linux 下openvpn安装

#openvpn的完整文件目录，可直接覆盖该文件目录

yum install -y lzo lzo-devel openssl openssl-devel pam pam-devel pkcs11-helper pkcs11-helper-devel

yum -y install rpm-build rpmdevtools

midir -p /data/soft

cd /data/soft

wget https://swupdate.openvpn.org/community/releases/openvpn-2.2.2.tar.gz

rpmbuild -tb openvpn-2.2.2.tar.gz

cd /root/rpmbuild/RPMS/x86_64

rpm -ivh openvpn-2.2.2-1.x86_64.rpm

cd /usr/share/doc/openvpn-2.2.2/easy-rsa/2.0

vim vars

exportKEY_COUNTRY="CN"   所在的国家

export KEY_PROVINCE="BJ"  所在的省份

exportKEY_CITY="Hangzhou"   所在的城市

exportKEY_ORG="aliyun"        所属的组织

export KEY_EMAIL=[e-mail]    邮件地址

##上述参数的值可以自定义设置，对配置无影响

ln -s openssl-1.0.0.cnf openssl.cnf

## 做个软链接到openssl-1.0.0.cnf配置文件 

source ./vars

./clean-all 

##清除并删除keys目录下的所有key 

./build-ca 

##生成CA证书，刚刚已经在vars文件中配置了默认参数值，多次回车完成就可以

./build-key-server server

##生成服务器证书，其中server是自定义的名字，一直回车，到最后会有两次交互，输入y确认

##完成后会在keys目录下保存了server.key、server.csr和server.crt三个文件。 

 

./build-key user01

##创建用户秘钥与证书 

##创建用户名为user01的秘钥和证书，一直回车，到最后会有两次确认，只要按y确认即可

##完成后，在keys目录下生成1024位RSA服务器密钥aliyunuser.key、aliyunuser.crt和aliyunuser.csr三个文件

 

./build-dh

##生成Diffie Hellman参数 

##执行了./build-dh后，会在keys目录下生成dh参数文件dh1024.pem，dh1024.pem文件客户端验证的时候会用到

  

 

/bin/cp -ap /usr/share/doc/openvpn-2.2.2/easy-rsa/2.0/keys/*  /etc/openvpn/

##将/usr/share/doc/openvpn-2.2.2/easy-rsa/2.0/keys目录下的所有文件复制到/etc/openvpn下

 

/bin/cp -ap /usr/share/doc/openvpn-2.2.2/sample-config-files/server.conf  /etc/openvpn/

##复制openvpn服务端配置文件server.conf文件到/etc/openvpn/目录下

cat > /etc/openvpn/server.conf << EOF

 

local 0.0.0.0

port 1194

proto udp

dev tun

ca ca.crt

cert server.crt

key server.key 

dh dh1024.pem

server 172.16.0.0 255.255.255.0

ifconfig-pool-persist ipp.txt

#push "redirect-gateway def1 bypass-dhcp"

push "route 192.168.0.0 255.0.0.0"

push "dhcp-option DNS 114.114.114.114" 

#push "dhcp-option DNS 10.143.22.116" 

keepalive 10 120

reneg-sec 360000

comp-lzo

user nobody

group nobody

persist-key

persist-tun

status openvpn-status.log

log openvpn.log

verb 3

auth-user-pass-verify /etc/openvpn/checkpsw.sh via-env

client-cert-not-required 

username-as-common-name

script-security 3

 

 

EOF

##修改配置文件，注意DNS的设置，例如阿里云上只能设置他们自己的DNS地址

##后四行是启用用户名密码认证的，不需要时可以注释掉

cat > /etc/openvpn/checkpsw.sh << 'EOF'

 

#!/bin/sh

###########################################################

# checkpsw.sh (C) 2004 Mathias Sundman <[e-mail]>

#

# This script will authenticate OpenVPN users against

# a plain text file. The passfile should simply contain

# one row per user with the username first followed by

# one or more space(s) or tab(s) and then the password.

 

PASSFILE="/etc/openvpn/psw-file"

LOG_FILE="/var/log/openvpn-password.log"

TIME_STAMP=`date "+%Y-%m-%d %T"`

 

###########################################################

 

if [ ! -r "${PASSFILE}" ]; then

  echo "${TIME_STAMP}: Could not open password file \"${PASSFILE}\" for reading." >> ${LOG_FILE}

  exit 1

fi

 

CORRECT_PASSWORD=`awk '!/^;/&&!/^#/&&$1=="'${username}'"{print $2;exit}' ${PASSFILE}`

 

if [ "${CORRECT_PASSWORD}" = "" ]; then

  echo "${TIME_STAMP}: User does not exist: username=\"${username}\", password=\"${password}\"." >> ${LOG_FILE}

  exit 1

fi

 

if [ "${password}" = "${CORRECT_PASSWORD}" ]; then

  echo "${TIME_STAMP}: Successful authentication: username=\"${username}\"." >> ${LOG_FILE}

  exit 0

fi

 

echo "${TIME_STAMP}: Incorrect password: username=\"${username}\", password=\"${password}\"." >> ${LOG_FILE}

exit 1

 

EOF

cat > /etc/openvpn/psw-file << EOF

yjb007 123456

EOF

chmod +x /etc/openvpn/checkpsw.sh理论/

chmod 400 /etc/openvpn/psw-file

chown nobody:nobody /etc/openvpn/psw-file

##配置使用用户名密码认证的脚本

 

vim /etc/sysctl.conf

net.ipv4.ip_forward = 1

sysctl -p 

##开启转发

iptables -t nat -A POSTROUTING -s 172.16.0.0/24 -j MASQUERADE

service iptables save

##添加iptables规则确保服务器可以转发数据包

 

/etc/init.d/openvpn start

netstat -ano | grep 1194

##启动openvpn

Windows PC客户端的配置 :

下载客户端安装包：http://oss.aliyuncs.com/aliyunecs/openvpn-2.1.3-install.rar

将云服务器中/etc/openvpn/目录下的user01.key、user01.crt、ca.crt文件下载到需要连接openvpn的Windows客户端上

保存到openvpn软件的安装路径下的\OpenVPN\config目录下

配置client.opvn文件

========================================

 

client

dev tun

proto udp

remote 101.201.101.163 1194

nobind

user nobody

group nobody

persist-key

persist-tun

ca ca.crt

;cert yujianbo.crt

;key yujianbo.key

comp-lzo

verb 3

auth-user-pass

auth-nocache

reneg-sec 360000

========================================