2019-06-18 18:04:20    2019-07-23 09:53:19   

vpn openvpn
### OpenVPN服务器 #### 开启epel-release ```bash yum install epel-release -y ``` #### 安装openvpn、easy-rsa和iptables-services ```bash yum install openvpn easy-rsa iptables-services -y ``` #### 配置easy-rsa ```bash cd /etc/openvpn/ cp -r /usr/share/easy-rsa /etc/openvpn/ ``` ```bash cd /etc/openvpn/easy-rsa/3/ vim vars ``` ``` set_var EASYRSA "$PWD" set_var EASYRSA_PKI "$EASYRSA/pki" set_var EASYRSA_DN "cn_only" set_var EASYRSA_REQ_COUNTRY "ID" set_var EASYRSA_REQ_PROVINCE "GuangDong" set_var EASYRSA_REQ_CITY "guangzhou" set_var EASYRSA_REQ_ORG "test CERTIFICATE AUTHORITY" set_var EASYRSA_REQ_EMAIL "sheyinsong@untes.co" set_var EASYRSA_REQ_OU "SHEYINSONG EASY CA" set_var EASYRSA_KEY_SIZE 2048 set_var EASYRSA_ALGO rsa set_var EASYRSA_CA_EXPIRE 7500 set_var EASYRSA_CERT_EXPIRE 3650 set_var EASYRSA_NS_SUPPORT "no" set_var EASYRSA_NS_COMMENT "SHEYINSONG CERTIFICATE AUTHORITY" set_var EASYRSA_EXT_DIR "$EASYRSA/x509-types" set_var EASYRSA_SSL_CONF "$EASYRSA/openssl-1.0.cnf" set_var EASYRSA_DIGEST "sha256" ``` ```bash chmod +x vars ``` #### 创建CA ```bash cd /etc/openvpn/easy-rsa/3/ ./easyrsa init-pki ./easyrsa build-ca #提示输入CA私钥的密码 ``` #### 创建OpenVPN服务器的证书和私钥 ```bash ./easyrsa gen-req openvpn-server nopass ``` #### CA签名OpenVPN服务器证书 ```bash ./easyrsa sign-req server openvpn-server ``` #### 验证签名的证书 ```bash openssl verify -CAfile pki/ca.crt pki/issued/openvpn-server.crt ``` #### 创建OpenVPN客户端的证书和私钥 ```bash cd /etc/openvpn/easy-rsa/3/ ./easyrsa gen-req client01 nopass ``` #### CA签名OpenVPN客户端证书 ```bash ./easyrsa sign-req client client01 ``` #### 验证签名的证书 ```bash openssl verify -CAfile pki/ca.crt pki/issued/client01.crt ``` #### 创建DH Key ```bash ./easyrsa gen-dh ``` #### 创建CRL key ```bash ./easyrsa gen-crl ``` #### 销毁拨号客户端(`注意:销毁客户端私钥,需要销毁才执行`) ```bash ./easyrsa revoke client01 ``` #### 拷贝证书和私钥到openvpn的目录 ```bash cp pki/ca.crt /etc/openvpn/server/ cp pki/issued/openvpn-server.crt /etc/openvpn/server/ cp pki/private/openvpn-server.key /etc/openvpn/server/ ``` ```bash cp pki/ca.crt /etc/openvpn/client/ cp pki/issued/client01.crt /etc/openvpn/client/ cp pki/private/client01.key /etc/openvpn/client/ ``` ```bash cp pki/dh.pem /etc/openvpn/server/ cp pki/crl.pem /etc/openvpn/server/ ``` #### 配置OpenVPN服务器 ```bash vim /etc/openvpn/server.conf ``` ``` # OpenVPN Port, Protocol and the Tun port 1194 proto udp dev tun # OpenVPN Server Certificate - CA, server key and certificate ca /etc/openvpn/server/ca.crt cert /etc/openvpn/server/openvpn-server.crt key /etc/openvpn/server/openvpn-server.key #DH and CRL key dh /etc/openvpn/server/dh.pem crl-verify /etc/openvpn/server/crl.pem # Network Configuration - Internal network # Redirect all Connection through OpenVPN Server server 10.10.1.0 255.255.255.0 push "redirect-gateway def1" # Using the DNS from https://dns.watch push "dhcp-option DNS 114.114.114.114" push "dhcp-option DNS 8.8.8.8" #Enable multiple client to connect with same Certificate key duplicate-cn # TLS Security cipher AES-256-CBC tls-version-min 1.2 tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-256-CBC-SHA256:TLS-DHE-RSA-WITH-AES-128-GCM-SHA256:TLS-DHE-RSA-WITH-AES-128-CBC-SHA256 auth SHA512 auth-nocache # Other Configuration keepalive 20 60 persist-key persist-tun comp-lzo yes daemon # OpenVPN Log log-append /var/log/openvpn.log verb 3 ``` #### 开启路由转发功能 ```bash echo 'net.ipv4.ip_forward = 1' >> /etc/sysctl.conf sysctl -p ``` #### iptables防火墙配置 ```bash iptables -A INPUT -p udp --dport=1194 -j ACCEPT #开放openvpn端口 internet_dev=$(ip route get 84.200.69.80 | awk 'NR==1 {print $(NF-2)}') #获取访问外网的网卡名 iptables -t nat -A POSTROUTING -s 10.10.1.0/24 -o $internet_dev -j MASQUERADE #enp0s3为局域网通信的网卡接口,这里会把拨号成功的客户端对访问公网的流量进行IP伪装,修改成enp0s3的接口IP,然后经由内网网关传到路由器,再次通过路由器的NAT转换成路由器的公网ip. ``` iptables允许拨号网段的流量转发(`针对FORWARD默认拒绝的情况`) ```bash iptables -A FORWARD -s 10.10.1.0/24 -j ACCEPT iptables -A FORWARD -d 10.10.1.0/24 -j ACCEPT ``` #### firewalled防火墙配置 ```bash firewall-cmd --permanent --add-service=openvpn #开放openvpn服务端口 firewall-cmd --permanent --zone=trusted --add-interface=tun0 #把tun0加入trusted firewall-cmd --permanent --zone=trusted --add-masquerade #trusted开启masquerade internet_dev=$(ip route get 84.200.69.80 | awk 'NR==1 {print $(NF-2)}') firewall-cmd --permanent --direct --passthrough ipv4 -t nat -A POSTROUTING -s 10.10.1.0/24 -o $internet_dev -j MASQUERADE firewall-cmd --permanent --direct --add-rule ipv4 filter FORWARD 0 -s 10.10.1.0/24 -j ACCEPT firewall-cmd --permanent --direct --add-rule ipv4 filter FORWARD 0 -d 10.10.1.0/24 -j ACCEPT firewall-cmd --reload ``` #### 启动OpenVPN服务器 ```bash systemctl start openvpn@server systemctl enable openvpn@server ``` #### 创建openVPN客户端的配置 ```bash vim /etc/openvpn/client/client01.ovpn ``` ``` client dev tun proto udp remote xx.xx.xx.xx 1194 #xx.xx.xx.xx配置为OpenVPN服务器所在网络的路由器公网IP,该地址为路由器的公网IP地址.端口可以自行修改,同路由器映射端口匹配即可 ca ca.crt cert client01.crt key client01.key cipher AES-256-CBC auth SHA512 auth-nocache tls-version-min 1.2 tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-256-CBC-SHA256:TLS-DHE-RSA-WITH-AES-128-GCM-SHA256:TLS-DHE-RSA-WITH-AES-128-CBC-SHA256 resolv-retry infinite compress lzo nobind persist-key persist-tun mute-replay-warnings verb 3 ``` #### 打包OpenVPN客户端配置 ```bash cd /etc/openvpn/ tar -czvf client01.tar.gz client/* scp root@xx.xx.xx.xx:/etc/openvpn/client01.tar.gz . ```   ### 配置路由器 ```bash 路由器添加端口映射:公网ip地址:1194---->OpenVPN的内网IP地址:1194 ```   ### OpenVPN客户端 #### 开启epel-release ```bash yum install epel-release -y ``` #### 安装OpenVPN ```bash yum install openvpn -y ``` #### 解压OpenVPN的配置 ```bash cd /etc/openvpn/ tar xvf client01.tar.gz ``` #### 拨号OpenVPN服务器 ```bash openvpn --config /etc/openvpn/client/client01.ovpn ``` ```bash Wed Jun 19 09:11:16 2019 OpenVPN 2.4.7 x86_64-redhat-linux-gnu [Fedora EPEL patched] [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Feb 20 2019 Wed Jun 19 09:11:16 2019 library versions: OpenSSL 1.0.2k-fips 26 Jan 2017, LZO 2.06 Wed Jun 19 09:11:16 2019 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info. Wed Jun 19 09:11:16 2019 TCP/UDP: Preserving recently used remote address: [AF_INET]xx.xx.xx.xx:1194 Wed Jun 19 09:11:16 2019 Socket Buffers: R=[212992->212992] S=[212992->212992] Wed Jun 19 09:11:16 2019 UDP link local: (not bound) Wed Jun 19 09:11:16 2019 UDP link remote: [AF_INET]xx.xx.xx.xx:1194 Wed Jun 19 09:11:16 2019 TLS: Initial packet from [AF_INET]xx.xx.xx.xx:1194, sid=a82ea46b b556e79b Wed Jun 19 09:11:16 2019 VERIFY OK: depth=1, CN=Easy-RSA CA Wed Jun 19 09:11:16 2019 VERIFY OK: depth=0, CN=openvpn-server Wed Jun 19 09:11:16 2019 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 2048 bit RSA Wed Jun 19 09:11:16 2019 [openvpn-server] Peer Connection Initiated with [AF_INET]xx.xx.xx.xx:1194 Wed Jun 19 09:11:17 2019 SENT CONTROL [openvpn-server]: 'PUSH_REQUEST' (status=1) Wed Jun 19 09:11:17 2019 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 114.114.114.114,dhcp-option DNS 8.8.8.8,route 10.10.1.1,topology net30,ping 20,ping-restart 60,ifconfig 10.10.1.6 10.10.1.5,peer-id 0,cipher AES-256-GCM' Wed Jun 19 09:11:17 2019 OPTIONS IMPORT: timers and/or timeouts modified Wed Jun 19 09:11:17 2019 OPTIONS IMPORT: --ifconfig/up options modified Wed Jun 19 09:11:17 2019 OPTIONS IMPORT: route options modified Wed Jun 19 09:11:17 2019 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified Wed Jun 19 09:11:17 2019 OPTIONS IMPORT: peer-id set Wed Jun 19 09:11:17 2019 OPTIONS IMPORT: adjusting link_mtu to 1625 Wed Jun 19 09:11:17 2019 OPTIONS IMPORT: data channel crypto options modified Wed Jun 19 09:11:17 2019 Data Channel: using negotiated cipher 'AES-256-GCM' Wed Jun 19 09:11:17 2019 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key Wed Jun 19 09:11:17 2019 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key Wed Jun 19 09:11:17 2019 ROUTE_GATEWAY 172.19.239.253/255.255.240.0 IFACE=eth0 HWADDR=00:16:3e:02:88:cd Wed Jun 19 09:11:17 2019 TUN/TAP device tun0 opened Wed Jun 19 09:11:17 2019 TUN/TAP TX queue length set to 100 Wed Jun 19 09:11:17 2019 /sbin/ip link set dev tun0 up mtu 1500 Wed Jun 19 09:11:17 2019 /sbin/ip addr add dev tun0 local 10.10.1.6 peer 10.10.1.5 Wed Jun 19 09:11:17 2019 /sbin/ip route add xx.xx.xx.xx/32 via 172.19.239.253 Wed Jun 19 09:11:17 2019 /sbin/ip route add 0.0.0.0/1 via 10.10.1.5 Wed Jun 19 09:11:17 2019 /sbin/ip route add 128.0.0.0/1 via 10.10.1.5 Wed Jun 19 09:11:17 2019 /sbin/ip route add 10.10.1.1/32 via 10.10.1.5 Wed Jun 19 09:11:17 2019 Initialization Sequence Completed ``` #### 验证openVPN客户端拨号是否成功(`成功则显示为OpenVPN的所在网络的公网ip`) ```bash curl ifconfig.io ``` 参考: https://www.howtoforge.com/tutorial/how-to-install-openvpn-server-and-client-with-easy-rsa-3-on-centos-7/ https://www.howtoforge.com/tutorial/how-to-install-openvpn-on-centos-7/
阅读 213 评论 0 收藏 0
阅读 213
评论 0
收藏 0