CentOS6下搭建OpenVPN服务器

CentOS 前端之家
前端之家收集整理的这篇文章主要介绍了CentOS6下搭建OpenVPN服务器，前端之家小编觉得挺不错的，现在分享给大家，也给大家做个参考。
OpenVPN是一个用于创建虚拟专用网络(Virtual Private Network)加密通道的免费开源软件。使用OpenVPN可以方便地在家庭、办公场所、住宿酒店等不同网络访问场所之间搭建类似于局域网的专用网络通道。OpenVPN使用方便，运行性能优秀，支持Solaris、 Linux 2.2+( linux 2.2+表示Linux 2.2及以上版本，下同)、OpenBSD 3.0+、FreeBSD、NetBSD、Mac OS X、 Android和Windows 2000+的 操作系统，并且采用了高强度的数据加密，再加上其开源免费的特性，使得OpenVPN成为中小型企业及个人的VPN首选产品。使用OpenVPN配合特定的代理服务器，可用于访问Youtube、FaceBook、Twitter等受限网站，也可用于突破公司的网络限制。
• 工具/原料

服务器端：CentOS6.5
客 户 端：Windows7
服务器端软件：epel-release-6-8.noarch.rpm，openvpn，easy-rsa
客户端软件： openvpn-install-2.3.4

• 服务器端安装及配置

1. 关闭SELINUX

  1.  setenforce0      //暂时关闭
  2.  sed -i '^SELINUX=/c\SELINUX=disabled'  /etc/selinux/config      //重启有效

2.安装"EPEL"源

  1.  wget http://dl.fedoraproject.org/pub/epel/6/i386/epel-release-6-8.noarch.rpm     //下载centos6 32位的EPEL源
  2.  rpm -ivh epel-release-6-8.noarch.rpm     //安装EPEL源
  3.  yum makecache     //更新本地缓存

3. 安装openvpn

  1. yum -y install openvpn easy-rsa

4. easy-rsa配置

  1.  mkdir -p /etc/openvpn/easy-rsa/keys
  2.  cp -rf/usr/share/easy-rsa/2.0/* /etc/openvpn/easy-rsa/

5. 创建CA证书和密钥

  1.  vi /etc/openvpn/easy-rsa/vars         //更改你自己的国家，省份，城市，邮箱等...
  2.  source  ./vars         //初始化证书的授权中心
  3. cd /etc/openvpn/easy-rsa
  4. ./clean-all           //清除keys目录下面的文件
  5.  ./build-ca         //创建ca证书
  6.  
  7. Generating a 1024 bit RSA private key
  8. .++++++
  9. ......................++++++
  10. writing new private key to 'ca.key'
  11. -----
  12. You are about to be asked to enter information that will be incorporated
  13. into your certificate request.
  14. What you are about to enter is what is called a Distinguished Name or a DN.
  15. There are quite a few fields but you can leave some blank
  16. For some fields there will be a default value,If you enter '.',the field will be left blank.
  17. -----
  18. Country Name (2 letter code) [CN]:
  19. State or Province Name (full name) [CA]:
  20. Locality Name (eg,city) [HZ]:
  21. Organization Name (eg,company) [HZ]:
  22. Organizational Unit Name (eg,section) [changeme]:
  23. Common Name (eg,your name or your server's hostname) [changeme]:
  24. Name [changeme]:
  25. Email Address [mail@host.domain]:

6.创建服务端的证书和密钥

  1. ./build-key-server server
  2.  
  3. Generating a 1024 bit RSA private key
  4. .....++++++
  5. .................++++++
  6. writing new private key to 'server.key'
  7. -----
  8. You are about to be asked to enter information that will be incorporated
  9. into your certificate request.
  10. What you are about to enter is what is called a Distinguished Name or a DN.
  11. There are quite a few fields but you can leave some blank
  12. For some fields there will be a default value,your name or your server's hostname) [server]:
  13. Name [changeme]:
  14. Email Address [mail@host.domain]:
  15.   
  16. Please enter the following 'extra' attributes
  17. to be sent with your certificate request
  18. A challenge password []:
  19. An optional company name []:
  20. Using configuration from /etc/easy-rsa/2.0/openssl.cnf
  21. Check that the request matches the signature
  22. Signature ok
  23. The Subject's Distinguished Name is as follows
  24. countryName           :PRINTABLE:'CN'
  25. stateOrProvinceName   :PRINTABLE:'CA'
  26. localityName          :PRINTABLE:'HZ'
  27. organizationName      :PRINTABLE:'HZ'
  28. organizationalUnitName:PRINTABLE:'changeme'
  29. commonName            :PRINTABLE:'server'
  30. name                  :PRINTABLE:'changeme'
  31. emailAddress          :IA5STRING:'mail@host.domain'
  32. Certificate is to be certified until Mar 28 03:05:21 2022 GMT (3650 days)
  33. Sign the certificate? [y/n]:y
  34.   
  35.   
  36.   1 out of 1 certificate requests certified,commit? [y/n]y
  37.   Write out database with 1 new entries
  38. Data Base Update

7.创建客户端的证书和密钥

  1. ./build-key client1
  2.  
  3. Generating a 1024 bit RSA private key
  4. ...++++++
  5. ...............++++++
  6. writing new private key to 'client1.key'
  7. -----
  8. You are about to be asked to enter information that will be incorporated
  9. into your certificate request.
  10. What you are about to enter is what is called a Distinguished Name or a DN.
  11. There are quite a few fields but you can leave some blank
  12. For some fields there will be a default value,your name or your server's hostname) [client1]:
  13. Name [changeme]:
  14. Email Address [mail@host.domain]:
  15.   
  16. Please enter the following 'extra' attributes
  17. to be sent with your certificate request
  18. A challenge password []:
  19. An optional company name []:
  20. Using configuration from /etc/easy-rsa/2.0/openssl.cnf
  21. Check that the request matches the signature
  22. Signature ok
  23. The Subject's Distinguished Name is as follows
  24. countryName           :PRINTABLE:'CN'
  25. stateOrProvinceName   :PRINTABLE:'CA'
  26. localityName          :PRINTABLE:'HZ'
  27. organizationName      :PRINTABLE:'HZ'
  28. organizationalUnitName:PRINTABLE:'changeme'
  29. commonName            :PRINTABLE:'client1'
  30. name                  :PRINTABLE:'changeme'
  31. emailAddress          :IA5STRING:'mail@host.domain'
  32. Certificate is to be certified until Mar 28 03:21:06 2022 GMT (3650 days)
  33. Sign the certificate? [y/n]:y
  34.   
  35.   
  36.   1 out of 1 certificate requests certified,commit? [y/n]y
  37.   Write out database with 1 new entries
  38. Data Base Updated

8.创建迪菲霍尔曼密钥交换参数

  1.  ./build-dh

9.拷贝服务端证书、秘钥等

  1.  cp /etc/openvpn/easy-rsa/keys/{server.crt,server.key,dh2048.pem,ca.crt} /etc/openvpn

10.配置VPN服务端

  1.  cp /usr/share/doc/openvpn-2.3.*/sample/sample-config-files/server.conf/etc/openvpn/     //复制配置文件到/etc/openvpn

修改服务端配置文件：

  1.  cat server.conf | grep "^[^#|^;]"              //列出未注释的内容
  1.  local 10.17.1.20  #监听地址
  2.  
  3.  port 1194   #监听端口
  4.  
  5.  proto tcp   #监听协议
  6.  
  7.  dev tun   #采用路由隧道模式
  8.  
  9.  ca ca.crt #ca证书路径
  10.  
  11.  cert server.crt  #服务器证书
  12.  
  13.  key server.key  # This file should be kept secret 服务器密钥
  14.  
  15.  dh dh2048.pem #密钥交换协议文件
  16.  
  17.  server 10.8.0.0 255.255.255.0    #给客户端分配地址池，注意：不能和VPN服务器内网网段有相同
  18.  
  19.  ifconfig-pool-persist ipp.txt
  20.  
  21.  push "route 192.168.20.0 255.255.255.0" #允许客户端访问内网 20.0 的网段。
  22.  
  23.  push"dhcp-option DNS 8.8.8.8"       #dhcp分配dns
  24.  
  25.  client-to-client  #客户端之间互相通信
  26.  
  27.  keepalive 10 120 #存活时间，10秒ping一次,120 如未收到响应则视为断线
  28.  
  29.  comp-lzo    #传输数据压缩
  30.  
  31.  max-clients 100 #最多允许 100 客户端连接
  32.  
  33.  user nobody    #用户
  34.  
  35.  group nobody   #用户组
  36.  
  37.  persist-key
  38.  
  39.  persist-tun
  40.  
  41.  status    /var/log/openvpn/openvpn-status.log
  42.  
  43.  log    /var/log/openvpn/openvpn.log
  44.  
  45.  verb 3

11.iptables配置

  1.  清空iptables配置：
  2.  
  3.  iptables -F
  4.  
  5.  iptables -X
  6.  
  7.  配置openvpn的nat功能，将所有网段的包转发到eth0口：
  8.  
  9.  iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
  10.  
  11.  添加FORWARD白名单：
  12.  
  13.  iptables -A FORWARD -i tun+ -j ACCEPT
  14.  
  15.  开启系统的路由功能：
  16.  
  17.  echo "1" > /proc/sys/net/ipv4/ip_forward
  18.  
  19.  service iptables save        //保存iptables配置
  20.  
  21.  service iptables restart      //重启iptables

12. 启动openvpn

  1.  service openvpn start

13. 配置客户端

复制客户端配置文件client.ovpn：

  1.  cp /usr/share/doc/openvpn-2.3.*/sample/sample-config-files/client.conf  /etc/openvpn/client.ovpn

修改客户端配置文件：

  1.  cat server.conf | grep "^[^#|^;]"
  1.  client
  2.  devtun
  3.  prototcp  //改为tcp
  4.  remote203.195.xxx.xxx1194   //OpenVPN服务器的外网IP和端口
  5.  resolv-retryinfinite
  6.  nobind
  7.  persist-key
  8.  persist-tun
  9.  caca.crt  //client1的证书
  10.  certclient.crt
  11.  keyclient.key  //client1的密钥
  12.  ns-cert-typeserver
  13.  comp-lzo
  14.  verb3
• OpenVPN客户端配置

1. 拷贝服务器端/etc/openvpn/easy-rsa/keys/{ca.crt,client.crt,client,key}和/etc/openvpn/client.ovpn到Windows7客户端 2. 下载openvpn客户端安装 下载地址： http://pan.baidu.com/s/1ZsgpS 3. 把刚才复制过来的几个文件拷贝到openvpn客户端安装目录下面的config目录里面（C:\Program Files\OpenVPN\config） 4.启动OpenVPN GUI 在电脑右下角的openvpn图标上右击，选择“Connect”。正常情况下应该能够连接成功，分配正常的IP。

猜你在找的CentOS相关文章

Centos7离线安装gcc4.8
有时候CentOS工作在无互联网的环境下，需要在离线环境下安装一些组件，这次实现的是模拟在...
CentOS7离线安装devtoolset-9并编译redis6.0.5
首先参照https://www.cnblogs.com/wdw984/p/13330074.html，来进行如何安装Centos和离线下...
使用Nginx在80端口上代理多个.NET CORE网站
有两个.NET CORE3.1网站部署在CentOS7上（内网IP是192.168.2.32），现在想实现访问http://...
CentOS7中配置vsftpd
1、yum -y install vsftpd 安装vsftpd 2、配置vsftpd的配置文件（/etc/vsftpd/vsftpd.conf...
CentOS7离线安装Mysql8.0
首先去mysql官网下载mysql的离线rpm安装包（https://downloads.mysql.com/archives/commun...
CentOS中增加网络连接数的方法
CentOS默认对外访问，发起的TCP链接总数小于28232个。 可以通过以下命令的结果计算出来 $ ...
VMware安装Centos7虚拟机
首先安装虚拟机很简单，所以呢，具体的安装过程就引用别人的博客，这篇文字很详细，引用之...
[Linux] 解决CentOS下Requires: libjson-c.so错误
当安装某些rpm包的时候 , 会爆出这个错误 Requires: libjson-c.so json-c是c语言下的json库...
阿里云centos7安装mysql8数据库
linux系统安装mysql8
centos安装mysql
一、安装 二、修改密码 三、修改远程连接权限(为了使用navicat)
LinuxWindowsCentOSUbuntuNginxWebServiceScalaMemcacheApacheRedisDockerBashAzureTomcatLNMPShell数据结构服务器运维网络安全
xebugnodemondocker-copydcoselasticsearcwindows-contdocker-windodocker-awsamazon-cloudenvoyproxyhashicorp-vaswisscomdevkafka-pythonzscalerphoton-osdocker-swarmkamongoogle-cloudconcoursewso2-ampersistent-vapi-managerprocess-manamanjarojenkins-workhypriotremoteapikeystonejsbitcoindbitcoin-test