CentOS下安装Openvpn(含OpenVZ类VPS)

前提:VPS已经打开tun/tap,装有iptables,openssl及openssl-devel,现在很多VPS尽量简化,编译器可能会需要安装gcc。

1,下载LZO和OpenVPN。
wget http://www.oberhumer.com/opensource/lzo … .04.tar.gz
wget http://openvpn.net/release/openvpn-2.1_rc22.tar.gz

2,安装,都使用默认路径,
./configure && make && make install
即可。

3,拷贝文件,初始化PKI。
cp -r /root/src/openvpn-2.1_rc22/easy-rsa/ /etc/openvpn/
cd /etc/openvpn/2.0/
export D=`pwd`
export KEY_CONFIG=$D/openssl.cnf
export KEY_DIR=$D/keys
export KEY_SIZE=1024
export KEY_COUNTRY=US
export KEY_PROVINCE=FL
export KEY_CITY=CHUNGKING
export KEY_ORG=”Sun”
export KEY_EMAIL=”[email protected]
. /vars

4,创建CA。

./clean-all
./build-ca

5,签发服务器证书和客户端证书。
./build-key-server server
./build-key client1

6,生成Diffie Hellman。
./build-dh
若不能执行,则 openssl dhparam -out ./keys/dh1024.pem 1024

证书生成完毕,可以把keys目录打包下载到本地以供客户端使用,下面进行openvpn服务器配置,

7,修改配置文件,如需使用代理连接,例如穿过中国移动CMWAP网关,配置文件中应使用tcp proto。
mkdir /etc/openvpn/2.0/conf
cd /etc/openvpn/2.0/conf && vi server.conf
——
port 1194
proto udp
dev tun
ca /etc/openvpn/2.0/keys/ca.crt
cert /etc/openvpn/2.0/keys/server.crt
key /etc/openvpn/2.0/keys/server.key置
dh /etc/openvpn/2.0/keys/dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push “redirect-gateway def1 bypass-dhcp”
push “dhcp-option DNS 10.8.0.1”
push “dhcp-option DNS 8.8.8.8”
client-to-client
keepalive 10 120
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
verb 3
——

8,启动openvpn.
/usr/local/sbin/openvpn –config /etc/openvpn/2.0/conf/server.conf

9,设置iptables nat,下面的环节,独立主机和OpenVZ会有一些区别,但区别不大,下为独立主机例,OpenVZ需要把eth0替换成venet0。

独立主机一般输入
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
即可,部分OpenVZ VPS需要执行
iptables -t nat -A POSTROUTING -s 10.8.0.0/255.255.255.0 -j SNAT –to-source x.x.x.x
其中x.x.x.x是VPS的IP地址。
保存防火墙配置:
/etc/init.d/iptables save
/etc/init.d/iptables restart

10,设置转发参数。
检查当前参数:sysctl -a | grep forward
对比下列参数,若有为0的项目,使用
sysctl -w net.ipv4.ip_forward=1
类似命令修改。
——
net.ipv4.conf.tun0.mc_forwarding = 0
net.ipv4.conf.tun0.forwarding = 1
net.ipv4.conf.eth0.mc_forwarding = 0
net.ipv4.conf.eth0.forwarding = 1
net.ipv4.conf.virbr0.mc_forwarding = 0
net.ipv4.conf.virbr0.forwarding = 1
net.ipv4.conf.lo.mc_forwarding = 0
net.ipv4.conf.lo.forwarding = 1
net.ipv4.conf.default.mc_forwarding = 0
net.ipv4.conf.default.forwarding = 1
net.ipv4.conf.all.mc_forwarding = 0
net.ipv4.conf.all.forwarding = 1
net.ipv4.ip_forward = 1
——

11,服务端设置已经完成,客户端配置文件如下,其中,x.x.x.x是服务器对外的服务IP地址,ca.crt,client1.crt,client1.key是之前在服务器上生成的服务器证书,客户端证书和客户端密钥。
——
client
dev tun
proto udp
remote x.x.x.x 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client1.crt
key client1.key
ns-cert-type server
comp-lzo
verb 3
redirect-gateway def1
——

Leave a Reply

Your email address will not be published. Required fields are marked *