技术交流QQ群:①185473046   ②190706903   ③203744115   网站地图
登录

下次自动登录
现在的位置: 首页Linux>正文
Linux系统安装部署Open-V+P+N服务器
2024年03月27日 Linux 暂无评论 ⁄ 被围观 1,606次+

OpenVPN 是一个开源的虚拟私人网络(VPN)实现软件,它可以用来建立安全的点对点或站点到站点连接。通过使用 OpenVPN,用户可以在不安全的网络上建立加密连接,确保数据传输的安全性和隐私性。

操作系统:CentOS-7.x

一、准备篇

1、关闭selinux

#执行以下命令

setenforce 0

sed -i 's/^SELINUX=.*/SELINUX=disabled/' /etc/selinux/config

2、防火墙设置

关闭firewall

systemctl stop firewalld.service #停止firewall

systemctl disable firewalld.service #禁止firewall开机启动

systemctl mask firewalld

systemctl stop firewalld

yum -y remove firewalld

安装iptables防火墙,开启tcp 1194端口

yum -y install iptables-services #安装

vi /etc/sysconfig/iptables

# sample configuration for iptables service

# you can edit this manually or use system-config-firewall

# please do not ask us to add additional ports/services to this default configuration

*filter

:INPUT ACCEPT [0:0]

:FORWARD ACCEPT [0:0]

:OUTPUT ACCEPT [0:0]

-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

-A INPUT -p icmp -j ACCEPT

-A INPUT -i lo -j ACCEPT

-A INPUT -p tcp -m state --state NEW -m tcp --dport 1194 -j ACCEPT

-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT

-A INPUT -j REJECT --reject-with icmp-host-prohibited

-A FORWARD -j REJECT --reject-with icmp-host-prohibited

COMMIT

:wq! #保存退出

systemctl enable iptables.service #设置防火墙开机启动

systemctl restart iptables.service #启动防火墙使配置生效

3、设置系统时间

rm -rf /etc/localtime #先删除默认的时区设置

ln -s /usr/share/zoneinfo/Asia/Shanghai /etc/localtime #替换亚洲/上海作为默认时区

vi /etc/sysconfig/clock #添加时区

Zone=Asia/Shanghai

:wq! #保存退出

timedatectl set-local-rtc 0

hwclock --systohc -u #系统时钟和硬件时钟同步,当前系统时区不为 UTC,是CST时间,所有要加-u参数

date #显示系统时间

date -s "2024-03-13 15:24:00" #修改时间

watch -n 1 date #显示实时时间

yum install ntp

ntpdate ntp.aliyun.com #同步时间服务器

echo -e "0 0 * * * /usr/sbin/ntpdate ntp.aliyun.com &>/dev/null" >> /var/spool/cron/root #添加计划任务

systemctl restart crond.service #重启服务

4、开启内核转发

vi /etc/sysctl.conf

net.ipv4.ip_forward = 1

sysctl -p #立即生效

5、系统参数优化

vi /etc/security/limits.conf #在最后一行添加以下代码

* soft nproc unlimited

* hard nproc unlimited

* soft nofile 1000000

* hard nofile 1000000

:wq! #保存退出

vi /etc/sysctl.conf #在最后一行添加以下代码

fs.file-max = 65535000

fs.nr_open = 65535000

kernel.pid_max=655350

vm.swappiness = 0

:wq! #保存退出

/sbin/sysctl -p

ulimit -a #查看

ulimit -n 1000000 #设置

6、安装依赖包

yum install openssl-devel lzo-devel pam-devel gcc

7、安装包下载

https://www.rpmfind.net/linux/epel/7/x86_64/Packages/o/openvpn-2.4.12-1.el7.x86_64.rpm #openvpn安装包

https://www.rpmfind.net/linux/epel/7/x86_64/Packages/p/pkcs11-helper-1.11-3.el7.x86_64.rpm #安装openvpn需要的依赖包

https://github.com/OpenVPN/easy-rsa/releases/download/v3.0.8/EasyRSA-3.0.8.tgz #用来制作证书的工具

上传安装包到/data/soft目录

二、安装篇

1、安装openvpn

cd /data/soft

rpm -ivh pkcs11-helper-1.11-3.el7.x86_64.rpm

yum localinstall openvpn-2.4.12-1.el7.x86_64.rpm

yum list installed openvpn

注:安装完成后,会自动创建用户openvpn、用户组openvpn

2、制作证书

cd /data/soft

tar xfz EasyRSA-3.0.8.tgz -C /etc/openvpn/

mv /etc/openvpn/EasyRSA-3.0.8 /etc/openvpn/EasyRSA

chown -R root:root /etc/openvpn/EasyRSA -R

chmod 755 /etc/openvpn/EasyRSA -R

cp /etc/openvpn/EasyRSA/vars.example /etc/openvpn/EasyRSA/vars

vi /etc/openvpn/EasyRSA/vars #修改下面的信息,也可以不改,不影响使用

set_var EASYRSA_REQ_COUNTRY "CN"

set_var EASYRSA_REQ_PROVINCE "ShannXi"

set_var EASYRSA_REQ_CITY "Xian"

set_var EASYRSA_REQ_ORG "Ltd."

set_var EASYRSA_REQ_EMAIL "xx@xx.com"

set_var EASYRSA_REQ_OU "OpenVPN"

:wq! #保存退出

cd /etc/openvpn/EasyRSA

./easyrsa init-pki #初始化,在当前目录创建pki目录

./easyrsa --batch build-ca nopass #创建CA证书,不需要密码

./easyrsa gen-dh #生成dh密钥

./easyrsa build-server-full server nopass #签名请求,生成服务器证书,不需要密码

./easyrsa build-client-full client1 nopass #生成了一个名为"client1"的客户端证书,不需要密码

./easyrsa build-client-full client2 nopass #生成了一个名为"client2"的客户端证书,不需要密码

EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl #生成证书吊销列表(CRL),有效期为 3650 天,可以不设置,证书长期有效

openvpn --genkey --secret /etc/openvpn/ta.key #生成tls密钥,用密钥取代密码输入

#拷贝证书

cd /etc/openvpn/EasyRSA/pki

cp ca.crt /etc/openvpn

cp private/ca.key /etc/openvpn

cp dh.pem /etc/openvpn

cp issued/server.crt /etc/openvpn

cp private/server.key /etc/openvpn

cp crl.pem /etc/openvpn

3、创建openvpn服务端配置文件

rpm -ql openvpn |grep server.conf #查看当前版本

cp /usr/share/doc/openvpn-2.4.12/sample/sample-config-files/server.conf /etc/openvpn/

mv /etc/openvpn/server.conf /etc/openvpn/server.conf.bak

vi /etc/openvpn/server.conf #添加配置

port 1194 #端口

proto tcp #指定采用的传输协议,可以选择tcp或udp

dev tun #指定创建的通信隧道类型,可选tun或tap,一般设置为tun

sndbuf 0 #设置为0自动调整数据包发送缓冲区大小

rcvbuf 0 #设置为0自动调整数据包接收缓冲区大小

ca ca.crt #指定证书颁发机构(CA)的证书文件

cert server.crt #指定服务器的证书文件

key server.key #指定服务器的私钥文件

dh dh.pem #指定Diffie-Hellman参数文件

auth SHA512 #指定使用SHA512算法进行身份验证

tls-auth ta.key 0 #指定TLS密钥文件

topology subnet #指定虚拟网络拓扑结构为子网模式

server 10.8.0.0 255.255.255.0 #自定义虚拟网段,网段不能冲突

ifconfig-pool-persist ipp.txt #指定IP地址租约持久化文件

push "route 10.189.189.0 255.255.255.0" #vpn服务器所在的内网段,向客户端推送这条路由信息

push "redirect-gateway def1 bypass-dhcp" #重定向所有流量通过VPN,如果只访问内网,外网流量不通过vpn请注释掉此行

push "dhcp-option DNS 223.5.5.5" #dns服务器地址,必须和客户端设置相同,如果只访问内网,外网流量不通过vpn请注释掉此行

push "dhcp-option DNS 223.6.6.6" #dns服务器地址,必须和客户端设置相同,如果只访问内网,外网流量不通过vpn请注释掉此行

keepalive 10 120 #保持活动连接的时间和频率

cipher AES-256-CBC #加密算法为AES-256-CBC,必须和客户端设置相同

comp-lzo #启用数据压缩,必须和客户端设置相同

user openvpn #指定OpenVPN进程的运行用户

group openvpn #指定OpenVPN进程的运行组

persist-key #持久化密钥

persist-tun #持久化通道

status openvpn-status.log #指定状态日志文件

verb 3 #指定日志详细级别,必须和客户端设置相同

crl-verify crl.pem #指定证书吊销列表文件

client-to-client #允许客户端之间通信

max-clients 1000 #设置最大客户端连接数为1000

duplicate-cn #允许相同公共名称的客户端连接,一个账号可以多人同时登录

auth-user-pass-verify /etc/openvpn/server/user/checkpsw.sh via-env #指定验证用户名和密码的脚本

script-security 3 #指定脚本安全级别,必须和客户端设置相同

username-as-common-name #使用用户名作为公共名称

:wq! #保存退出

mkdir -p /etc/openvpn/server/user/ #创建目录

vi /etc/openvpn/server/user/checkpsw.sh #创建密码检查脚本

#!/bin/sh

###########################################################

# checkpsw.sh (C) 2004 Mathias Sundman <mathias@openvpn.se>

#

# This script will authenticate OpenVPN users against

# a plain text file. The passfile should simply contain

# one row per user with the username first followed by

# one or more space(s) or tab(s) and then the password.

PASSFILE="/etc/openvpn/server/user/psw-file"

LOG_FILE="/var/log/openvpn/password.log"

TIME_STAMP=`date "+%Y-%m-%d %T"`

###########################################################

if [ ! -r "${PASSFILE}" ]; then

echo "${TIME_STAMP}: Could not open password file "${PASSFILE}" for reading." >> ${LOG_FILE}

exit 1

fi

CORRECT_PASSWORD=`awk '!/^;/&&!/^#/&&$1=="'${username}'"{print $2;exit}' ${PASSFILE}`

if [ "${CORRECT_PASSWORD}" = "" ]; then

echo "${TIME_STAMP}: User does not exist: username="${username}", password=

"${password}"." >> ${LOG_FILE}

exit 1

fi

if [ "${password}" = "${CORRECT_PASSWORD}" ]; then

echo "${TIME_STAMP}: Successful authentication: username="${username}"." >> ${LOG_FILE}

exit 0

fi

echo "${TIME_STAMP}: Incorrect password: username="${username}", password=

"${password}"." >> ${LOG_FILE}

exit 1

:wq! #保存退出

chmod 700 /etc/openvpn/server/user/checkpsw.sh

chown openvpn:openvpn /etc/openvpn/server/user/checkpsw.sh

vi /etc/openvpn/server/user/psw-file #创建账号密码,前面是账号,后面是密码

client1 123456

client2 123456

:wq! #保存退出

#设置权限

chmod 600 /etc/openvpn/server/user/psw-file

chown openvpn:openvpn /etc/openvpn/server/user/psw-file

# 查看service名

rpm -ql openvpn |grep service

systemctl restart openvpn@server #重启服务

systemctl enable openvpn@server #开机启动

4、拷贝客户端证书

从server上将生成的ca.crt、ta.key、client1.crt、client1.key、client2.crt、client2.key、文件下载到客户端

cp /etc/openvpn/ca.crt /etc/openvpn/client

cp /etc/openvpn/ta.key /etc/openvpn/client

cp /etc/openvpn/EasyRSA/pki/issued/client1.crt /etc/openvpn/client

cp /etc/openvpn/EasyRSA/pki/issued/client2.crt /etc/openvpn/client

cp /etc/openvpn/EasyRSA/pki/private/client1.key /etc/openvpn/client

cp /etc/openvpn/EasyRSA/pki/private/client2.key /etc/openvpn/client

5、编辑,把证书合并到一个文件里面

<ca>

ca.crt里面的内容

</ca>

<cert>

client1.crt里面的内容

</cert>

<key>

client1.key里面的内容

</key>

<tls-auth>

ta.key里面的内容

</tls-auth>

cd /etc/openvpn/client

vi /etc/openvpn/client/client1.ovpn #编辑,把证书合并到这个文件

client #指定配置文件为客户端配置

dev tun #指定使用TUN设备作为通信隧道类型

auth-user-pass #指定要求用户通过用户名和密码进行身份验证

proto tcp #指定使用TCP协议传输数据

sndbuf 0 #和服务端配置一样

rcvbuf 0 #和服务端配置一样

remote 10.189.189.197 1194 #指定连接服务器的IP地址和端口号

resolv-retry infinite #在连接失败时无限重试

nobind #不绑定到特定本地地址和端口

persist-key #和服务端配置一样

persist-tun #和服务端配置一样

remote-cert-tls server #开启证书登录

push "dhcp-option DNS 223.5.5.5" #和服务端配置一样,向客户端推送DNS服务器地址,如果只访问内网,外网流量不通过vpn请注释掉此行

push "dhcp-option DNS 223.5.6.6" #和服务端配置一样,向客户端推送DNS服务器地址,如果只访问内网,外网流量不通过vpn请注释掉此行

auth SHA512 #和服务端配置一样

cipher AES-256-CBC #和服务端配置一样

comp-lzo #和服务端配置一样

setenv opt block-outside-dns #阻止客户端使用除VPN外的DNS,科学上网有用,只访问内网需要注释掉此行

key-direction 1

verb 3

<ca>

-----BEGIN CERTIFICATE-----

MIIDKzCCAhOgAwIBAgIJAKqUKgImWthIMA0GCSqGSIb3DQEBCwUAMBMxETAPBgNV

BAMMCENoYW5nZU1lMB4XDTI0MDMyNjA4MjkwNVoXDTM0MDMyNDA4MjkwNVowEzER

MA8GA1UEAwwIQ2hhbmdlTWUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB

AQDMWdwtgtLkAHsRSg13rHMdrXbEyYMIGX+45XJcV4uByqEYEQetjDVyFjPh5Lqh

3W6+vqUUreZK3LXvLr+P+STznFKlIy6wKAlpZnSCh6QxziDHE6Fkg68T/sjDC4ar

/aEEujYjAXUAqZmjksZq4L+wR3pGyJg6SslaxP9vrfEnQ1fhll//LQbaEDLYdywh

/Ay+lJkVLP5Yv5n/XIDtBF/+eDT92aMGKQWHVGth1+zSIOnnkGs9qO2RJTLESpu4

K/HKCPZkSbnwYx8JiiGj6Mcs1Li7WlFt1jQ782iYq41xgnyJi7vCW9XGAY4ZiDjQ

7DVuU1Xjvij2+bfOZjquEGX1AgMBAAGjgYEwfzAdBgNVHQ4EFgQUSQ4+53IfKl9e

kaisR1vgfmeQd6YwQwYDVR0jBDwwOoAUSQ4+53IfKl9ekaisR1vgfmeQd6ahF6QV

MBMxETAPBgNVBAMMCENoYW5nZU1lggkAqpQqAiZa2EgwDAYDVR0TBAUwAwEB/zAL

BgNVHQ8EBAMCAQYwDQYJKoZIhvcNAQELBQADggEBAEuNnIeQbCTLfLYVyfeD9lKG

JK0mer/TKsnoo5iEnXbER+HnLfQbKh3vYiD22lSJwwkZiRj/Qzy14fspRUYtM21H

Kv32LzvJLiemccGAl3uh01OMXLlNLhL/jwUNxGOe7xG63khb/gnpb0C1cte+l1/F

3VfzgrtlTyxVwPiXOO0H9JBIEeQ7YmI6w5Qk9TCVZsFo78rUQ6fGtK5Oc8g493Xu

AuBuogSfKFK+87vWL5etEF0xeGo5KRz2oGp0/0IcTvafZ/+llsgzIQU+wbIaw/CK

P5o3cXsEup+ZPN85be3lF+sb6N8Jem7a138C4e7joJIz0Fo4uHCnsZ5Vnj43Ffc=

-----END CERTIFICATE-----

</ca>

<cert>

Certificate:

Data:

Version: 3 (0x2)

Serial Number:

9a:d9:7b:d8:5f:11:ae:b2:a8:39:00:16:a8:2c:4d:49

Signature Algorithm: sha256WithRSAEncryption

Issuer: CN=ChangeMe

Validity

Not Before: Mar 26 08:30:31 2024 GMT

Not After : Jun 29 08:30:31 2026 GMT

Subject: CN=client1

Subject Public Key Info:

Public Key Algorithm: rsaEncryption

Public-Key: (2048 bit)

Modulus:

00:e8:d7:63:55:5a:83:14:4f:03:0f:21:80:d3:cd:

4e:45:68:73:91:9b:7b:96:b3:33:53:ec:24:ae:90:

a6:61:60:0f:4b:50:d0:39:47:b9:9e:0f:be:c1:5b:

06:5e:6e:fd:9d:d0:71:31:ae:5f:97:06:d3:51:c6:

61:3d:d6:ec:14:10:80:92:cd:8f:0a:75:f2:97:dc:

0f:fb:8c:6c:37:16:d9:a0:79:3e:93:3f:5e:4e:40:

1c:a8:7b:77:9f:be:34:23:9b:e5:18:67:36:4c:1e:

8e:4a:17:6c:76:21:0c:ce:6a:46:cc:3d:dd:79:ae:

a5:64:43:66:20:ee:69:00:e5:bf:2a:3b:ac:a6:e1:

f3:58:5a:2d:fb:c7:4d:dd:bc:56:65:c5:bd:6a:74:

11:47:16:1f:0f:fd:7d:ad:50:ec:30:70:eb:93:d5:

25:81:f7:ab:70:cb:41:83:ca:76:f8:40:07:e8:e0:

a2:a5:57:d4:a3:25:35:85:44:f0:81:e0:d6:2a:1f:

1c:b5:f5:11:7f:6f:ef:ab:87:89:d2:82:a6:c9:6e:

16:4f:11:aa:89:71:8d:42:73:75:55:34:2b:b2:93:

d3:de:91:ff:03:83:f8:af:f5:b3:5f:7f:36:09:f6:

08:d8:6c:4c:36:0f:e6:90:8c:db:fd:15:2b:55:6c:

e4:27

Exponent: 65537 (0x10001)

X509v3 extensions:

X509v3 Basic Constraints:

CA:FALSE

X509v3 Subject Key Identifier:

79:0E:78:BF:94:BA:5E:4E:DB:66:53:37:78:54:DD:93:2F:CE:22:8C

X509v3 Authority Key Identifier:

keyid:49:0E:3E:E7:72:1F:2A:5F:5E:91:A8:AC:47:5B:E0:7E:67:90:77:A6

DirName:/CN=ChangeMe

serial:AA:94:2A:02:26:5A:D8:48

X509v3 Extended Key Usage:

TLS Web Client Authentication

X509v3 Key Usage:

Digital Signature

Signature Algorithm: sha256WithRSAEncryption

b0:b5:d6:fc:6f:07:29:f3:d3:e6:d4:77:77:d6:e3:79:8b:88:

c2:22:c6:2b:00:9a:c2:ef:39:bc:5e:0e:65:82:da:16:79:d3:

40:38:9d:51:88:2d:8d:e5:dc:33:f1:fb:dc:b2:03:d3:a0:9d:

57:22:79:73:fe:13:2a:4d:f8:b5:0f:56:a8:38:64:5e:6e:90:

88:64:29:fa:9c:54:1c:02:73:4a:10:69:f2:1d:8c:90:de:2e:

9c:88:b8:8c:ce:88:a3:54:38:23:19:63:e8:4e:14:ab:56:b0:

3c:e8:71:a1:88:a1:06:3b:d1:b0:56:56:43:cc:5c:b1:88:73:

32:a6:7c:77:04:35:19:68:75:b7:90:7f:65:f9:3e:93:5a:ad:

4e:38:b1:14:5b:50:07:08:37:25:f8:d7:ac:06:83:1a:b3:ea:

5b:c4:26:15:10:11:cf:be:75:52:1d:b7:35:06:98:fc:5b:dd:

53:4f:5a:de:e0:4a:91:81:85:a8:bf:fe:3a:11:42:b4:58:5f:

84:96:5b:3e:af:55:d5:e9:08:6a:9d:7f:25:f8:70:1f:7b:56:

ce:52:2a:07:37:c8:55:d8:b5:a9:c4:46:7a:fe:50:69:ff:37:

5e:f9:19:4c:eb:ce:90:9e:d4:ea:9d:52:36:26:22:6f:ca:f4:

c4:d1:51:ce

-----BEGIN CERTIFICATE-----

MIIDRTCCAi2gAwIBAgIRAJrZe9hfEa6yqDkAFqgsTUkwDQYJKoZIhvcNAQELBQAw

EzERMA8GA1UEAwwIQ2hhbmdlTWUwHhcNMjQwMzI2MDgzMDMxWhcNMjYwNjI5MDgz

MDMxWjASMRAwDgYDVQQDDAdjbGllbnQxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A

MIIBCgKCAQEA6NdjVVqDFE8DDyGA081ORWhzkZt7lrMzU+wkrpCmYWAPS1DQOUe5

ng++wVsGXm79ndBxMa5flwbTUcZhPdbsFBCAks2PCnXyl9wP+4xsNxbZoHk+kz9e

TkAcqHt3n740I5vlGGc2TB6OShdsdiEMzmpGzD3dea6lZENmIO5pAOW/KjuspuHz

WFot+8dN3bxWZcW9anQRRxYfD/19rVDsMHDrk9UlgfercMtBg8p2+EAH6OCipVfU

oyU1hUTwgeDWKh8ctfURf2/vq4eJ0oKmyW4WTxGqiXGNQnN1VTQrspPT3pH/A4P4

r/WzX382CfYI2GxMNg/mkIzb/RUrVWzkJwIDAQABo4GUMIGRMAkGA1UdEwQCMAAw

HQYDVR0OBBYEFHkOeL+Uul5O22ZTN3hU3ZMvziKMMEMGA1UdIwQ8MDqAFEkOPudy

HypfXpGorEdb4H5nkHemoRekFTATMREwDwYDVQQDDAhDaGFuZ2VNZYIJAKqUKgIm

WthIMBMGA1UdJQQMMAoGCCsGAQUFBwMCMAsGA1UdDwQEAwIHgDANBgkqhkiG9w0B

AQsFAAOCAQEAsLXW/G8HKfPT5tR3d9bjeYuIwiLGKwCawu85vF4OZYLaFnnTQDid

UYgtjeXcM/H73LID06CdVyJ5c/4TKk34tQ9WqDhkXm6QiGQp+pxUHAJzShBp8h2M

kN4unIi4jM6Io1Q4Ixlj6E4Uq1awPOhxoYihBjvRsFZWQ8xcsYhzMqZ8dwQ1GWh1

t5B/Zfk+k1qtTjixFFtQBwg3JfjXrAaDGrPqW8QmFRARz751Uh23NQaY/FvdU09a

3uBKkYGFqL/+OhFCtFhfhJZbPq9V1ekIap1/JfhwH3tWzlIqBzfIVdi1qcRGev5Q

af83XvkZTOvOkJ7U6p1SNiYib8r0xNFRzg==

-----END CERTIFICATE-----

</cert>

<key>

-----BEGIN PRIVATE KEY-----

MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDo12NVWoMUTwMP

IYDTzU5FaHORm3uWszNT7CSukKZhYA9LUNA5R7meD77BWwZebv2d0HExrl+XBtNR

xmE91uwUEICSzY8KdfKX3A/7jGw3FtmgeT6TP15OQByoe3efvjQjm+UYZzZMHo5K

F2x2IQzOakbMPd15rqVkQ2Yg7mkA5b8qO6ym4fNYWi37x03dvFZlxb1qdBFHFh8P

/X2tUOwwcOuT1SWB96twy0GDynb4QAfo4KKlV9SjJTWFRPCB4NYqHxy19RF/b++r

h4nSgqbJbhZPEaqJcY1Cc3VVNCuyk9Pekf8Dg/iv9bNffzYJ9gjYbEw2D+aQjNv9

FStVbOQnAgMBAAECggEAcoZ2smXZsWSHoaqd/g+unw8YQRdT+7Ta2z18cWxumdiw

zR/Lu1DfKLKf5eUKxeobzsLW2lPlapiN2lwUOmF7LwdK5mo7IC8RisZQCi9wjswr

cPYR5EU38o8wSWKpXSYl6Rnl3lHt8BTbcfABhj0NWn4ForIPPKm9agqIskvx0+E9

Ae4TzkFEAJCM7V1vWA2UX4+Wnj7+6oMd8qMEN+1PwtM+IUahTPFJQOc8PAW8tJi9

5h673xbwc+YpnDRU232KQGbto2eH6+eKVIJg50jis86aioLbAle/8272e9iSP1RP

Y8GTqH4czCpgFgs2JSDghUvj0Z1S9Snkd3xiICpRcQKBgQD9yiAYrQKMe7Wxm1J4

TeWBQsZkQPRebCvihj9T/2n4qVISpPZuO7Iuvhj7KNj2733zdiMnO39gw95NtfAn

qLKoavWFHw2BKnIA20Fw5pqnZjSSS2AlBoOQuQOb2iK/BoHt0mlIF2Mlb8Yuefzb

RoEZupdIRQz3Q9ptj+dGD3NL2QKBgQDq3o3wt2Jl0qfLKrZQ0BaFfQ5voWOz9Hqe

15RZ3KaOABSGCKJ7TWX9p0vTehEoZzBm2B5c2OtZea6gsnrC3JuoIuqdQ996ASXg

rU8VhGduDKReQj80cvwSmvcCdhicaQ25OWEUzu+6OWr+CyJu9uUUzm2M4DSrQF1h

AIW92LOv/wKBgG5Iql/utr/TdmZCp7jNqODd4pZoP4jUmtFqIxTeVe+PrLGba9cF

K+3x/6sM2hOciPAGM0p2KWkkVHMSj9S8Ez7qk9yQXO73QekrXimwnB4IZOn5xULx

rLR0IaRVS2oVatqs58FDIHuBMe66Ze3nmmxS0DDAiNzeaInZ0dd5GVIpAoGBAJHr

lYohlUuntkH+lmjc77EdwjNOtNAgK3K2g1/VO9FrcVTY1oH+00flgbGw3Coa+jJb

QXnz9zyO4hTK7oRUZYzvrI3qllSJlAvkAQdgTJZN2m0JgZVHfx7cEm0ADEhY6ILU

iGFSNBSiCbwuFMWWNTtZCS0GOxLOmXVjyrPph7HnAoGBAIF3udcuSAQusciA2ASy

MSBRMkJMVIxANWDgvMdOdTGWRbXA/IlKwyLDFXgZoQK/YGiLmWUaz50cy8hAJBL7

TOlL8arJzruVgnrjqhj3WDBZvogx05k3J85PRQ8dDad9BMCPWmFn+I5jGWv8rgVB

NpRp9zvWjwELAiOqQpUPfZa5

-----END PRIVATE KEY-----

</key>

<tls-auth>

#

# 2048 bit OpenVPN static key

#

-----BEGIN OpenVPN Static key V1-----

d2db59c6690bb3f05ce331fc66464f9f

5382329a16b515ebe402ae1458a97673

c160507123c76373f7be093b200ab838

9309113dafa8db1d1b1b80d9f7e355d9

25a2cecaa533d74d80951a0ecf50a334

15cb9d7fe1d3c828f20e2694e46982ae

49e32e889a401ad733b10bbfbffcaa13

d39ea0e0a324bde71064e3e5e83ed3a8

d7e5921528d4b0c75db07ee2ca271009

68b6343bcc5303446320a48dd1c2cc12

1937f4c2cbb180cf261caebb20447840

be1f9591ade5ced4056958150b6e107b

a7d14fe439576b9c270ce165c1b8346f

e31b66d96c5225e052ac75cc3e62c43d

ab4ac08a0807d3c2afc426bdd1325070

bc21d96dee5123ea5a2bf7f982570c16

-----END OpenVPN Static key V1-----

</tls-auth>

:wq! #保存退出

6、设置iptables防火墙转发规则,否则登录之后无法访问网络

iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT

iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to 10.189.189.197

iptables-save > /etc/sysconfig/iptables #保存规则

systemctl restart iptables.service #启动防火墙使配置生效

cat /etc/sysconfig/iptables #防火墙配置文件

# Generated by iptables-save v1.4.21 on Tue Mar 19 15:57:47 2024

*nat

:P REROUTING ACCEPT [12975:2079674]

:INPUT ACCEPT [134:8032]

:OUTPUT ACCEPT [166:12426]

:P OSTROUTING ACCEPT [167:12486]

-A POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to-source 10.189.189.197

COMMIT

# Completed on Tue Mar 19 15:57:47 2024

# Generated by iptables-save v1.4.21 on Tue Mar 19 15:57:47 2024

*filter

:INPUT ACCEPT [0:0]

:FORWARD ACCEPT [0:0]

:OUTPUT ACCEPT [108908:56620509]

-A INPUT -p tcp -m tcp --dport 1194 -j ACCEPT

-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

-A INPUT -p icmp -j ACCEPT

-A INPUT -i lo -j ACCEPT

-A INPUT -p tcp -m state --state NEW -m tcp --dport 1194 -j ACCEPT

-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT

-A INPUT -j REJECT --reject-with icmp-host-prohibited

-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

-A FORWARD -s 10.8.0.0/24 -j ACCEPT

-A FORWARD -j REJECT --reject-with icmp-host-prohibited

COMMIT

# Completed on Tue Mar 19 15:57:47 2024

7、设置目录权限

chown openvpn:openvpn /etc/openvpn/ -R #设置权限,重要,否则客户端登录不上去

systemctl restart openvpn@server #重启服务

三、测试篇

下载/etc/openvpn/client/client1.ovpn到本地客户端

Windows客户端

C:\Program Files\OpenVPN\config

放到这个目录

安装openvpn客户端

客户端下载地址::https://www.techspot.com/downloads/5182-openvpn.html

安装完成之后打开客户端导入配置文件:client1.ovpn

输入用户名密码进行连接

直接输入内网地址即可访问办公室服务器

特别说明:

要实现只让特定流量通过 VPN 连接,而其他流量绕过 VPN 直接连接到互联网。

服务端配置文件只设置这个一个push,其他的push删掉

push "route 10.189.189.0 255.255.255.0" #vpn服务器所在的内网段,向客户端推送这条路由信息

客户端配置文件,删掉下面的这个参数

;setenv opt block-outside-dns #阻止客户端使用除VPN外的DNS,科学上网有用,只访问内网需要注释掉此行

至此,Linux系统安装部署Open-VPN服务器完成。

     

  系统运维技术交流QQ群:①185473046 系统运维技术交流□Ⅰ ②190706903 系统运维技术交流™Ⅱ ③203744115 系统运维技术交流™Ⅲ

给我留言

您必须 [ 登录 ] 才能发表留言!



Copyright© 2011-2024 系统运维 All rights reserved
版权声明:本站所有文章均为作者原创内容,如需转载,请注明出处及原文链接
陕ICP备11001040号-3