差别
这里会显示出您选择的修订版和当前版本之间的差别。
| 两侧同时换到之前的修订记录前一修订版后一修订版 | 前一修订版 | ||
| zh:实际案例指导:如何搭建基于astercc系统的openvpn [2015/06/02 03:52] – liuxl | zh:实际案例指导:如何搭建基于astercc系统的openvpn [2016/01/18 02:08] (当前版本) – [第三步:创建服务端证书及key] liuxl | ||
|---|---|---|---|
| 行 1: | 行 1: | ||
| ======如何搭建基于astercc系统的OpenVPN====== | ======如何搭建基于astercc系统的OpenVPN====== | ||
| - | VPN服务器端：Centos 6.6(装有astercc系统) | + | VPN服务器端：Centos 6.6(Final) |
| - | VPN客户端：Windows 7 | + | VPN客户端：Windows7 |
| - | {{: | ||
| - | =====第一步: | ||
| + | =====第一步: | ||
| - | ====安装EPEL==== | ||
| - | |||
| - | < | ||
| - | rpm -Uvh epel-release-6-8.noarch.rpm | ||
| - | </ | ||
| - | |||
| - | {{: | ||
| + | ====安装EPEL仓库==== | ||
| + | < | ||
| + | < | ||
| ====安装OpenVPN==== | ====安装OpenVPN==== | ||
| - | 包含了 lzo 和 pkcs | + | 包含了 lzo 和 pkcs11-helper |
| < | < | ||
| - | {{: | ||
| - | {{: | + | ====安装Easy-rsa==== |
| + | 该包用来制作ca证书，服务端证书，客户端证书。此版本为: | ||
| + | < | ||
| + | < | ||
| - | |||
| - | ====安装easy-rsa==== | ||
| - | |||
| - | < | ||
| - | unzip master.zip | ||
| - | </ | ||
| - | |||
| - | {{: | ||
| - | |||
| - | {{: | ||
| 解压完成后，将解压得到的文件夹easy-rsa-master重命名为easy-rsa： | 解压完成后，将解压得到的文件夹easy-rsa-master重命名为easy-rsa： | ||
| 行 45: | 行 32: | ||
| 然后再将得到的easy-rsa文件夹复制到/ | 然后再将得到的easy-rsa文件夹复制到/ | ||
| < | < | ||
| - | |||
| - | {{: | ||
| ====安装Unzip和Zip==== | ====安装Unzip和Zip==== | ||
| - | 在安装easy-rsa步骤中，假如在 "unzip master.zip" | ||
| - | {{: | + | 在安装Easy-rsa步骤中，假如在 "unzip master.zip" 时提示: -bash: unzip: command not found，则需要执行如下操作： |
| - | {{: | + | debian系统，就直接执行如下命令进行安装： |
| + | < | ||
| + | centos系统，那就需要输入下面的命令进行安装： | ||
| + | < | ||
| 行 65: | 行 52: | ||
| < | < | ||
| - | 然后，复制vars.example 为 vars | + | 然后，在此目录下复制 vars.example 为 vars |
| < | < | ||
| - | {{: | ||
| - | + | 最后，根据自己VPS情况修改下面字段，命令：vi vars，然后进行修改，最后 | |
| - | 最后，修改下面字段，命令：vi vars，然后进行修改，最后wq保存。注意：配置文件下面以 ";" | + | |
| < | < | ||
| - | | + | |
| | | ||
| | | ||
| | | ||
| | | ||
| - | | + | |
| </ | </ | ||
| 行 85: | 行 70: | ||
| 首先，进入/ | 首先，进入/ | ||
| - | < | + | < |
| - | | + | < |
| - | </ | + | |
| - | {{: | ||
| 然后，创建根证书，输入并确认密码，再输入common name： | 然后，创建根证书，输入并确认密码，再输入common name： | ||
| < | < | ||
| - | {{:zh:实际案例指导:创建根证书01.png?700|}} | + | 如下： |
| + | < | ||
| + | Note: using Easy-RSA configuration from: ./vars | ||
| + | Generating a 2048 bit RSA private key | ||
| + | .............................................................+++ | ||
| + | ...........................................+++ | ||
| + | writing new private key to '/ | ||
| + | Enter PEM pass phrase: | ||
| + | Verifying - Enter PEM pass phrase: | ||
| + | ----- | ||
| + | You are about to be asked to enter information that will be incorporated | ||
| + | into your certificate request. | ||
| + | What you are about to enter is what is called a Distinguished Name or a DN. | ||
| + | There are quite a few fields but you can leave some blank | ||
| + | For some fields there will be a default value, | ||
| + | If you enter ' | ||
| + | ----- | ||
| + | Common Name (eg: your user, host, or server name) [Easy-RSA CA]:server | ||
| - | 注意：在上述部分需要输入PEM密码 PEM pass phrase，输入两次，此密码必须记住，不然以后不能为证书签名，我输入的：1234。还需要输入common name 通用名，这个你自己随便设置个独一无二的，我输入的：andy。 | + | CA creation complete and you may now import and sign cert requests. |
| + | Your new CA certificate file for publishing is at: | ||
| + | / | ||
| + | </ | ||
| + | |||
| + | 注意：在上述部分需要输入PEM密码 PEM pass phrase，输入两次，此密码必须记住，不然以后不能为证书签名。还需要输入common name 通用名，这个你自己随便设置个独一无二的，我输入的：server。 | ||
| 再创建服务器端证书，输入Common Name： | 再创建服务器端证书，输入Common Name： | ||
| < | < | ||
| - | {{:zh:实际案例指导:创建服务器端证书01.png?700|}} | + | 如下： |
| + | < | ||
| + | Note: using Easy-RSA configuration from: ./vars | ||
| + | Generating a 2048 bit RSA private key | ||
| + | .........+++ | ||
| + | .....+++ | ||
| + | writing new private key to '/ | ||
| + | ----- | ||
| + | You are about to be asked to enter information that will be incorporated | ||
| + | into your certificate request. | ||
| + | What you are about to enter is what is called a Distinguished Name or a DN. | ||
| + | There are quite a few fields but you can leave some blank | ||
| + | For some fields there will be a default value, | ||
| + | If you enter ' | ||
| + | ----- | ||
| + | Common Name (eg: your user, host, or server name) [server]: | ||
| + | |||
| + | Keypair and certificate request completed. Your files are: | ||
| + | req: / | ||
| + | key: / | ||
| + | </ | ||
| + | 该过程中需要输入common name，回车的话，确认为：server。 | ||
| 创建签约服务端证书： | 创建签约服务端证书： | ||
| < | < | ||
| - | {{:zh:实际案例指导:签约服务端证书01.png?700|}} | + | 如下： |
| + | < | ||
| + | Note: using Easy-RSA configuration from: ./vars | ||
| - | 最后，创建Diffie-Hellman，确保key穿越不安全网络的命令： | + | You are about to sign the following certificate. |
| + | Please check over the details shown below for accuracy. Note that this request | ||
| + | has not been cryptographically verified. Please be sure it came from a trusted | ||
| + | source or that you have verified the request checksum with the sender. | ||
| + | |||
| + | Request subject, to be signed as a server certificate for 3650 days: | ||
| + | |||
| + | subject= | ||
| + | commonName | ||
| + | |||
| + | Type the word ' | ||
| + | Confirm request details: yes | ||
| + | Using configuration from / | ||
| + | Enter pass phrase for / | ||
| + | Check that the request matches the signature | ||
| + | Signature ok | ||
| + | The Subject' | ||
| + | commonName | ||
| + | Certificate is to be certified until May 30 05:45:15 2025 GMT (3650 days) | ||
| + | |||
| + | Write out database with 1 new entries | ||
| + | Data Base Updated | ||
| + | |||
| + | Certificate created at: / | ||
| + | </ | ||
| + | 该命令中.需要你确认生成 输入yes，还需要提供创建CA时候的密码。如果你忘记了密码，那就从第三步: | ||
| + | |||
| + | |||
| + | 最后，创建Diffie-Hellman，确保key穿越不安全网络的命令，可能会执行很长时间，请耐心等待，不要中断： | ||
| < | < | ||
| - | {{: | + | 如下： |
| - | {{:zh: | + | < |
| + | Note: using Easy-RSA configuration from: ./vars | ||
| + | Generating DH parameters, 2048 bit long safe prime, generator 2 | ||
| + | This is going to take a long time | ||
| + | ............+............................................... | ||
| + | ........................................................................... | ||
| + | ..................................................................................... | ||
| + | ..............................................................+............................ | ||
| + | ......................................+...............+.....................++*++* | ||
| + | |||
| + | DH parameters of size 2048 created at / | ||
| + | </ | ||
| 行 118: | 行 185: | ||
| =====第四步: | =====第四步: | ||
| - | 首先，进入root目录新建client文件夹，文件夹可随意命名，然后拷贝前面解压得到的easy-ras文件夹到client文件夹,进入下列目录： | + | 首先，进入root目录新建client文件夹，文件夹可随意命名，然后拷贝前面解压得到的easy-rsa文件夹到client文件夹，并进入到/ |
| < | < | ||
| - | | + | mkdir client |
| cp -R / | cp -R / | ||
| - | cd client/ | + | cd client/ |
| - | + | </ | |
| - | {{: | + | |
| 行 130: | 行 196: | ||
| < | < | ||
| - | {{: | + | 如下： |
| + | < | ||
| + | [root@astercc1 easyrsa3]# | ||
| + | init-pki complete; you may now create a CA or requests. | ||
| + | Your newly created PKI dir is: / | ||
| + | </ | ||
| - | 再创建客户端key及生成证书(记住生成是自己输入的密码)： | + | 再创建客户端key及生成证书(记住生成时自己输入的密码)： |
| - | < | + | < |
| - | {{:zh:实际案例指导:创建客户端key01.png?700|}} | + | 如下： |
| + | < | ||
| + | Generating a 2048 bit RSA private key | ||
| + | ...............+++ | ||
| + | ............................+++ | ||
| + | writing new private key to '/ | ||
| + | Enter PEM pass phrase: | ||
| + | Verifying - Enter PEM pass phrase: | ||
| + | ----- | ||
| + | You are about to be asked to enter information that will be incorporated | ||
| + | into your certificate request. | ||
| + | What you are about to enter is what is called a Distinguished Name or a DN. | ||
| + | There are quite a few fields but you can leave some blank | ||
| + | For some fields there will be a default value, | ||
| + | If you enter ' | ||
| + | ----- | ||
| + | Common Name (eg: your user, host, or server name) [client1]: | ||
| + | |||
| + | Keypair and certificate request completed. Your files are: | ||
| + | req: / | ||
| + | key: / | ||
| + | </ | ||
| - | 然后再将得到的andy.req导入然后签约证书： | + | 然后再将得到的client1.req导入，然后签约证书： |
| a.进入到/ | a.进入到/ | ||
| - | + | < | |
| - | | + | |
| b.导入req | b.导入req | ||
| + | < | ||
| - | | + | 如下： |
| + | < | ||
| + | [root@astercc1 easyrsa3]# cd / | ||
| + | [root@astercc1 easyrsa3]# | ||
| + | [root@astercc1 easyrsa3]# | ||
| + | [root@astercc1 easyrsa3]# | ||
| + | |||
| + | Note: using Easy-RSA configuration from: ./vars | ||
| + | |||
| + | The request has been successfully imported with a short name of: client1 | ||
| + | You may now use this name to perform signing operations on this request. | ||
| + | </ | ||
| c.签约证书 | c.签约证书 | ||
| + | < | ||
| - | | + | 如下： |
| + | < | ||
| - | {{:zh:实际案例指导: | + | Note: using Easy-RSA configuration from: ./vars |
| - | 这里生成client，所以必须为client，andy要与之前导入名字一致。上面签约证书跟server类似，就不截图了，但是期间还是要输入CA的密。 | + | You are about to sign the following certificate. |
| + | Please check over the details shown below for accuracy. Note that this request | ||
| + | has not been cryptographically verified. Please be sure it came from a trusted | ||
| + | source or that you have verified the request checksum with the sender. | ||
| + | Request subject, to be signed as a client certificate for 3650 days: | ||
| - | 最后这一步很重要，现在说一下我们上面都生成了什么东西 | + | subject= |
| + | commonName | ||
| - | 服务端：(/ | + | Type the word ' |
| + | Confirm request details: yes | ||
| + | Using configuration from / | ||
| + | Enter pass phrase for / | ||
| + | Check that the request matches the signature | ||
| + | Signature ok | ||
| + | The Subject' | ||
| + | commonName | ||
| + | Certificate is to be certified until May 30 06:14:04 2025 GMT (3650 days) | ||
| - | / | + | Write out database with 1 new entries |
| - | / | + | Data Base Updated |
| - | / | + | |
| - | / | + | |
| - | / | + | |
| - | / | + | |
| - | / | + | |
| - | / | + | |
| - | 客户端：(/root/client/ | + | Certificate created at: /etc/openvpn/easy-rsa/ |
| + | </ | ||
| - | / | ||
| - | / | ||
| - | a.这一步就是拷贝这些文件放入到相应位置。将下列文件放到/ | + | 这里生成client，所以必须为client1，要与之前导入名字一致。上面签约证书跟server类似，但是期间还是要输入CA的密码。 |
| + | |||
| + | |||
| + | 最后看一下上面都生成了什么东西： | ||
| + | |||
| + | 服务端：(/ | ||
| + | |||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | |||
| + | 客户端：(/ | ||
| + | |||
| + | / | ||
| + | / | ||
| + | |||
| + | a.这一步就是拷贝这些文件放入到相应位置。将下列文件放到/ | ||
| < | < | ||
| cp / | cp / | ||
| cp / | cp / | ||
| - | cp / | + | cp / |
| + | </ | ||
| 这样就将上述四个文件放入到了/ | 这样就将上述四个文件放入到了/ | ||
| - | b.这一步将下列文件放到/ | + | b.这一步将下列文件放到/ |
| - | < | + | < |
| + | cp / | ||
| cp / | cp / | ||
| - | cp / | + | cp / |
| - | + | </ | |
| - | 这样就将上述三个文件复制到了/ | + | |
| - | + | ||
| - | {{: | + | |
| + | 这样就将上述三个文件复制到了/ | ||
| 行 201: | 行 333: | ||
| 当你安装好了openvpn时候，他会提供一个server配置的文件例子，在 / | 当你安装好了openvpn时候，他会提供一个server配置的文件例子，在 / | ||
| - | |||
| < | < | ||
| - | 然后修改配置 vi server.conf，如下： | + | 然后修改配置 vi server.conf |
| - | < | + | |
| - | port 1194 | + | |
| - | dev tun | + | |
| - | proto udp | + | |
| - | ca / | + | |
| - | cert / | + | |
| - | key / | + | |
| - | dh / | + | |
| - | | + | |
| - | | + | |
| - | push " | + | |
| - | push " | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | verb 3 </ | + | |
| - | 每个项目都会由一大堆介绍。上述修改，openvpn提供的server.conf已经全部提供，我们只需要去掉前面的注释 # | + | 如下： |
| + | < | ||
| + | local a.b.c.d | ||
| + | port 1194 (端口号，可以自行定义，但定义完要在centos的 / | ||
| + | proto udp # 服务器端 和 客户端的设置要一致 | ||
| + | dev tun # 服务器端 和 客户端的设置要一致 | ||
| + | ca / | ||
| + | cert / | ||
| + | key / | ||
| + | dh / | ||
| + | server 10.8.0.0 255.255.255.0 | ||
| + | ifconfig-pool-persist ipp.txt | ||
| + | push " | ||
| + | push " | ||
| + | keepalive 10 120 | ||
| + | comp-lzo | ||
| + | max-clients 100 # 最大客户端数，可以不写 | ||
| + | persist-key | ||
| + | persist-tun | ||
| + | status / | ||
| + | log / | ||
| + | log-append | ||
| + | verb 4 | ||
| + | </ | ||
| + | 每个项目都会由一大堆介绍。上述修改，openvpn提供的server.conf已经全部提供，我们只需要去掉前面的注释 # | ||
| - | ？？开启系统转发功能？？ | + | 开启 |
| - | + | < | |
| - | [root@vpn ~]# vim / | + | 将net.ipv4.ip_forward = 0 改成 net.ipv4.ip_forward = 1 |
| - | [root@vpn ~]# sysctl -p | + | < |
| - | [root@vpn ~]# sysctl -a | grep net.ipv4.ip_forward net.ipv4.ip_forward = 1 | + | < |
| - | + | ||
| - | ？？封装出去的数据包（eth0是你的vps外网的网卡）？？： | + | |
| - | + | ||
| - | /sbin/iptables -t nat -I POSTROUTING -s 10.8.0.0/255.255.255.0 | + | |
| | | ||
| - | |||
| - | |||
| - | |||
| - | |||
| - | |||
| - | |||
| =====第六步: | =====第六步: | ||
| + | 首先，将VPS生成的 客户端证书和key文件(即：ca.crt | ||
| + | 其次，去官网 https:// | ||
| + | 然后，对客户端进行配置，编辑 client.ovpn 文件。 | ||
| - | + | 如下： | |
| - | + | < | |
| - | + | dev tun # 服务器端 和 客户端的设置要一致 | |
| + | proto udp # 服务器端 和 客户端的设置要一致 | ||
| + | remote 8.38.33.10 | ||
| + | resolv-retry infinite | ||
| + | nobind | ||
| + | persist-key | ||
| + | persist-tun | ||
| + | ca ca.crt | ||
| + | cert client1.crt | ||
| + | key client1.key | ||
| + | comp-lzo | ||
| + | verb 3 </ | ||
| =====第七步: | =====第七步: | ||
| + | a.启动VPS上的OpenVPN服务，执行以下命令： | ||
| + | < | ||
| + | 如果出现：service start failed！！ 运行 openvpn / | ||
| - | + | b.启动客户端 | |
| - | + | 以管理员身份来运行OpenVPN-GUI启动，注意在启动后需要输入创建client1.key时候的密码，然后进入连接的界面。假如连接失败，请先把VPS的iptables停掉，执行如下命令，然后再连接： | |
| - | {{: | + | < |
| - | + | ||
| - | + | ||
| - | + | ||
| - | + | ||
| - | + | ||
| - | < | + | |
| - | + | ||
| - | + | ||
| - | + | ||
| - | + | ||
| - | + | ||
