openvpn安装之一server安装配置

linux  /  管理员 发布于 3年前   3971

#### openvpn安装

yum install -y -q openvpn

#### 证书生成 参考链接 

http://openwrt.iteye.com/blog/2305318

#### sysctl.conf 确认ip转发开启

net.ipv4.ip_forward = 1

#### 文件分布 /etc/openvpn/server

├── ccd #客户端路由和地址分配（文件名必须和client证书一致）
│?? ├── jiebei1
│?? └── jiebei2
├── keys #证书目录
│?? ├── 01.pem
│?? ├── ......
└── server.conf #server配置文件

#### server.conf样例

port 4194
proto tcp
#dev tap
#proto udp
dev tun

####证书配置
ca /etc/openvpn/server/keys/ca.crt
cert /etc/openvpn/server/keys/server.crt
key /etc/openvpn/server/keys/server.key
dh /etc/openvpn/server/keys/dh2048.pem
tls-auth /etc/openvpn/server/keys/ta.key 0
####
server 10.38.0.0 255.255.255.0  #vpn通道网段
ifconfig-pool-persist ipp.txt
push "dhcp-options DNS 114.114.114.114"
push "route 10.10.1.0 255.255.255.0" #push给clinet的路由信息
sndbuf 0
rcvbuf 0
client-config-dir /etc/openvpn/server/ccd
route 192.168.1.0 255.255.255.0 #clinet网段的路由信息，有多少写多少
route 172.18.1.0 255.255.255.0
keepalive 20 300
cipher BF-CBC
comp-lzo
max-clients 5000
user nobody
group nobody
persist-key
persist-tun
status /etc/openvpn/server/openvpn-status.log
log-append  /etc/openvpn/server/openvpn.log
verb 3
mute 20

#### ccd文件样例

[root@jb-managerserver server]# cat ccd/jiebei1
iroute 172.18.1.0 255.255.255.0 #vpn-client的网段
ifconfig-push 10.38.0.6 10.38.0.5 #分配给vpn-client的地址

#### openvpn-server.service样例

[root@jb-managerserver server]# cat /etc/systemd/system/openvpn-server.service
[Unit]
Description=OpenVPN Robust And Highly Flexible Tunneling Application
After=network.target
[Service]
PrivateTmp=true
Type=forking
PIDFile=/var/run/openvpn-server/server.pid
ExecStart=/usr/sbin/openvpn --daemon --writepid /var/run/openvpn-server/server.pid  --config /etc/openvpn/server/server.conf
#服务启动或者关闭后须添加/删除的nat转发规则。
ExecStartPost=/usr/sbin/iptables -t nat -A POSTROUTING -s 10.38.0.6/32 -o eth0 -j MASQUERADE
ExecStartPost=/usr/sbin/iptables -t nat -A POSTROUTING -s 10.38.0.10/32 -o eth0 -j MASQUERADE
ExecStopPost=/usr/sbin/iptables -t nat -D POSTROUTING -s 10.38.0.6/32 -o eth0 -j MASQUERADE
ExecStopPost=/usr/sbin/iptables -t nat -D POSTROUTING -s 10.38.0.10/32 -o eth0 -j MASQUERADE
[Install]
WantedBy=multi-user.target

#### 服务启动关闭

systemctl start/stop/restart openvpn-server

#### 排错  日志

/etc/openvpn/server/openvpn-status.log
/etc/openvpn/server/openvpn.log

- iptables -S -tnat  iptables -tnat -L -nv
- tcpdump
- route -n