linux下openvpn2.3.4服务器部署

admin

二、部署openvpn    本次部署openvpn服务器，因为使用了最新的openvpn2.3.4，而这个包里面没有包含最重要的证书制作部分：easy-rsa    openvpn官网也给出明确说明：Starting with openvpn-2.3_alpha2 easy-rsa is no longer part of the OpenVPN source or binary packages    所以，我们需要事先下载好easyrsa，可以到GitHub上进行下载，配置过程将在下面第3步进行，本次部署使用了easy-rsa3，与easy-rsa2.0的操作完全不同，网上其它关于easy-rsa2.0的教程不适合本次部署    在部署openvpn之前，最好用ntpdate同步一下服务器的时间，否则生成证书的时间也不准确，会造成那个什么centificate error等的错误！
" r6 o/ Q8 Q2 I2 q* c1、安装lzo
3 q6 q, q5 W7 Z( `    lzo是致力于解压速度的一种数据压缩算法123[root@vpn ~]# tar xf lzo-2.08.tar.gz[root@vpn ~]# cd lzo-2.08[root@vpn lzo-2.08]# ./configure && make && make install2、安装openvpn1234567[root@vpn ~]# tar xf openvpn-2.3.4.tar.gz[root@vpn ~]# cd openvpn-2.3.4[root@vpn openvpn-2.3.4]# ./configure --with-lzo-headers=/usr/local/include/ --with-lzo-lib=/usr/local/lib[root@vpn openvpn-2.3.4]# make && make install[root@vpn openvpn-2.3.4]# [root@vpn openvpn-2.3.4]# which openvpn/usr/local/sbin/openvpn      #看到这里，说明安装openvpn成功3、配置easyrsa服务端    openvpn-2.3.4软件包不包含证书（ca证书，服务端证书，客户端证书）制作工具，所以还需要单独下载easy-rsa，最新的为easy-rsa3    Starting with openvpn-2.3_alpha2 easy-rsa is no longer part of the OpenVPN source or binary packages（来源openvpn官网）123456789101112[root@vpn ~]# unzip easy-rsa-master.zip [root@vpn ~]# mv easy-rsa-master easy-rsa[root@vpn ~]# cp -R easy-rsa/ openvpn-2.3.4/[root@vpn ~]# cd openvpn-2.3.4/easy-rsa/easyrsa3/[root@vpn easyrsa3]# cp vars.example vars[root@vpn easyrsa3]# vim varsset_var EASYRSA_REQ_COUNTRY "CN"set_var EASYRSA_REQ_PROVINCE "Beijing"set_var EASYRSA_REQ_CITY "Beijing"set_var EASYRSA_REQ_ORG "nmshuishui Certificate"set_var EASYRSA_REQ_EMAIL "353025240@qq.com"set_var EASYRSA_REQ_OU "My OpenVPN"4、创建服务端证书及key（1）初始化123456789[root@vpn easyrsa3]# lseasyrsa  openssl-1.0.cnf  vars  vars.example  x509-types[root@vpn easyrsa3]# [root@vpn easyrsa3]# ./easyrsa init-pki Note: using Easy-RSA configuration from: ./vars init-pki complete; you may now create a CA or requests.Your newly created PKI dir is: /root/openvpn-2.3.4/easy-rsa/easyrsa3/pki（2）创建根证书12345678910111213141516171819202122[root@vpn easyrsa3]# ./easyrsa build-ca Note: using Easy-RSA configuration from: ./varsGenerating a 2048 bit RSA private key.............................................+++........+++writing new private key to '/root/openvpn-2.3.4/easy-rsa/easyrsa3/pki/private/ca.key'Enter PEM pass phrase:                      #输入密码，此密码用途证书签名Verifying - Enter PEM pass phrase:          #确认密码-----You are about to be asked to enter information that will be incorporatedinto your certificate request.What you are about to enter is what is called a Distinguished Name or a DN.There are quite a few fields but you can leave some blankFor some fields there will be a default value,If you enter '.', the field will be left blank.-----Common Name (eg: your user, host, or server name) [Easy-RSA CA]:nmshuishui  #输入一个Common Name CA creation complete and you may now import and sign cert requests.Your new CA certificate file for publishing is at:/root/openvpn-2.3.4/easy-rsa/easyrsa3/pki/ca.crt（3）创建服务器端证书1234567891011121314151617181920[root@vpn easyrsa3]# ./easyrsa gen-req server nopass Note: using Easy-RSA configuration from: ./varsGenerating a 2048 bit RSA private key................................+++......+++writing new private key to '/root/openvpn-2.3.4/easy-rsa/easyrsa3/pki/private/server.key'-----You are about to be asked to enter information that will be incorporatedinto your certificate request.What you are about to enter is what is called a Distinguished Name or a DN.There are quite a few fields but you can leave some blankFor some fields there will be a default value,If you enter '.', the field will be left blank.-----Common Name (eg: your user, host, or server name) [server]:nmshuishui-BJ  #该Common Name一定不要与创建根证书时的                                                                          #Common Name一样，这是血与泪的教训  Keypair and certificate request completed. Your files are:req: /root/openvpn-2.3.4/easy-rsa/easyrsa3/pki/reqs/server.reqkey: /root/openvpn-2.3.4/easy-rsa/easyrsa3/pki/private/server.key（4）签约服务器端证书123456789101112131415161718192021222324252627282930[root@vpn easyrsa3]# ./easyrsa sign server server Note: using Easy-RSA configuration from: ./vars  You are about to sign the following certificate.Please check over the details shown below for accuracy. Note that this requesthas not been cryptographically verified. Please be sure it came from a trustedsource or that you have verified the request checksum with the sender. Request subject, to be signed as a server certificate for 3650 days: subject=    commonName                = nmshuishui  Type the word 'yes' to continue, or any other input to abort.  Confirm request details: yes        #输入yes继续Using configuration from /root/openvpn-2.3.4/easy-rsa/easyrsa3/openssl-1.0.cnfEnter pass phrase for /root/openvpn-2.3.4/easy-rsa/easyrsa3/pki/private/ca.key:    #输入刚才创建根证书时的密码Check that the request matches the signatureSignature okThe Subject's Distinguished Name is as followscommonName            :PRINTABLE:'nmshuishui'Certificate is to be certified until Aug 21 14:18:49 2024 GMT (3650 days) Write out database with 1 new entriesData Base Updated Certificate created at: /root/openvpn-2.3.4/easy-rsa/easyrsa3/pki/issued/server.crt（5）创建Diffie-Hellman，确保key穿越不安全网络的命令：12345678[root@vpn easyrsa3]# ./easyrsa gen-dh Note: using Easy-RSA configuration from: ./varsGenerating DH parameters, 2048 bit long safe prime, generator 2This is going to take a long time...................................................................................................................................................................................................................+..........................................................................................................................+..................................................+.....................................................+..................................................................................................................................+............+............................................................................................................+...+............+...............+..............................................+.........................+..................................+.................+............................................................+..................................+........................................................................................................................................+................................................................+.......................................+...................................................................................................................................................++*++* DH parameters of size 2048 created at /root/openvpn-2.3.4/easy-rsa/easyrsa3/pki/dh.pem5、创建客户端证书（1）在根目录下建立client目录123[root@vpn easyrsa3]# cd[root@vpn ~]# mkdir client[root@vpn ~]# cp -R easy-rsa/ client/（2）初始化123456789[root@vpn ~]# cd client/easy-rsa/easyrsa3/[root@vpn easyrsa3]# lseasyrsa  openssl-1.0.cnf  vars  vars.example  x509-types[root@vpn easyrsa3]# ./easyrsa init-pki Note: using Easy-RSA configuration from: ./vars init-pki complete; you may now create a CA or requests.Your newly created PKI dir is: /root/client/easy-rsa/easyrsa3/pki（3）创建客户端key及生成证书12345678910111213141516171819202122[root@vpn easyrsa3]# ./easyrsa gen-req nmshuishui Note: using Easy-RSA configuration from: ./varsGenerating a 2048 bit RSA private key....................................................+++.................................................................................................................................................................................+++writing new private key to '/root/client/easy-rsa/easyrsa3/pki/private/nmshuishui.key'Enter PEM pass phrase:            #输入密码Verifying - Enter PEM pass phrase:-----You are about to be asked to enter information that will be incorporatedinto your certificate request.What you are about to enter is what is called a Distinguished Name or a DN.There are quite a few fields but you can leave some blankFor some fields there will be a default value,If you enter '.', the field will be left blank.-----Common Name (eg: your user, host, or server name) [nmshuishui]:nmshuishui   #输入nmshuishui                      Keypair and certificate request completed. Your files are:req: /root/client/easy-rsa/easyrsa3/pki/reqs/nmshuishui.reqkey: /root/client/easy-rsa/easyrsa3/pki/private/nmshuishui.key（4）将得到的nmshuishui.req导入并签约证书12345678910111213141516171819202122232425262728293031323334353637383940[root@vpn ~]# cd openvpn-2.3.4/easy-rsa/easyrsa3/[root@vpn easyrsa3]#   #导入req[root@vpn easyrsa3]# ./easyrsa import-req /root/client/easy-rsa/easyrsa3/pki/reqs/nmshuishui.req nmshuishui Note: using Easy-RSA configuration from: ./vars The request has been successfully imported with a short name of: nmshuishuiYou may now use this name to perform signing operations on this request. [root@vpn easyrsa3]#     #签约证书[root@vpn easyrsa3]# ./easyrsa sign client nmshuishui Note: using Easy-RSA configuration from: ./vars  You are about to sign the following certificate.Please check over the details shown below for accuracy. Note that this requesthas not been cryptographically verified. Please be sure it came from a trustedsource or that you have verified the request checksum with the sender. Request subject, to be signed as a client certificate for 3650 days: subject=    commonName                = nmshuishui  Type the word 'yes' to continue, or any other input to abort.  Confirm request details: yes       #输入yesUsing configuration from /root/openvpn-2.3.4/easy-rsa/easyrsa3/openssl-1.0.cnfEnter pass phrase for /root/openvpn-2.3.4/easy-rsa/easyrsa3/pki/private/ca.key:    #输入创建根证书时的密码Check that the request matches the signatureSignature okThe Subject's Distinguished Name is as followscommonName            :PRINTABLE:'nmshuishui'Certificate is to be certified until Aug 21 12:49:40 2024 GMT (3650 days) Write out database with 1 new entriesData Base Updated Certificate created at: /root/openvpn-2.3.4/easy-rsa/easyrsa3/pki/issued/nmshuishui.crt   #签约成功（5）服务端及客户端生成的文件
服务端：（/root/openvpn-2.3.4/easy-rsa/easyrsa3/pki）文件夹12345678/root/openvpn-2.3.4/easy-rsa/easyrsa3/pki/ca.crt/root/openvpn-2.3.4/easy-rsa/easyrsa3/pki/reqs/server.req/root/openvpn-2.3.4/easy-rsa/easyrsa3/pki/reqs/qingliu.req/root/openvpn-2.3.4/easy-rsa/easyrsa3/pki/private/ca.key/root/openvpn-2.3.4/easy-rsa/easyrsa3/pki/private/server.key/root/openvpn-2.3.4/easy-rsa/easyrsa3/pki/issued/server.crt/root/openvpn-2.3.4/easy-rsa/easyrsa3/pki/issued/qingliu.crt/root/openvpn-2.3.4/easy-rsa/easyrsa3/pki/dh.pem客户端：（/root/client/easy-rsa）12/root/client/easy-rsa/easyrsa3/pki/private/nmshuishui.key/root/client/easy-rsa/easyrsa3/pki/reqs/nmshuishui.key   #这个文件被我们导入到了服务端文件，所以那里也有（6）拷贝服务器密钥及证书等到openvpn目录1234[root@vpn ~]# cp openvpn-2.3.4/easy-rsa/easyrsa3/pki/ca.crt openvpn-2.3.4/[root@vpn ~]# cp openvpn-2.3.4/easy-rsa/easyrsa3/pki/private/server.key openvpn-2.3.4/[root@vpn ~]# cp openvpn-2.3.4/easy-rsa/easyrsa3/pki/issued/server.crt openvpn-2.3.4/[root@vpn ~]# cp openvpn-2.3.4/easy-rsa/easyrsa3/pki/dh.pem openvpn-2.3.4/（7）拷贝客户端密钥及证书等到client目录123[root@vpn ~]# cp openvpn-2.3.4/easy-rsa/easyrsa3/pki/ca.crt /root/client [root@vpn ~]# cp openvpn-2.3.4/easy-rsa/easyrsa3/pki/issued/nmshuishui.crt /root/client[root@vpn ~]# cp /root/client/easy-rsa/easyrsa3/pki/private/nmshuishui.key /root/client（8）为服务端编写配置文件当安装好openvpn时候，它会提供一个server配置的文件例子1/root/openvpn-2.3.4/sample/sample-config-files/server.conf将此例子拷贝openvpn目录，然后配置123456789101112131415161718192021[root@vpn ~]# cp openvpn-2.3.4/sample/sample-config-files/server.conf openvpn-2.3.4/[root@vpn ~]# vim openvpn-2.3.4/server.conflocal 192.168.1.104    #（自己vps IP）port 1194proto udpdev tunca /root/openvpn-2.3.4/ca.crtcert /root/openvpn-2.3.4/server.crtkey /root/openvpn-2.3.4/server.key # This file should be kept secretdh /root/openvpn-2.3.4/dh.pemserver 10.8.0.0 255.255.255.0ifconfig-pool-persist ipp.txtpush "redirect-gateway def1 bypass-dhcp"push "dhcp-option DNS 8.8.8.8"keepalive 10 120comp-lzomax-clients 100persist-keypersist-tunstatus openvpn-status.logverb 3（9）开启系统转发功能12345[root@vpn ~]# vim /etc/sysctl.confnet.ipv4.ip_forward = 0  改成 net.ipv4.ip_forward = 1[root@vpn ~]# sysctl -p[root@vpn ~]# sysctl -a | grep net.ipv4.ip_forwardnet.ipv4.ip_forward = 1（10）封装出去的数据包（eth0是你的vps外网的网卡）：1/sbin/iptables -t nat -I POSTROUTING -s 10.8.0.0/255.255.255.0 -o eth0 -j MASQUERADE三、下载openvpn客户端，并进行配置1、将客户端密钥及证书等拷出到windows备用123[root@vpn ~]# cd client/[root@vpn client]# lsca.crt  easy-rsa  nmshuishui.crt  nmshuishui.key    #带后缀的这三个2、安装openvpn-gui工具
（1）将D:\Program Files (x86)\OpenVPN\sample-config\client.ovpn复制到D:\Program Files (x86)\OpenVPN\config（2）将从linux中拷贝出来的三个密钥及证书放到D:\Program Files (x86)\OpenVPN\config下（3）编辑D:\Program Files (x86)\OpenVPN\config\client.ovpn，修改为12345678910111213clientdev tunproto udpremote 192.168.1.104 1194resolv-retry infinitenobindpersist-keypersist-tunca ca.crt //这里需要证书cert nmshuishui.crtkey nmshuishui.keycomp-lzoverb 3

admin

   1.2 准备 OpenVPN 安装目录
" R" f5 r5 y/ ^% ~( Q  u( ^
; m9 i0 F0 D: n$ J" O- I1 h6 s, Y# q        因为此文件是使用源码安装,所以选择的程序安装目录为: /usr/local/openvpn 目录, 配置文件目录为/etc/openvpn 目录

4 I8 ^, Q+ H7 u3 w        程序目录: /usr/local/openvpn

        配置目录: /etc/openvpn

1 o) z2 ?; ]' L5 T0 P2. 开始安装 OpenVPN

( h" P  i/ F4 @+ f1 x   2.1 编译 OpenVPN

        [root@client ~]#cd /home/src/openvpn

$ T9 x1 f9 d0 z% [( J0 K        [root@client openvpn]#tar zxvf lzo-2.03.tar.gz
' n! K! r$ F5 k1 G6 e
        [root@client openvpn]#cd lzo-2.03

        [root@client lzo-2.03]#./configure && make && make install

  W( u. `7 U( y! t/ W! Z6 ^        编辑/etc/ld.so.conf
0 q' e1 B8 q; j: s- A- s5 |
        [root@client lzo-2.03]#cat >> /etc/ld.so.conf << EOF
" @! G2 _% ^3 E
          /lib

          /lib64
5 W5 |9 s% T  A! @* ~3 A/ w9 \
          /usr/lib

          /usr/lib64
: @* R+ q2 L9 F3 r
          /usr/local/lib
3 ~7 L/ S3 ^8 t6 @' T( g/ Q0 @
! U" D6 U3 {1 P          /usr/local/lib64

- s: b8 U$ Q: R          EOF
# Q5 x9 n* k1 A
        编辑完后运行
( {& I& T7 O7 K% v$ ?7 X: w0 T
9 u6 n' ]/ h4 G0 f. S        [root@client lzo-2.03]#ldconfig
$ I7 d( P+ y7 }- j$ B. b( ^
        使动态连接库文件生效,接下来编译 openvpn

& B  A4 r, K+ o; W        [root@client openvpn]# tar zxvf openvpn-2.0.9.tar.gz
8 z$ o! z9 m: D# y
  H* y$ b1 J+ T4 w( A9 M* j: F& C& e        [root@client openvpn]# cd openvpn-2.0.9
8 ~) F! i% U8 q% T8 L" W4 Y4 V8 C
        [root@client openvpn-2.0.9]# ./configure –prefix=/usr/local/openvpn && make && make install

        [root@client openvpn-2.0.9]#tree /usr/local/openvpn
5 T  r. U" p5 w2 T9 Q% m  y! N6 x
3 `& I# h8 l6 ^6 v) L* q' u/ U        应该有以下输出
! r7 w; d: H8 `
* F! B1 j+ K6 ?8 B, T        [root@client ~]# tree /usr/local/openvpn/

( ^' K: L' x3 E( t/ t1 e- [7 q. n, F8 e& F        /usr/local/openvpn/
& x& F( i7 C/ v2 i. F
/ `5 J7 n0 k: a* _1 ^        |-- man
/ M% M4 d+ X& L9 ^
5 t" c8 g$ @2 r2 a% M8 B( [  P0 E        | `-- man8
0 F3 c2 i0 F* S! u+ H! P" x
        |      `-- openvpn.8
2 o& ^5 l4 U. |. W
6 M3 V/ U. q# b3 D        `-- sbin
  Y4 Y/ r! i7 E6 Y* `
        |-- key

        `-- openvpn

, ?2 S# U0 t9 s. m! j+ f        3 directories, 3 files

$ O( l% M) \" I" R* r) y2 w% M3. 配置的 OpenVPN Server

   3.1 建立配置环境
' e4 {0 a8 G1 J+ g/ Y3 R
' V8 |/ e+ L7 H       [root@client ~]# mkdir -p /etc/openvpn
5 o" u1 V1 x& m# }/ v2 A8 t& v
: ^3 \1 X% e/ T2 z; f: ]) F       [root@client ~]# cp -R /home/src/openvpn/openvpn-2.0.9/easy-rsa /etc/openvpn
0 H, q4 F% S. j% k0 _6 E
       [root@client ~]# cd /etc/openvpn/easy-rsa/2.0/

       此目录下以许多程序及脚本, 以下为使用到的程序及脚本说明
/ m) |& N9 |) `$ n2 z) U8 h
$ y3 |, }# \" N3 z& a       vars                  脚本, 是用来创建环境变量,设置所需要要的变量的脚本
- p. O1 g2 E% H9 u, S) [9 c
- g8 p8 l; ^3 ?+ e0 U- T2 b" e       clean-all             脚本,是创建生成 ca 证书及密钥文件所需要的文件及目录

/ c/ R4 a8 R. \* [    build-ca           脚本, 生成 ca 证书(交互)
& O7 I5 ~4 ]: v% J! o( J
    build-dh           脚本, 生成 Diffie-Hellman 文件(交互)
; b& b2 V8 r8 k' g0 j1 p
* x& K. R4 g3 c2 n    build-key-server   脚本, 生成服务器端密钥(交互)

: k  q# b+ H6 `9 l    build-key          脚本, 生成客户端密钥(交互)

. ?! K- z# n5 b# w0 N' R2 Q$ O    pkitool            脚本, 直接使用 vars 的环境变量设置, 直接生成证书(非交互)
/ [7 n. f5 k) a; N
$ Y, P# q- _  z* L: b3.2 生成 CA 证书及密钥[注意字符输入不要出错]

8 i* b3 F4 ?% R* z    [root@client 2.0]# . ../vars

    [root@client 2.0]# chmod +rwx *
- E- N$ r% j* N' F* H1 N$ s9 y' q
9 `) {/ U3 x6 I8 Y    初始化 keys 目录,创建生成 ca 证书及密钥文件所需要的文件和目录

    [root@client 2.0]# ./clean-all

  X( }: _. H; Q( l  [) c3 g   编辑 vars 文件,生成环境变量, vars 里的参数根据自己需要改变.
6 a4 m! O& I$ M
   export KEY_SIZE=1024                     #生成密钥的位数
2 E  k% C- t* I9 J7 K
   export KEY_COUNTRY=CN                    #定义所在的国家编码, 2 个字符

   export KEY_PROVINCE=BeiJing              #定义所在的省份
" e* x( E3 o- A! g- r
& X' c* t( O1 B0 V$ m   export KEY_CITY=BeiJing                  #定义所在的城市

& Y2 s  j% ?( }0 i1 y% q   export KEY_ORG=”VPN Test org”            #定义所在的组织

   export KEY_OU=”VPN COM”                  #定义所在的单位
! w6 H7 f! T: \1 j- b; [1 ]
4 n- J4 Z1 L) P   export KEY_EMAIL=”china.client@gmail.com” #定义你的邮件地址
3 ^, @" M  k( r" v" b8 c5 b* ^
    修改好 vars 文件后就可以开始生成 ca 证书及密钥文件了!
6 r) ^2 N: V) ^! h+ {7 ?' J  Z
* t5 R' {! ]% }    [root@client 2.0]# source ./vars

    生成 Root Ca 证书, 用于签发 Server 和 Client 证书
  z, O5 H$ Z9 \1 }' z5 S
    [root@client 2.0]#./build-ca

5 f9 O0 b6 I) o$ z    [root@client 2.0]# ls keys
, \  L* \8 p9 M/ N  g- p2 k" \
6 Z+ L9 W5 I% g) W1 x" H2 p& g7 B    可以看到已经生成了 ca.crt ca.key 文件

2 e. d% W* G9 Z+ A/ w/ t9 [    生成 Diffie-Hellman 文件
1 H( X9 y1 \# B7 @
* A& l* ?1 {  r& e# g) U3 B    [root@client 2.0]#./build_dh
- Z* d; a9 i  Q+ Y& g4 r2 U
0 s2 m+ ^, H" |% R: c    [root@client 2.0]#ls -l keys/dh2048.pem

    可以看到生成了 2048 位的 Diffie-Hellman 文件

    生成服务器使用的 VPN server Ca 证书

    [root@client 2.0]#./build-key-server server

    server 是你为 CA 证书起的一个名字, 以 server 名字为例,生成的服务器使用的 CA 证书文件为: server.crt server.key

9 z4 Y9 y  ]3 m    将生成的 CA 证书及密钥拷贝到/etc/openvpn 下

    [root@client 2.0]#cp keys/{ca.crt,ca.key,server.crt, server.key, dh2048.pem} /etc/openvpn/

3.3 生成客户端 CA 证书及密钥
3 Q% _/ r+ p# A, `9 Q& @+ X
$ X' X9 ~4 p/ s8 I& {    生成客户端 CA 证书及密钥使用:build-key 程序即可

  ?* q( d' M- }- f. @0 T. O, [    [root@client 2.0]#./build-key client

4 A* [5 l$ x6 k# R$ e9 I8 t& V+ F    将在 keys 目录下生成 client.crt client.csr client.key 三个客户端证书

    将 ca.crt ca.key client.crt client.csr client.key 五个文件打包,以备客户端 vpn 使用

: r' Q! ~& n+ S    [root@client2.0]#tar zcvf client.vpn.key.tar.gz keys/{ca.crt,ca.key,client.crt,client.csr,client.key}

3.4 生成 openvpn 配置文件
* _  S7 s% f* g2 Y, ^) n0 p
    创建 openvpn 配置文件最好的方法是先看 openvpn 的样例文件,在源码目录下的 sample-config-files 下,本例为
3 @/ P0 k. W4 W% U4 E8 d; f1 N
    /home/src/openvpn/openvpn-2.0.9/sample-config-files

    服务器端配置文件名: server.conf

! ?7 z# B* n. N7 B# ]    客户端配置文件名为: client.conf

    可以根据需要修改.
" I; Q/ r$ H, R
7 `$ ?( i& c2 f3 f- x5 _- I    本例的配置文件 为:/etc/openvpn/openvpn.conf
, i; }* U9 s& b. m' r& m! ]# X
     #########################################################################

     port 1723 #openvpn 默认端口为 1194
* H# P9 G  P! N9 p2 ?
     proto tcp

# t/ p+ ]: O9 E7 G       dev tun
  t* z3 q/ I# e) c6 Y4 u- H4 G
       #########################################################################
7 k) s7 O; k" G9 A
       # ca 证书及服务器证书以所在的文件目录为准,本例是放在了/etc/openvpn 目录下,与配置文件相同目录

       #########################################################################
' O; V- W7 I2 e9 F- B
$ F' [( r. [8 G       ca ca.crt
; E, C6 @5 i: C5 d& ?% ?7 n$ ?
6 V) C4 W4 ?0 G! [$ M  u       cert server.crt
5 N) [" U" K3 S) R( [
       key server.key

       dh dh2048.pem

) d  b( \1 i+ R8 Y7 o* V& f       server 172.16.0.0 255.255.0.0
( a) ~0 k4 m! m$ z
       push "dhcp-option DNS 202.106.0.20"
+ K4 h" z3 n& U* j, v9 X- C
: M5 o1 S' L9 m" k5 h6 }: W% g       push "dhcp-option DNS 168.210.2.2"
: i1 T) \. }. ^' a2 x: H' B$ z( g
) q* Y1 n2 F" o7 _( J( X' @. |7 L       push "route 172.16.0.0 255.255.0.0"

       ifconfig-pool-persist ipp.txt
7 d6 ^7 _; O( T2 ?4 V& F
& f) u' \1 I$ F( t" u, {7 C       keepalive 10 120
/ J! p, h9 N( Z4 k
2 a2 @& \0 p6 k       comp-lzo
9 f) n# q% ^5 p6 Z1 ]
       user nobody
4 u( v# ~4 p7 K9 l
       group nobody

/ R, _. ^6 l) p2 M8 n# k       persist-key

1 \2 q# _. X5 J2 ^: N+ }1 a' m) K5 q       persist-tun

9 i* a) E1 p. u, I! P6 @4 ?- H       status /var/log/openvpn-status.log

       verb 3

       #Client 之间可以相互访问

. j2 O2 m$ s: K; S       client-to-client
: p) p6 n2 ~2 c' r
       #允许一个用户多次访问
% J9 \. B' B- }. s
       duplicate-cn

       log /var/log/openvpn.log
* \; i; i% i* p9 }% u$ n4 j
       log-append /var/log/openvpn.log

7 c. }# D5 s4 d6 l       #########################################################################

5 ^9 _/ t. ?' l. l/ _  3.5 创建 openvpn 的启动脚本

+ N7 w. Y7 r. m8 O: D      openvpn 的启动脚本在源码目录: sample-scripts 目录下
9 ?1 g$ w2 X3 V
      文件名为: openvpn.init
4 `# z* C$ b* F, |  Z9 v( A$ B
      将 openvpn.ini 拷贝到/etc/init.d 下,并重新命名为 openvpn

      [root@client ~]#cp -f /home/src/openvpn/openvpn-2.0.9/sample-scripts/openvpn.init /etc/init.d/openvpn

      因为是用源码编译安装并指定了目录,所以需要修改/etc/init.d/openvpn 的 69 行
! ]2 L; i: K' \. {
' e, |0 J0 j- R, [       openvpn_locations="/usr/sbin/openvpn /usr/local/sbin/openvpn"
  W6 k3 T9 j9 A
1 g8 }3 y8 {7 _: r      修改为:

        openvpn_locations="/usr/local/openvpn/sbin/openvpn /usr/sbin/openvpn /usr/local/sbin/openvpn"
+ q+ E5 b0 y9 J7 ~
9 t' A# [4 h3 N9 i. [' z7 T# ?  T  3.6 将 openvpn 添加到系统自启动
4 u/ t- I( N, K/ h* i5 r
2 f& e/ C; a2 }. c  ^) G      [root@client ~]# chkconfig –add openvpn

0 C$ g8 F1 I& B# c9 [. Y- j: ]  3.7 启动/停止 openvpn 服务
# v0 F/ [0 x) e/ x- W, s$ T
         启动 openvpn 服务

% A4 l/ g) k8 y: R0 g         [root@client ~]#service openvpn start
8 ~* F$ @6 O) ^# @2 B
         停止 openvpn 服务

         [root@client ~]#service openvpn stop

admin

安装 LZO 代码:
cd /lzo-2.02
./configure
) B, c9 t4 p6 A, f- m+ r$ U/ emake
5 {3 p4 Q: S* K7 Qmake check
0 v2 f  A* r5 i3 U  ]make install
2 T6 Y; S0 X9 y6 w$ Y5 X; \; U. f安装 OpenVPN
代码:

cd /openvpn-2.0.5
( d9 |# E# F, ]+ B9 p( i./configure
# ?/ H6 Q. ?- p# b: I* L% n1 E# 或用指定dir: (注:下述命令, 应该在一行写完. 为了方便显示, 这里分成了四行)
# ./configure --with-lzo-headers=/usr/local/include
+ [- q% Q( z  `6 {#  --with-lzo-lib=/usr/local/lib
#  --with-ssl-headers=/usr/local/include/openssl
#  --with-ssl-lib=/usr/local/lib
9 `, v/ e& z+ U* S" B$ Qmake
$ u9 N1 w, C( k. fmake install
9 R% s( w' G8 C8 V' k% C4 S) k生成证书Key
! b4 N2 ]% k% e% ?6 [8 m. [! ^4 q初始化 PKI

+ B8 a: F- E, |; ?7 W( s(如果没有 export 命令也可以用 setenv [name] [value] 命令)
4 I! K1 w5 T1 t* e
) D8 S* e' k9 E8 @代码:
  D  ]) c, \% e: f5 l* |  [$ L& T) E
/ O9 w: S& u0 G+ N  c% o$ D" ocd /openvpn-2.0.5/easy-rsa
( l  ~8 a% ^" O6 Eexport D=`pwd`
# }9 Y, {* ~' k' a+ }export KEY_CONFIG=$D/openssl.cnf
' ?9 j2 D/ {2 b1 {* }export KEY_DIR=$D/keys
  D$ M6 q$ t- Z) c4 Y$ cexport KEY_SIZE=1024
export KEY_COUNTRY=CN
" ~* G* ~; _9 v6 L1 T5 Pexport KEY_PROVINCE=GD
export KEY_CITY=SZ
2 n5 m8 d% b0 |9 `- n' hexport KEY_ORG="xiaohui.com"
! u% ^6 I5 j5 {( |2 s2 ]export KEY_EMAIL="your-email [at] xiaohui.com"
Build:
& A% z, H; k- |; N代码:
6 j7 t$ u0 v! j
- E5 B0 i4 N9 z" P./clean-all
, w% G* }3 _2 U./build-ca
; d! L& i: `& w1 I3 ^$ `' N+ u
& ~0 R2 k9 ?9 I* H: D" A4 D7 XGenerating a 1024 bit RSA private key
................++++++
% T$ \. l" {# l" F8 I5 y........++++++
writing new private key to 'ca.key'
% J* K1 T/ I* |$ P-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
7 D. }0 a! C5 `+ q, q; {% @For some fields there will be a default value,
If you enter '.', the field will be left blank.
# x2 S6 T' K' w+ J. L% Z4 H6 ?& O- A-----
$ ]  U6 t( Z! n  j& b0 b; LCountry Name (2 letter code) [CN]:
State or Province Name (full name) [GD]:
9 K5 p6 L* W# K0 r4 K* f' wLocality Name (eg, city) [SZ]:
Organization Name (eg, company) [xiaohui.com]:
# a- `6 f, P; r0 ?6 d; wOrganizational Unit Name (eg, section) []:xiaohui.com
Common Name (eg, your name or your server's hostname) []:server
8 ~  l8 Q- n1 MEmail Address [your-email [at] xiaohui.com]:
5 R+ G% ^6 n. o# 建立 server key 代码: 代码:
! k' ?7 v$ w5 s& m5 D- W./build-key-server server
" P  i$ K+ b! r% L1 Q, N4 I2 C
; i& f7 T2 Q' m% `5 M+ \" E# eGenerating a 1024 bit RSA private key
0 u7 [) q# z, [! t  t- \6 d......++++++
# x- ^+ d! p* s$ i# p* i  y7 u....................++++++
writing new private key to 'server.key'
7 B" |0 p) h9 d0 i4 u-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
6 Q- e0 p( P. d2 y# C3 \- h% kThere are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
6 ]: q1 ~# a0 L0 }# H9 V) P- D) M4 h-----
4 D7 q& [* n3 p: ?Country Name (2 letter code) [CN]:
8 a+ N1 G2 R* m9 C. P% }State or Province Name (full name) [GD]:
Locality Name (eg, city) [SZ]:
0 e: h) ^; N; `+ t/ n# w8 m* GOrganization Name (eg, company) [xiaohui.com]:
: r' T6 n# p( Y) d! FOrganizational Unit Name (eg, section) []:xiaohui.com
/ v+ P9 T* v5 }9 `1 ^0 G1 \Common Name (eg, your name or your server's hostname) []:server
; d% F- Q$ p2 D) N& ^' _Email Address [your-email [at] xiaohui.com]:

0 p5 [8 [3 N4 M4 S8 dPlease enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:abcd1234
$ Q* |; J; P) N+ BAn optional company name []:xiaohui.com
Using configuration from /openvpn-2.0.5/easy-rsa/openssl.cnf
& S# h8 q) G9 m3 F( y3 i* BCheck that the request matches the signature
/ |$ P0 ^9 d/ {, ]5 C% R! }& ~Signature ok
The Subject's Distinguished Name is as follows
& ^% [, b2 g- C" `2 ~9 I/ EcountryName           :PRINTABLE:'CN'
stateOrProvinceName   :PRINTABLE:'GD'
localityName          :PRINTABLE:'SZ'
2 p7 Q+ r# d8 W* S( U% v0 H5 v5 C+ |organizationName      :PRINTABLE:'xiaohui.com'
organizationalUnitName:PRINTABLE:'xiaohui.com'
# D% b9 }3 {  t' [) Z. g% PcommonName            :PRINTABLE:'server'
' }7 W8 h1 w; S8 C0 K# \emailAddress          :IA5STRING:'your-email [at] xiaohui.com'
3 e2 P9 s/ h  ^Certificate is to be certified until Mar 19 08:15:31 2016 GMT (3650 days)
Sign the certificate? [y/n]:y

$ s; h) E2 @+ J! x
1 out of 1 certificate requests certified, commit? [y/n]y
$ \+ ^2 Z8 s& E) }' H: C/ GWrite out database with 1 new entries
3 u+ F- D) D0 B6 ~) {Data Base Updated
, v7 ]5 c/ S7 G7 c. Q2 R/ r$ i8 G#生成客户端 key

4 l+ Z6 \' I0 y' b$ j代码:
4 M1 J7 Z5 F) E( R
, U: _, v: ^8 g& g' [./build-key client1
0 N4 ]$ L6 N3 F8 J( QGenerating a 1024 bit RSA private key
.....++++++
......++++++
, p. t, k/ p  k8 i3 |# G9 awriting new private key to 'client1.key'
-----
% E3 z8 e8 G0 s( {You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
( `5 e) \' J: G0 uFor some fields there will be a default value,
7 ]  [  _* G; Q9 ^: w; m0 _4 |  AIf you enter '.', the field will be left blank.
; b3 S% O( H6 F. s-----
Country Name (2 letter code) [CN]:
7 ], i2 ^3 F+ H$ @State or Province Name (full name) [GD]:
2 R6 C5 |4 f5 NLocality Name (eg, city) [SZ]:
Organization Name (eg, company) [xiaohui.com]:
Organizational Unit Name (eg, section) []:xiaohui.com
Common Name (eg, your name or your server's hostname) []:client1    #重要: 每个不同的 client 生成的证书, 名字必须不同.
Email Address [your-email [at] xiaohui.com]:

Please enter the following 'extra' attributes
to be sent with your certificate request
7 l) Y$ h6 b7 |A challenge password []:abcd1234
An optional company name []:xiaohui.com
Using configuration from /openvpn-2.0.5/easy-rsa/openssl.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
5 b* `1 `4 C) E+ L/ {countryName           :PRINTABLE:'CN'
stateOrProvinceName   :PRINTABLE:'GD'
localityName          :PRINTABLE:'SZ'
1 Y) }4 j5 V/ a5 morganizationName      :PRINTABLE:'xiaohui.com'
organizationalUnitName:PRINTABLE:'xiaohui.com'
" i  L+ {8 z- D+ [commonName            :PRINTABLE:'client1'
emailAddress          :IA5STRING:'your-email [at] xiaohui.com'
Certificate is to be certified until Mar 19 08:22:00 2016 GMT (3650 days)
! j; |. J) w& K7 d2 wSign the certificate? [y/n]:y

9 r1 d0 V' a* k: J
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
依次类推生成其他客户端证书/key
  T( C$ y: z: F8 Y8 S( A4 y* D
代码:

! Q+ r# A/ e7 k$ X  Y./build-key client2
./build-key client3
% ~6 X: w0 X2 h" S注意在进入 Common Name (eg, your name or your server's hostname) []: 的输入时, 每个证书输入的名字必须不同.
生成 Diffie Hellman 参数 。代码:
" H, _' ?; I6 S. o) m./build-dh
将 keys 下的所有文件打包下载到本地
代码:
$ R; ~3 |1 k0 F# K
1 G* i# S2 c+ x- s" s* g1 Ztar -cf mykeys.tar /openvpn-2.0.5/easy-rsa/keys
! |$ d5 _! M* d' I8 {8 kcp mykeys.tar /home/xiaohui.comsys/public_html/mykeys.tar
' k7 H' M7 v" s/ I) e1 p将 mykeys.tar 移到 web public(绝对路径因人而异) 上, 然后用 http://www.a.com/mykeys.tar 方式将其下载到本地保存, 然后将其从server删除: 代码:
2 X" q4 |7 I8 X. \# H5 u8 ]7 p5 Grm /home/xiaohui.comsys/public_html/mykeys.tar
  `7 ]0 g9 o. @* A1 l也可以用其他方法把 key file搞到本地，例如 ftp.
创建服务端配置文件
从样例文件创建:
) n6 w; `  L3 P, d, ^+ I
代码:

cd $dir/sample-config-files/ # 进入源代码解压目录下的sample-config-files子目录
3 j) a0 _% p: Q. K5 U4 Ccp server.conf /usr/local/etc  # cp服务器配置文件到/usr/local/etc
$ |0 q( Y; m8 u  N" l7 }0 P9 A+ wvi /usr/local/etc/server.conf
4 M" {$ f- _. x8 T我建立的server.conf 的内容稍后另附.
创建客户端配置文件
代码:

cd $dir/sample-config-files/  #进入源代码解压目录下的sample-config-files子目录
$ K3 j. G: \( }- {" _: ?# e, \cp client.conf /usr/local/etc  #cp客户端配置文件到/usr/local/etc
vi /usr/local/etc/client.conf
我建立的client.conf 的内容稍后另附.
0 }* V' P2 \8 l& Y2 f7 C启动Openvpn: openvpn [server config file] 代码:
! ~9 A  z' V  L: N9 r  c0 {/usr/local/sbin/openvpn --config /usr/local/etc/server.conf
" q3 D4 r) L% E8 f8 Z4 B0 {

admin

二、部署openvpn

    本次部署openvpn服务器，因为使用了最新的openvpn2.3.4，而这个包里面没有包含最重要的证书制作部分：easy-rsa
4 o  o2 b9 O2 r6 Y! ^' r/ w) v
    openvpn官网也给出明确说明：Starting with openvpn-2.3_alpha2 easy-rsa is no longer part of the OpenVPN source or binary packages
/ G+ [; d2 o) }  U6 d; v
    所以，我们需要事先下载好easyrsa，可以到GitHub上进行下载，配置过程将在下面第3步进行，本次部署使用了easy-rsa3，与easy-rsa2.0的操作完全不同，网上其它关于easy-rsa2.0的教程不适合本次部署

% f# j9 k( A$ a. F" _. t1 _    在部署openvpn之前，最好用ntpdate同步一下服务器的时间，否则生成证书的时间也不准确，会造成那个什么centificate error等的错误！
+ f+ s" n; R; m7 V" W4 M
; C9 O/ D' n9 {  ?. [' U% h+ W1、安装lzo

" K; @6 u. e) D' t1 ~0 f    lzo是致力于解压速度的一种数据压缩算法


, v3 r7 |/ [- o% H: E2 j[root@vpn ~]# tar xf lzo-2.08.tar.gz
[root@vpn ~]# cd lzo-2.08
2 O" p' w  U" `$ u/ I3 [" V$ D[root@vpn lzo-2.08]# ./configure && make && make install
: ?4 W' V! S( K4 p  a2、安装openvpn
6 m/ s3 S; L4 Y, X! ^, J

[root@vpn ~]# tar xf openvpn-2.3.4.tar.gz
. k0 A7 H1 c$ o' A, d/ p& b[root@vpn ~]# cd openvpn-2.3.4
[root@vpn openvpn-2.3.4]# ./configure --with-lzo-headers=/usr/local/include/ --with-lzo-lib=/usr/local/lib
/ V% a# X6 \; G, G/ A, G[root@vpn openvpn-2.3.4]# make && make install
[root@vpn openvpn-2.3.4]#
6 `2 p5 f. s- }% c% y[root@vpn openvpn-2.3.4]# which openvpn
/usr/local/sbin/openvpn      #看到这里，说明安装openvpn成功
3、配置easyrsa服务端
7 C. L6 P$ U) W7 I5 [0 H0 \+ I. ^! O
    openvpn-2.3.4软件包不包含证书（ca证书，服务端证书，客户端证书）制作工具，所以还需要单独下载easy-rsa，最新的为easy-rsa3
: K8 _% c( B( G9 K
0 S2 p' x  }( i8 q    Starting with openvpn-2.3_alpha2 easy-rsa is no longer part of the OpenVPN source or binary packages（来源openvpn官网）

+ _: S1 d2 u6 z
[root@vpn ~]# unzip easy-rsa-master.zip
[root@vpn ~]# mv easy-rsa-master easy-rsa
* z, @" X. I3 b6 F* O* ]% ]6 Y[root@vpn ~]# cp -R easy-rsa/ openvpn-2.3.4/
, }- i; V/ x& P. X- W; G) W% G[root@vpn ~]# cd openvpn-2.3.4/easy-rsa/easyrsa3/
8 Q0 S; i' c6 C[root@vpn easyrsa3]# cp vars.example vars
[root@vpn easyrsa3]# vim vars
$ J' ?6 d2 v3 a1 hset_var EASYRSA_REQ_COUNTRY "CN"
set_var EASYRSA_REQ_PROVINCE "Beijing"
. o, B5 V2 M( `+ y( B4 mset_var EASYRSA_REQ_CITY "Beijing"
9 U' i. B. B1 m8 d3 Kset_var EASYRSA_REQ_ORG "nmshuishui Certificate"
set_var EASYRSA_REQ_EMAIL "353025240@qq.com"
% d1 ]2 y8 Q9 t- ]set_var EASYRSA_REQ_OU "My OpenVPN"
4 |2 ^! z1 O% r, y: O  a0 T4、创建服务端证书及key
. j7 |& b% S0 f8 e& l4 V4 \2 j
0 w, c4 \& F! }/ [# X（1）初始化


: u/ Y; Y: g1 l. j' N0 Y[root@vpn easyrsa3]# ls
easyrsa  openssl-1.0.cnf  vars  vars.example  x509-types
[root@vpn easyrsa3]#
+ p! ^6 J7 L6 M; |% r# x& o1 B/ d# b[root@vpn easyrsa3]# ./easyrsa init-pki

Note: using Easy-RSA configuration from: ./vars

init-pki complete; you may now create a CA or requests.
% n% f$ ?6 o! t8 g9 O1 x8 V1 ?4 FYour newly created PKI dir is: /root/openvpn-2.3.4/easy-rsa/easyrsa3/pki
# l/ q+ G% z9 X! L（2）创建根证书

$ Z; y2 ~; M" v
% |2 e/ p4 S, ^7 E7 O1 Z4 g
; `2 L# o' Z+ m2 U2 \  G[root@vpn easyrsa3]# ./easyrsa build-ca

Note: using Easy-RSA configuration from: ./vars
* L1 _' E3 Y. A* ~2 ]2 Q/ ]: TGenerating a 2048 bit RSA private key
% p2 }9 X( ]9 j6 r2 l.............................................+++
& @- h) {/ Y- G7 x........+++
/ }  ]2 Z' M+ B- F4 u! awriting new private key to '/root/openvpn-2.3.4/easy-rsa/easyrsa3/pki/private/ca.key'
% B4 X% D% C. ~0 ZEnter PEM pass phrase:                      #输入密码，此密码用途证书签名
Verifying - Enter PEM pass phrase:          #确认密码
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
6 U1 x4 G5 l0 CWhat you are about to enter is what is called a Distinguished Name or a DN.
( t6 n3 n1 z3 G+ MThere are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
3 w3 M; }2 `/ b2 \-----
Common Name (eg: your user, host, or server name) [Easy-RSA CA]:nmshuishui  #输入一个Common Name

+ z3 J/ N1 p' f$ r4 s& }/ O) w1 X/ X9 PCA creation complete and you may now import and sign cert requests.
Your new CA certificate file for publishing is at:
/root/openvpn-2.3.4/easy-rsa/easyrsa3/pki/ca.crt
: l3 l) W6 a0 T5 d- h（3）创建服务器端证书


[root@vpn easyrsa3]# ./easyrsa gen-req server nopass

( I5 z8 z! d2 L# H  RNote: using Easy-RSA configuration from: ./vars
Generating a 2048 bit RSA private key
4 l. W2 V( _+ u1 R4 Q) y................................+++
0 O. O) [6 s, C8 r# |4 c8 Q......+++
4 J/ W, J; D. N: e$ Dwriting new private key to '/root/openvpn-2.3.4/easy-rsa/easyrsa3/pki/private/server.key'
-----
1 q, P2 p  |# f* x" lYou are about to be asked to enter information that will be incorporated
* j# r2 l9 D* m9 G8 `7 ginto your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
! J, B: b/ w5 B- g3 J  t& ZThere are quite a few fields but you can leave some blank
For some fields there will be a default value,
6 O  |- \% p5 |* F0 {6 ]If you enter '.', the field will be left blank.
-----
Common Name (eg: your user, host, or server name) [server]:nmshuishui-BJ  #该Common Name一定不要与创建根证书时的
                                                                          #Common Name一样，这是血与泪的教训  
; u& J0 }8 n0 DKeypair and certificate request completed. Your files are:
# ?+ \& x# K( f  t1 h* p! k* [req: /root/openvpn-2.3.4/easy-rsa/easyrsa3/pki/reqs/server.req
$ g3 y' `/ m4 O0 v7 b% ekey: /root/openvpn-2.3.4/easy-rsa/easyrsa3/pki/private/server.key
（4）签约服务器端证书



* t1 o. a+ ~/ Z/ g9 |[root@vpn easyrsa3]# ./easyrsa sign server server
! m0 w& I' [# D0 b# Q4 ]2 r& t
Note: using Easy-RSA configuration from: ./vars


You are about to sign the following certificate.
9 {( x& J3 b! k" S- YPlease check over the details shown below for accuracy. Note that this request
2 t0 w+ A1 j& g& u+ X4 khas not been cryptographically verified. Please be sure it came from a trusted
source or that you have verified the request checksum with the sender.
( i% [; n0 E( P" L- N1 X- h
% O$ c" H; N. Y0 H: b& v: BRequest subject, to be signed as a server certificate for 3650 days:
# h" L5 `; `" _3 y$ Q
& f2 o3 e# ^" a' Q8 P) ]+ C: y- Bsubject=
    commonName                = nmshuishui

+ J: r4 G9 }$ L
! A+ d( Y, ~5 ^! L: W* [1 zType the word 'yes' to continue, or any other input to abort.
  Confirm request details: yes        #输入yes继续
Using configuration from /root/openvpn-2.3.4/easy-rsa/easyrsa3/openssl-1.0.cnf
, n, A' Q1 y6 |6 T2 UEnter pass phrase for /root/openvpn-2.3.4/easy-rsa/easyrsa3/pki/private/ca.key:    #输入刚才创建根证书时的密码
Check that the request matches the signature
/ P" h) C2 `& r, O. QSignature ok
The Subject's Distinguished Name is as follows
commonName            :PRINTABLE:'nmshuishui'
6 V$ N5 `4 l7 B& ^! o8 SCertificate is to be certified until Aug 21 14:18:49 2024 GMT (3650 days)
- G  J- q6 V  Z- p1 N1 U' H0 r) m
, k$ a9 h8 k! sWrite out database with 1 new entries
0 }9 B# x; f8 ~- G8 CData Base Updated
, V' K, J% @7 A( {$ D* k1 A
. F  m, Y3 C/ h3 n* }% h% ?Certificate created at: /root/openvpn-2.3.4/easy-rsa/easyrsa3/pki/issued/server.crt
（5）创建Diffie-Hellman，确保key穿越不安全网络的命令：



  \9 `! ?5 g  F& C5 U5 \[root@vpn easyrsa3]# ./easyrsa gen-dh

Note: using Easy-RSA configuration from: ./vars
. f* u1 ?" G, h  `3 oGenerating DH parameters, 2048 bit long safe prime, generator 2
' d' u  w- Z" g$ QThis is going to take a long time
% o  s" Z& U- \; ?( G+ T# W0 i0 h- A...................................................................................................................................................................................................................+..........................................................................................................................+..................................................+.....................................................+..................................................................................................................................+............+............................................................................................................+...+............+...............+..............................................+.........................+..................................+.................+............................................................+..................................+........................................................................................................................................+................................................................+.......................................+...................................................................................................................................................++*++*
2 }4 p, k# `/ A
DH parameters of size 2048 created at /root/openvpn-2.3.4/easy-rsa/easyrsa3/pki/dh.pem
* B# `+ {/ u5 w. T5、创建客户端证书

) l$ ^7 K( B8 W# M5 m+ {; Q2 w( {  b3 a（1）在根目录下建立client目录


5 Q1 c2 `! G4 a' h[root@vpn easyrsa3]# cd
[root@vpn ~]# mkdir client
[root@vpn ~]# cp -R easy-rsa/ client/
（2）初始化


[root@vpn ~]# cd client/easy-rsa/easyrsa3/
# x# S. d7 E" t, e[root@vpn easyrsa3]# ls
+ l6 X! P7 r% M9 k' Deasyrsa  openssl-1.0.cnf  vars  vars.example  x509-types
& t+ n4 _+ ~0 }8 \[root@vpn easyrsa3]# ./easyrsa init-pki
) ^8 X$ r$ ?. V; w- F
! _/ ~) T  F0 a# J3 |" `Note: using Easy-RSA configuration from: ./vars
' Q: c' S; ^) g. c
9 K6 |! ]4 B7 o' ]: zinit-pki complete; you may now create a CA or requests.
7 ?- [0 @, \) }Your newly created PKI dir is: /root/client/easy-rsa/easyrsa3/pki
) R! `% n' a9 R  s( j1 h& A（3）创建客户端key及生成证书

9 n* ^) v1 M/ S/ Y) S3 @4 N
9 E) c( Z# W$ e6 X( |* d9 t1 e- Q
# {+ I" T' g8 Y9 T0 m2 ]7 F, v[root@vpn easyrsa3]# ./easyrsa gen-req nmshuishui

Note: using Easy-RSA configuration from: ./vars
8 J0 @, P6 ?3 O; X( gGenerating a 2048 bit RSA private key
% w, v1 v& [8 f# `6 J....................................................+++
) S2 g% G/ j7 l! Q' [) w.................................................................................................................................................................................+++
writing new private key to '/root/client/easy-rsa/easyrsa3/pki/private/nmshuishui.key'
Enter PEM pass phrase:            #输入密码
$ E& x/ P7 O0 O" M1 ^, S6 yVerifying - Enter PEM pass phrase:
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
6 c. x7 e( R7 [! c: c* a6 \# \5 VWhat you are about to enter is what is called a Distinguished Name or a DN.
6 m. y) I2 K: _+ W% h' H( `There are quite a few fields but you can leave some blank
3 g) D7 k9 P) N' X6 q4 J, MFor some fields there will be a default value,
  ]& x# N% k- s$ |+ e+ C, C- gIf you enter '.', the field will be left blank.
-----
3 B$ @& d8 C. F- E1 x: S- O( f) LCommon Name (eg: your user, host, or server name) [nmshuishui]:nmshuishui   #输入nmshuishui                     
: ~- t( |5 u- M$ o) g6 ]- d" H# V
Keypair and certificate request completed. Your files are:
8 r$ ~$ K" K: Vreq: /root/client/easy-rsa/easyrsa3/pki/reqs/nmshuishui.req
1 Z& R- A% R# d  ckey: /root/client/easy-rsa/easyrsa3/pki/private/nmshuishui.key
（4）将得到的nmshuishui.req导入并签约证书

! n: u8 v' i+ M* o: M
/ {! \1 G: N5 o* o, A$ ^[root@vpn ~]# cd openvpn-2.3.4/easy-rsa/easyrsa3/
3 F. |. H5 Z4 p: ?, P, J[root@vpn easyrsa3]#   #导入req
[root@vpn easyrsa3]# ./easyrsa import-req /root/client/easy-rsa/easyrsa3/pki/reqs/nmshuishui.req nmshuishui
8 T7 [9 Z2 N* e$ y
7 g" X& c) A) Z6 q2 bNote: using Easy-RSA configuration from: ./vars

The request has been successfully imported with a short name of: nmshuishui
# |0 L4 f9 N5 h5 PYou may now use this name to perform signing operations on this request.
& X  s; |3 G( v- s' h" R( ~
) }3 L/ n, E3 n. e1 d1 ~$ t3 z" T[root@vpn easyrsa3]#     #签约证书
[root@vpn easyrsa3]# ./easyrsa sign client nmshuishui

Note: using Easy-RSA configuration from: ./vars
' ]4 I; e+ v; i

You are about to sign the following certificate.
Please check over the details shown below for accuracy. Note that this request
has not been cryptographically verified. Please be sure it came from a trusted
! g. D) l4 U9 b+ }& o$ n4 m* n8 Psource or that you have verified the request checksum with the sender.
- b- n9 q1 ?  f# K
; D/ C1 O) A: p5 X( QRequest subject, to be signed as a client certificate for 3650 days:

# }# d% ?2 `- Z6 t( J' W0 a8 ~/ e9 C' Psubject=
+ C  X  |$ h7 i; C9 U# p- m) y    commonName                = nmshuishui
% `4 d% S) w' y8 x

Type the word 'yes' to continue, or any other input to abort.
8 O+ E$ @* Q- [  Confirm request details: yes       #输入yes
Using configuration from /root/openvpn-2.3.4/easy-rsa/easyrsa3/openssl-1.0.cnf
Enter pass phrase for /root/openvpn-2.3.4/easy-rsa/easyrsa3/pki/private/ca.key:    #输入创建根证书时的密码
. f! b5 A/ b9 d: |& hCheck that the request matches the signature
" b. Z' R. w! N2 w3 RSignature ok
: H2 u, A; c% i1 ]; Q9 LThe Subject's Distinguished Name is as follows
6 J6 x" V# N/ q7 |1 ncommonName            :PRINTABLE:'nmshuishui'
4 r! [# B- D* g5 o( UCertificate is to be certified until Aug 21 12:49:40 2024 GMT (3650 days)

Write out database with 1 new entries
Data Base Updated

Certificate created at: /root/openvpn-2.3.4/easy-rsa/easyrsa3/pki/issued/nmshuishui.crt   #签约成功
5 h: {% t" U' B; m（5）服务端及客户端生成的文件
2 R* X; x' C! P+ @. Y% i. Z8 P
# V4 R  i0 q5 q& n服务端：（/root/openvpn-2.3.4/easy-rsa/easyrsa3/pki）文件夹
% u7 H' W+ {( t' J9 H. F5 V; I

/root/openvpn-2.3.4/easy-rsa/easyrsa3/pki/ca.crt
+ l+ I7 \6 n4 d, ~$ A/root/openvpn-2.3.4/easy-rsa/easyrsa3/pki/reqs/server.req
/root/openvpn-2.3.4/easy-rsa/easyrsa3/pki/reqs/qingliu.req
/root/openvpn-2.3.4/easy-rsa/easyrsa3/pki/private/ca.key
$ ?$ |" m8 L8 ]% I/root/openvpn-2.3.4/easy-rsa/easyrsa3/pki/private/server.key
! Z3 K, ~( _( C+ u5 Z/ ?3 e$ m/root/openvpn-2.3.4/easy-rsa/easyrsa3/pki/issued/server.crt
( R# ^" c3 d% G. _0 A' ^' Z/root/openvpn-2.3.4/easy-rsa/easyrsa3/pki/issued/qingliu.crt
' z& ~% N* k' Z5 v3 t/root/openvpn-2.3.4/easy-rsa/easyrsa3/pki/dh.pem
: M% C4 l/ m- R: w3 {客户端：（/root/client/easy-rsa）

, Z- I' l9 @  G5 t
8 C4 ]3 M* D2 G: e  g+ ~/root/client/easy-rsa/easyrsa3/pki/private/nmshuishui.key
. S' j5 G4 O  N. Q* M' x/root/client/easy-rsa/easyrsa3/pki/reqs/nmshuishui.key   #这个文件被我们导入到了服务端文件，所以那里也有
（6）拷贝服务器密钥及证书等到openvpn目录
  y' a7 e& S# M7 K+ I" ^: F9 l
3 u  z+ L# @! F, b0 r' n# h! `  N) z4 j
% q& P- ^5 c; V7 |* j[root@vpn ~]# cp openvpn-2.3.4/easy-rsa/easyrsa3/pki/ca.crt openvpn-2.3.4/
[root@vpn ~]# cp openvpn-2.3.4/easy-rsa/easyrsa3/pki/private/server.key openvpn-2.3.4/
& ]; y0 C5 S2 U: p3 o9 v[root@vpn ~]# cp openvpn-2.3.4/easy-rsa/easyrsa3/pki/issued/server.crt openvpn-2.3.4/
0 o* V' b' h- }* `- c& r[root@vpn ~]# cp openvpn-2.3.4/easy-rsa/easyrsa3/pki/dh.pem openvpn-2.3.4/
7 E" o" F4 i4 ]（7）拷贝客户端密钥及证书等到client目录


" H2 g# u7 m, `4 n; ^: M[root@vpn ~]# cp openvpn-2.3.4/easy-rsa/easyrsa3/pki/ca.crt /root/client
[root@vpn ~]# cp openvpn-2.3.4/easy-rsa/easyrsa3/pki/issued/nmshuishui.crt /root/client
[root@vpn ~]# cp /root/client/easy-rsa/easyrsa3/pki/private/nmshuishui.key /root/client
) p" ~5 i, y9 Z7 d4 [（8）为服务端编写配置文件
8 G: L$ [# I" [+ o/ h6 I* q6 W
# i5 a* D1 s/ d+ @当安装好openvpn时候，它会提供一个server配置的文件例子
! Q0 f3 |. o/ j# O# f8 [6 Y6 u
1
/root/openvpn-2.3.4/sample/sample-config-files/server.conf
将此例子拷贝openvpn目录，然后配置
8 i) a4 n9 \2 {0 Z) k, u4 q

: \" i: \# E/ [9 L[root@vpn ~]# cp openvpn-2.3.4/sample/sample-config-files/server.conf openvpn-2.3.4/
- D" \( I6 B# b) Z[root@vpn ~]# vim openvpn-2.3.4/server.conf
local 192.168.1.104    #（自己vps IP）
port 1194
proto udp
dev tun
5 J# `& p/ t* @. }0 {ca /root/openvpn-2.3.4/ca.crt
cert /root/openvpn-2.3.4/server.crt
key /root/openvpn-2.3.4/server.key # This file should be kept secret
dh /root/openvpn-2.3.4/dh.pem
server 10.8.0.0 255.255.255.0
2 \$ T) Q8 s# Y: i/ G) Jifconfig-pool-persist ipp.txt
0 k! o) K% L5 z6 P8 ?8 N% m8 m* ypush "redirect-gateway def1 bypass-dhcp"
, A$ W$ Q( B1 x- B5 a/ Ppush "dhcp-option DNS 8.8.8.8"
6 f% k8 m8 O% ]' O9 R4 `0 ?; Akeepalive 10 120
comp-lzo
max-clients 100
persist-key
8 ?/ j! K, A. q5 {$ e3 K6 c, L) _persist-tun
3 u* j% ?( z; P# m. ^8 c5 k# K2 Lstatus openvpn-status.log
verb 3
. Y# d* z$ r% w# k& h) R3 O（9）开启系统转发功能


[root@vpn ~]# vim /etc/sysctl.conf
net.ipv4.ip_forward = 0  改成 net.ipv4.ip_forward = 1
6 d6 }& ]8 n' s5 Y' U[root@vpn ~]# sysctl -p
4 q' P7 l7 K& Y9 O8 ]" ]* N[root@vpn ~]# sysctl -a | grep net.ipv4.ip_forward
; d& |$ B5 u5 o5 }# Pnet.ipv4.ip_forward = 1
（10）封装出去的数据包（eth0是你的vps外网的网卡）：
" s2 X% I& R' j* z' h+ W
/ `$ ]  X. g/ A5 m
% K5 Q; p; \& b; r# U: h/sbin/iptables -t nat -I POSTROUTING -s 10.8.0.0/255.255.255.0 -o eth0 -j MASQUERADE

admin

下载openvpn客户端，并进行配置

+ t# y* s& \$ i' c7 u; b1、将客户端密钥及证书等拷出到windows备用


: r, h" {% h, U: V[root@vpn ~]# cd client/
[root@vpn client]# ls
& n  C8 _5 `: l7 ^, x7 mca.crt  easy-rsa  nmshuishui.crt  nmshuishui.key    #带后缀的这三个

# {: g- Q0 _9 B) A2、安装openvpn-gui工具
' k! R1 V- {! u
& w1 t/ g  `' M+ h: u（1）将D:\Program Files (x86)\OpenVPN\sample-config\client.ovpn复制到D:\Program Files (x86)\OpenVPN\config

0 c4 Y$ n' L- @7 Q2 N2 Z3 s（2）将从linux中拷贝出来的三个密钥及证书放到D:\Program Files (x86)\OpenVPN\config下