{"id":4833,"date":"2024-11-05T11:54:12","date_gmt":"2024-11-05T03:54:12","guid":{"rendered":"https:\/\/www.aqwu.net\/wp\/?p=4833"},"modified":"2024-11-05T11:57:35","modified_gmt":"2024-11-05T03:57:35","slug":"%e5%9c%a8-centos-%e4%b8%8a%e5%88%9b%e5%bb%baopenvpn-server%e5%92%8c%e9%85%8d%e7%bd%aeclient","status":"publish","type":"post","link":"https:\/\/www.aqwu.net\/wp\/?p=4833","title":{"rendered":"\u5728 Centos \u4e0a\u521b\u5efaOpenvpn Server\u548c\u914d\u7f6eClient"},"content":{"rendered":"\n

\u4e00\u3001\u5b89\u88c5 Openvpn Server<\/strong><\/h2>\n\n\n\n

\u5728 CentOS \u4e0a\u5feb\u901f\u5b89\u88c5 OpenVPN \u670d\u52a1\u7684\u6b65\u9aa4\u5982\u4e0b\uff1a<\/p>\n\n\n\n

1. \u66f4\u65b0\u7cfb\u7edf<\/h3>\n\n\n\n
sudo yum update -y\n<\/pre><\/div>\n\n\n\n
2. \u5b89\u88c5 EPEL \u6e90\u5e76\u5b89\u88c5 OpenVPN \u548c Easy-RSA<\/h3>\n\n\n\n
sudo yum install epel-release -y\nsudo yum install openvpn easy-rsa -y\n<\/pre><\/div>\n\n\n\n
3. \u624b\u52a8\u521b\u5efa\u76ee\u5f55\u5e76\u590d\u5236 Easy-RSA<\/code> \u6587\u4ef6<\/h3>\n\n\n\n
mkdir -p ~\/openvpn-ca\ncp -r \/usr\/share\/easy-rsa\/3\/* ~\/openvpn-ca\/\ncd ~\/openvpn-ca\n<\/pre><\/div>\n\n\n\n
4. \u521d\u59cb\u5316 Easy-RSA<\/code> \u73af\u5883<\/h3>\n\n\n\n
.\/easyrsa init-pki\n<\/pre><\/div>\n\n\n\n
5. \u914d\u7f6e CA \u548c\u8bc1\u4e66<\/h3>\n\n\n\n
\u5b8c\u6210\u4e0a\u8ff0\u6b65\u9aa4\u540e\uff0c\u4f60\u53ef\u4ee5\u7ee7\u7eed\u4ece\u4ee5\u4e0b\u6b65\u9aa4\u914d\u7f6e CA \u548c\u8bc1\u4e66\uff1a<\/p>\n\n\n\n
5.1 \u751f\u6210 CA \u8bc1\u4e66<\/h4>\n\n\n\n
.\/easyrsa build-ca<\/pre><\/div>\n\n\n\n
5.2 \u751f\u6210\u670d\u52a1\u5668\u8bc1\u4e66\u548c\u5bc6\u94a5<\/h4>\n\n\n\n
.\/easyrsa build-server-full server nopass\n<\/pre><\/div>\n\n\n\n
5.3 \u751f\u6210 Diffie-Hellman \u53c2\u6570<\/h4>\n\n\n\n
.\/easyrsa gen-dh\n<\/pre><\/div>\n\n\n\n
6.\u751f\u6210\u5ba2\u6237\u7aef\u8bc1\u4e66\u548c\u5bc6\u94a5<\/h3>\n\n\n\n
\u4e3a\u6bcf\u4e2a\u5ba2\u6237\u7aef\u751f\u6210\u4e00\u4e2a\u552f\u4e00\u7684\u8bc1\u4e66\u548c\u5bc6\u94a5\u3002\u4ee5\u4e0b\u4ee5 client1<\/code> \u4e3a\u4f8b\uff1a<\/p>\n\n\n\n
.\/easyrsa build-client-full client1 nopass\n<\/pre><\/div>\n\n\n\n
7. \u590d\u5236\u8bc1\u4e66\u548c\u5bc6\u94a5\u5230 OpenVPN \u914d\u7f6e\u76ee\u5f55<\/h3>\n\n\n\n
\u5c06\u751f\u6210\u7684\u8bc1\u4e66\u548c\u5bc6\u94a5\u6587\u4ef6\u590d\u5236\u5230 OpenVPN \u76ee\u5f55\u4e2d\uff1a<\/p>\n\n\n\n
mkdir -p \/etc\/openvpn\/server\nsudo cp pki\/ca.crt pki\/issued\/server.crt pki\/private\/server.key pki\/dh.pem \/etc\/openvpn\/server\n<\/pre><\/div>\n\n\n\n
\u5bf9\u4e8e\u5ba2\u6237\u7aef\u8bc1\u4e66\uff0c\u53ef\u4ee5\u590d\u5236\u5230 \/etc\/openvpn\/clients\/<\/code> \u6216\u5176\u4ed6\u5408\u9002\u7684\u4f4d\u7f6e\uff1a<\/p>\n\n\n\n
mkdir -p ~\/client-configs\/keys\ncp pki\/ca.crt pki\/issued\/client1.crt pki\/private\/client1.key ~\/client-configs\/keys\/\n<\/pre><\/div>\n\n\n\n
8. \u751f\u6210 ta.key<\/code> \u6587\u4ef6<\/strong><\/h3>\n\n\n\n
sudo openvpn --genkey --secret \/etc\/openvpn\/server\/ta.key\n<\/pre><\/div>\n\n\n\n
9. \u914d\u7f6e OpenVPN \u670d\u52a1\u5668<\/h3>\n\n\n\n
\u590d\u5236\u9ed8\u8ba4\u7684\u914d\u7f6e\u6587\u4ef6\u5e76\u8fdb\u884c\u4fee\u6539\uff1a<\/p>\n\n\n\n
sudo cp \/usr\/share\/doc\/openvpn*\/sample\/sample-config-files\/server.conf \/\/etc\/openvpn\/server\/server.conf\n<\/pre><\/div>\n\n\n\n
\u7136\u540e\u7f16\u8f91 \/etc\/openvpn\/server\/server.conf<\/code>\uff0c\u4fee\u6539\u4ee5\u4e0b\u5173\u952e\u53c2\u6570\uff1a<\/p>\n\n\n\n
    \n
  • \u8bc1\u4e66\u548c\u5bc6\u94a5\u8def\u5f84<\/strong><\/li>\n<\/ul>\n\n\n\n
    ca ca.crt\ncert server.crt\nkey server.key\ndh dh.pem\n<\/pre><\/div>\n\n\n\n
    \u5f00\u542f\u5ba2\u6237\u7aef\u4e4b\u95f4\u7684\u901a\u4fe1<\/strong> \u5c06 client-to-client<\/code> \u884c\u53d6\u6d88\u6ce8\u91ca\uff0c\u5141\u8bb8\u5ba2\u6237\u7aef\u4e4b\u95f4\u901a\u4fe1\u3002<\/p>\n\n\n\n
    \u542f\u7528 NAT<\/strong> \u786e\u4fdd\u542f\u7528 IP \u8f6c\u53d1\uff0c\u7f16\u8f91 \/etc\/sysctl.conf<\/code> \u6587\u4ef6\uff0c\u8bbe\u7f6e\u4ee5\u4e0b\u5185\u5bb9\uff1a<\/p>\n\n\n\n
    net.ipv4.ip_forward = 1\n<\/pre><\/div>\n\n\n\n
    \u8fd0\u884c\u4ee5\u4e0b\u547d\u4ee4\u4f7f\u5176\u751f\u6548\uff1a<\/p>\n\n\n\n
    sudo sysctl -p\n<\/pre><\/div>\n\n\n\n
    10. \u5b8c\u6574\u7684 server.conf<\/code> \u914d\u7f6e\u6587\u4ef6<\/h3>\n\n\n\n
    \u53ef\u4ee5\u53c2\u7167\u4e0b\u9762\u7684\u914d\u7f6e<\/p>\n\n\n\n
    port 1194\nproto udp\ndev tun\nca ca.crt\ncert server.crt\nkey server.key  # This file should be kept secret\ndh none\nserver 10.8.0.0 255.255.255.0\nifconfig-pool-persist \/var\/log\/openvpn\/ipp.txt\npush \"redirect-gateway def1 bypass-dhcp\"\npush \"dhcp-option DNS 208.67.222.222\"\npush \"dhcp-option DNS 208.67.220.220\"\nduplicate-cn\nkeepalive 10 120\ntls-crypt ta.key\ncipher AES-256-GCM\nauth SHA256\npersist-key\npersist-tun\nstatus \/var\/log\/openvpn\/openvpn-status.log\nverb 3\nexplicit-exit-notify 1\n\n<\/pre><\/div>\n\n\n\n
    \u5982\u679c\u6ca1\u6709 \/var\/log\/openvpn\/ \u8def\u5f84\uff0c\u8bf7\u4f7f\u7528\u4e0b\u9762\u7684\u547d\u4ee4\u521b\u5efa<\/p>\n\n\n\n
    mkdir -p \/var\/log\/openvpn\/<\/pre><\/div>\n\n\n\n
    11. \u914d\u7f6e\u9632\u706b\u5899<\/h3>\n\n\n\n
    \u786e\u4fdd\u9632\u706b\u5899\u5141\u8bb8 OpenVPN \u6d41\u91cf\uff0c\u901a\u8fc7\u4ee5\u4e0b\u547d\u4ee4\u6dfb\u52a0\u9632\u706b\u5899\u89c4\u5219\uff1a<\/p>\n\n\n\n
    sudo systemctl enable firewalld\n\nsudo systemctl start firewalld\n\nsudo firewall-cmd --zone=public --add-service=openvpn --permanent\nsudo firewall-cmd --zone=public --add-masquerade --permanent\nsudo firewall-cmd --reload\n<\/pre><\/div>\n\n\n\n
    \u53ef\u4ee5\u4f7f\u7528\u4ee5\u4e0b\u547d\u4ee4\u68c0\u67e5 firewalld<\/code> \u7684 masquerade \u8bbe\u7f6e\u662f\u5426\u5df2\u751f\u6548\uff1a<\/p>\n\n\n\n
    sudo firewall-cmd --zone=public --query-masquerade\n<\/pre><\/div>\n\n\n\n
    \u5982\u679c\u8fd4\u56de yes<\/code>\uff0c\u5219 NAT \u8f6c\u53d1\u5df2\u6210\u529f\u542f\u7528\u3002\u5b8c\u6210\u540e\uff0c\u518d\u6b21\u5c1d\u8bd5\u5ba2\u6237\u7aef\u7684\u8fde\u63a5\u6d4b\u8bd5\u3002<\/p>\n\n\n\n
    12. \u542f\u52a8 OpenVPN \u670d\u52a1\uff08\u5728 CentOS 7+\uff09<\/h3>\n\n\n\n
    \u5728 CentOS 7 \u53ca\u4ee5\u4e0a\u7248\u672c\uff0cOpenVPN \u53ef\u80fd\u4f1a\u4f7f\u7528 openvpn-server@<\/code> \u670d\u52a1\u5355\u5143\u800c\u4e0d\u662f openvpn@<\/code>\u3002\u8bd5\u8bd5\u4ee5\u4e0b\u547d\u4ee4\uff1a<\/p>\n\n\n\n
    sudo systemctl start openvpn-server@server\nsudo systemctl enable openvpn-server@server\n<\/pre><\/div>\n\n\n\n
     \u68c0\u67e5\u670d\u52a1\u72b6\u6001<\/strong><\/p>\n\n\n\n
    sudo systemctl status openvpn-server@server\n<\/pre><\/div>\n\n\n\n
    \u68c0\u67e5\u7cfb\u7edf\u65e5\u5fd7<\/strong><\/p>\n\n\n\n
    sudo journalctl -xe\n<\/pre><\/div>\n\n\n\n
    \u5c1d\u8bd5\u624b\u52a8\u8fd0\u884c OpenVPN \u8fdb\u884c\u8c03\u8bd5<\/strong><\/p>\n\n\n\n
    \u4f60\u4e5f\u53ef\u4ee5\u624b\u52a8\u8fd0\u884c OpenVPN \u6765\u76f4\u63a5\u67e5\u770b\u9519\u8bef\u4fe1\u606f\uff1a<\/p>\n\n\n\n
    sudo openvpn --config \/etc\/openvpn\/server\/server.conf\n<\/pre><\/div>\n\n\n\n
    \u4e8c\u3001\u914d\u7f6e Openvpn <\/strong>\u5ba2\u6237\u7aef<\/h2>\n\n\n\n
    1. \u51c6\u5907\u5ba2\u6237\u7aef\u914d\u7f6e\u6587\u4ef6<\/h3>\n\n\n\n
    \u521b\u5efa\u5ba2\u6237\u7aef\u914d\u7f6e\u6587\u4ef6 client1.ovpn<\/code>\uff0c\u5185\u5bb9\u5982\u4e0b\uff1a<\/p>\n\n\n\n
    client\ndev tun\nproto udp\nremote YOUR_SERVER_IP 1194\nresolv-retry infinite\nnobind\npersist-key\npersist-tun\nremote-cert-tls server\ncipher AES-256-GCM\nauth SHA256\nkey-direction 1\n#ignore-unknown-option block-outside-dns\ntun-mtu 1400\nmssfix 1360\nverb 3\n\n<ca>\n# \u5c06 ca.crt \u7684\u5185\u5bb9\u590d\u5236\u5230\u8fd9\u91cc\n<\/ca>\n\n<cert>\n# \u5c06 client1.crt \u7684\u5185\u5bb9\u590d\u5236\u5230\u8fd9\u91cc\n<\/cert>\n\n<key>\n# \u5c06 client1.key \u7684\u5185\u5bb9\u590d\u5236\u5230\u8fd9\u91cc\n<\/key>\n\n<tls-crypt>\n# \u5c06 ta.key \u7684\u5185\u5bb9\u590d\u5236\u5230\u8fd9\u91cc\n<\/tls-crypt>\n\n<\/pre><\/div>\n\n\n\n
    \u5c06 YOUR_SERVER_IP<\/code> \u66ff\u6362\u4e3a\u60a8\u7684 OpenVPN \u670d\u52a1\u5668\u7684\u5b9e\u9645 IP \u5730\u5740\u3002<\/strong><\/p>\n\n\n\n
    2. \u5c06\u8bc1\u4e66\u548c\u5bc6\u94a5\u5185\u5bb9\u590d\u5236\u5230\u914d\u7f6e\u6587\u4ef6\u4e2d<\/h3>\n\n\n\n
    \u5728 client1.ovpn<\/code> \u6587\u4ef6\u4e2d\uff0c\u5c06 <ca><\/code>, <cert><\/code>, <key><\/code>, <tls-crypt><\/code> \u6807\u7b7e\u66ff\u6362\u4e3a\u5b9e\u9645\u8bc1\u4e66\u548c\u5bc6\u94a5\u7684\u5185\u5bb9\u3002\u786e\u4fdd\u6bcf\u4e2a\u6807\u7b7e\u5305\u542b\u5bf9\u5e94\u7684\u6587\u4ef6\u5185\u5bb9\uff0c\u4f8b\u5982\uff1a<\/p>\n\n\n\n
    <ca>\n-----BEGIN CERTIFICATE-----\n...CA \u8bc1\u4e66\u5185\u5bb9...\n-----END CERTIFICATE-----\n<\/ca>\n<\/pre><\/div>\n\n\n\n
    3. \u5bfc\u5165\u5ba2\u6237\u7aef\u914d\u7f6e\u6587\u4ef6<\/h3>\n\n\n\n
    \u5c06 client1.ovpn<\/code> \u6587\u4ef6\u5bfc\u5165\u5230 OpenVPN \u5ba2\u6237\u7aef\uff08\u9002\u7528\u4e8e Windows\u3001Mac\u3001Linux \u53ca\u79fb\u52a8\u8bbe\u5907\u7684 OpenVPN \u5e94\u7528\uff09\u3002\u5728\u5ba2\u6237\u7aef\u5e94\u7528\u4e2d\u9009\u62e9 client1.ovpn<\/code> \u6587\u4ef6\u5e76\u8fde\u63a5\u3002<\/p>\n\n\n\n
    4. \u8fde\u63a5\u6d4b\u8bd5<\/h3>\n\n\n\n
    \u542f\u52a8 OpenVPN \u5ba2\u6237\u7aef\uff0c\u9009\u62e9\u914d\u7f6e\u6587\u4ef6\u8fdb\u884c\u8fde\u63a5\u3002\u5ba2\u6237\u7aef\u5e94\u6210\u529f\u8fde\u63a5\u5230\u670d\u52a1\u5668\uff0c\u83b7\u5f97 VPN IP \u5730\u5740\u3002<\/p>\n\n\n\n
    <\/p>\n","protected":false},"excerpt":{"rendered":"
    \u4e00\u3001\u5b89\u88c5 Openvpn Server \u5728 CentOS \u4e0a\u5feb\u901f\u5b89\u88c5 OpenVPN \u670d\u52a1\u7684\u6b65\u9aa4\u5982\u4e0b\uff1a 1.  […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"set","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[59],"tags":[388],"class_list":["post-4833","post","type-post","status-publish","format-standard","hentry","category-linux","tag-openvpn"],"views":1742,"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/www.aqwu.net\/wp\/index.php?rest_route=\/wp\/v2\/posts\/4833","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.aqwu.net\/wp\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.aqwu.net\/wp\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.aqwu.net\/wp\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.aqwu.net\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4833"}],"version-history":[{"count":3,"href":"https:\/\/www.aqwu.net\/wp\/index.php?rest_route=\/wp\/v2\/posts\/4833\/revisions"}],"predecessor-version":[{"id":4836,"href":"https:\/\/www.aqwu.net\/wp\/index.php?rest_route=\/wp\/v2\/posts\/4833\/revisions\/4836"}],"wp:attachment":[{"href":"https:\/\/www.aqwu.net\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4833"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.aqwu.net\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4833"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.aqwu.net\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4833"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}