当前位置: 代码迷 >> Web前端 >> OpenVPN装配与配置实践
  详细解决方案

OpenVPN装配与配置实践

热度:319   发布时间:2012-09-02 21:00:34.0
OpenVPN安装与配置实践

?

OpenVPN在安全性上比PPTP,L2TP和IPsec都高,因为它通过三个证书的安全验证,实现了整个通信链路的完整加密。

注:该文档参考了VPSYOU.com的帮助文档,在此表示感谢。
帮助文档链接如下:http://www.vpsyou.com/centos5-5-install-openvpn/

但在实际的安装配置过程中,我发现这篇帮助文档中仍然存在着一些小的配置上的错误,并且为了让OpenVPN易于卸载,我将分散的程序目录都规划在了相同位置,加上了防火墙策略,最后成功登陆并翻过GFW。于是,我将整个过程记录了下来,以供大家参考。

安装步骤:

一、首先检查VPS上的tun设备是否可用,如果不可用需要联系客服打开,否则OpenVPN无法启用。
通过root用户登陆,执行
#cat /dev/net/tun
cat: /dev/net/tun: File descriptor in bad state

如果现实结果如上所示,则表示tun设备可用,其它则表示设备异常,无法安装OpenVPN

二、下载安装所需软件包:
wget ftp://rpmfind.net/linux/epel/5/i386/pkcs11-helper-devel-1.07-2.el5.1.i386.rpm
wget ftp://rpmfind.net/linux/epel/5/i386/pkcs11-helper-1.07-2.el5.1.i386.rpm
wget http://www.oberhumer.com/opensource/lzo/download/lzo-2.04.tar.gz
wget http://swupdate.openvpn.net/community/releases/openvpn-2.1.4.tar.gz

三、使用yum安装程序所需开发包
yum install -y openssl openssl-devel automake pkgconfig iptables

四、安装OpenVPN服务端
1.安装pkcs11-helper RPM包
rpm -ivh pkcs11-helper-1.07-2.el5.1.i386.rpm
rpm -ivh pkcs11-helper-devel-1.07-2.el5.1.i386.rpm

2.安装 LZO
tar zxvf lzo-2.04.tar.gz
cd lzo-2.04/
./configure --prefix=/opt/lzo
make
make check
make install
cd ../

3.安装 OpenVPN

tar zxvf openvpn-2.1.4.tar.gz
cd openvpn-2.1.4
./configure --prefix=/opt/openvpn --with-lzo-headers=/opt/lzo/include --with-lzo-lib=/opt/lzo/lib --with-ssl-headers=/usr/include/openssl --with-ssl-lib=/usr/lib
make
make install
cd ../

然后,下面就开始了key证书文件的创建,总共需要创建三个,即ca,server key,client key。

4.生成证书Key
cp -r easy-rsa /opt/openvpn/
cd /opt/openvpn/easy-rsa/2.0/

vim export_new_var

export D=`pwd`
export KEY_CONFIG=$D/openssl.cnf
export KEY_DIR=$D/keys
export KEY_SIZE=1024
export KEY_COUNTRY=CN #国家
export KEY_PROVINCE=BJ #省份
export KEY_CITY=BJ   #城市
export KEY_ORG="heyLinux.com" #组织
export KEY_EMAIL="root@heyLinux.com" #邮箱

source export_new_var
./clean-all

./build-ca

Generating a 1024 bit RSA private key
..++++++
...........++++++
writing new private key to 'ca.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]:
State or Province Name (full name) [BJ]:
Locality Name (eg, city) [BJ]:
Organization Name (eg, company) [heyLinux.com]:
Organizational Unit Name (eg, section) []:heyLinux
Common Name (eg, your name or your server's hostname) [heyLinux.com CA]:heyLinux
.com
Name []:heyLinux
Email Address [root@heyLinux.com]:

5.建立 server key

[root@centos 2.0]# ./build-key-server server
Generating a 1024 bit RSA private key
............................++++++
..........++++++
writing new private key to 'server.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]:
State or Province Name (full name) [BJ]:
Locality Name (eg, city) [BJ]:
Organization Name (eg, company) [heyLinux.com]:
Organizational Unit Name (eg, section) []:heyLinux
Common Name (eg, your name or your server's hostname) [server]:heyLinux.com
Name []:heyLinux
Email Address [root@heyLinux.com]:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:123456
An optional company name []:heyLinux.com
Using configuration from /etc/openvpn/easy-rsa/2.0/openssl.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName           :PRINTABLE:'CN'
stateOrProvinceName   :PRINTABLE:'BJ'
localityName          :PRINTABLE:'BJ'
organizationName      :PRINTABLE:'heyLinux.com'
organizationalUnitName:PRINTABLE:'heyLinux'
commonName            :PRINTABLE:'heyLinux.com'
name                  :PRINTABLE:'heyLinux'
emailAddress          :IA5STRING:'root@heyLinux.com'
Certificate is to be certified until Apr 12 08:21:52 2021 GMT (3650 days)
Sign the certificate? [y/n]:y

6.生成客户端 key

[root@centos 2.0]# ./build-key client1
Generating a 1024 bit RSA private key
................................................................................
.........++++++
......................++++++
writing new private key to 'client1.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]:
State or Province Name (full name) [BJ]:
Locality Name (eg, city) [BJ]:
Organization Name (eg, company) [heyLinux.com]:
Organizational Unit Name (eg, section) []:heyLinux
Common Name (eg, your name or your server's hostname) [client1]:
Name []:heyLinux
Email Address [root@heyLinux.com]:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:123456
An optional company name []:heyLinux.com
Using configuration from /etc/openvpn/easy-rsa/2.0/openssl.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName           :PRINTABLE:'CN'
stateOrProvinceName   :PRINTABLE:'BJ'
localityName          :PRINTABLE:'BJ'
organizationName      :PRINTABLE:'heyLinux.com'
organizationalUnitName:PRINTABLE:'heyLinux'
commonName            :PRINTABLE:'client1'
name                  :PRINTABLE:'heyLinux'
emailAddress          :IA5STRING:'root@heyLinux.com'
Certificate is to be certified until Apr 12 08:24:33 2021 GMT (3650 days)
Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

如果想生成多个client key的话,重复以上步骤,修改client1为client2,client3……即可。

至此,所有的key都已经生成完毕,如果你想删除这些key,重新生成的话,执行以下命令。
source var
./clean-all

7.生成 Diffie Hellman 参数
./build-dh

8.将 keys 下的所有文件打包下载到本地
tar -cf keys.tar keys

9.创建服务端配置文件

vi /opt/openvpn/etc/server.conf
内容如下:

port 1194
proto udp

dev tun

ca /opt/openvpn/easy-rsa/2.0/keys/ca.crt
cert /opt/openvpn/easy-rsa/2.0/keys/server.crt
key /opt/openvpn/easy-rsa/2.0/keys/server.key
dh /opt/openvpn/easy-rsa/2.0/keys/dh1024.pem

server 10.10.20.0 255.255.255.0

client-to-client
keepalive 10 120

comp-lzo

persist-key
persist-tun
status /opt/openvpn/easy-rsa/2.0/keys/openvpn-status.log
verb 4

push "dhcp-option DNS 10.10.20.1"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"

10.创建客户端配置文件

vi /opt/openvpn/etc/client.conf
内容如下

client

dev tun
proto udp

remote 204.74.215.57 1194 #请换成自己ip
persist-key
persist-tun
ca /opt/openvpn/easy-rsa/2.0/keys/ca.crt
cert /opt/openvpn/easy-rsa/2.0/keys/client1.crt
key /opt/openvpn/easy-rsa/2.0/keys/client1.key
ns-cert-type server
comp-lzo
verb 3

redirect-gateway def1
route-method exe
route-delay 2

12.设置 OpenVPN 服务器 reboot后自动启动 openvpn

vi /etc/rc.local
加入:
/opt/openvpn/sbin/openvpn --config /opt/openvpn/etc/server.conf > /dev/null 2>&1 &

运行OpenVPN服务端
/opt/openvpn/sbin/openvpn --config /opt/openvpn/etc/server.conf > /dev/null 2>&1 &

检查服务端是否启动
执行netstat -lnp
如果看到有 0.0.0.0:1194 则证明服务端已经成功启动。

五、防火墙规则设置
1.开放OpenVPN服务器端口
iptables -A INPUT -p udp -m state --state NEW -m udp --dport 1194 -j ACCEPT
2.启用NAT映射,实现共享上网
iptables -t nat -A POSTROUTING -s 10.10.20.0/255.255.255.0 -o eth0 -j MASQUERADE
3.开启数据转发
sysctl -w net.ipv4.ip_forward=1

六、OpenVPN GUI for Windows 客户端安装
1.下载并安装 .NET Framwork 3.5 SP1
由于OpenVPN客户端需要 .NET Framwork 3.5 SP1 以上的支持,所以很遗憾,我们不得不先安装它。
下载地址:http://www.microsoft.com/downloads/zh-cn/details.aspx?FamilyID=333325fd-ae52-4e35-b531-508d977d32a6&DisplayLang=zh-cn

2.下载并安装OpenVPN客户端
下载地址:http://swupdate.openvpn.net/downloads/openvpn-client.msi

3.创建客户端配置文件

进入程序目录,C:\Program Files\OpenVPN Technologies\OpenVPN Client\etc\profile
创建配置文件client.ovpn,内容如下:

client 

dev tun
proto udp 

remote 204.74.215.57 1194 #请换成自己ip

persist-key
persist-tun
ca ca.crt
cert client1.crt
key client1.key
ns-cert-type server
comp-lzo
verb 3 

redirect-gateway def1
route-method exe
route-delay 2

4.将所需的证书等文件放入客户端目录
将之前压缩的keys.tar压缩文件解压,并将目录下的所有文件移动到目录:
C:\Program Files\OpenVPN Technologies\OpenVPN Client\etc\profile

5.启动OpenVPN客户端
启动OpenVPN客户端软件,点击添加连接配置,选择本地文件导入,然后导入刚刚创建的client.ovpn文件。
如下图所示:

然后界面上会出现一个Client1选项,点击即可登录

登录成功

至此,整个OpenVPN的安装过程就已经完成了,如果你也是国外的VPS主机的话,那就开始体验翻过GFW的快乐吧。

七、卸载OpenVPN
如果你觉得OpenVPN用起来太过于麻烦或其它原因想卸载OpenVPN,那么,请执行以下操作。

killall openvpn
rpm -e pkcs11-helper-1.07-2.el5.1.i386.rpm
rpm -e pkcs11-helper-devel-1.07-2.el5.1.i386.rpm

rm -rf /opt/lzo
rm -rf /opt/openvpn

  相关解决方案