CentOS5下安装OpenVPN
最近做VPN服务器，当然只能算是阳光自己做来测试的，不过倒是可以参考就算是为以后正式启用做准备。
一. OpenVPN 安装环境
- Server 端的环境
- CentOS, kernel版本: 2.6.18, IP 为 221.233.59.16(ADSL拨号)
- kernel 需要支持 tun 设备, 需要加载 iptables 模块.
- 安装的 OpenVPN 的版本: 2.1.rc15.(目前最新版 可在http://openvpn.net 上下载).
- Client 端的环境:
- Windows XP SP2
- openvpn-2.1_rc15-install.exe(此版本集成了 OpenVPN GUI 客户端)
二. OpenVPN 服务端安装过程
- 用putty登录到CentOS
- 下载LZO和OpenVPN 2.1.rc15
wget http://www.oberhumer.com/opensource/lzo/download/minilzo-2.03.tar.gz wget http://openvpn.net/release/openvpn-2.1_rc15.tar.gz
- 安装LZO和OpenVPN
tar zxvf lzo-2.03.tar.gz cd lzo-2.03 ./configure make make install cd .. tar zxvf openvpn-2.1_rc15.tar.gz cd openvpn-2.1_rc15 ./configure make make install cd .. cp /root/openvpn-2.1_rc15/easy-rsa/ -r /etc/openvpn
- 生成证书初始化PKI
cd /etc/openvpn/2.0/#可以设置下OpenVPN参数(也可以修改vars文件来配置) export D=`pwd` export KEY_CONFIG=$D/openssl.cnf export KEY_DIR=$D/keys export KEY_SIZE=1024 export KEY_COUNTRY=CN export KEY_PROVINCE=GD export KEY_CITY=SZ export KEY_ORG="dvdmaster" export KEY_EMAIL="support@cooldvd.com" #也可以不用设置直接执行下面的命令 . vars
创建证书颁发机构(CA)
./clean-all ./build-ca Generating a 1024 bit RSA private key ................++++++ ........++++++ writing new private key to 'ca.key' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [CN]: State or Province Name (full name) [GD]: Locality Name (eg, city) [SZ]: Organization Name (eg, company) [dvdmaster]: Organizational Unit Name (eg, section) []:dvdmaster Common Name (eg, your name or your server's hostname) []:server Email Address [support@cooldvd.com]:
建立server key
./build-key-server server Generating a 1024 bit RSA private key ......++++++ ....................++++++ writing new private key to 'server.key' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [CN]: State or Province Name (full name) [GD]: Locality Name (eg, city) [SZ]: Organization Name (eg, company) [dvdmaster]: Organizational Unit Name (eg, section) []:dvdmaster Common Name (eg, your name or your server's hostname) []:server Email Address [support@cooldvd.com]: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []:abcd1234 An optional company name []:dvdmaster Using configuration from /etc/openvpn/2.0/openssl.cnf Check that the request matches the signature Signature ok The Subject's Distinguished Name is as follows countryName
RINTABLE:'CN'
stateOrProvinceName RINTABLE:'GD'
localityName RINTABLE:'SZ'
organizationName RINTABLE:'dvdmaster'
organizationalUnitName:PRINTABLE:'dvdmaster'
commonName RINTABLE:'server'
emailAddress :IA5STRING:'support@cooldvd.com'
Certificate is to be certified until Mar 19 08:15:31 2016 GMT (3650 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
生成客户端 key
./build-key client1 Generating a 1024 bit RSA private key .....++++++ ......++++++ writing new private key to 'client1.key' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [CN]: State or Province Name (full name) [GD]: Locality Name (eg, city) [SZ]: Organization Name (eg, company) [dvdmaster]: Organizational Unit Name (eg, section) []:dvdmaster Common Name (eg, your name or your server's hostname) []:client1 #重要: 每个不同的client 生成的证书, 名字必须不同. Email Address [support@cooldvd.com]: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []:abcd1234 An optional company name []:dvdmaster Using configuration from /etc/openvpn/2.0/openssl.cnf Check that the request matches the signature Signature ok The Subject's Distinguished Name is as follows countryName
RINTABLE:'CN'
stateOrProvinceName RINTABLE:'GD'
localityName RINTABLE:'SZ'
organizationName RINTABLE:'dvdmaster'
organizationalUnitName:PRINTABLE:'dvdmaster'
commonName RINTABLE:'client1'
emailAddress :IA5STRING:'support@cooldvd.com'
Certificate is to be certified until Mar 19 08:22:00 2016 GMT (3650 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated 以此类推建立其他客户端 key
./build-key client2 ./build-key client3
注意在进入 Common Name (eg, your name or your server’s hostname) []: 的输入时, 每个证书输入的名字必须不同.
- 生成Diffie Hellman参数
./build-dh
- 将 keys 下的所有文件打包下载到本地(可以通过winscp,http,ftp等等……)
tar zcvf yskeys.tar.gz keys/
- 创建服务端配置文件
mkdir /etc/openvpn/2.0/conf cp /root/openvpn-2.1_rc15/sample-config-files/server.conf /etc/openvpn/2.0/conf/server.conf
服务端配置文件(server.conf)样例
port 1194 proto udp dev tun ca /etc/openvpn/2.0/keys/ca.crt cert /etc/openvpn/2.0/keys/ovpnser.crt key /etc/openvpn/2.0/keys/ovpnser.key # This file should be kept secret dh /etc/openvpn/2.0/keys/dh1024.pem server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt push "redirect-gateway def1 bypass-dhcp" push "dhcp-option DNS 10.8.0.1" push "dhcp-option DNS 202.103.44.150" #客户端获得的DNS地址 push "dhcp-option DNS 202.103.24.68" #客户端获
最新评论