|
|
Centos8.5系统安装OpenVPN-超详细! T' S9 k! K4 l W) }; @
* n. T& m( U% a需求：公司外部员工需要访问内部办公网服务器，所以需要搭建一个vpn提供外部员工使用。
; A) T- ?! n3 m4 P& D# L& Q1 @$ h! E2 f3 m; h
1： 环境
! u6 K) w4 M2 l% D服务器系统：CentOS Linux release 8.5.2111- U7 Z( ~) |/ S+ |( z3 }2 u
服务器配置：不重要
; c- i: y3 C% h4 b$ b6 i. [服务器IP：
) P/ ]$ ?7 G. M- |# U' Y- POpenvpn服务器：
. y: `% d2 ]- H! \外网：8 {. [0 w r* \4 b+ N/ ?, s, J
内网：! T" y! K8 }. D& R5 n
内网测试服务器：
, G( `7 g0 L! jopenvpn客户端服务器网段：10.10.10.0/22
( h0 |/ \: E5 l w2 f- SOpenVpn版本：openvpn-2.6.170 a1 M$ _, h' t+ j
easy-rsa版本：3.0.8" T) q8 m: E s+ y/ ~
0 C/ r7 N8 C( W7 B# [) P
安装包存放的路径：/usr/src/install/
( ^9 V1 W* D; @; Z/ m3 u5 W, H程序安装目录：/data/openvpn
) j) @4 Z1 C: {6 j0 j& I* p* O) o B6 i0 N: I9 o
备注：
( g# T7 I6 F* W1 P/ p0 kroot# 代表在root用户下执行的命令
x. ]. X* z( T1 W& n7 m$ 代表是在普通用户下执行的命令& A2 u, ]" A6 X/ ^8 t
# 单个#号代表注释$ ?! x2 v0 z8 J2 w3 p5 g
1 v5 c5 B" N8 s+ q* `5 ?
+ A. Z) d t6 y' E3 g0 c2：安装步骤6 o& N+ L) |& W( s4 a' ?8 R
2.1 准备工作& i( q ?2 q2 d* M3 B. p- m
（以下所有操作均在Openvpn服务器操作）
1 K0 U* W% ]$ l0 O$ n2 u( F% l# 关闭防火墙
3 X4 W' H, _, n% k& U- n: Qroot# systemctl stop firewalld, d3 ?, B( {/ i6 }
root# systemctl disable firewalld
: H E: M4 I, B) H/ D2 H3 ~- t
: M. t' F! ^7 h2 @- R2 ?# 关闭selinux2 K2 O& p" L& ~5 c$ C+ A/ c R
root# sed -i 's/enforcing/disabled/' /etc/selinux/config
! f& ^7 p1 C/ P) c: P$ h* |1 eroot# setenforce 0
5 ?% J, B& T3 V
, Y4 g+ Q. C* [: ?) F# 安装依赖
5 g2 Y. F9 l7 f5 uroot# yum install -y vim wget lrzsz gcc-c++ openssl openssl-devel net-tools lzo lzo-devel pam pam-devel
3 M0 r) f: i4 P, X5 m% T
: j- T, l8 u" M# 下载安装包
4 R8 g; u# `' Jroot# mkdir /tmp/install
+ v- Q5 `( d1 C: O qroot# cd /tmp/install+ u: U, p7 B/ Y# m4 }3 p
root# wget https://swupdate.openvpn.org/com ... penvpn-2.5.6.tar.gz7 K, _' q, X) d
root# wget https://github.com/OpenVPN/easy- ... 8/EasyRSA-3.0.8.tgz
/ _# k) u) M- o, `6 z, F7 ]6 ^( x7 w4 |7 r8 M
" p1 p' C3 r8 B' m$ S2.2 安装OpenVpn和EasyRSA
* E& _ s. C/ H#1）安装OpenVpn7 A i4 W5 `1 R) X" b* w
root# cd /tmp/install
% c8 ^7 N. q) l
0 o/ A" X/ K8 \#创建目录" Z+ v2 l5 k: W; Z
root# mkdir /data: V" _! x# e; p9 S$ R2 U1 ~, h
$ h! I% }4 Z8 E8 c" o* y& e6 W r
#解压缩4 g0 V8 A+ R* G2 t0 c( K3 L0 g
root# tar -zxvf openvpn-2.6.17.tar.gz
$ a- m: F$ ^& T6 Z; y3 P r0 ^' f/ M. X# E% r6 N. Z: ]4 @
- t2 T t1 I j$ idnf install -y autoconf automake libtool pkgconfig gcc gcc-c++ make openssl-devel lzo-devel pam-devel iproute lz4-devel python3-docutils libnl3-devel pkgconf-pkg-config libcap-ng-devel+ v8 v* L& o) L4 H+ z
5 s6 K6 r- i1 B! H% L2 O+ R6 ]
root# cd openvpn-2.6.17
1 }6 t0 o3 r1 z( K- W. t. V" y5 y" U! K4 S
! [: a6 ]4 Z+ R$ g* X% ]生成configure文件：& h! d5 e' c: l) ~& E
/ i: j0 q- F: ^# autoreconf -fi0 U" B. N# r9 c: B
libtoolize: putting auxiliary files in AC_CONFIG_AUX_DIR, '.'.
) A, ^' R) l5 f# p9 g0 D9 j; mlibtoolize: copying file './ltmain.sh'& G: j3 f1 E3 r0 G0 N; R W- [
libtoolize: putting macros in AC_CONFIG_MACRO_DIRS, 'm4'.
! @, Z* y4 ?8 p/ H- p9 s3 Plibtoolize: copying file 'm4/libtool.m4'* u2 e3 C- u( L% {
libtoolize: copying file 'm4/ltoptions.m4'
# u/ {, d+ u2 Ylibtoolize: copying file 'm4/ltsugar.m4'
9 Q8 {2 v1 n+ ~5 L( w* l, mlibtoolize: copying file 'm4/ltversion.m4'- a4 b6 D; y* u- ?8 i% s$ R
libtoolize: copying file 'm4/lt~obsolete.m4'
! @5 t; U% T6 a! Alibtoolize: Remember to add 'LT_INIT' to configure.ac.0 V5 |/ l# b% T8 q% D/ a+ n
configure.ac:74: installing './compile'" T% x/ }0 H5 {
configure.ac:73: installing './config.guess'
/ D' L4 o9 M: q( e- [configure.ac:73: installing './config.sub'5 a Z8 ]/ S& @ A
configure.ac:72: installing './install-sh'2 n' U2 a) m- ]. x2 d) F- ^* Q4 ^
configure.ac:72: installing './missing'
' t: m# B* N- j8 @ H9 K$ j& Zsrc/compat/Makefile.am: installing './depcomp'
2 W5 w/ E- z1 Z' H |! m
# [4 @! |; }6 e" u3 h/ `5 Q/ ?
6 ~: Q- X2 E4 a; B2 Xdnf install -y libnl-3-dev pkgconf-pkg-config$ S& l0 ^- E6 C
" z+ A* h+ g3 C0 ~0 @4 x8 H1 B#--prefix= 后面路径是安装openvpn到那个文件路径下( u* j9 ^ W1 ?/ i$ Q! s" z' v, O
root# ./configure --prefix=/data/openvpn/( c2 u+ X4 e7 ^( ^4 I
$ _% v, D( W9 q; T% x. P Z
#编译) m6 U: q# j6 R- X W
root# make && make install* Y; N/ Q& J5 a, i( g0 F. V( G
6 o; V# k8 w8 r- O F#添加openvpn的环境变量 _( M# D$ o- t$ {. N4 a( \7 }4 @
root# echo -e "PATH=\$PATH:/data/openvpn/sbin" >/etc/profile.d/openvpn256.sh
5 f% E2 a9 ?! [* t: a1 z, Y1 y& i- |7 X; j9 Q5 W, m. K' r: Y- L" ?
#加载环境变量) s5 m( G2 b0 M2 y' [
root# source /etc/profile6 x8 M1 c6 \5 C
9 y2 W; N" f+ U L1 p' j#执行下面的命令看看是否成功，出现以下内容表示成功
* L+ |* D' D1 x
6 V) K1 x4 r$ V! [" e* x# openvpn --version) e& H, O: a$ T, s5 z
OpenVPN 2.6.17 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] [DCO]3 j+ f( `3 A+ X0 T" [: X+ X
library versions: OpenSSL 1.1.1k FIPS 25 Mar 2021, LZO 2.08* O- v+ p1 C5 E t( d" k6 W
DCO version: N/A
) l. ^$ D$ ^" D. q, I' {8 |Originally developed by James Yonan, z, i3 Q% {+ r
Copyright (C) 2002-2024 OpenVPN Inc <sales@openvpn.net>
( L- w; w `# _1 W2 U% n. n- TCompile time defines: enable_async_push=no enable_comp_stub=no enable_crypto_ofb_cfb=yes enable_dco=auto enable_dco_arg=auto enable_debug=yes enable_dlopen=unknown enable_dlopen_self=unknown enable_dlopen_self_static=unknown enable_fast_install=yes enable_fragment=yes enable_iproute2=no enable_libtool_lock=yes enable_lz4=yes enable_lzo=yes enable_management=yes enable_pam_dlopen=no enable_pedantic=no enable_pkcs11=no enable_plugin_auth_pam=yes enable_plugin_down_root=yes enable_plugins=yes enable_port_share=yes enable_selinux=no enable_shared=yes enable_shared_with_static_runtimes=no enable_small=no enable_static=yes enable_strict=no enable_strict_options=no enable_systemd=no enable_werror=no enable_win32_dll=yes enable_wolfssl_options_h=yes enable_x509_alt_username=no with_aix_soname=aix with_crypto_library=openssl with_gnu_ld=yes with_mem_check=no with_openssl_engine=auto with_sysroot=no# c4 H( R; x1 R& t; E% ~3 L
- `% Y+ T$ K$ T- B: y#2）安装EasyRSA4 K$ K$ @0 x- {* ^+ p, p( j
root# cd /tmp/install! `. J1 ?4 }( h% t) L7 J/ T, t
root# tar -zxvf easy-rsa-3.2.2.tar.gz! y# ~) W9 h( f. n3 G. N2 y
# cp -r easy-rsa-3.2.2 /data/easyRSA-3.3.2
) g& ^- f7 A% E) u6 {& ]3 \) D& \% M$ h/ K
, A, W y( k4 l+ {2.3 服务端配置
! @9 X, }; x, x8 t& g$ F! F) M2.3.1 准备CA签发机构环境! A! i/ C) J6 H: G& q6 l# ^7 w
#拷贝EasyRSA$ v1 D4 u( G2 m3 }
root# cp -r /data/EasyRSA /data/openvpn/easy-rsa-server
! n3 c9 j k, s7 ~9 R: Lcp -r /data/easyRSA-3.3.2/ /data/openvpn/easy-rsa-server
. b$ c% v' q1 t+ Z. e+ K" x- O+ |6 G. M l! P/ E
' U; ^0 h+ }: b4 m3 {3 _( [
root# cd /data/openvpn/easy-rsa-server
+ t$ g8 ]) D: jcd /data/openvpn/easy-rsa-server/easyrsa3
' p- E4 }% Z; }5 Y, ?0 U2 L& N7 \, N% @0 O7 N5 K# u+ p
#准备签发证书的默认变量文件
0 o9 Z' S" [. k9 `root# egrep -v "^$|^#" vars.example >vars, w+ c% D+ [) T
) o# b: g# N3 ~9 F" ] v[root@openvpn easyrsa3]# egrep -v "^$|^#" vars.example > vars
3 `0 S3 F2 i! Z# M. I0 ?[root@openvpn easyrsa3]# cat vars+ F7 Z7 w! L; k7 e, V
if [ -z "$EASYRSA_CALLER" ]; then
: {6 S9 h; ~- B& k! H echo "You appear to be sourcing an Easy-RSA *vars* file. This is" >&2
) L% X: e' \% A& s/ G5 R: x8 d echo "no longer necessary and is disallowed. See the section called" >&2# h) N2 R! `- _- A! ?
echo "*How to use this file* near the top comments for more details." >&2
G" G. B+ O) J& q0 G5 z return 1
6 q; p% E6 X/ n X+ Ifi
* k Q6 A9 h6 D
o$ i# h+ u. Q& x3 S$ y7 M& _7 X9 `$ H5 ^/ {. y2 ]
% [9 z- ]0 T$ c5 j4 n#编辑vars文件，在最后一行增加以下内容 A7 e7 k' {" h; s S0 a+ `
root# vim vars- Q. ~, [3 f- r, t# A/ w2 m
#添加参数，设置CA证书有效期为100年（日期可以你自己决定设置多长）
5 ?: H" ], P9 i: G( O, _% u9 {* vset_var EASYRSA_CA_EXPIRE 36500
: ?2 W) d' A9 v# L4 A9 K#添加参数，设置服务器证书为10年* y8 t8 {2 u2 d% K
set_var EASYRSA_CERT_EXPIRE 3650
5 B8 Y! @; V5 K3 t# ?! d; f
8 f+ K6 u( e X% f2 z+ Y
8 w+ b8 v1 y) K& B1 E查看配置vars的内容：
( O, `1 T0 _) U& c6 S/ Y5 a
' N( f. A7 L, U5 H& X6 O* Y' X+ d6 a) {" z8 {$ e2 s0 v
if [ -z "$EASYRSA_CALLER" ]; then. Z, G' A; {9 Q; }# [' `. f( n% j0 @
echo "You appear to be sourcing an Easy-RSA 'vars' file." >&2
4 D# ^7 g5 q g. K z/ z% b# l echo "This is no longer necessary and is disallowed. See the section called" >&2" l5 {+ W- P/ ?% g5 B% H3 w
echo "'How to use this file' near the top comments for more details." >&2/ {- G! |( }% D* Y- V2 ?+ k
return 17 l: W- S1 t% [9 i2 F2 M3 z3 h
fi+ s! m- X, K& f' ?; V
set_var EASYRSA_CA_EXPIRE 36500. W( [1 r) a7 a* r' ^; v
set_var EASYRSA_CERT_EXPIRE 7300
: h0 r8 R* q- ]2 y* c# l* l, q% b- D5 ]) N( k
. I( i7 q6 I3 ~: y) ]
2.3.2 创建CA机构与服务器证书: T( q. G5 o* W/ m3 r" s
#1）创建CA机构; j$ y; C5 e% x) `6 l
root# cd /data/openvpn/easy-rsa-server& B# A, k0 S9 k' u$ }7 X1 }
cd /data/openvpn/easy-rsa-server/easyrsa3
8 _1 T& }4 c4 H& z
! w: p5 y. y# c2 B% b" x#初始化，执行此命令会生成pki目录. ~7 ?/ N6 t- ?. ~+ b8 q
6 Z, k- N6 j$ B" ?( _9 m1 W
[root@openvpn easyrsa3]# ls4 e" n5 j& Q( v" b% U
easyrsa openssl-easyrsa.cnf vars vars.example x509-types/ S$ \& o9 Z: ~3 o
[root@openvpn easyrsa3]# ./easyrsa init-pki
% m8 W, Z; M/ q4 CUsing Easy-RSA 'vars' configuration:5 y2 ~$ Y( ?# `! D' N. V
* /data/openvpn/easy-rsa-server/easyrsa3/vars
$ u7 z5 z: V4 I( @: B4 j
. J" g, r8 t( i% S" wNotice
; J8 `! g* b+ X6 E& a------
0 f" k6 t1 D" i- a( d& g'init-pki' complete; you may now create a CA or requests.0 J# V4 }. f/ r3 B: B" a* |, G
0 N- e: _3 k% F* ^ Z( K8 C+ v# TYour newly created PKI dir is:
- n3 ?+ V! z' c* /data/openvpn/easy-rsa-server/easyrsa3/pki
, ^5 t* r! e& j, Q4 |- V) h
: b& `6 z( K0 C' M1 O( _Using Easy-RSA configuration:
6 C5 Q9 s) |* H0 E O) p% `* /data/openvpn/easy-rsa-server/easyrsa3/vars
) H4 f3 ?+ m: n; b+ o/ |[root@openvpn easyrsa3]# ls
@* D' B5 Z) A( keasyrsa openssl-easyrsa.cnf pki vars vars.example x509-types
3 Y3 Z" i5 \8 P2 v9 }) H( y1 T/ A Z8 p
* j) r' K% l: s6 t4 q1 c, Q5 j; U5 r0 \; A: s" J* N$ p
3 V+ N+ V" }. G- i) f
#创建CA机构,nopass代表不需要密码的意思
$ z$ g3 V# \0 [root# ./easyrsa build-ca nopass
5 ]9 J; W4 M- @ m+ { G5 [. o4 S+ b" b% W, T+ V6 D
& I3 O! R# A1 H- W
+ k, R# `1 @' H& A& |& D- F* w+ X[root@openvpn easyrsa3]# ./easyrsa build-ca nopass
; {$ e, ^! K& N- `Using Easy-RSA 'vars' configuration:$ |/ ^$ J! g3 \7 d+ t
* /data/openvpn/easy-rsa-server/easyrsa3/vars
% q' O6 r* \, Q! y e..+++++2 i4 u; h) z% v) a
.........+++++
- o6 Y2 H% k3 R6 NYou are about to be asked to enter information that will be incorporated
+ E. }* }: O+ [& s' p- Q Binto your certificate request.: v4 J% c, Y3 K% D! i
What you are about to enter is what is called a Distinguished Name or a DN.
, a( y0 p# u H$ u( ]There are quite a few fields but you can leave some blank
+ b* b+ ~2 D F5 a4 t8 iFor some fields there will be a default value,
0 D1 G, G+ b5 o# YIf you enter '.', the field will be left blank.
5 u6 b% t6 N" }( s-----
6 G6 e$ y& W3 `( q# D, Q5 SCommon Name (eg: your user, host, or server name) [Easy-RSA CA]:jckj
& `" a! w t, k; z. u# \5 Y: x* w5 g: B/ F$ r0 s
Notice' I U( s$ a( @2 q6 D
------9 `$ _5 t$ D# T- a m$ M$ I; ]
CA creation complete. Your new CA certificate is at:
, B( [5 x* Q, u {9 G; ?* /data/openvpn/easy-rsa-server/easyrsa3/pki/ca.crt" R. [% J3 S) k! {) D
0 U2 b! @2 @8 F- t" y. G6 I2 U0 M/ f+ `Create an OpenVPN TLS-AUTH|TLS-CRYPT-V1 key now: See 'help gen-tls' c& x, p) T+ m+ ?5 ^9 `" J
+ j% l2 {/ i" `: @! ~0 b$ uBuild-ca completed successfully.( P1 ^" B; s) o" b$ c. F- T4 Z2 C M
; O6 T6 q1 d) O9 I& \& T$ |7 y. a
, e/ I; K: V' q" R
0 `8 |3 b$ y+ j, _) |6 O#执行创建ca机构成功的话，会出现下面的这个ca.crt文件, v4 N, p# W3 d& |/ a4 d Y
Your new CA certificate file for publishing is at:
- r" W0 Q- H% f/data/openvpn/easy-rsa-server/pki/ca.crt5 ~4 ]# V8 j: Q! v
8 f1 [6 I: n" ~% ~6 ~6 P( U4 A0 ]#CA证书文件
: G' S6 _" V' f5 s' M( Q! ?6 h$ G4 p" V: l& z0 S- {0 A
[root@openvpn easyrsa3]# ls -l /data/openvpn/easy-rsa-server/easyrsa3/pki/ca.crt
) ^# Z- R" L) ~. \" M-rw-------. 1 root root 1176 Jan 17 12:19 /data/openvpn/easy-rsa-server/easyrsa3/pki/ca.crt: d# j4 U8 `' R/ X0 O6 I, r
4 N" Z+ S0 P0 Z( o0 Z2 ~1 e H' n9 |" {# w6 z
#CA秘钥文件& X7 \( u5 O- q X. |
Q6 D& l1 w! U# O9 b$ p# H2 t
[root@openvpn easyrsa3]# ls -l /data/openvpn/easy-rsa-server/easyrsa3/pki/private/ca.key
4 r" \ n* h! q# z. {; {& r- H5 O-rw-------. 1 root root 1704 Jan 17 12:17 /data/openvpn/easy-rsa-server/easyrsa3/pki/private/ca.key
) o9 x6 z2 i8 y/ I+ S; W4 @/ U/ p: Z5 e* T( }# e$ u- ~% \! U9 _
+ y+ f; o1 e% p#2）创建服务端证书
9 M7 U' c. u7 F* G7 S9 [; }1 Kroot# cd /data/openvpn/easy-rsa-server
& z: d9 p! x$ o4 O& ~+ X6 J; wcd /data/openvpn/easy-rsa-server/easyrsa3- g, A. D4 y9 h' Q/ \7 F7 p$ |
#创建服务端证书申请文件，openvpnserver为了区别参数标识，我这里设置为openvpnserver，如果你自己安装的话可以使用默认的server 这个名称' i) F9 R7 p1 t! }0 e
root# ./easyrsa gen-req openvpnserver nopass
4 q* ^! Z3 O9 X, y' s/ t
# n6 r( N8 t+ d+ h/ Y% n* _5 ?. N, o9 V* {5 @! y' m; K/ e
& A, L# f; b0 k0 K7 d! G, J9 {5 ~2 K$ M
[root@openvpn easyrsa3]# ./easyrsa gen-req openvpnserver nopass6 P3 p! }5 Y5 e9 ^
Using Easy-RSA 'vars' configuration:+ V" y. s- v1 N6 t
* /data/openvpn/easy-rsa-server/easyrsa3/vars) z1 {% F) a/ V3 N% k
Generating a RSA private key. c2 }$ C" `+ Z$ E3 }: m7 X6 z
.............................+++++( A# y0 g, w& ?6 E7 G& c/ ^
.................................................................+++++* U3 z& I0 a L: B1 D: J
writing new private key to '/data/openvpn/easy-rsa-server/easyrsa3/pki/253f5ec5/temp.2.1'9 K% H6 S( R* i5 E6 h
-----: L3 B: l/ X& U( X0 r
You are about to be asked to enter information that will be incorporated: L' K- @! |- ^0 o+ l' o
into your certificate request.: ^7 g$ `- \: p6 u0 n
What you are about to enter is what is called a Distinguished Name or a DN.
' [* l9 G- B- k# x: _+ E) IThere are quite a few fields but you can leave some blank
4 n5 v7 P2 T! x, V% HFor some fields there will be a default value,8 m: p" Z4 G, @( A2 @
If you enter '.', the field will be left blank.
# q/ T8 D: Y4 u3 ? U% W& X' }% W-----
) `$ V9 d3 Z. M( e; u- l3 WCommon Name (eg: your user, host, or server name) [openvpnserver]: 回车
3 E1 c) O% M% E9 ~( Q. v7 \
0 l! c4 b+ O4 W" Z6 V, M* JNotice$ m' M, _: m, l' v; ?
------1 E; e. m3 F" V6 u& ]4 a) @* c
Private-Key and Public-Certificate-Request files created.
# U4 y& N3 n# q3 TYour files are:
6 v0 }9 q% |, V% c: o8 s$ ~! C* req: /data/openvpn/easy-rsa-server/easyrsa3/pki/reqs/openvpnserver.req7 p6 h3 D/ S! b: _4 j7 p
* key: /data/openvpn/easy-rsa-server/easyrsa3/pki/private/openvpnserver.key
* n$ b4 o# R& v
" J8 z/ P4 t& M( `! M! B7 l. d
& l0 T: g+ C( X5 P# t; H6 n' }: `) x- B) s: G1 z
: [8 v- M% h( s- c
#默认回车就行
* `; ~1 X* I7 T; OCommon Name (eg: your user, host, or server name) [openvpnserver]:7 t5 ^6 h4 Y/ K4 O1 B
Keypair and certificate request completed. Your files are:& Q9 G+ s0 w2 s3 A; S/ T0 n
; j* g: k8 |! b8 i6 C1 r2 x, v6 v1 n$ E. O& ^' s
* c. c; e: f0 J4 X8 H& {$ K3 B0 K' m& N, b
#请求文件
; @ ?) u, u9 H W. ]$ s8 g: Freq: /data/openvpn/easy-rsa-server/easyrsa3/pki/reqs/openvpnserver.req" \9 `% ~4 K. T) p
#私钥文件9 L3 W& h8 a6 Z7 \
key: /data/openvpn/easy-rsa-server/easyrsa3/pki/private/openvpnserver.key
) F/ R q( V9 Z! o& l' C
5 W8 W }" R% J0 [3 o#3）签发服务端证书. E2 k* \# V0 n+ N8 t
绿色部分不做：1 W) k! b$ V h$ q
root# cd /data/openvpn/easy-rsa-server
1 g$ ]! E$ Q7 Z/ D3 Y! Scd /data/openvpn/easy-rsa-server/easyrsa3
4 q. }6 e8 T6 A- E$ H#这里的server是代表服务端意思，openvpnserver这个是上面我们创建的服务端证书的名称
; X& w2 h$ z0 F' V. kroot# ./easyrsa sign server openvpnserver5 U( t) b0 c0 v7 Z: r
#输入yes6 j2 P5 m" ]& h: Q
Type the word 'yes' to continue, or any other input to abort.
7 \% {" b% ?( X! h! zConfirm request details: yes' }, T+ Q& Z+ c4 e! V- L7 [/ i
#服务端的证书文件
: y/ L# f! v# I6 q8 rCertificate created at: /data/openvpn/easy-rsa-server/pki/issued/openvpnserver.crt
# w& u0 t9 T# E+ s
) o: K3 j& y, \; B- P; ^
: D4 T8 Z$ A2 N+ g9 p+ d# o \1 k; W
[root@openvpn easyrsa3]# ./easyrsa sign server openvpnserver
/ {7 O! n/ ~, R6 HUsing Easy-RSA 'vars' configuration:
0 y$ b1 ?# r" t5 e4 J7 @% }2 J* /data/openvpn/easy-rsa-server/easyrsa3/vars
, L2 C" a% u* z( o) H) l' Y1 {Please check over the details shown below for accuracy. Note that this request
5 R7 e6 M- \) q3 Z7 g& W0 {! uhas not been cryptographically verified. Please be sure it came from a trusted1 v5 f% G" _, t, Q
source or that you have verified the request checksum with the sender.
' x" F2 S0 n- e" N, vYou are about to sign the following certificate:
P, |" J. T9 u6 }5 i, c3 e
8 g- v! ?1 T) ^9 ?9 a4 a8 W* H Requested CN: 'openvpnserver'
( y: O: l% [7 S8 Y" T Requested type: 'server'* U" g: `- e9 Y9 k( o
Valid for: '365' days
( v8 x) j" O r) R) {" a! Z
8 T' |# r/ n! J+ [0 r8 K9 r& v# x# j2 [6 s5 ]- {4 B0 n- K1 B
subject=8 W' ? s; {. w. I
commonName = openvpnserver# ~% m( o- G, q8 i* `
) r. `) d" y, [& v; Y
Type the word 'yes' to continue, or any other input to abort.
4 g6 i N0 p$ S6 T Confirm requested details: yes d( I1 N3 f- E
9 n8 F' z8 |. z& PUsing configuration from /data/openvpn/easy-rsa-server/easyrsa3/pki/774d5125/temp.1.1
S. U2 X+ J6 r+ v8 n/ vCheck that the request matches the signature
. \5 x: j4 \. j0 ?1 \9 Q1 H2 CSignature ok* s4 \# [( ?: r3 U
The Subject's Distinguished Name is as follows) b+ V, R$ w8 M9 m% _+ f; I
commonName :ASN.1 12:'openvpnserver'
) b, ^2 g$ M/ i2 O6 OCertificate is to be certified until Jan 17 04:25:48 2027 GMT (365 days)3 _" P5 e8 U' Q& y4 I! U* N% k
: u. \/ E" S* y- s. IWrite out database with 1 new entries# O; {1 w k% K
Data Base Updated" C" O/ c o4 l! l4 F1 L
' m0 h8 R5 S3 a% N$ _Notice% c! I3 Y8 ?9 e: d
------
/ k9 O9 W9 Y x( S2 ]Inline file created:8 j$ H+ P2 K" \- w
* /data/openvpn/easy-rsa-server/easyrsa3/pki/inline/private/openvpnserver.inline9 ~9 i2 e2 M6 i, P* u. Q
9 ?! i3 Q! h; X& }
) }" x0 c8 j( |4 f( C8 B: `5 ^
Notice5 h0 n: t% S8 A7 @) J$ ?
------
* j% y+ L: F" j3 ^" B- BCertificate created at:
0 e2 Q# g% |+ g" A# N* /data/openvpn/easy-rsa-server/easyrsa3/pki/issued/openvpnserver.crt; v# G* q$ @/ p: Q6 Y" x5 |, L
" b% `+ _, s4 b
0 P# e. T. K! g! P
- s8 T' O* x0 `8 p#4）创建交互秘钥
! V% p8 @: C$ D* Groot# cd /data/openvpn/easy-rsa-server& o9 g* _# n: F3 q u7 T( G0 y
cd /data/openvpn/easy-rsa-server/easyrsa3- G9 G" O+ g4 [3 J7 M5 F5 P
root# ./easyrsa gen-dh
4 p, |6 i/ ~& X" E/ i2 X$ g- dDH parameters of size 2048 created at /data/openvpn/easy-rsa-server/pki/dh.pem4 s/ ^! U& x: l+ [4 t
* R4 P0 b. q6 [, T; H5 O' S9 L
& j2 t/ N5 c8 B1 W
[root@openvpn easyrsa3]# ./easyrsa gen-dh
8 ?. x5 i" `$ q+ w3 `$ FUsing Easy-RSA 'vars' configuration:+ t. e k9 u+ D* i7 e0 R7 E x
* /data/openvpn/easy-rsa-server/easyrsa3/vars
; F& C1 D& t/ |% AGenerating DH parameters, 2048 bit long safe prime, generator 2) j2 M+ n1 O$ Q' |5 W! B
This is going to take a long time
8 F3 K9 ?, u; P; X9 R( \; k............................................................................................+...........+..............................................+.....................................+.................................+....................................................+.........................................................................................................+...................+.................................................................................................................................................................................+......................................................+.............................................................................+..............................................................................+...............................................................................................................+........................................+....................................+............................................+.............................................................................................+........................................................................................................++*++*++*++*
; z n G* N1 |0 V) mDH parameters appear to be ok.# ~/ Y+ `6 h+ m W' Q
# X/ J7 k0 J, \( T4 j3 lNotice
5 w- ?3 N) g+ a" {- l------5 x4 O. ^# Y- s* E$ Y
5 K% ?* w0 m) a! I1 j2 u9 e
DH parameters of size 2048 created at:
& R8 n! I8 _9 N5 r2 Q9 g0 S5 Q* /data/openvpn/easy-rsa-server/easyrsa3/pki/dh.pem
* i" i& Q) P2 i* M, U
1 D0 p$ ?$ V; g7 H6 I# E
* u, T0 O4 J Z s# \# P7 U4 [* O) Z; D+ Q
#5） 启用安全增强配置 q0 W% L2 g/ w* o3 ~( ]7 i
root# cd /data/openvpn/easy-rsa-server G, k) c2 z8 v7 c
cd /data/openvpn/easy-rsa-server/easyrsa3
. ^5 F6 G4 b1 i) M1 d: y; n" D( I( t5 `2 q! V a4 G2 X
root# openvpn --genkey tls-auth ta.key
0 F" ^; k; m4 ]! Y3 ]
% Z |0 }1 w$ y% T; H6 n! }9 k& S: _2 v6 y7 q5 B8 y
[root@openvpn easyrsa3]# openvpn --genkey tls-auth ta.key. V6 f0 Z7 }8 R8 T, ^
[root@openvpn easyrsa3]# ls
0 t; ~+ R9 I% W; J5 p1 _( Deasyrsa openssl-easyrsa.cnf pki ta.key vars vars.example x509-types+ p; W' }: r9 L5 M
[root@openvpn easyrsa3]# 2 x) D3 W. Y1 G2 x* j7 G
: k s" J. X' c o4 I
) \1 ^8 s2 v0 Y9 E. y
0 N% \- V/ \$ x+ g2.3.3 OpenVPN服务端配置
; T& E1 I; Y+ \% Z+ L#创建openvpn用户; ` k2 V% r4 d' U: i. z* j- X$ b
root# groupadd openvpn
$ ?7 P, Q- C3 Yroot# useradd -M -s /sbin/nologin -g openvpn openvpn
5 G. p8 B A: o8 \: }: w
, e( P- a0 r$ K9 e3 A[root@localhost easy-rsa-server]# groupadd openvpn
' h! y. M! |; @3 W[root@localhost easy-rsa-server]# useradd -M -s /sbin/nologin -g openvpn openvpn% ]# ? l5 ?9 O7 w) C+ r
; F( t- T+ T( G8 L/ F
0 e! u7 I. n6 I5 c8 [3 L: p7 o# 创建证书存放目录
0 e+ s5 d' c+ i0 Z3 O1 q- j; proot# mkdir /data/openvpn/certificate
* i& b _2 f+ ^! L7 {
5 x! ~# K: B' i& `. f! I+ c9 }2 d# 创建日志存放目录
" ?+ L+ P/ ^+ u3 Broot# mkdir /data/openvpn/logs
4 k+ f! Y# l7 u4 ?8 m$ r( oroot# chown openvpn. /data/openvpn/logs
' O& o( \3 k! t5 u; [7 J3 v9 b( F2 z9 ^) Q3 m O) w/ Q
; r6 H& Z$ y% V
[root@localhost logs]# chown -R openvpn. /data/openvpn/logs/5 j9 F2 I! h( r! E9 V
0 w- b. W/ W2 f3 ^$ |7 M8 H+ X
( k0 U, g+ Y1 w4 C$ W( ~! B8 i# 将服务端证书秘钥和交互秘钥复制到certificate目录* T/ B+ H. Q% M X. j" k" P
7 f) k# ~8 Z/ A1 n4 L
[root@openvpn easyrsa3]# cp /data/openvpn/easy-rsa-server/easyrsa3/pki/ca.crt /data/openvpn/certificate/7 R$ P8 A5 b/ B
[root@openvpn easyrsa3]# cp /data/openvpn/easy-rsa-server/easyrsa3/pki/issued/openvpnserver.crt /data/openvpn/certificate/
' B7 _# Q( b% ~. G[root@openvpn easyrsa3]# cp /data/openvpn/easy-rsa-server/easyrsa3/pki/private/openvpnserver.key /data/openvpn/certificate/+ I0 N. }. n, M4 m( w7 Z
[root@openvpn easyrsa3]# cp /data/openvpn/easy-rsa-server/easyrsa3/pki/dh.pem /data/openvpn/certificate/
0 I9 O: x* s2 [# a2 p4 P, C[root@openvpn easyrsa3]# cp /data/openvpn/easy-rsa-server/easyrsa3/ta.key /data/openvpn/certificate/
! Y* C3 p4 n- Q* x
& m9 S) e$ P3 E& j#添加配置文件
& j+ j% X8 @1 Y0 s" Z+ m! [4 rroot# cd /data/openvpn/
i' _0 f/ }3 q( @root# vim /data/openvpn/server.conf- s3 S3 A* q! M' W" F z \
#__server.conf—stat___
! b% Z$ ?5 N' `8 F: S#端口& h) v5 {1 S" B' `1 I: U
port 11950 F4 r1 @7 P+ K. {, ^( e5 z
#协议7 w$ g2 t( l" O! @' Z; C5 F
proto tcp
& }6 [# W/ f* b7 A8 o) a: hdev tun% W$ D+ G/ ]) k% I( j5 T: q
#ca证书文件
% B! E% I, C- v2 zca /data/openvpn/certificate/ca.crt
% g( x ?; a8 g( e#服务端证书文件" a8 m8 x1 x, J" }
cert /data/openvpn/certificate/openvpnserver.crt
* N- d8 v' n( i; t# [- l#服务端私钥文件+ B. H! u. ]" V* I. w
key /data/openvpn/certificate/openvpnserver.key1 o4 a- Q9 i4 l! D% U! U! J. @7 J* B
#交换秘钥文件
6 {6 U" w) J( O$ |' h& w% }7 N. p2 jdh /data/openvpn/certificate/dh.pem
" p6 q. C+ T& M. G#安全增强文件，0是服务端，1是客户端
( l( B8 q* u: x) wtls-auth /data/openvpn/certificate/ta.key 0
* B. S" B" D3 y; G- L#分配客户端IP的网段，不能和服务器一个网段，不能冲突9 u, s2 G m0 Q9 j5 I
server 10.8.0.0 255.255.255.0- |: h7 w* G: F' k, Z8 ^
#运行通讯的内网路由，可以多条
: F& s. z/ |$ I5 U5 }push "route 192.168.0.0 255.255.255.0"/ k2 R* a% i* a/ n; e% I/ t1 T6 _
$ e* Y/ T/ h5 W, `! r2 b
push "route 192.168.6.0 255.255.255.0"
' x* C5 j# B3 |0 |9 A7 | npush "route 172.30.1.0 255.255.252.0") x1 B4 T2 E" Q: d3 h
#会话检测，每十秒测试一下，超过120秒没回应就认为对方down
! r3 F: ?, W6 @4 @, v0 kkeepalive 10 120. A1 I, }! A* Z9 n- L8 M. B
#加密算法* S; r5 g7 k% A+ A: m$ G
cipher AES-256-CBC
9 q2 m8 A; N+ [9 J3 g#压缩算法
# V7 e2 m: G9 r l$ `. b" ]5 e8 g( lcompress lz4-v2
2 Q* R0 ]( M0 K+ }( U" a0 Q#推送客户端使用lz4-v2算法$ w1 [, Q' k6 A \: j8 k1 }
push "compress lz4-v2"
% J5 S% m5 V: Y#最大客户端数6 U5 Y. l" ]/ R2 y% W0 ~( j
max-clients 100
) Y. y% R: s' `5 {#运行openvpn的用户和用户组' a5 |1 G3 D$ C. u6 E
user openvpn7 T& r! }/ ?1 N
group openvpn! Z, v0 l; m8 d# T- @, `/ Y. A
#状态日志) k6 l1 n; X1 e( t \7 @" G& k
status /data/openvpn/logs/openvpn-status.log
( z. C; d+ I$ O# m$ ~. k% nlog-append /data/openvpn/logs/openvpn.log
4 ?* Q: e# B Q- K( C& b; z#日志级别
I1 T; o8 E2 \. Averb 3
# A0 |% ^" V+ |+ I, K/ o6 k7 zmute 20. L- n1 N; \' }
#__server.conf—end___) U( A1 D( R7 e6 g6 z
' w2 F6 r, [ d4 x+ K
( m; W' o7 R% L( d! ^#内核转发规则
: m, k# x9 `$ q$ v2 G; Q( F# Xroot# echo "net.ipv4.ip_forward=1" >>/etc/sysctl.conf
) E! u* g# o9 v2 l. ]0 S( Rroot# sysctl -p
$ I* ^5 |7 |+ b' N' ]( o( R# w9 R0 Z# u; n( t+ a
#iptablesNAT规则0 k, c T* k N% k/ B; J) v
#这里的ip就是server.conf 中的server 10.10.10.0 255.255.252.0 ;添加转发规则到开机启动项
+ D7 ^ D2 w, f6 B( k# w4 Wroot#echo 'iptables -t nat -A POSTROUTING -s 10.10.10.0/22 -j MASQUERADE' >> /etc/rc.d/rc.local
8 ?, N/ O* F5 d5 [2 ^5 u/ _6 eroot#echo 'iptables -t nat -A POSTROUTING -s 172.30.1.0/22 -j MASQUERADE' >> /etc/rc.d/rc.local' Q$ G6 A0 G) O3 R* W' @
root# chmod +x /etc/rc.d/rc.local
7 I. `6 v4 _* i$ i' ]8 b) Uroot# /etc/rc.d/rc.local# T( V# R# @# t8 D
0 Z/ }! }9 _7 H$ w' t
+ [6 G! Y9 H$ [) t$ j. t# w上面的可以暂时不执行，都使用firewall-cmd方式添加 ： 7 Y5 W: `) I2 B: N$ E
firewall-cmd --permanent --zone=public --add-interface=tun09 d: r, c! j. @( J$ ]
firewall-cmd --permanent --zone=public --add-masquerade
) K# l/ ?' u7 V( Y, `( wfirewall-cmd --permanent --add-forward7 G) u/ @ C# _ E
添加转发规则。允许可通行。3 C. Z, N) h# Q! @7 j/ Z
I+ k W& R! o- n @( U
% f: n+ s4 W7 l$ I! m. i8 U; x* n4 M% p7 C8 H( C3 b1 R
2.3.4 启动OpenVPN6 `4 d6 m- ^1 z* W0 p7 x
# 创建启动文件
: R0 a8 h$ Q lroot# vim /etc/systemd/system/openvpn.service7 \4 p3 `* ?- e
[Unit]# d0 o# Z- L( A' c
Description=OpenVPN Server0 R9 m, V3 \* G3 @% @
After=network.target* O9 q- B6 }3 V2 c
After=syslog.target, o" }: g9 N3 _
! R: f% f) p; P3 l[Install]9 M9 g* N" W8 t; W6 {! v. r# D7 O4 t
WantedBy=multi-user.target
/ Q1 X) V* R+ _3 r% ~5 {" i0 s& B1 i0 D9 Y0 p; M
[Service]7 v' p: w" R4 R& l
ExecStart=/data/openvpn/sbin/openvpn --config /data/openvpn/server.conf2 s" P& U3 s8 u4 o) j
# G! k/ Z4 }% N' t8 G, a3 V
+ x. [+ @0 N" {7 S9 P c#加载系统服务
; X0 p% x! u4 q- k" m; Q/ }8 Broot# systemctl daemon-reload
. z; E* `2 r1 A' M2 l#开机启动
. s- V% g$ ?7 n" a; z' Nroot# systemctl enable openvpn.service
- _/ }6 z# ?1 @1 V2 r* U#启动服务
3 s, Z* u5 \# V1 Y5 v2 f/ o9 Hroot# systemctl start openvpn.service4 k2 ~% e0 @1 |: m. _" C" ^; t! I
#查看服务运行状态5 a: a) Q# m! A/ a8 N$ C
root# systemctl status openvpn.service
1 [# f3 n* f: [3 @, r5 T' R e
/ g* p' ~* w& m1 U8 j
7 _- {0 x: `' {3 G g2.4 客户端文件配置
: U# ]# O( F' q& N0 v6 K/ v2.4.1 准备客户端证书0 r! l/ a% m% j. o) h
#1）创建客户端申请证书
# x' B! N5 v$ @; m$ l
5 c; B7 \: H% F' j+ V6 I) u% o[root@openvpn data]# cp -r /data/easyRSA-3.3.2/ /data/openvpn/easy-rsa-client
8 p3 t( O' y$ M[root@openvpn data]# cd /data/openvpn/easy-rsa-client/easyrsa3/
7 L: D; g( E! K8 {8 v, }4 B[root@openvpn easyrsa3]# ls
/ X, `" v+ g% Feasyrsa openssl-easyrsa.cnf vars.example x509-types
i v$ ~8 \- Y2 m+ s5 b; |: s[root@openvpn easyrsa3]# : X, N9 t1 E; n! L/ |
" z1 b( A1 p2 V( O
+ [$ B. f1 B! W# c* }; }. s2 N" P1 v( O
#初始化，执行此命令会生成pki目录
% x7 ?! A6 F" d2 f. ?9 d8 Proot# ./easyrsa init-pki
1 {7 R: | V6 W' s
- @. ^3 V& C* ~2 A, Z: u, v3 N# M, u$ M2 N* w9 }! A
[root@openvpn easyrsa3]# ./easyrsa init-pki, Y8 o, l( I# t5 T0 t# E
, B# J9 P0 h; m4 o! D5 ?. p3 {Notice& ] Z8 l4 M5 v
------
8 H/ L$ [$ F# _! Y5 F# s( ]'init-pki' complete; you may now create a CA or requests.
2 d' L* J1 m( X' G4 i, B _
! o4 N$ p U E2 G, C& b, Q4 L0 BYour newly created PKI dir is:/ R7 V) I( }6 L" ?# T8 w- P
* /data/openvpn/easy-rsa-client/easyrsa3/pki+ @+ ]: V3 M9 w! Y& h
+ l0 H0 P9 e8 Z, `0 H9 B6 ?* ?9 p
Using Easy-RSA configuration:
' A- ]2 u& R1 x1 f8 }* undefined. `! P' {- |& F& e% U
. M4 g9 Z8 [- \4 ]: ]9 n
. R' a" s3 \# W8 D
#创建客户端申请证书,我这里用的是名字全拼
8 [: I4 q: F* C$ E
* B" T" l' d0 M/ a2 }. O
3 g9 e8 K& z9 O7 m2 s6 a( v7 Z9 s% L
) q8 z3 o' F+ s9 [[root@openvpn easyrsa3]# ./easyrsa gen-req longrui nopass
3 `; Q3 t5 W1 X! C; h: v- dGenerating a RSA private key# `. z3 O- t' d" }' r% w; y
..+++++
* S o6 o! u; o% w, B" \1 Y7 I9 d.......+++++) Z% G* k7 t4 e4 D- e% P! k
writing new private key to '/data/openvpn/easy-rsa-client/easyrsa3/pki/2f9b0fd7/temp.2.1'
# ^& _ H4 l5 X s. w$ t-----$ r5 i7 ]) b& S2 N, p- }3 t% F* W
You are about to be asked to enter information that will be incorporated
: t$ Z2 t/ [. d( T- Dinto your certificate request.8 I. I- u0 h3 b1 @/ n7 E1 h
What you are about to enter is what is called a Distinguished Name or a DN.9 P2 R8 l. h; V; a7 f6 P6 |
There are quite a few fields but you can leave some blank
: ?- b$ b8 s& o9 [+ a" f3 k& YFor some fields there will be a default value,( I0 P* `, n* V. z" Q6 I
If you enter '.', the field will be left blank.
; u/ y- L2 v/ z. t5 j, _ [. f-----) J8 h" N, y" e0 C
Common Name (eg: your user, host, or server name) [longrui]:# Y7 e" f( Y2 n
x! y; W! e$ e+ I) NNotice1 Y" _% o' w8 Z: b# p; p* u) n
------+ ?+ D4 z4 G# M1 F4 H+ _2 a+ _5 `
Private-Key and Public-Certificate-Request files created.
! v- r5 v4 c# t$ }$ C: xYour files are:
1 F. {& |' u$ U9 I* req: /data/openvpn/easy-rsa-client/easyrsa3/pki/reqs/longrui.req
2 q/ v& X% [- Z, M9 v8 M. y* key: /data/openvpn/easy-rsa-client/easyrsa3/pki/private/longrui.key- V0 Q6 P- [; a5 T
2 z+ R9 K# _& c
" K8 a t9 ^) P
6 m4 E+ s) d2 q, _( m9 M
#2）服务端签发证书! z9 _, w9 [8 z2 N: B+ U
5 Q' b* z9 C3 P. C0 }+ `/ _* G
[root@openvpn easy-rsa-server]# cd /data/openvpn/easy-rsa-server/easyrsa3/
" |+ f2 Y3 w: a* N: H. a& t[root@openvpn easyrsa3]#
2 Q/ G' K' V% w* _0 \3 V9 O7 p$ y( X6 z8 c& ?) l; ]1 C
#将客户端证书复制到CA工作目录9 o4 z/ X2 H0 O/ M
' r9 A# H* R4 }5 u" R! B" ?! m
5 Q( A& c$ F% y3 o* `/ a[root@openvpn easyrsa3]# ./easyrsa import-req /data/openvpn/easy-rsa-client/easyrsa3/pki/reqs/longrui.req longrui( q% |1 r! N& r- Q; U, a
Using Easy-RSA 'vars' configuration:1 w8 }. _; f% X3 D# F! ?2 M6 F
* /data/openvpn/easy-rsa-server/easyrsa3/vars. a$ M+ N Y! D+ Z E$ i3 ?; O
, S7 |$ p9 [6 y
Notice. A3 v' H- H+ c- R* `! P
------
& `. M: N0 L+ ~; X* NRequest successfully imported with short-name: longrui7 B; }0 i4 I4 x3 G* k
This request is now ready to be signed.3 R0 _# z; p( B" I6 O; s) c- S- W0 {
* R7 j" H$ s' \: t/ |$ |
$ G( ^3 s. h* D
& A6 Z- S* f7 N6 z- E" q; q( P#设置客户端证书有效期，我这里设置的是90天/ E0 X; X$ v/ G. F* k1 d
root# sed -i "s/set_var EASYRSA_CERT_EXPIRE.*$/set_var EASYRSA_CERT_EXPIRE\t90/g" ./vars
7 a8 t; j! B6 F* z% Y/ ]: ]0 C#签发证书
) ~3 V! @+ Y; Q+ P% ?2 groot# ./easyrsa sign client longrui
: p* N. f! k5 D v#输入yes9 G/ Z- ]9 Y( }8 y( n; \0 O
Type the word 'yes' to continue, or any other input to abort.: A" f1 N: Q8 p: ~
Confirm request details:yes
# ]1 N4 Z% a+ A5 E! B) i/ D, d; w% m# y) o U' Z
/ B% x/ y) S4 m$ `2 {4 D1 c& c
#生成的证书
. T! C$ f v/ M7 v! B0 fCertificate created at: /data/openvpn/easy-rsa-server/pki/issued/longrui.crt \* L1 A2 o2 {. G
3 N4 T9 v4 B& D [9 {" }, E* X$ t% n
[root@openvpn easyrsa3]# ./easyrsa sign client longrui " m' L \2 }& Q1 B
Using Easy-RSA 'vars' configuration:
$ n6 `# @# \6 j) F4 g* /data/openvpn/easy-rsa-server/easyrsa3/vars0 T) N8 ?! q- j4 W2 i
Please check over the details shown below for accuracy. Note that this request. `4 k m Z' Y- y
has not been cryptographically verified. Please be sure it came from a trusted) B) ?0 a9 a/ M9 z+ R4 e
source or that you have verified the request checksum with the sender.2 g8 G( i" v. u" W; Q1 ^
You are about to sign the following certificate:: i1 R6 I4 ?% J P4 w
9 i/ t+ J6 v/ z. J4 r& v Requested CN: 'longrui'
% [" P, ^ c: R! n0 r9 x% ~ Requested type: 'client'. g# J3 l0 s* M6 ?+ H# X- K/ E
Valid for: '365' days! G2 ?- V. e0 F* t+ W7 }
3 S. ]3 F" q& m5 d1 Q5 r
( ]' k7 X% T/ L7 a: o" @+ d8 p
subject=9 t* R r8 T* O7 g+ P% @! J
commonName = longrui
3 g3 `5 {3 i5 a* X
2 H. U% d$ }* }. V( ]0 e# uType the word 'yes' to continue, or any other input to abort.: g9 ~0 `: @5 r0 ^/ h
Confirm requested details: yes
% U/ h8 X) n" j# p- g
: R# l* @# Z$ w5 G4 p, p6 iUsing configuration from /data/openvpn/easy-rsa-server/easyrsa3/pki/48fc94cb/temp.1.1
. G4 O6 v _( ?& a6 N7 u. o$ |Check that the request matches the signature
0 w ^9 B/ A2 J; i5 |# @) n/ f! oSignature ok
$ P# H7 i) Y; Z1 U4 H6 o5 OThe Subject's Distinguished Name is as follows6 s5 c$ u& f. T: r% t) \
commonName :ASN.1 12:'longrui'6 G5 l3 d" t2 H, c8 N5 @' _) z
Certificate is to be certified until Jan 17 07:12:25 2027 GMT (365 days)
5 X" v& \7 K5 D5 X) o
8 k8 P0 r/ B* }1 h$ hWrite out database with 1 new entries
0 `: h6 c& ?6 U) nData Base Updated) U7 F) P# ?% Y' r. Q3 \
5 [/ ?; `3 Y3 L) c$ \- o5 ]: ]WARNING5 w1 y/ I: \' _; d, I, c5 E
=======" r# Z- w1 t# D1 a: T
INCOMPLETE Inline file created:! j0 E+ I& | T; b
* /data/openvpn/easy-rsa-server/easyrsa3/pki/inline/longrui.inline
) S9 }3 x: }0 @4 I6 s0 x! G
& c8 g) ?9 l! p& F: a1 C( l7 K9 C% X; V1 Q
Notice
3 W9 X' e- L4 |6 m2 S( A9 g------
- `' ~" F6 ~6 X& H, PCertificate created at:
8 L3 R9 d: s4 K' o. k7 Y N& V* /data/openvpn/easy-rsa-server/easyrsa3/pki/issued/longrui.crt1 M$ q6 x3 p& |+ \ d
: n; G d/ V2 V2 s) r3 I3 h+ d5 g6 U. Z
2.4.2 准备客户端配置文件3 [& _7 t" `' G @0 g* {% B9 x
#创建存放目录% y* Y! `, S8 J
root# mkdir /data/openvpn/client/ S9 Q' Z% A! U; G
#创建张三证书存放的目录
7 T( ?7 U1 h ~6 C) {root# mkdir /data/openvpn/client/longrui% t1 Z( B1 Y0 b7 x' t* u
#复制证书" ]3 Y1 E6 y9 U/ @; [8 n: L' ?
7 J3 j2 q$ ?0 n2 ^! v) A8 W
$ F9 X0 o3 d. T% o7 i' v* S[root@openvpn easyrsa3]# mkdir /data/openvpn/client/longrui/ w X+ t; v, i/ R+ i) ]7 o
[root@openvpn easyrsa3]# find /data/openvpn/ \( -name "longrui.key" -o -name "longrui.crt" -o -name "ca.crt" -o -name "ta.key" \) -exec cp {} /data/openvpn/client/longrui \;
% E4 p1 a; C7 j# ?% F- |( Fcp: '/data/openvpn/client/longrui/longrui.crt' and '/data/openvpn/client/longrui/longrui.crt' are the same file
4 r( I: h! D# Z# z* Pcp: '/data/openvpn/client/longrui/ca.crt' and '/data/openvpn/client/longrui/ca.crt' are the same file0 c- h. t! u" n0 i* N2 ^+ a2 @
cp: '/data/openvpn/client/longrui/ta.key' and '/data/openvpn/client/longrui/ta.key' are the same file" R2 u5 b7 Y+ r! H
cp: '/data/openvpn/client/longrui/longrui.key' and '/data/openvpn/client/longrui/longrui.key' are the same file% Q. X9 r( G, ~6 A! W
& j& ]/ I+ [! J* ^9 O8 f/ I; y& T5 p: |% `# b% W
$ e! d. Z5 d% K! v1 Z2 i
[root@openvpn2 ~]# firewall-cmd --permanent --direct --add-rule ipv4 nat POSTROUTING 0 -s 10.160.131.0/24 -j MASQUERADE0 |! i: d; W9 [% N' G; x* k8 K
success. H" f; E+ c4 G) u) L, Z
[root@openvpn2 ~]# firewall-cmd --permanent --direct --add-rule ipv4 nat POSTROUTING 1 -s 172.30.0.0/22 -j MASQUERADE
: |8 s( ?% k8 ]8 b6 Dsuccess
& u9 O2 M4 q J; t( o4 ]5 B& H0 `& Z" N5 s3 V) a& u c! a
firewall-cmd --add-interface=tun0
3 o. W! J3 a! V4 E- [! `, e, N$ a. q, s+ T% w1 E' ]% t
修改文件：6 Q( o' g B' O( v5 e6 r; u: R) P
root# vim /data/openvpn/client/longrui/client.ovpn
3 C: }" _3 h: ]- K( Eclient
+ K) g& R) I7 v. Q b9 r7 wdev tun+ F* ?6 p) r, P0 v& @- i/ }' q- f, Y
proto tcp5 ~3 X! g( |; p+ j2 j- Q/ d
remote 公网ip 1194
3 S+ v2 B2 s' H: R( `! X" X+ Eresolv-retry infinite s# U; e7 D2 t M! b
nobind7 U+ q. |7 o/ L* R/ X5 L
ca ca.crt
0 L! A. N9 F6 E, Ocert longrui.crt
% p# ]/ _1 p: M' {1 t6 [key longrui.key
* S, Q7 n7 d5 I# p- k( Oremote-cert-tls server
6 }" x: `- n/ ]/ c- u4 z X& Utls-auth ta.key 1
% ]5 K) ?1 p" Ucipher AES-256-CBC# G; G1 r0 W8 x/ n. v1 e* E& e7 Q u0 _
verb 3
5 D) O$ I* U5 U; l! Mcompress lz4-v2
9 p$ I8 [1 D( G& ~- p5 @6 q
7 Z! F; v% N" M( B Y
( `$ V! [5 }& m* b8 z) K+ e \2.5 测试& X) O, ~! M8 {- p2 s% C0 L
#将证书下载下来% C# ?8 M) k2 N$ \/ H$ h6 H* |) J4 K
root# cd /data/openvpn/client/
2 Y) f' _! u5 ^8 l+ J' lroot# tar -zcvf longrui.tar.gz longrui
4 h5 u1 j' z: Q/ e: zroot# sz longrui.tar.gz1 q W# i7 d; q: a/ B
5 }! z' Q/ Y! S0 s
#win10 安装客户端（这里不演示了）
, \! g+ p* p) i! D) W. S0 u: Lhttps://swupdate.openvpn.org/com ... tall-2.4.5-I601.exe
5 P3 M8 H! O* I/ z% J6 R# k9 V#将 zhangsan.tar.gz 复制到 openvpn的config目录，然后点击链接# [5 a" w# X3 U+ Q+ i. T
+ p# u4 r2 R. V- u
- F* W- c+ g% I6 P. w7 R#双击运行9 N9 {6 w0 u" d0 ]/ Q+ S2 P" x: v' a5 K
: q( }) M7 h: m. D) _: ` V/ F' g- ^/ ^
' ~% f7 Q8 S! ~$ m6 x+ _#这样表示链接成功了/ H" C5 Y" {6 |+ ~
|: L7 @7 f5 \7 B& P
2 x, Q8 F0 T# g( V# s3 ?#测试连接mysql数据库端口
" b8 e7 c5 k/ B3 X7 q6 z5 l1 j+ k- O( l: L5 M# D8 k( }
+ j8 `- _' O0 c" M( c
: p9 ~4 {; {5 s5 l9 \; ^( R j [
3 ：安装包
) y1 w: g$ n! b2 v' S) ^0 Z$ r+ Q官网下载地址：
+ E5 Z9 Q: v# j- c7 u' c4 y9 k5 @openvpn 服务端下载地址：& D1 i x, i& T4 ~" p! A
https://swupdate.openvpn.org/com ... penvpn-2.5.6.tar.gz' s- V5 F a5 Q1 |
openvpn 客户端下载地址：, E8 S. m8 \% {3 p2 c
https://swupdate.openvpn.org/com ... tall-2.4.5-I601.exe
& g7 U& _. c, Y* AEasyRSA下载地址：
K+ B/ ~0 Y9 r! o2 Ahttps://github.com/OpenVPN/easy- ... 8/EasyRSA-3.0.8.tgz
7 \3 Y' B+ a' W
1 B, c2 o9 o+ F1 f8 {# \. B* I- `/ K" n, E0 @; k" J, o0 ]
添加防火墙规则：) ^/ u- g! ?4 Q+ x9 k
firewall-cmd --permanent --direct --add-rule ipv4 filter FORWARD 0 -i tun0 -o bondmgt -j ACCEPT4 {/ L/ h: C# g# Y" ^6 d
firewall-cmd --permanent --direct --add-rule ipv4 filter FORWARD 0 -i bondmgt -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT* I0 |! f3 _* W% i
firewall-cmd --permanent --direct --add-rule ipv4 nat POSTROUTING 0 -s 10.160.131.0/24 -j MASQUERADE) X' L& ]7 W5 `5 f' E
firewall-cmd --zone=internal --add-masquerade --permanent
+ N: t* ?6 Y5 R9 u: c) O+ E1 m0 c& z F k' M
这是后面测试的结果，上面的可以暂时不执行：
! C1 M1 S' X# |2 Dfirewall-cmd --permanent --zone=public --add-interface=tun0
: P* T6 `! B8 V0 s' A v, i8 x: f3 pfirewall-cmd --permanent --zone=public --add-masquerade D+ W2 p c4 n) R' Y }2 q
firewall-cmd --permanent --add-forward1 N8 }3 Q9 H2 M) q' h9 E; _4 T4 u, T
. _* c: \3 G7 m添加转发规则。允许可通行。 |
; _" T6 k) Q4 h; d; K W& U( U1 f% z9 t! \* u& T; N! j5 E
2 \$ d" z* n/ C% m0 K8 E( C% Q
./easyrsa sign-req client wogong3
' H3 X: c# K; g8 n" N/ b#wogong3为创建客户端的证书的Common Name
- t6 H% G3 l: ]1 `. {# `$ b6 g9 H验证证书是否正确* Z4 T' K1 j3 g
openssl verify -CAfile ca.crt issued/wogong2.crt
B1 ~% K8 E% y# e; x0 fopenssl verify -CAfile ca.crt issued/wogong3.crt8 {. ]0 u' O# C* V/ ^5 [6 x
6 x2 n+ E V d, {0 b7 V* `) p1 V" ?7 h Y0 n9 v' w) k* B
! u) D$ `3 @: Y+ x h, m5 L* j& |* r' @' F. N
! `8 E/ |+ ^- r. X% f1 N/ u
$ D, L, U) `* g* Q% Q9 C4 Z6 Q V! d# l
3 y4 W: D, \$ s0 b; T5 r
" ?; [, y2 _, o2 ]$ } |
|
发表于 2026-1-17 13:18:00
发表于 2026-3-11 10:47:45