{"id":19280,"date":"2016-08-25T06:00:32","date_gmt":"2016-08-24T22:00:32","guid":{"rendered":"https:\/\/2blog.ilc.edu.tw\/25793\/2016\/08\/25\/%e5%9c%a8-centos-7-x-%e4%b8%8a%e4%bd%bf%e7%94%a8-openvpn\/"},"modified":"2021-03-18T17:24:48","modified_gmt":"2021-03-18T09:24:48","slug":"%e5%9c%a8-centos-7-x-%e4%b8%8a%e4%bd%bf%e7%94%a8-openvpn","status":"publish","type":"post","link":"https:\/\/2blog.ilc.edu.tw\/25793\/2016\/08\/25\/%e5%9c%a8-centos-7-x-%e4%b8%8a%e4%bd%bf%e7%94%a8-openvpn\/","title":{"rendered":"\u5728 CentOS 7.x \u4e0a\u4f7f\u7528 OpenVPN"},"content":{"rendered":"

\u53c3\u8003\u7db2\u7ad9\uff1a
CentOS 7 install OpenVPN @ \u56de\u61b6……! :: \u75de\u5ba2\u90a6 PIXNET ::<\/a>
CentOS 7 \u5b89\u88dd OpenVPN Server \u2013 Linux \u6280\u8853\u624b\u672d<\/a><\/p>\n

1. \u5b89\u88dd epel \u5957\u4ef6\u5eab
# yum install epel-release<\/span><\/p>\n

2. \u5b89\u88dd OpenVPN \u5957\u4ef6
# yum install openvpn<\/span><\/p>\n

3. \u5b89\u88dd Easy RSA \u5957\u4ef6\uff0c\u4e4b\u5f8c\u8981\u7522\u751f Key \u7684
# yum install easy-rsa<\/span>[@more@]4. \u8907\u88fd server.conf \u7684\u7bc4\u4f8b\u6a94\u81f3 openvpn \u8a2d\u5b9a\u6a94\u76ee\u9304
# cp \/usr\/share\/doc\/openvpn-*\/sample\/sample-config-files\/server.conf \/etc\/openvpn<\/span><\/p>\n

5. \u5099\u4efd\u539f\u8a2d\u5b9a\u6a94
# cp \/etc\/openvpn\/server.conf \/etc\/openvpn\/server.conf.$(date +%F)<\/span><\/p>\n

6. \u4fee\u6539 \/etc\/openvpn\/server.conf<\/span> \u8a2d\u5b9a\u6a94
# egrep -v “^#|^$|^;” \/etc\/openvpn\/server.conf<\/span>
port 1194<\/span>
proto tcp<\/span>
dev tun<\/span>
ca ca.crt<\/span>
cert server.crt<\/span>
key server.key\u00a0 # This file should be kept secret<\/span>
dh dh2048.pem<\/span>
server 10.8.0.0 255.255.255.0<\/span>
ifconfig-pool-persist ipp.txt<\/span>
push “route 10.8.0.0 255.255.255.0”<\/span>
push “redirect-gateway def1 bypass-dhcp”<\/span>
push “dhcp-option DNS 168.95.1.1”<\/span>
push “dhcp-option DNS 8.8.8.8”<\/span>
client-to-client<\/span>
duplicate-cn<\/span>
keepalive 10 120<\/span>
tls-auth ta.key 0 # This file is secret<\/span>
comp-lzo<\/span>
max-clients 10<\/span>
user nobody<\/span>
group nobody<\/span>
persist-key<\/span>
persist-tun<\/span>
status openvpn-status.log<\/span>
verb 3<\/span><\/p>\n

7. \u5efa\u7acb Easy RSA \u8981\u7522\u751f Key \u7684\u76ee\u9304
# mkdir -p \/etc\/openvpn\/easy-rsa\/keys<\/span><\/p>\n

8. \u8907\u88fd Easy RSA \u7bc4\u4f8b\u6a94\u81f3 Easy RSA \u8a2d\u5b9a\u6a94\u76ee\u9304
# cp -rf \/usr\/share\/easy-rsa\/2.0\/* \/etc\/openvpn\/easy-rsa<\/span><\/p>\n

9. \u8acb\u60c5\u6cc1\u4fee\u6539 \/etc\/openvpn\/easy-rsa\/vars<\/span> \u4e2d\u7684\u8b8a\u6578
export KEY_COUNTRY=”US”<\/span>
export KEY_PROVINCE=”CA”<\/span>
export KEY_CITY=”SanFrancisco”<\/span>
export KEY_ORG=”Fort-Funston”<\/span>
export KEY_EMAIL=”me@myhost.mydomain”<\/span>
export KEY_OU=”MyOrganizationalUnit”<\/span><\/p>\n

# X509 Subject Field<\/span>
export KEY_NAME=”EasyRSA”<\/span><\/p>\n

10. \u4ee5\u4e0b\u70ba\u958b\u59cb\u505a\u5efa\u7acb\u6191\u8b49\u7684\u52d5\u4f5c:
# cp \/etc\/openvpn\/easy-rsa\/openssl-1.0.0.cnf \/etc\/openvpn\/easy-rsa\/openssl.cnf<\/span>
# cd \/etc\/openvpn\/easy-rsa<\/span>
# source .\/vars<\/span>
NOTE: If you run .\/clean-all, I will be doing a rm -rf on \/etc\/openvpn\/easy-rsa\/keys<\/span><\/p>\n

# .\/clean-all<\/span>
# .\/build-ca<\/span>
# .\/build-key-server server<\/span><\/p>\n

# .\/build-dh<\/span>
# cd \/etc\/openvpn\/easy-rsa\/keys<\/span>
# cp dh2048.pem ca.crt server.crt server.key \/etc\/openvpn<\/span>
# cd \/etc\/openvpn\/easy-rsa<\/span>
# .\/build-key client<\/span><\/p>\n

11. \u7522\u751f ta.key
# cd \/etc\/openvpn\/<\/span>
# openvpn –genkey –secret ta.key<\/span><\/p>\n

12. \u5b89\u88dd iptables \u7684\u76f8\u95dc packages \u8207\u8a2d\u5b9a iptables
# yum install iptables-services -y<\/span>
# systemctl mask firewalld<\/span>
# systemctl enable iptables<\/span>
Created symlink from \/etc\/systemd\/system\/basic.target.wants\/iptables.service to \/usr\/lib\/systemd\/system\/iptables.service.<\/span>
# systemctl stop firewalld<\/span>
# systemctl start iptables<\/span>
# iptables –flush<\/span><\/p>\n

13. iptables \u9632\u706b\u7246\u4e0a\u7684\u8a2d\u5b9a
\u5c07 Source IP range \u70ba 10.8.0.0\/24 \u7684 IP \u505a NAT \u5f8c\uff0c\u4e26\u7531 ppp0 \u51fa\u53bb
# iptables -A FORWARD -i tun0 -s 10.8.0.0\/24 -j ACCEPT<\/span>
# iptables -t nat -A POSTROUTING -s 10.8.0.0\/24 -o ppp0 -j MASQUERADE<\/span>
# iptables-save > \/etc\/sysconfig\/iptables<\/span>
# systemctl restart iptables<\/span><\/p>\n

14. \u4fee\u6539 \/etc\/sysctl.conf<\/span> \u8a2d\u5b9a
# vim \/etc\/sysctl.conf<\/span>
—————————————–
\uff0e\uff0e\uff0e\uff0e\uff0e\uff0e
net.ipv4.ip_forward = 1<\/span>
\uff0e\uff0e\uff0e\uff0e\uff0e\uff0e
—————————————–<\/p>\n

15. \u555f\u52d5 OpenVPN \u670d\u52d9\uff0c\u4e26\u8a2d\u5b9a\u958b\u6a5f\u6642\u555f\u52d5
# systemctl start openvpn@server.service<\/span>
# systemctl enable openvpn@server.service<\/span>
Created symlink from \/etc\/systemd\/system\/multi-user.target.wants\/openvpn@server.service to \/usr\/lib\/systemd\/system\/openvpn@.service.<\/span><\/p>\n

16. \u6aa2\u67e5 OpenVPN \u670d\u52d9\u72c0\u614b
# systemctl status openvpn@server.service<\/span>
\u25cf openvpn@server.service – OpenVPN Robust And Highly Flexible Tunneling Application On server<\/span>
\u00a0\u00a0 Loaded: loaded (\/usr\/lib\/systemd\/system\/openvpn@.service; enabled; vendor preset: disabled)<\/span>
\u00a0\u00a0 Active: active (running) since \u65e5 2016-08-14 15:13:07 CST; 9s ago<\/span>
\u00a0 Process: 2294 ExecStart=\/usr\/sbin\/openvpn –daemon –writepid \/var\/run\/openvpn\/%i.pid –cd \/etc\/openvpn\/ –config %i.conf (code=exited, status=0\/SUCCESS)<\/span>
\u00a0Main PID: 2295 (openvpn)<\/span>
\u00a0\u00a0 CGroup: \/system.slice\/system-openvpn.slice\/openvpn@server.service<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 mq2295 \/usr\/sbin\/openvpn –daemon –writepid \/var\/run\/openvpn\/server.pid –cd \/etc\/openvpn\/ –config server.conf<\/span><\/p>\n

17. \u6aa2\u67e5 OpenVPN \u662f\u5426\u6709\u6b63\u5e38\u555f\u52d5
# netstat -antulp | grep :1194<\/span>
tcp\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0\u00a0\u00a0\u00a0\u00a0\u00a0 0 0.0.0.0:1194\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0.0.0.0:*\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 LISTEN\u00a0\u00a0\u00a0\u00a0\u00a0 1039\/openvpn<\/span><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

\u53c3\u8003\u7db2\u7ad9\uff1aCentOS 7 install OpenVPN @ \u56de\u61b6……! :: \u75de\u5ba2 … <\/p>\n

\u95b1\u8b80\u5168\u6587\u3008\u5728 CentOS 7.x \u4e0a\u4f7f\u7528 OpenVPN\u3009<\/span><\/a><\/p>\n","protected":false},"author":55,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[117,168],"tags":[],"class_list":["post-19280","post","type-post","status-publish","format-standard","hentry","category-c-78462","category-c-84780"],"meta_key":{"_pingme":["1"],"_encloseme":["1"],"lt_post_id":["650586"]},"_links":{"self":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/19280"}],"collection":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/users\/55"}],"replies":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/comments?post=19280"}],"version-history":[{"count":1,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/19280\/revisions"}],"predecessor-version":[{"id":20830,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/19280\/revisions\/20830"}],"wp:attachment":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/media?parent=19280"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/categories?post=19280"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/tags?post=19280"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}