0sent\u00a0with\u00a0your\u00a0certificate\u00a0request\nA\u00a0challenge\u00a0password\u00a0[]:123456\nAn\u00a0optional\u00a0company\u00a0name\u00a0[]:sunny\nUsing\u00a0configuration\u00a0from\/application\/openvpn-2.2.2\/easy-rsa\/2.0\/openssl-1.0.0.cnf\nCheck\u00a0that\u00a0the\u00a0request\u00a0matches\u00a0the\u00a0signature\nSignature\u00a0ok\nThe\u00a0Subject\\'s\u00a0Distinguished\u00a0Name\u00a0is\u00a0as\u00a0follows\ncountryName\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0:PRINTABLE:\\'CN\\'\nstateOrProvinceName\u00a0\u00a0:PRINTABLE:\\'HB\\'\nlocalityName\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0:PRINTABLE:\\'WuHan\\'\norganizationName\u00a0\u00a0\u00a0\u00a0\u00a0:PRINTABLE:\\'sunny\\'\norganizationalUnitName:PRINTABLE:\\'sunny\\'\ncommonName\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0:PRINTABLE:\\'server\\'\nname\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0:PRINTABLE:\\'sunny\\'\nemailAddress\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0:IA5STRING:\\'519209@qq.com\\'\nCertificate\u00a0is\u00a0to\u00a0be\u00a0certified\u00a0until\u00a0Jul\u00a0\u00a05\u00a009:04:46\u00a02026\u00a0GMT\u00a0(3650\u00a0days)\nSign\u00a0the\u00a0certificate?\u00a0[y\/n]:y\n1\u00a0out\u00a0of\u00a01\u00a0certificate\u00a0requests\u00a0certified,\u00a0commit?\u00a0[y\/n]y\nWrite\u00a0out\u00a0database\u00a0with\u00a01\u00a0new\u00a0entries\nData\u00a0Base\u00a0Updated<\/pre>\n
\u7740\u8272\u7684\u662f\u624b\u52a8\u8f93\u5165\u7684\uff0c\u9700\u8981\u4e24\u6b21\u786e\u8ba4
\n\u68c0\u67e5\u751f\u6210\u7684\u8bc1\u4e66\u5bc6\u94a5\u5bf9<\/strong><\/p>\n
[root@vpnserver\u00a02.0]#\u00a0ll\u00a0keys\/server*\n-rw-r--r--.\u00a01\u00a0root\u00a0root\u00a03943\u00a0Jul\u00a07\u00a017:04\u00a0keys\/server.crt\u00a0\u00a0\u00a0\u00a0#\u670d\u52a1\u7aef\u8bc1\u4e66\n-rw-r--r--.\u00a01\u00a0root\u00a0root\u00a0\u00a0757Jul\u00a0\u00a07\u00a017:04\u00a0keys\/server.csr\u00a0\u00a0#\u670d\u52a1\u7aef\u8bc1\u4e66\u8bf7\u6c42\u6587\u4ef6\n-rw-------.\u00a01\u00a0root\u00a0root\u00a0\u00a0916Jul\u00a0\u00a07\u00a017:04\u00a0keys\/server.key\u00a0\u00a0#\u670d\u52a1\u7aef\u79c1\u94a5<\/pre>\n
2.4.4\u00a0\u00a0\u00a0\u751f\u6210\u5ba2\u6237\u7aef\u8bc1\u4e66\u4e0e\u5bc6\u94a5
\n\u5ba2\u6237\u7aef\u751f\u6210\u8bc1\u4e66\u662f\u4e0e\u5ba2\u6237\u7684\u8d26\u53f7\u662f\u4e00\u4e00\u5bf9\u5e94\u7684\uff0c\u6bcf\u4e00\u4e2a\u8d26\u53f7\u5bf9\u5e94\u4e00\u4e2a\u670d\u52a1\u7aef\u8bc1\u4e66\u6587\u4ef6
\n\u751f\u6210\u4e00\u4e2a\u65e0\u5bc6\u7801\u9a8c\u8bc1\u5bc6\u94a5\uff0c\u4f7f\u7528\u547d\u4ee4build-key
\n\u65b0\u5efa\u4e00\u4e2atest\u5ba2\u6237\u7aef\u5bc6\u94a5\uff0c\u6b64\u8d26\u53f7\u65e0\u9700\u5bc6\u7801\u9a8c\u8bc1<\/p>\n
[root@vpnserver\u00a02.0]#\u00a0.\/build-key\u00a0test\nGenerating\u00a0a\u00a01024\u00a0bit\u00a0RSA\u00a0private\u00a0key\n.....................................++++++\n..++++++\nwriting\u00a0new\u00a0private\u00a0key\u00a0to\u00a0\\'test.key\\'\n-----\nYou\u00a0are\u00a0about\u00a0to\u00a0be\u00a0asked\u00a0to\u00a0enter\u00a0information\u00a0that\u00a0will\u00a0beincorporated\ninto\u00a0your\u00a0certificate\u00a0request.\nWhat\u00a0you\u00a0are\u00a0about\u00a0to\u00a0enter\u00a0is\u00a0what\u00a0is\u00a0called\u00a0a\u00a0Distinguished\u00a0Nameor\u00a0a\u00a0DN.\nThere\u00a0are\u00a0quite\u00a0a\u00a0few\u00a0fields\u00a0but\u00a0you\u00a0can\u00a0leave\u00a0some\u00a0blank\nFor\u00a0some\u00a0fields\u00a0there\u00a0will\u00a0be\u00a0a\u00a0default\u00a0value,\nIf\u00a0you\u00a0enter\u00a0\\'.\\',\u00a0the\u00a0field\u00a0will\u00a0be\u00a0left\u00a0blank.\n-----\nCountry\u00a0Name\u00a0(2\u00a0letter\u00a0code)\u00a0[CN]:\nState\u00a0or\u00a0Province\u00a0Name\u00a0(full\u00a0name)\u00a0[HB]:\nLocality\u00a0Name\u00a0(eg,\u00a0city)\u00a0[WuHan]:\nOrganization\u00a0Name\u00a0(eg,\u00a0company)\u00a0[sunny]:\nOrganizational\u00a0Unit\u00a0Name\u00a0(eg,\u00a0section)\u00a0[sunny]:\nCommon\u00a0Name\u00a0(eg,\u00a0your\u00a0name\u00a0or\u00a0your\u00a0server\\'s\u00a0hostname)\u00a0[test]:\nName\u00a0[sunny]:\nEmail\u00a0Address\u00a0[519209@qq.com]:\nPlease\u00a0enter\u00a0the\u00a0following\u00a0\\'extra\\'\u00a0attributes\nto\u00a0be\u00a0sent\u00a0with\u00a0your\u00a0certificate\u00a0request\nA\u00a0challenge\u00a0password\u00a0[]:123456\nAn\u00a0optional\u00a0company\u00a0name\u00a0[]:sunny\nUsing\u00a0configuration\u00a0from\/application\/openvpn-2.2.2\/easy-rsa\/2.0\/openssl-1.0.0.cnf\nCheck\u00a0that\u00a0the\u00a0request\u00a0matches\u00a0the\u00a0signature\nSignature\u00a0ok\nThe\u00a0Subject\\'s\u00a0Distinguished\u00a0Name\u00a0is\u00a0as\u00a0follows\ncountryName\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0:PRINTABLE:\\'CN\\'\nstateOrProvinceName\u00a0\u00a0:PRINTABLE:\\'HB\\'\nlocalityName\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0:PRINTABLE:\\'WuHan\\'\norganizationName\u00a0\u00a0\u00a0\u00a0\u00a0:PRINTABLE:\\'sunny\\'\norganizationalUnitName:PRINTABLE:\\'sunny\\'\ncommonName\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0:PRINTABLE:\\'test\\'\nname\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0:PRINTABLE:\\'sunny\\'\nemailAddress\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0:IA5STRING:\\'519209@qq.com\\'\nCertificate\u00a0is\u00a0to\u00a0be\u00a0certified\u00a0until\u00a0Jul\u00a0\u00a05\u00a009:13:01\u00a02026\u00a0GMT\u00a0(3650\u00a0days)\nSign\u00a0the\u00a0certificate?\u00a0[y\/n]:y\n1\u00a0out\u00a0of\u00a01\u00a0certificate\u00a0requests\u00a0certified,\u00a0commit?\u00a0[y\/n]y\nWrite\u00a0out\u00a0database\u00a0with\u00a01\u00a0new\u00a0entries\nData\u00a0Base\u00a0Updated<\/pre>\n
\u751f\u6210\u4e00\u4e2a\u9700\u8981\u5bc6\u7801\u9a8c\u8bc1\u7684\u5ba2\u6237\u7aef\u5bc6\u94a5sunny,\u5bc6\u7801\u4e3a123456\uff0c\u751f\u4ea7\u73af\u5883\u6b64\u5bc6\u7801\u9700\u8981\u8bbe\u7f6e\u8f83\u590d\u6742<\/p>\n
[root@vpnserver\u00a02.0]#\u00a0.\/build-key-pass\u00a0sunny\nGenerating\u00a0a\u00a01024\u00a0bit\u00a0RSA\u00a0private\u00a0key\n...++++++\n...............................................++++++\nwriting\u00a0new\u00a0private\u00a0key\u00a0to\u00a0\\'sunny.key\\'\nEnter\u00a0PEM\u00a0pass\u00a0phrase:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0#\u6b64\u5904\u9700\u8981\u8f93\u5165\u7528\u6237\u5bc6\u7801\nVerifying\u00a0-\u00a0Enter\u00a0PEM\u00a0pass\u00a0phrase:\u00a0\u00a0\u00a0\u00a0\u00a0#\u6b64\u5904\u9700\u8981\u786e\u8ba4\u7528\u6237\u5bc6\u7801\n-----\nYou\u00a0are\u00a0about\u00a0to\u00a0be\u00a0asked\u00a0to\u00a0enter\u00a0information\u00a0that\u00a0will\u00a0beincorporated\ninto\u00a0your\u00a0certificate\u00a0request.\nWhat\u00a0you\u00a0are\u00a0about\u00a0to\u00a0enter\u00a0is\u00a0what\u00a0is\u00a0called\u00a0a\u00a0Distinguished\u00a0Nameor\u00a0a\u00a0DN.\nThere\u00a0are\u00a0quite\u00a0a\u00a0few\u00a0fields\u00a0but\u00a0you\u00a0can\u00a0leave\u00a0some\u00a0blank\nFor\u00a0some\u00a0fields\u00a0there\u00a0will\u00a0be\u00a0a\u00a0default\u00a0value,\nIf\u00a0you\u00a0enter\u00a0\\'.\\',\u00a0the\u00a0field\u00a0will\u00a0be\u00a0left\u00a0blank.\n-----\nCountry\u00a0Name\u00a0(2\u00a0letter\u00a0code)\u00a0[CN]:\nState\u00a0or\u00a0Province\u00a0Name\u00a0(full\u00a0name)\u00a0[HB]:\nLocality\u00a0Name\u00a0(eg,\u00a0city)\u00a0[WuHan]:\nOrganization\u00a0Name\u00a0(eg,\u00a0company)\u00a0[sunny]:\nOrganizational\u00a0Unit\u00a0Name\u00a0(eg,\u00a0section)\u00a0[sunny]:\nCommon\u00a0Name\u00a0(eg,\u00a0your\u00a0name\u00a0or\u00a0your\u00a0server\\'s\u00a0hostname)\u00a0[sunny]:\nName\u00a0[sunny]:\nEmail\u00a0Address\u00a0[519209@qq.com]:\n\u00a0\nPlease\u00a0enter\u00a0the\u00a0following\u00a0\\'extra\\'\u00a0attributes\nto\u00a0be\u00a0sent\u00a0with\u00a0your\u00a0certificate\u00a0request\nA\u00a0challenge\u00a0password\u00a0[]:123456\nAn\u00a0optional\u00a0company\u00a0name\u00a0[]:sunny\nUsing\u00a0configuration\u00a0from\/application\/openvpn-2.2.2\/easy-rsa\/2.0\/openssl-1.0.0.cnf\nCheck\u00a0that\u00a0the\u00a0request\u00a0matches\u00a0the\u00a0signature\nSignature\u00a0ok\nThe\u00a0Subject\\'s\u00a0Distinguished\u00a0Name\u00a0is\u00a0as\u00a0follows\ncountryName\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0:PRINTABLE:\\'CN\\'\nstateOrProvinceName\u00a0\u00a0:PRINTABLE:\\'HB\\'\nlocalityName\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0:PRINTABLE:\\'WuHan\\'\norganizationName\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0:PRINTABLE:\\'sunny\\'\norganizationalUnitName:PRINTABLE:\\'sunny\\'\ncommonName\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0:PRINTABLE:\\'sunny\\'\nname\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0:PRINTABLE:\\'sunny\\'\nemailAddress\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0:IA5STRING:\\'519209@qq.com\\'\nCertificate\u00a0is\u00a0to\u00a0be\u00a0certified\u00a0until\u00a0Jul\u00a0\u00a05\u00a009:16:29\u00a02026\u00a0GMT\u00a0(3650\u00a0days)\nSign\u00a0the\u00a0certificate?\u00a0[y\/n]:\n1\u00a0out\u00a0of\u00a01\u00a0certificate\u00a0requests\u00a0certified,\u00a0commit?\u00a0[y\/n]y\nWrite\u00a0out\u00a0database\u00a0with\u00a01\u00a0new\u00a0entries\nData\u00a0Base\u00a0Updated<\/pre>\n
\u67e5\u770b\u751f\u6210\u7684\u5ba2\u6237\u7aef\u5bc6\u94a5<\/p>\n
[root@vpnserver\u00a02.0]#\u00a0ls\u00a0-l\u00a0keys\/{test,sunny}*\n-rw-r--r--.\u00a01\u00a0root\u00a0root\u00a03821\u00a0Jul\u00a07\u00a017:16\u00a0keys\/sunny.crt\n-rw-r--r--.\u00a01\u00a0root\u00a0root\u00a0\u00a0757Jul\u00a0\u00a07\u00a017:16\u00a0keys\/sunny.csr\n-rw-------.\u00a01\u00a0root\u00a0root\u00a01041\u00a0Jul\u00a07\u00a017:16\u00a0keys\/sunny.key\n-rw-r--r--.\u00a01\u00a0root\u00a0root\u00a03816\u00a0Jul\u00a07\u00a017:13\u00a0keys\/test.crt\n-rw-r--r--.\u00a01\u00a0root\u00a0root\u00a0\u00a0757Jul\u00a0\u00a07\u00a017:13\u00a0keys\/test.csr\n-rw-------.\u00a01\u00a0root\u00a0root\u00a0\u00a0916Jul\u00a0\u00a07\u00a017:13\u00a0keys\/test.key<\/pre>\n
2.4.5\u00a0\u00a0\u00a0\u751f\u6210\u5bc6\u7801\u534f\u8bae\u4ea4\u6362\u6587\u4ef6
\n\u4f7f\u7528\u547d\u4ee4build-dh\u547d\u4ee4\u751f\u6210\u5bc6\u7801\u534f\u8bae\u4ea4\u6362\u6587\u4ef6\uff0c\u76f4\u63a5\u6267\u884c\u547d\u4ee4\u5373\u53ef\u3002<\/p>\n
[root@vpnserver\u00a02.0]#\u00a0.\/build-dh\nGenerating\u00a0DH\u00a0parameters,\u00a01024\u00a0bit\u00a0long\u00a0safe\u00a0prime,\u00a0generator\u00a02\nThis\u00a0is\u00a0going\u00a0to\u00a0take\u00a0a\u00a0long\u00a0time\n.........................................+.............................++*++*++*\n[root@vpnserver\u00a02.0]#\u00a0ls\u00a0keys\/dh1024.pem\nkeys\/dh1024.pem<\/pre>\n
2.4.6\u00a0\u00a0\u00a0\u751f\u6210\u9632\u653b\u51fbkey\u6587\u4ef6
\n\u751f\u6210\u9632\u6b62\u653b\u51fb\u7684key\u6587\u4ef6<\/p>\n
[root@vpnserver\u00a02.0]#\u00a0openvpn\u00a0--genkey\u00a0--secret\u00a0keys\/ta.key\n[root@vpnserver\u00a02.0]#\u00a0ll\u00a0keys\/ta.key\n-rw-------.\u00a01\u00a0root\u00a0root\u00a0636\u00a0Jul\u00a07\u00a017:22\u00a0keys\/ta.key<\/pre>\n
2.4.7\u00a0\u00a0\u00a0\u7f16\u8f91\u670d\u52a1\u7aef\u914d\u7f6e\u6587\u4ef6
\n\u521b\u5efa\u914d\u7f6e\u6587\u4ef6\u76ee\u5f55<\/p>\n
mkdir\u00a0\/etc\/openvpn\ncd\u00a0\/etc\/openvpn<\/pre>\n
\u5c06keys\u76ee\u5f55\u62f7\u8d1d\u5230\u914d\u7f6e\u6587\u4ef6\u76ee\u5f55<\/p>\n
[root@vpnserver\u00a0openvpn]#\u00a0cp\u00a0-ap\u00a0\/application\/openvpn\/easy-rsa\/2.0\/keys.\n[root@vpnserver\u00a0openvpn]#\u00a0ll\ntotal\u00a04\ndrwx------.\u00a02\u00a0root\u00a0root\u00a04096\u00a0Jul\u00a07\u00a017:22\u00a0keys<\/pre>\n
\u5c06\u670d\u52a1\u7aef\u914d\u7f6e\u6587\u4ef6\u62f7\u8d1d\u5230\/etc\/openvpn\u76ee\u5f55<\/p>\n
cp\u00a0\/application\/openvpn\/sample-config-files\/server.conf\u00a0server.bak<\/pre>\n
\u5c06server.bak\u4e2d\u7684\u6709\u6548\u6307\u4ee4\u91cd\u5b9a\u5411\u81f3server.conf<\/p>\n
grep\u00a0-Ev\u00a0\\\"#|;|^$\\\"\u00a0server.bak\u00a0>server.conf<\/pre>\n
\u7f16\u8f91server.conf\u6587\u4ef6\uff0c\u4fee\u6539\u540e\u7684\u6587\u4ef6\u5185\u5bb9\u5982\u4e0b\uff1a<\/p>\n
local\u00a0192.168.3.201\nport\u00a052115\nproto\u00a0tcp\ndev\u00a0tun\nca\u00a0\/etc\/openvpn\/keys\/ca.crt\ncert\u00a0\/etc\/openvpn\/keys\/server.crt\nkey\u00a0\/etc\/openvpn\/keys\/server.key\ndh\u00a0\/etc\/openvpn\/keys\/dh1024.pem\nserver\u00a010.8.0.0\u00a0255.255.255.0\npush\u00a0\\\"route\u00a0192.168.18.0\u00a0255.255.255.0\\\"\nifconfig-pool-persist\u00a0ipp.txt\nkeepalive\u00a010\u00a0120\ncomp-lzo\npersist-key\npersist-tun\nstatus\u00a0openvpn-status.log\nlog\u00a0\/var\/log\/openvpn.log\nduplicate-cn\nclient-to-client\nverb\u00a03<\/pre>\n
local\u672c\u5730\u76d1\u542c\u7684IP\u5730\u5740
\nport\u672c\u5730\u76d1\u542c\u7684\u7aef\u53e3\uff0c\u9ed8\u8ba4\u4e3a1194\uff0c\u5b89\u5168\u8d77\u89c1\uff0c\u5efa\u8bae\u4fee\u6539
\nproto\u534f\u8bae\uff0c\u8fd9\u91cc\u4f7f\u7528tcp\u534f\u8bae\uff0c\u7a33\u5b9a\u6027\u66f4\u597d
\ndev tun,\u4f7f\u7528tunnel\u63a5\u53e3\uff0c\u53e6\u5916\u8fd8\u6709\u4e00\u79cd\u4e3atap
\nca CA\u8bc1\u4e66\u6587\u4ef6\u8def\u5f84
\ncert\u670d\u52a1\u7aef\u8bc1\u4e66\u8def\u5f84
\nkey\u670d\u52a1\u7aef\u5bc6\u94a5\u6587\u4ef6\u8def\u5f84
\ndh\u8bc1\u4e66\u5bc6\u94a5\u4ea4\u6362\u6587\u4ef6\u8def\u5f84
\nserver\u5206\u914d\u7ed9\u5ba2\u6237\u7aef\u7684IP\u5730\u5740\uff0c\u5373\u5ba2\u6237\u7aef\u62d4\u53f7\u6210\u529f\u540e\u83b7\u53d6\u5230\u7684IP\u5730\u5740
\npush\u63a8\u9001\u5230\u5ba2\u6237\u7aef\u7684\u8def\u7531\u4fe1\u606f\uff0c\u4e00\u822c\u8fd9\u91cc\u63a8\u9001\u7684\u662fvpnserver\u7aef\u7684\u672c\u5730\u5b50\u7f51
\nifconfig-pool-persist\u8bb0\u5f55\u5ba2\u6237\u7aef\u6240\u83b7\u53d6\u5230\u7684IP\u5730\u5740\u4fe1\u606f\u5217\u8868\uff0c\u5ba2\u6237\u7aef\u91cd\u542f\u540e\u83b7\u53d6\u5230\u4e0e\u4e0a\u6b21\u5206\u914d\u7684IP\u76f8\u540c\u7684IP\u5730\u5740\u4fe1\u606f
\nkeepalive 10 120\u6bcf\u969410\u79d2\u5ba2\u6237\u7aefping\u670d\u52a1\u7aef\uff0c\u786e\u4fdd\u670d\u52a1\u7aef\u6ca1\u6709\u79bb\u7ebf\uff0c\u8d85\u957f\u4e3a120\u79d2
\ncomp-lzo\u5141\u8bb8\u538b\u7f29\u4f20\u8f93
\nstatus openvpn-status.log\u8fde\u63a5\u72b6\u6001\u65e5\u5fd7
\nlog\u8fde\u63a5\u65e5\u5fd7\u4fe1\u606f
\nduplicate-cn\u5141\u8bb8\u540c\u4e00\u8d26\u53f7\u591a\u4eba\u540c\u65f6\u4f7f\u7528
\nclient-to-client\u5141\u8bb8\u5ba2\u6237\u7aef\u4e0e\u5ba2\u6237\u7aef\u4e4b\u95f4\u901a\u4fe1
\nverb\u65e5\u5fd7\u7ea7\u522b
\n;max-clients 100\u6700\u5927\u5ba2\u6237\u7aef\u6570\u91cf\u9ed8\u8ba4\u4e3a100\u4e2a
\n2.5\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u542f\u52a8\u670d\u52a1\u7aef<\/strong>
\n2.5.1\u00a0\u00a0\u00a0\u542f\u52a8\u670d\u52a1\u7aef<\/p>\n
[root@vpnserver\u00a0openvpn]#\u00a0\/usr\/local\/sbin\/openvpn\u00a0--config\/etc\/openvpn\/server.conf\u00a0&\n[1]\u00a022510\n[root@vpnserver\u00a0openvpn]#\u00a0ps\u00a0-ef|grep\u00a0openvpn\nroot\u00a0\u00a0\u00a0\u00a0\u00a0\u00a022510\u00a0\u00a022401\u00a00\u00a009:06\u00a0pts\/0\u00a0\u00a0\u00a0\u00a000:00:00\/usr\/local\/sbin\/openvpn\u00a0--config\u00a0\/etc\/openvpn\/server.conf\nroot\u00a0\u00a0\u00a0\u00a0\u00a0\u00a022521\u00a0\u00a022401\u00a00\u00a009:06\u00a0pts\/0\u00a0\u00a0\u00a0\u00a000:00:00\u00a0grep\u00a0openvpn<\/pre>\n
\u62a5\u9519\u5904\u7406\u4e00\uff1a<\/p>\n
[root@vpnserver\u00a0openvpn]#\u00a0less\u00a0\/var\/log\/openvpn.log\nOptions\u00a0error:\u00a0You\u00a0must\u00a0define\u00a0private\u00a0key\u00a0file\u00a0(--key)\u00a0or\u00a0PKCS#12file\u00a0(--pkcs12)\nUse\u00a0--help\u00a0for\u00a0more\u00a0information.<\/pre>\n
\u6839\u636e\u63d0\u793a\uff0c\u8868\u660e\u914d\u7f6e\u6587\u4ef6\u4e2d\u6ca1\u6709\u52a0\u5165\u670d\u52a1\u7aef\u7684\u5bc6\u94a5\u6587\u4ef6\u8def\u5f84\uff0c\u6216\u8005\u8def\u5f84\u4e0d\u5bf9\uff0c\u68c0\u67e5server.conf\u6587\u4ef6\u4e2dkey\u6587\u4ef6\u7684\u914d\u7f6e<\/p>\n
key\u00a0\/etc\/openvpn\/keys\/server.key<\/pre>\n
2.5.2\u00a0\u00a0\u00a0\u5c06OpenVPN\u52a0\u5165\u5f00\u673a\u81ea\u542f\u52a8
\n\u9700\u8981\u5c06OpenVPN\u52a0\u5165\u5f00\u673a\u81ea\u542f\u52a8
\n\u65b9\u6cd5\u4e00\uff1a
\n\u5c06\u542f\u52a8\u547d\u4ee4\u52a0\u5165\u5230\/etc\/rc.local<\/p>\n
echo\u00a0\u201c\/usr\/local\/sbin\/openvpn\u00a0--config\u00a0\/etc\/openvpn\/server.conf>\/dev\/null\u00a0\u00a0&\u201d>>\/etc\/rc.local<\/pre>\n
\u65b9\u6cd5\u4e8c\uff1a
\n\u5229\u7528sample-scripts\u4e0b\u9762\u7684\u811a\u672c<\/p>\n
cp\u00a0\/application\/openvpn\/sample-scripts\/openvpn.init\u00a0\/etc\/init.d\/openvpn\nchkconfig\u00a0openvpn\u00a0on\nchkconfig\u00a0--list\u00a0openvpn\nopenvpn\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a00:off\u00a0\u00a0\u00a01:off\u00a0\u00a02:on\u00a0\u00a0\u00a0\u00a03:on\u00a0\u00a0\u00a0\u00a04:on\u00a0\u00a0\u00a05:on\u00a0\u00a0\u00a0\u00a06:off<\/pre>\n
\n
3\u3001\u00a0\u00a0\u00a0\u00a0openvpn\u5ba2\u6237\u7aef\u5b89\u88c5\u4e0e\u914d\u7f6e<\/strong>
\n3.1\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0windows\u5ba2\u6237\u7aef\u5b89\u88c5\u4e0e\u914d\u7f6e<\/strong>
\n3.1.1\u00a0\u00a0\u00a0\u67e5\u770b\u64cd\u4f5c\u7cfb\u7edf\u7248\u672c
\n\u8fd9\u91cc\u63d0\u4f9b\u4e86\u4e0d\u540c\u64cd\u4f5c\u7cfb\u7edf\u7248\u672c\uff0c\u53ef\u4ee5\u6839\u636e\u81ea\u5df1\u64cd\u4f5c\u7cfb\u7edf\u7684\u7248\u672c\u9009\u62e9\u5bf9\u5e94\u7684\u5ba2\u6237\u7aef\u8f6f\u4ef6\u8fdb\u884c\u5b89\u88c5\uff0cwin8\u548cwin10\u9009\u62e9win7\u5ba2\u6237\u7aef\u5b89\u88c5\uff0c\u5728\u6211\u7684\u7535\u8111\u4e0a\u53f3\u952e\u5c5e\u6027\u53ef\u4ee5\u67e5\u770b\u64cd\u4f5c\u7cfb\u7edf\u7248\u672c
\n3.1.2\u00a0\u00a0\u00a0\u5b89\u88c5windows\u5ba2\u6237\u7aef\u8f6f\u4ef6
\nwin10\u53ef\u4ee5\u4f7f\u7528win7\u5ba2\u6237\u7aef\uff0c\u8fd9\u91cc\u4ee5win7-64\u4f4d\u64cd\u4f5c\u7cfb\u7edf\u4e3a\u4f8b\uff0c\u8fdb\u5165windows-win7-64\u4f4d
\n\u53cc\u51fb\u201copenvpn-install-2.3.11-I601-x86_64(win7).exe\u201d
\n\u70b9\u51fb\u201dnext\u201d
\n\u70b9\u51fb\u201cI Agree\u201d
\n\u4e0d\u505a\u4efb\u4f55\u4fee\u6539\uff0c\u70b9\u51fbNext
\n\u9009\u62e9\u5b89\u88c5\u8def\u5f84\uff0c\u6309\u9ed8\u8ba4\u8def\u5f84\u5373\u53ef\uff0c64\u4f4d\u7cfb\u7edf\u9ed8\u8ba4\u4e3a\u201dC:\\\\Program Files\\\\OpenVPN\u201d,\u5176\u5b83\u7cfb\u7edf\u8def\u5f84\u4f1a\u7565\u6709\u4e0d\u540c
\n\u70b9\u51fbInstall,\u5982\u679c\u63d0\u793a\u662f\u5426\u4fe1\u4efb\uff0c\u52fe\u9009\u201cAlways trust software from \u2026\u201d,\u70b9\u51fbInstall
\n\u70b9\u51fbnext\u8fdb\u5165\u4e0b\u4e00\u6b65
\n\u70b9\u51fbFinish\u5b8c\u6210\u5b89\u88c5
\n3.1.3\u00a0\u00a0\u00a0windows\u5ba2\u6237\u7aef\u8f6f\u4ef6\u914d\u7f6e
\n3.1.4\u00a0\u00a0\u00a0\u62f7\u575d\u8bc1\u4e66\u6587\u4ef6
\n\u8fdb\u5165\u5230openvpn\u5b89\u88c5\u76ee\u5f55\u4e0b\u7684config\u6587\u4ef6\u5939\u4e2d\uff0c\u6211\u7684\u8def\u5f84\u4e3a\u201cC:\\\\Program Files\\\\OpenVPN\\\\config\u201c\uff0c\u65b0\u5efatest\u76ee\u5f55\uff0c\u5c06openvpnserver\u4e0a\/etc\/openvpn\/keys\u76ee\u5f55\u4e0b\u7684\u8bc1\u4e66\u6587\u4ef6ca.crt,test.crt,test.key\u62f7\u8d1d\u5230config\u76ee\u5f55\u4e2dconfig\u76ee\u5f55\u62f7\u8d1d
\n\u5728test\u76ee\u5f55\u4e0b\u65b0\u5efatest.ovpn\u6587\u4ef6\uff0c\u6b64\u6587\u4ef6\u7684\u6a21\u677f\u4e3a\/application\/openvpn\/sample-config-files\/client.conf,\u6b64\u6587\u4ef6test.ovpn\u5185\u5bb9\u5982\u4e0b\uff1a<\/p>\n
client\ndev\u00a0tun\nproto\u00a0tcp\nremote\u00a0192.168.3.201\u00a052115\nresolv-retry\u00a0infinite\nnobind\npersist-key\npersist-tun\nca\u00a0ca.crt\ncert\u00a0test.crt\nkey\u00a0test.key\nns-cert-type\u00a0server\ncomp-lzo\nverb\u00a03<\/pre>\n
3.1.5\u00a0\u00a0\u00a0\u8fde\u63a5\u6d4b\u8bd5
\n\u5b89\u88c5\u5b8c\u6210\u540e\u684c\u9762\u4f1a\u51fa\u73b0\u4e00\u4e2a\u56fe\u6807\uff0c\u53cc\u51fb\u70b9\u5f00\uff0c\u53f3\u4e0b\u89d2\u4f1a\u51fa\u73b0\u4e00\u4e2a\u5e26\u5c0f\u9501\u7684\u5c0f\u56fe\u6807\uff0c\u5728\u56fe\u6807\u4e0a\u70b9\u51fb\u53f3\u952e\uff0c\u9009\u4e2d\u8d26\u53f7test\uff0c\u70b9\u51fbConnect\uff0c\u5982\u679c\u6ca1\u6709\u5bc6\u7801\uff0c\u4f1a\u76f4\u63a5\u8fde\u63a5\uff0c\u5982\u679c\u9700\u8981\u5bc6\u7801\uff0c\u5219\u4f1a\u63d0\u793a\u8f93\u5165\u5bc6\u7801
\n\u62d4\u53f7\u6210\u529f\u540e\uff0c\u53f3\u4e0b\u89d2\u4f1a\u5f39\u51fa\u63d0\u793a
\n\u5e76\u4e14\u539f\u6765\u7070\u8272\u7684\u56fe\u6807\u4f1a\u53d8\u4e3a\u7eff\u8272\uff0c\u8868\u793a\u5df2\u7ecf\u8fde\u63a5\u4e0a\u4e86
\n3.1.6\u00a0\u00a0\u00a0\u8fde\u901a\u6027\u6d4b\u8bd5
\n\u6b64\u65f6ping VPN\u670d\u52a1\u5668\u7684\u5185\u7f51\u53e3192.168.18.201\u5df2\u901a\uff0c\u4f46\u5230lanserver192.168.18.203\u4e0d\u901a<\/p>\n
C:\\\\Users\\\\Administrator>ping\u00a0192.168.18.201\n\u6b63\u5728\u00a0Ping\u00a0192.168.18.201\u00a0\u5177\u6709\u00a032\u00a0\u5b57\u8282\u7684\u6570\u636e:\n\u6765\u81ea\u00a0192.168.18.201\u00a0\u7684\u56de\u590d:\u00a0\u5b57\u8282=32\u00a0\u65f6\u95f4<1ms\u00a0TTL=64\n\u6765\u81ea\u00a0192.168.18.201\u00a0\u7684\u56de\u590d:\u00a0\u5b57\u8282=32\u00a0\u65f6\u95f4=1ms\u00a0TTL=64\nC:\\\\Users\\\\Administrator>ping\u00a0192.168.18.203\n\u6b63\u5728\u00a0Ping\u00a0192.168.18.203\u00a0\u5177\u6709\u00a032\u00a0\u5b57\u8282\u7684\u6570\u636e:\n\u8bf7\u6c42\u8d85\u65f6\u3002\n\u8bf7\u6c42\u8d85\u65f6\u3002<\/pre>\n
\u67e5\u770blanserver\u4e0a\u7684\u8def\u7531<\/p>\n
[root@lanserver\u00a0~]#\u00a0route\u00a0-n\nKernel\u00a0IP\u00a0routing\u00a0table\nDestination\u00a0\u00a0\u00a0\u00a0\u00a0Gateway\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Genmask\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Flags\u00a0Metric\u00a0Ref\u00a0\u00a0\u00a0\u00a0Use\u00a0Iface\n192.168.18.0\u00a0\u00a0\u00a0\u00a00.0.0.0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0255.255.255.0\u00a0\u00a0\u00a0U\u00a0\u00a0\u00a0\u00a00\u00a0\u00a0\u00a0\u00a0\u00a0\u00a00\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a00\u00a0eth0\n169.254.0.0\u00a0\u00a0\u00a0\u00a0\u00a00.0.0.0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0255.255.0.0\u00a0\u00a0\u00a0\u00a0\u00a0U\u00a0\u00a0\u00a0\u00a01002\u00a0\u00a0\u00a00\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a00\u00a0eth0\n0.0.0.0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0192.168.18.2\u00a0\u00a0\u00a0\u00a00.0.0.0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0UG\u00a0\u00a0\u00a00\u00a0\u00a0\u00a0\u00a0\u00a0\u00a00\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a00\u00a0eth0<\/pre>\n
\u5728windows\u4e0aping 192.168.18.203,\u7136\u540e\u5728lanserver\u4e0a\u6293\u5305\u6d4b\u8bd5<\/p>\n
[root@lanserver\u00a0~]#\u00a0tcpdump\u00a0icmp\ntcpdump:\u00a0verbose\u00a0output\u00a0suppressed,\u00a0use\u00a0-v\u00a0or\u00a0-vv\u00a0for\u00a0full\u00a0protocoldecode\nlistening\u00a0on\u00a0eth0,\u00a0link-type\u00a0EN10MB\u00a0(Ethernet),\u00a0capture\u00a0size\u00a065535bytes\n18:47:48.676249\u00a0IP\u00a010.8.0.6\u00a0>\u00a0192.168.18.203:\u00a0ICMP\u00a0echo\u00a0request,id\u00a01,\u00a0seq\u00a017288,\u00a0length\u00a040\n18:47:48.676288\u00a0IP\u00a0192.168.18.203\u00a0>\u00a010.8.0.6:\u00a0ICMP\u00a0echo\u00a0reply,\u00a0id1,\u00a0seq\u00a017288,\u00a0length\u00a040<\/pre>\n
\u53ef\u89c1\u6709\u5305\u8fc7\u6765\uff0c\u4f46\u6ca1\u6709\u56de\u5305\uff0c\u539f\u56e0\u662flanserver\u4e0a\u6709\u4e00\u6761\u9ed8\u8ba4\u7f51\u5173\uff0c\u4f46\u662f\u6307\u5411\u7684\u4e0d\u662fvpnserver,\u89e3\u51b3\u529e\u6cd5\u6709\u4e24\u4e2a\uff1a
\n\u65b9\u6cd5\u4e00\uff1a\u5c06lanserver\u4e0a\u7684\u7f51\u5173\u6307\u5411vpnserver<\/p>\n
[root@lanserver\u00a0~]#\u00a0route\u00a0del\u00a0default\u00a0gw\u00a0192.168.18.2\n[root@lanserver\u00a0~]#\u00a0route\u00a0add\u00a0default\u00a0gw\u00a0192.168.18.201\n[root@lanserver\u00a0~]#\u00a0route\u00a0-n\nKernel\u00a0IP\u00a0routing\u00a0table\nDestination\u00a0\u00a0\u00a0\u00a0\u00a0Gateway\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Genmask\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Flags\u00a0Metric\u00a0Ref\u00a0\u00a0\u00a0\u00a0Use\u00a0Iface\n192.168.18.0\u00a0\u00a0\u00a0\u00a00.0.0.0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0255.255.255.0\u00a0\u00a0\u00a0U\u00a0\u00a0\u00a0\u00a00\u00a0\u00a0\u00a0\u00a0\u00a0\u00a00\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a00\u00a0eth0\n169.254.0.0\u00a0\u00a0\u00a0\u00a0\u00a00.0.0.0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0255.255.0.0\u00a0\u00a0\u00a0\u00a0\u00a0U\u00a0\u00a0\u00a0\u00a01002\u00a0\u00a0\u00a00\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a00\u00a0eth0\n0.0.0.0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0192.168.18.201\u00a0\u00a00.0.0.0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0UG\u00a0\u00a0\u00a00\u00a0\u00a0\u00a0\u00a0\u00a0\u00a00\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a00\u00a0eth0<\/pre>\n
\u6dfb\u52a0\u5b8c\u6210\u540e\uff0cwindows\u5ba2\u6237\u7aef\u4e0elanserver\u7acb\u523b\u5c31\u901a\u4e86
\n\u65b9\u6cd5\u4e8c\uff1a\u5355\u72ec\u6dfb\u52a0\u4e00\u6761\u523010.8.0.0\/24\u7684\u8def\u7531
\n\u9996\u5148\u5220\u9664\u9ed8\u8ba4\u8def\u7531\uff0c\u5220\u9664\u6210\u529f\u540e\uff0c\u5ba2\u6237\u7aef\u4e0elanserver\u7acb\u9a6c\u5c31\u4e0d\u901a\u4e86<\/p>\n
route\u00a0del\u00a0default\u00a0gw\u00a0192.168.18.201<\/pre>\n
\u6dfb\u52a0\u523010.8.0.0\/24\u7f51\u6bb5\u7684\u8def\u7531<\/p>\n
route\u00a0add\u00a0-net\u00a010.8.0.0\/24\u00a0gw\u00a0192.168.18.201<\/pre>\n
\u65b9\u6cd5\u4e09\uff1a\u7f51\u5173\u4e0d\u5728vpnserver\u4e0a\uff0c\u5728vpnserver\u4e0a\u6dfb\u52a0\u4e00\u6761NAT\u5730\u5740\u8f6c\u6362\uff0c\u5c06\u6240\u6709\u768410.8.0.0\/24\u7f51\u6bb5\u7684IP\u90fd\u8f6c\u6210192.168.18.201\uff0c\u5728iptables\u4e0a\u6dfb\u52a0\u5982\u4e0b\u8bed\u53e5<\/p>\n
iptables\u00a0-t\u00a0nat\u00a0-APOSTROUTING\u00a0-s\u00a010.8.0.0\/24\u00a0-o\u00a0eth0\u00a0-j\u00a0MASQUERADE<\/pre>\n
\u4e0a\u9762\u7684\u547d\u4ee4\u4e5f\u53ef\u4ee5\u7528\u5982\u4e0b\u547d\u4ee4\u66ff\u6362<\/p>\n
iptables\u00a0-t\u00a0nat\u00a0-APOSTROUTING\u00a0-s\u00a010.8.0.0\/24\u00a0-o\u00a0eth0\u00a0-j\u00a0SNAT\u00a0--to-source\u00a0192.168.18.201<\/pre>\n
\u5728windows\u5ba2\u6237\u7aef\u4e0aping,\u5b9e\u9645IP\u4e3a10.8.0.6,\u800c\u5728lanserver\u4e0a\u6293\u5305\u770b\u5230\u7684\u6e90\u5730\u5740\u663e\u793a\u4e3a192.168.18.201<\/p>\n
[root@lanserver\u00a0~]#\u00a0tcpdump\u00a0-i\u00a0eth0\u00a0icmp\ntcpdump:\u00a0verbose\u00a0output\u00a0suppressed,\u00a0use\u00a0-v\u00a0or\u00a0-vv\u00a0for\u00a0full\u00a0protocoldecode\nlistening\u00a0on\u00a0eth0,\u00a0link-type\u00a0EN10MB\u00a0(Ethernet),\u00a0capture\u00a0size\u00a065535bytes\n19:21:52.889132\u00a0IP\u00a0192.168.18.201\u00a0>192.168.18.203:\u00a0ICMP\u00a0echo\u00a0request,\u00a0id\u00a01,\u00a0seq\u00a018615,\u00a0length\u00a040\n19:21:52.889154\u00a0IP\u00a0192.168.18.203\u00a0>\u00a0192.168.18.201:\u00a0ICMP\u00a0echoreply,\u00a0id\u00a01,\u00a0seq\u00a018615,\u00a0length\u00a040\n19:21:53.904123\u00a0IP\u00a0192.168.18.201\u00a0>\u00a0192.168.18.203:\u00a0ICMP\u00a0echorequest,\u00a0id\u00a01,\u00a0seq\u00a018616,\u00a0length\u00a040\n19:21:53.904144\u00a0IP\u00a0192.168.18.203\u00a0>\u00a0192.168.18.201:\u00a0ICMP\u00a0echoreply,\u00a0id\u00a01,\u00a0seq\u00a018616,\u00a0length\u00a040<\/pre>\n
\u5c0f\u7ed3\uff1a<\/strong>
\n\u65b9\u6cd5\u4e00\u4f18\u70b9\u5b9e\u65bd\u7b80\u5355\uff0c\u53ea\u9700lanserver\u7f51\u5173\u6307\u5411vpnserver\u5373\u53ef\uff0c\u5728\u67d0\u4e9b\u7f51\u5173\u6307\u5411\u8def\u7531\u5668\u7684\u60c5\u5f62\u4e0b\uff0c\u53ef\u4ee5\u5728\u8def\u7531\u5668\u4e0a\u6dfb\u52a0\u4e00\u6761\u5230\u8fdc\u7aef10.8.0.0\/24\u7684\u8def\u7531\u5373\u53ef\uff0c\u7f3a\u70b9\u662f\u9700\u8981\u7ecf\u8fc7\u8def\u7531\u5668\u8df3\u8f6c\uff0c\u591a\u4e86\u4e00\u8df3
\n\u65b9\u6cd5\u4e8c\u9700\u8981\u5728\u6240\u6709\u7684lanserver\u4e0a\u6dfb\u52a0\u8def\u7531\uff0c\u5b9e\u65bd\u8d77\u6765\u8f83\u9ebb\u70e6\u3002
\n\u65b9\u6cd5\u4e09\u9488\u5bf9\u65b9\u6cd52\u8fdb\u884c\u6539\u8fdb\uff0c\u4e0d\u9700\u8981\u5728\u6bcf\u53f0\u673a\u5668\u4e0a\u914d\u7f6e\u8def\u7531\uff0c\u7f3a\u70b9\u662f\u65e0\u6cd5\u663e\u793a\u51fa\u6e90IP\u4fe1\u606f
\n3.2\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0linux\u5ba2\u6237\u7aef\u5b89\u88c5\u4e0e\u914d\u7f6e<\/strong>
\n3.2.1\u00a0\u00a0\u00a0\u5b89\u88c5linux\u5ba2\u6237\u7aef\u8f6f\u4ef6
\nlinux\u5ba2\u6237\u7aef\u8f6f\u4ef6\u7684\u5b89\u88c5\u4e0e\u670d\u52a1\u7aef\u8f6f\u4ef6\u5b89\u88c5\u8fc7\u7a0b\u4e00\u6837\uff0c\u4e5f\u662f\u9700\u8981\u5148\u5b89\u88c5lzo\uff0c\u7136\u540e\u6e90\u7801\u7f16\u8bd1openvpn2.2.2,\u5177\u4f53\u5b89\u88c5\u64cd\u4f5c\u8fc7\u7a0b\u53ef\u53c2\u7167\u670d\u52a1\u7aef\u6e90\u7801\u5305\u5b89\u88c52.4.1<\/i><\/a>
\n3.2.2\u00a0\u00a0\u00a0\u7f16\u8f91\u5ba2\u6237\u7aef\u914d\u7f6e\u6587\u4ef6
\n\u65b0\u5efa\u914d\u7f6e\u6587\u4ef6\u76ee\u5f55\/etc\/openvpn<\/p>\n
mkdir\u00a0\/etc\/openvpn\ncd\u00a0\/etc\/openvpn<\/pre>\n
\u5c06ca.crt,test.crt,test.key,client.conf\u4e0a\u4f20
\n1\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0[root@vpnclient openvpn]# ls<\/p>\n
ca.crt\u00a0\u00a0client.conf\u00a0\u00a0test.crt\u00a0test.key<\/pre>\n
client.conf\u5185\u5bb9\u4e0ewindows\u5ba2\u6237\u7aef\u4e0b\u7684test.ovpn\u5185\u5bb9\u4e00\u6837<\/p>\n
[root@vpnclient\u00a0openvpn]#\u00a0cat\u00a0client.conf\nclient\ndev\u00a0tun\nproto\u00a0tcp\nremote\u00a0192.168.3.201\u00a052115\nresolv-retry\u00a0infinite\nnobind\npersist-key\npersist-tun\nca\u00a0ca.crt\ncert\u00a0test.crt\nkey\u00a0test.key\nns-cert-type\u00a0server\ncomp-lzo\nverb\u00a03<\/pre>\n
3.2.3\u00a0\u00a0\u00a0\u8fdc\u7a0b\u62d4\u5165vpn
\n\u4f7f\u7528\u4e0e\u670d\u52a1\u7aef\u7c7b\u4f3c\u7684\u542f\u52a8\u65b9\u5f0f\u8fdb\u884c\u542f\u52a8\uff0c\u5f00\u673a\u81ea\u542f\u65b9\u5f0f\u53ef\u4ee5\u52a0\u5165\/etc\/rc.local<\/p>\n
[root@vpnclient\u00a0openvpn]#\u00a0\/usr\/local\/sbin\/openvpn\u00a0--config\/etc\/openvpn\/client.conf\u00a0\u00a0&\n[1]\u00a016347\n[root@vpnclient\u00a0openvpn]#\u00a0Thu\u00a0Jul\u00a07\u00a019:49:00\u00a02016\u00a0OpenVPN\u00a02.2.2\u00a0x86_64-unknown-linux-gnu\u00a0[SSL]\u00a0[LZO2][EPOLL]\u00a0[eurephia]\u00a0built\u00a0on\u00a0Jul\u00a0\u00a07\u00a02016\nThu\u00a0Jul\u00a0\u00a07\u00a019:49:00\u00a02016\u00a0NOTE:OpenVPN\u00a02.1\u00a0requires\u00a0\\'--script-security\u00a02\\'\u00a0or\u00a0higher\u00a0to\u00a0call\u00a0user-definedscripts\u00a0or\u00a0executables\n\u2026\u6b64\u5904\u7701\u7565\u82e5\u5e72\u884c\nThu\u00a0Jul\u00a0\u00a07\u00a019:49:03\u00a02016\u00a0ROUTEdefault_gateway=192.168.3.251\nThu\u00a0Jul\u00a0\u00a07\u00a019:49:04\u00a02016TUN\/TAP\u00a0device\u00a0tun0\u00a0opened\nThu\u00a0Jul\u00a0\u00a07\u00a019:49:04\u00a02016TUN\/TAP\u00a0TX\u00a0queue\u00a0length\u00a0set\u00a0to\u00a0100\nThu\u00a0Jul\u00a0\u00a07\u00a019:49:04\u00a02016\/sbin\/ifconfig\u00a0tun0\u00a010.8.0.10\u00a0pointopoint\u00a010.8.0.9\u00a0mtu\u00a01500\nThu\u00a0Jul\u00a0\u00a07\u00a019:49:04\u00a02016\/sbin\/route\u00a0add\u00a0-net\u00a0192.168.18.0\u00a0netmask\u00a0255.255.255.0\u00a0gw\u00a010.8.0.9\nThu\u00a0Jul\u00a0\u00a07\u00a019:49:04\u00a02016\/sbin\/route\u00a0add\u00a0-net\u00a010.8.0.0\u00a0netmask\u00a0255.255.255.0\u00a0gw\u00a010.8.0.9\nThu\u00a0Jul\u00a0\u00a07\u00a019:49:04\u00a02016Initialization\u00a0Sequence\u00a0Completed\n\u62d4\u53f7\u6210\u529f\u540e\uff0c\u4f1a\u591a\u51fa\u4e00\u4e2a\u63a5\u53e3tun0\n[root@vpnclient\u00a0openvpn]#\u00a0ifconfig\u00a0tun0\ntun0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Linkencap:UNSPEC\u00a0\u00a0HWaddr00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00\u00a0\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0inetaddr:10.8.0.10\u00a0\u00a0P-t-P:10.8.0.9\u00a0\u00a0Mask:255.255.255.255\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0UP\u00a0POINTOPOINTRUNNING\u00a0NOARP\u00a0MULTICAST\u00a0\u00a0MTU:1500\u00a0\u00a0Metric:1\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0RX\u00a0packets:0errors:0\u00a0dropped:0\u00a0overruns:0\u00a0frame:0\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0TX\u00a0packets:0errors:0\u00a0dropped:0\u00a0overruns:0\u00a0carrier:0\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0collisions:0txqueuelen:100\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0RX\u00a0bytes:0\u00a0(0.0b)\u00a0\u00a0TX\u00a0bytes:0\u00a0(0.0\u00a0b)<\/pre>\n
\u5982\u679c\u662f\u5e26\u5bc6\u7801\u8ba4\u8bc1\u7684\u7528\u6237\uff0c\u4ee5sunny\u4e3a\u4f8b\uff0c\u5c06sunny.crt,sunny.key,sunny.ovpn\u4e0a\u4f20\u81f3\/etc\/openvpn,sunny.ovpn\u7684\u5185\u5bb9\u5982\u4e0b\uff1a<\/p>\n
client\ndev\u00a0tun\nproto\u00a0tcp\nremote\u00a0192.168.3.204\u00a052115\nresolv-retry\u00a0infinite\nnobind\npersist-key\npersist-tun\nca\u00a0ca.crt\ncert\u00a0sunny.crt\nkey\u00a0sunny.key\nns-cert-type\u00a0server\ncomp-lzo\nverb\u00a03\n--script-security\u00a03<\/pre>\n
\u5728\/etc\/openvpn\u4e0b\u65b0\u5efa\u5bc6\u7801\u6587\u4ef6pass.txt<\/p>\n
123456<\/pre>\n
\u5b89\u5168\u8d77\u89c1\uff0c\u4fee\u6539pass.txt\u6743\u9650\u4e3a400<\/p>\n
chmod\u00a0400\u00a0\/etc\/openvpn\/pass.txt<\/pre>\n
\u542f\u52a8\u5ba2\u6237\u7aef<\/p>\n
openvpn--config\u00a0\/etc\/openvpn\/sunny.ovpn\u00a0--askpass\u00a0\/etc\/openvpn\/pass.txt\u00a0&<\/pre>\n
\u52a0\u5165\u5f00\u673a\u81ea\u542f\u7684\u65b9\u6cd5\uff1a<\/p>\n
echo\u00a0\u2018openvpn\u00a0--config\u00a0\/etc\/openvpn\/sunny.ovpn\u00a0--askpass\/etc\/openvpn\/pass.txt\u00a0>\/dev\/null\u00a0&\u2019>>\/etc\/rc.local<\/pre>\n
3.2.4\u00a0\u00a0\u00a0\u68c0\u67e5\u8def\u7531\u53d8\u5316\u548c\u8fde\u901a\u6027
\n\u6d4b\u8bd5\u5230192.168.18.203\u7f51\u7edc\u662f\u901a\u7684\uff0c\u505c\u6389openvpn\u670d\u52a1\uff08pkill openvpn\uff09\u540e\uff0c\u7f51\u7edc\u53c8\u65ad\u5f00\u4e86\uff0clinux\u5ba2\u6237\u7aef\u914d\u7f6e\u6210\u529f
\n\u8fde\u901a\u6027\u95ee\u9898\u5904\u7406\u65b9\u6848\u4e0ewindows\u5ba2\u6237\u7aef\u4e0a\u4e00\u81f4\uff0c\u89c13.1.6<\/i><\/a><\/p>\n
\n
4\u3001\u00a0\u00a0\u00a0\u00a0openvpn\u9ad8\u53ef\u7528\u65b9\u6848<\/strong>
\n4.1\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u4f7f\u7528openvpn\u5b9e\u73b0\u4ee3\u7406\u8bbf\u95ee<\/strong>
\n4.1.1\u00a0\u00a0\u00a0\u7ffb\u5899\u89e3\u51b3\u65b9\u6848\u9700\u6c42\u5206\u6790
\n\u4e0eweb\u4ee3\u7406\u7c7b\u4f3c\uff0c\u5ba2\u6237\u7684IP\u5730\u5740\u901a\u8fc7\u4ee3\u7406\u8bbf\u95ee\u540e\uff0c\u6e90\u5730\u5740\u53d8\u6210vpnserver\u7684\u5916\u7f51IP\uff0c\u5ba2\u6237\u7aef\u6240\u6709\u7684\u4e0a\u7f51\u884c\u4e3a\u90fd\u8d70vpnserver,\u76f8\u5f53\u4e8e\u662f\u8fdc\u7aef\u7684vpnserver\u53bb\u8bf7\u6c42\u7f51\u9875\u670d\u52a1\u3002\u4e4b\u524d\u7684\u666e\u901a\u6a21\u5f0f\u53ea\u662f\u8bbf\u95ee\u8fdc\u7aef\u7279\u5b9a\u7684\u5185\u7f51\u670d\u52a1\u5668\u65f6\uff0c\u624d\u4f1a\u8d70vpnserver\uff0c\u5176\u5b83\u5916\u7f51\u8bbf\u95ee\u4f9d\u7136\u8d70\u5ba2\u6237\u7aef\u672c\u5730\u7f51\u7edc\uff0c\u5982\u679c\u8fd9\u53f0vpnserver\u5728\u56fd\u5916\uff0c\u53ef\u4ee5\u901a\u8fc7\u6b64\u670d\u52a1\u5668\u8bbf\u95ee\u56fd\u5916\u7684\u7f51\u7ad9\uff0c\u8bf7\u4e0d\u8981\u4f7f\u7528\u6b64\u65b9\u6cd5\u7528\u4e8e\u975e\u6cd5\u7528\u9014\uff0c\u5426\u5219\u540e\u679c\u81ea\u8d1f\u3002
\n\u5177\u4f53\u903b\u8f91\u5982\u4e0b\u56fe\u6240\u793a\uff1a
\n\u00a0<\/i><\/a>
\n\\\"openvpn\u914d\u7f6e\\\"<\/a>
\n4.1.2\u00a0\u00a0\u00a0\u4ee3\u7406\u8bbf\u95ee\u89e3\u51b3\u65b9\u6848\u914d\u7f6e
\n\u548c\u666e\u901a\u914d\u7f6e\u76f8\u6bd4\uff0c\u5728server.conf\u4e0a\u589e\u52a0\u5982\u4e0b\u914d\u7f6e<\/p>\n
push\u00a0\\\"redirect-gateway\u00a0def1\u00a0bypass-dhcp\u00a0bypass-dns\\\"\npush\u00a0\\\"dhcp-option\u00a0DNS\u00a08.8.8.8\\\"\npush\u00a0\\\"dhcp-option\u00a0DNS\u00a08.8.4.4\\\"<\/pre>\n
\u542f\u52a8\u8f6c\u53d1\u529f\u80fd<\/p>\n
sed\u00a0\u2013i\u00a0\u2018s#net.ipv4.ip_forward=\u00a00#\u00a0net.ipv4.ip_forward=\u00a01#g\u2019\/etc\/sysctl.conf\nsysctl\u00a0\u2013p<\/pre>\n
\u5f00\u542f\u9632\u706b\u5899NAT\u6620\u5c04<\/p>\n
iptables\u00a0-t\u00a0nat\u00a0-A\u00a0POSTROUTING\u00a0-s\u00a010.8.0.0\/24\u00a0-o\u00a0eth0\u00a0-j\u00a0MASQUERADE<\/pre>\n
\u5f00\u653e\u9632\u706b\u5899<\/p>\n
iptables\u00a0-A\u00a0INPUT\u00a0-p\u00a0udp\u00a0-m\u00a0state\u00a0\u2013state\u00a0NEW\u00a0\u2013m\u00a0udp\u00a0\u00a0--dport\u00a052115\u00a0-j\u00a0ACCEPT<\/pre>\n
4.2\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u540c\u4e00\u8d26\u53f7\u62d4\u5165\u4e0d\u540c\u670d\u52a1\u5668<\/strong>
\n4.2.1\u00a0\u00a0\u00a0\u5b9e\u73b0\u539f\u7406
\n\\\"openvpn\u914d\u7f6e\\\"<\/a>
\n\u914d\u7f6e\u4e24\u53f0vpnserver,\u7b2c2\u53f0\u670d\u52a1\u5668\u4e0a\u540c\u6837\u4e5f\u9700\u8981\u5f00\u542fnet.ipv4.ip_forward\uff0c\u6e90\u7801\u7f16\u8bd1\u5b89\u88c5\u5b8c\u6210\u540e\uff0c\u6240\u6709\u7684\u8bc1\u4e66\u5236\u4f5c\u8fc7\u7a0b\u4e0d\u9700\u8981\u4e86\uff0c\u76f4\u63a5\u5c06vpnserver1\u4e0b\/etc\/openvpn\/keys\u76ee\u5f55\u62f7\u8d1d\u5230vpnserver2\u4e2d\uff0c\u8fd9\u6837\u4e24\u53f0vpnserver\u7684\u5185\u5bb9\u662f\u4e00\u6837\u7684\uff0c\u9664\u4e86\u63a5\u5165\u7684IP\u5730\u5740\u4e0d\u4e00\u6837\uff0c\u53ea\u9700\u8981\u5728\u5ba2\u6237\u7aef\u751f\u6210\u4e00\u4e2a\u65b0\u7684\u914d\u7f6e\u6587\u4ef6\uff08client.conf\/test2.ovpn\uff09,
\n4.2.2\u00a0\u00a0\u00a0\u540c\u4e00\u8d26\u53f7\u62d4\u5165\u4e0d\u540cvpnserver\u65b9\u6848
\n\u5728vpnserver1\u4e0a\u5bf9\u8bc1\u4e66\u6587\u4ef6\u76ee\u5f55\u6253\u5305<\/p>\n
[root@vpnserver\u00a0openvpn]#\u00a0cd\u00a0\/tmp\n[root@vpnserver\u00a0tmp]#\u00a0tar\u00a0zcvf\u00a0openvpn.tar.gz\u00a0\/etc\/openvpn\/\n[root@vpnserver\u00a0tmp]#\u00a0scp\u00a0openvpn.tar.gz\u00a0192.168.3.204:\/tmp<\/pre>\n
\u5728vpnserver2\u4e0a\u89e3\u5305<\/p>\n
[root@vpnserver2\u00a0tmp]#\u00a0tar\u00a0xf\u00a0openvpn.tar.gz\u00a0-C\u00a0\/\n[root@vpnserver2\u00a0tmp]#\u00a0ls\u00a0\/etc\/openvpn\/\nipp.txt\u00a0\u00a0keys\u00a0\u00a0openvpn-status.log\u00a0\u00a0server.bak\u00a0server.conf<\/pre>\n
\u4fee\u6539vpnsever2\u4e0a\u7684server.conf\u6587\u4ef6<\/p>\n
local\u00a0192.168.3.204\nserver10.8.1.0\u00a0255.255.255.0<\/pre>\n
\u542f\u52a8vpnserver2<\/p>\n
\/usr\/local\/sbin\/openvpn\u00a0--config\u00a0\/etc\/openvpn\/server.conf\u00a0&<\/pre>\n
\u52a0\u5165\u5f00\u673a\u81ea\u542f\u52a8<\/p>\n
echo\u00a0\\\"\/usr\/local\/sbin\/openvpn\u00a0--config\u00a0\/etc\/openvpn\/server.conf>\/dev\/null\u00a0\u00a0&\\\">>\/etc\/rc.local<\/pre>\n
\u4fee\u6539\u5ba2\u6237\u7aef\u914d\u7f6e\u6587\u4ef6\uff0c\u65b0\u589e\u4e00\u4e2a\u914d\u7f6e\u6587\u4ef6\uff0c\u9664IP\u5730\u5740\u5916\uff0c\u5176\u5b83\u5747\u4e00\u6837
\n\u4e00\u65e6\u4e00\u53f0vpnserver\u505c\u6389\u4e86\uff0c\u9700\u8981\u624b\u52a8\u5c06\u6b64\u94fe\u63a5\u65ad\u5f00\uff0c\u62d4\u53f7\u5230\u53e6\u5916\u4e00\u53f0vpnserver
\n\u4f18\u70b9\uff1a\u65e0\u989d\u5916\u5355\u70b9\u6545\u969c\uff0c\u914d\u7f6e\u7b80\u5355
\n\u7f3a\u70b9\uff1a\u9700\u8981\u624b\u5de5\u5207\u6362\u62d4\u53f7\u670d\u52a1\u5668
\n4.3\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0OPENVPN\u8d1f\u8f7d\u5747\u8861<\/strong>
\n4.3.1\u00a0\u00a0\u00a0\u539f\u7406\u56fe\u89e3
\n\u00a0<\/i><\/a>
\n\\\"openvpn\u914d\u7f6e\\\"<\/a>
\n4.3.2\u00a0\u00a0\u00a0\u8d1f\u8f7d\u5747\u8861\u5b9e\u73b0
\n\u914d\u7f6eserver\u5ba2\u6237\u7aef\u5206\u914d\u4e0d\u540c\u7684IP\u5730\u5740<\/p>\n
server1\n\u00a0\u00a0\u00a0\u00a0server\u00a010.8.0.0\u00a0255.255.255.0\nserver2\n\u00a0\u00a0\u00a0\u00a0server\u00a010.8.1.0255.255.255.0\nserver3\nserver\u00a010.8.2.0\u00a0255.255.255.0<\/pre>\n
\u5728vpnserver2\u4e0a\u6dfb\u52a0\u5982\u4e0b\u547d\u4ee4\u4e2d\u7684\u4e00\u6761\uff0c\u505a\u5730\u5740\u8f6c\u6362
\n\u65b9\u6cd51\uff1a<\/p>\n
iptables\u00a0-t\u00a0nat\u00a0-APOSTROUTING\u00a0-s\u00a010.8.1.0\/24\u00a0-o\u00a0eth0\u00a0-j\u00a0MASQUERADE<\/pre>\n
\u65b9\u6cd52\uff1a<\/p>\n
iptables\u00a0-t\u00a0nat\u00a0-APOSTROUTING\u00a0-s\u00a010.8.1.0\/24\u00a0-o\u00a0eth0\u00a0-j\u00a0SNAT\u00a0--to-source\u00a0192.168.18.204<\/pre>\n
\u5ba2\u6237\u7aef\u914d\u7f6e\u914d\u7f6e\u6587\u4ef6\u4fee\u6539<\/p>\n
remote\u00a0192.168.3.201\u00a052115\nremote\u00a0192.168.3.204\u00a052115\nremote-random\nresolv-retry\u00a020<\/pre>\n
\u8fd9\u6837\u53ea\u9700\u8981\u5efa\u4e00\u4e2a\u914d\u7f6e\u6587\u4ef6\u5373\u53ef\uff0c\u5f53\u4e00\u53f0vpnserver\u65ad\u6389\u65f6\uff0c20\u79d2\u540e\u81ea\u52a8\u8fde\u53e6\u5916\u4e00\u53f0vpnserver<\/p>\n
\n
5\u3001\u00a0\u00a0\u00a0\u00a0openvpn\u7edf\u4e00\u8eab\u4efd\u8ba4\u8bc1\u4f53\u7cfb\u89e3\u51b3\u65b9\u6848<\/strong>
\n5.1\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0OpenVPN\u7edf\u4e00\u8eab\u4efd\u9a8c\u8bc1\u5206\u7c7b
\n1\uff09\u00a0\u00a0\u901a\u8fc7\u672c\u5730\u8bc1\u4e66\u5bc6\u94a5\u8ba4\u8bc1
\n2\uff09\u00a0\u00a0\u672c\u5730\u6587\u4ef6\u8ba4\u8bc1
\n\u672c\u5730\u65b0\u5efa\u8d26\u53f7\u5bc6\u7801\u6587\u4ef6\uff0c\u901a\u8fc7\u811a\u672c\u9a8c\u8bc1\u672c\u5730\u7684\u5bc6\u7801\u6587\u4ef6
\n3\uff09\u00a0\u00a0\u901a\u8fc7\u6570\u636e\u5e93\u8ba4\u8bc1
\n\u65b9\u6cd51\uff1a\u5229\u7528\u811a\u672c\u7a0b\u5e8f\u6216PHP\u7a0b\u5e8f\u4e0d\u4ece\u672c\u5730\u6587\u4ef6\u8bfb\uff0c\u4eceMysql\u6570\u636e\u5e93\u4e2d\u8bfb\u53d6
\n\u65b9\u6cd52\uff1a\u4f7f\u7528pam_mysql\u6a21\u5757
\n4\uff09\u00a0\u00a0LDAP\u7edf\u4e00\u7528\u6237\u8ba4\u8bc1
\n\u65b9\u6cd51\uff1aopenvpn-auth-ldap
\n\u65b9\u6cd52\uff1a\u5229\u7528\u7b2c\u4e00\u4e2a\u6587\u4ef6\u8ba4\u8bc1\u7684\u601d\u8def\uff0c\u53bbLDAP\u67e5\u8be2\uff0c\u4e5f\u53ef\u4ee5\u548c\u672c\u5730\u6587\u4ef6\u505a\u6bd4\u8f83
\n5\uff09\u00a0\u00a0Radis\uff08Remote Authentication Dial In User Service\uff09\u8ba4\u8bc1\uff0c\u4e3b\u8981\u7528\u6765\u9a8c\u8bc1\u3001\u6388\u6743\u3001\u8ba1\u8d39
\n6\uff09\u00a0\u00a0\u5229\u7528\u5fae\u8f6f\u7684\u6d3b\u52a8\u76ee\u5f55\u8ba4\u8bc1\uff08\u53ef\u4ee5\u548cLDAP\u6253\u901a\uff09
\n7\uff09\u00a0\u00a0\u7ed3\u5408U\u76fe\u7b49\u8bbe\u5907\u8ba4\u8bc1
\n5.2\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0OpenVPN\u672c\u5730\u8eab\u4efd\u8ba4\u8bc1
\n5.2.1\u00a0\u00a0\u00a0\u670d\u52a1\u7aef\u914d\u7f6e
\n\u5728\/etc\/openvpn\/server.conf\u4e2d\u6dfb\u52a0\u5982\u4e0b\u914d\u7f6e<\/p>\n
#auth\u00a0password\u00a0added\u00a0by\u00a0sunny\nscript-security\u00a03\nauth-user-pass-verify\u00a0\/etc\/openvpn\/checkpsw.sh\u00a0via-env\nclient-cert-not-required\nusername-as-common-name<\/pre>\n
\u8bf4\u660e\uff1a
\nscript-security 3\u00a0\u00a0\u4f7f\u75283\u7ea7\u522b\u5f00\u542f\u811a\u672c\u4f7f\u7528\u529f\u80fd
\nauth-user-pass-verify \/etc\/openvpn\/checkpsw.sh via-env\u4f7f\u7528\u811a\u672c\u9a8c\u8bc1\u672c\u5730\u6587\u4ef6
\nclient-cert-not-required\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u4e0d\u9a8c\u8bc1\u5ba2\u6237\u7aef\u8bc1\u4e66\uff0c\u5982\u679c\u542f\u7528\u8bc1\u4e66\u548c\u5bc6\u7801\u53cc\u91cd\u8ba4\u8bc1\u6ce8\u91ca\u6b64\u884cusername-as-common-name\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u4f7f\u7528\u5ba2\u6237\u63d0\u4f9b\u7684UserName\u4f5c\u4e3aCommonName
\n\u5728\/etc\/openvpn\u4e0b\u65b0\u5efa\u811a\u672c\u6587\u4ef6checkpsw.sh<\/p>\n
#!\/bin\/sh\n###########################################################\n#\u00a0checkpsw.sh\u00a0(C)\u00a02004\u00a0Mathias\u00a0Sundman\u00a0<mathias@openvpn.se>\n#\n#\u00a0This\u00a0script\u00a0will\u00a0authenticate\u00a0OpenVPN\u00a0users\u00a0against\n#\u00a0a\u00a0plain\u00a0text\u00a0file.\u00a0The\u00a0passfile\u00a0should\u00a0simply\u00a0contain\n#\u00a0one\u00a0row\u00a0per\u00a0user\u00a0with\u00a0the\u00a0username\u00a0first\u00a0followed\u00a0by\n#\u00a0one\u00a0or\u00a0more\u00a0space(s)\u00a0or\u00a0tab(s)\u00a0and\u00a0then\u00a0the\u00a0password.\nPASSFILE=\\\"\/etc\/openvpn\/psw-file\\\"\nLOG_FILE=\\\"\/var\/log\/openvpn-password.log\\\"\nTIME_STAMP=`date\u00a0\\\"+%Y-%m-%d\u00a0%T\\\"`\n###########################################################\nif\u00a0[\u00a0!\u00a0-r\u00a0\\\"${PASSFILE}\\\"\u00a0];\u00a0then\necho\u00a0\\\"${TIME_STAMP}:\u00a0Could\u00a0not\u00a0open\u00a0password\u00a0file\\\\\\\"${PASSFILE}\\\\\\\"\u00a0for\u00a0reading.\\\"\u00a0>>\u00a0${LOG_FILE}\nexit\u00a01\nfi\nCORRECT_PASSWORD=`awk\\'!\/^;\/&&!\/^#\/&&$1==\\\"\\'${username}\\'\\\"{print\u00a0$2;exit}\\'${PASSFILE}`\nif\u00a0[\u00a0\\\"${CORRECT_PASSWORD}\\\"\u00a0=\u00a0\\\"\\\"\u00a0];\u00a0then\u00a0\necho\u00a0\\\"${TIME_STAMP}:\u00a0User\u00a0does\u00a0not\u00a0exist:\u00a0username=\\\\\\\"${username}\\\\\\\",password=\\\\\\\"${password}\\\\\\\".\\\"\u00a0>>\u00a0${LOG_FILE}\nexit\u00a01\nfi\nif\u00a0[\u00a0\\\"${password}\\\"\u00a0=\u00a0\\\"${CORRECT_PASSWORD}\\\"\u00a0];\u00a0then\u00a0\necho\u00a0\\\"${TIME_STAMP}:\u00a0Successful\u00a0authentication:username=\\\\\\\"${username}\\\\\\\".\\\"\u00a0>>\u00a0${LOG_FILE}\nexit\u00a00\nfi\necho\u00a0\\\"${TIME_STAMP}:\u00a0Incorrect\u00a0password:username=\\\\\\\"${username}\\\\\\\",\u00a0password=\\\\\\\"${password}\\\\\\\".\\\">>\u00a0${LOG_FILE}\nexit\u00a01<\/mathias@openvpn.se><\/pre>\n
\u8d4b\u4e88\u53ef\u6267\u884c\u6743\u9650<\/p>\n
chmod\u00a0u+x\u00a0checkpsw.sh<\/pre>\n
\u65b0\u5efa\u5bc6\u7801\u6587\u4ef6\/etc\/openvpn\/psw-file,\u524d\u9762\u662f\u7528\u6237\uff0c\u540e\u9762\u662f\u5bc6\u7801\uff0c\u6bcf\u884c\u4e00\u6761\uff0c\u4e2d\u95f4\u7528\u7a7a\u683c\u6216\u8005tab\u952e\u9694\u5f00<\/p>\n
client01\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0111111\nclient02\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0123456<\/pre>\n
\u4fee\u6539\u5bc6\u7801\u6587\u4ef6\u6743\u9650<\/p>\n
\u00a0chmod\u00a0400\u00a0psw-file<\/pre>\n
\u91cd\u542fopenvpn<\/p>\n
pkill\u00a0openvpn\nps\u00a0-ef|grep\u00a0openvpn\n\/etc\/init.d\/openvpn\u00a0start\nps\u00a0-ef|grep\u00a0openvpn<\/pre>\n
5.2.2\u00a0\u00a0\u00a0\u5ba2\u6237\u7aef\u914d\u7f6e
\n5.2.2.1\u00a0windows\u5ba2\u6237\u7aef\u914d\u7f6e
\n\u7f16\u8f91test\u7528\u6237\u7684\u5ba2\u6237\u7aef\u914d\u7f6e\u6587\u4ef6test-192.168.3.201.ovpn\uff0c\u65b0\u589e\u7ea2\u8272\u90e8\u5206\u914d\u7f6e\uff0c\u4fee\u6539\u540e\u7684\u914d\u7f6e\u5982\u4e0b\uff1a<\/p>\n
client\ndev\u00a0tun\nproto\u00a0tcp\nremote\u00a0192.168.3.201\u00a052115\nresolv-retry\u00a0infinite\nnobind\npersist-key\npersist-tun\nca\u00a0ca.crt\n;cert\u00a0test.crt\n;key\u00a0test.key\nns-cert-type\u00a0server\ncomp-lzo\nverb\u00a03\nauth-user-pass<\/pre>\n
5.2.2.2\u00a0linux\u5ba2\u6237\u7aef\u914d\u7f6e
\nLinux\u5ba2\u6237\u7aef\u914d\u7f6e\u6587\u4ef6\u5982\u4e0b\uff1a<\/p>\n
;cert\u00a0test.crt\n;key\u00a0test.key\nauth-user-pass\u00a0\u00a0\u00a0\u00a0auth-user-pass\/etc\/openvpn\/psw-file<\/pre>\n
\u65b0\u5efa\u5bc6\u7801\u6587\u4ef6\/etc\/openvpn\/psw-file\uff0c\u7b2c\u4e00\u884c\u4e3a\u7528\u6237\u540d\uff0c\u7b2c\u4e8c\u884c\u4e3a\u5bc6\u7801<\/p>\n
client02\n123456<\/pre>\n
\u4fee\u6539\u6743\u9650\u4e3a400<\/p>\n
chmod\u00a0400\u00a0\/etc\/openvpn\/psw-file<\/pre>\n
\u6dfb\u52a0\u5230\u5f00\u673a\u81ea\u542f\u52a8<\/p>\n
echo\u00a0\u201c\/usr\/local\/sbin\/openvpn--config\u00a0\/etc\/openvpn\/client.conf\u00a0>\/dev\/null\u00a0&\u201d>>\/etc\/rc.local<\/pre>\n
\u6b64\u529f\u80fd\u9700\u8981\u7f16\u8bd1\u65f6\u52a0\u5165–enable-password-save\u53c2\u6570\uff0c\u5373<\/p>\n
.\/configure\u00a0--enable-password-save\u00a0--with-lzo-lib=\/usr\/local\/lib\u00a0--with-lzo-headers=\/usr\/local\/include<\/pre>\n
\u5426\u5219\u4f1a\u62a5\u5982\u4e0b\u9519\u8bef\uff1a<\/p>\n
\\'Auth\\'\u00a0password\u00a0cannot\u00a0be\u00a0read\u00a0from\u00a0a\u00a0file<\/pre>\n
5.2.3\u00a0\u00a0\u00a0\u8fde\u63a5\u6d4b\u8bd5
\nwindows\u5ba2\u6237\u7aef\u76f4\u63a5\u62d4\u53f7\u6d4b\u8bd5\uff0c\u4f1a\u5f39\u51fa\u7528\u6237\u5bc6\u7801\u8f93\u5165\u6846\uff0c\u8f93\u5165client01,111111
\nlinux\u5ba2\u6237\u7aef\u76f4\u63a5\u542f\u52a8\u670d\u52a1\u5373\u53ef<\/p>\n","protected":false},"excerpt":{"rendered":"
1\u3001openvpn\u4ecb\u7ecd\u4e0e\u56fe\u89e3 1.1\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0openvpn\u4ecb\u7ecd OpenVPN\u00a0\u662f\u4e00\u4e2a\u57fa\u4e8e\u00a0OpenSSL …<\/p>\n
  OpenVPN\u914d\u7f6e\u8be6\u89e3<\/span> \u67e5\u770b\u5168\u6587 »<\/a><\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"default","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","theme-transparent-header-meta":"default","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":""},"categories":[102,124],"tags":[],"uagb_featured_image_src":{"full":false,"thumbnail":false,"medium":false,"medium_large":false,"large":false,"1536x1536":false,"2048x2048":false,"mailpoet_newsletter_max":false,"woocommerce_thumbnail":false,"woocommerce_single":false,"woocommerce_gallery_thumbnail":false,"shop_catalog":false,"shop_single":false,"shop_thumbnail":false},"uagb_author_info":{"display_name":"weijing","author_link":"http:\/\/www.weijing.co\/?author=4"},"uagb_comment_info":1,"uagb_excerpt":"1\u3001openvpn\u4ecb\u7ecd\u4e0e\u56fe\u89e3 1.1\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0openvpn\u4ecb\u7ecd OpenVPN\u00a0\u662f\u4e00\u4e2a\u57fa\u4e8e\u00a0OpenSSL…","_links":{"self":[{"href":"http:\/\/www.weijing.co\/index.php?rest_route=\/wp\/v2\/posts\/5432"}],"collection":[{"href":"http:\/\/www.weijing.co\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.weijing.co\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.weijing.co\/index.php?rest_route=\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"http:\/\/www.weijing.co\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=5432"}],"version-history":[{"count":0,"href":"http:\/\/www.weijing.co\/index.php?rest_route=\/wp\/v2\/posts\/5432\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.weijing.co\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5432"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.weijing.co\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5432"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.weijing.co\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5432"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}