update

2021-11-14 14:32:08 +08:00
parent f75ad8bedd
commit b0f6120151
152 changed files with 22219 additions and 8 deletions
--- a/content/post/openvpn-install.md
+++ b/content/post/openvpn-install.md
@@ -0,0 +1,175 @@
+---
+title: "CentOS7 安装 Openvpn"
+date: 2019-10-30T01:12:40+08:00
+lastmod: 2019-10-30T01:12:40+08:00
+tags: ["openvpn"]
+categories: ["network"]
+---
+
+# 环境
+
+角色 | 主机名 | 操作系统 | IP
+---- | ---- | ---- | ----
+vpn 服务端 | vpn-server | CentOS7 | 192.168.1.90
+vpn 客户端 | vpn-client | CentOS7 | 192.168.1.91
+
+# 两台服务器初始准备
+- 关闭 SELinux
+- 关闭防火墙或放行 udp 端口 1194
+- 安装 openvpn
+    ```bash
+    yum install epel-release
+    yum clean all
+    yum makecache fast
+    yum install easy-rsa openvpn
+    ```
+
+# 在 vpn-server 上创建证书
+- 复制 easy-rsa 脚本到 /opt/easy-rsa/ 下
+    ```bash
+    cp -af /usr/share/easy-rsa/3.0.3/ /opt/easy-rsa
+    # vars 文件包含证书相关配置，可修改
+    cp /usr/share/doc/easy-rsa-3.0.3/vars.example /opt/easy-rsa/vars
+    ```
+- 初始化 pki 目录结构
+    ```bash
+    cd /opt/easy-rsa
+    ./easyrsa init-pki
+    ```
+- 生成免密 ca 证书
+    ```bash
+    # 使用默认 common name 即可
+    ./easyrsa build-ca nopass
+    ```
+- 生成服务端免密证书
+    ```bash
+    # 参数 my-server0 指定生成的客户端证书文件名及其 common name
+    ./easyrsa build-server-full my-server0 nopass
+    ```
+- 生成客户端免密证书
+    ```bash
+    # 参数 my-client0 指定生成的客户端证书文件名及其 common name
+    # 不同的客户端需指定不同的 common name
+    # 方便在 client-conf-dir 目录下创建对应的同名客户端配置文件
+    ./easyrsa build-client-full my-client0 nopass
+    ```
+- 生成 dh.pem
+    ```bash
+    ./easyrsa gen-dh
+    ```
+- 生成 ta.key
+    ```bash
+    openvpn --genkey --secret pki/ta.key
+    ```
+- 查看证书目录
+    ```
+    /opt/easy-rsa/
+    ├── easyrsa
+    ├── openssl-1.0.cnf
+    ├── pki
+    │   ├── ca.crt
+    │   ├── certs_by_serial
+    │   │   ├── 1835C740AD1421868300998618C0641F.pem
+    │   │   └── 4F3AF1ED7D42ED56CCF26CC7622F4F50.pem
+    │   ├── dh.pem
+    │   ├── index.txt
+    │   ├── index.txt.attr
+    │   ├── index.txt.attr.old
+    │   ├── index.txt.old
+    │   ├── issued
+    │   │   ├── my-client0.crt
+    │   │   └── my-server0.crt
+    │   ├── private
+    │   │   ├── ca.key
+    │   │   ├── my-client0.key
+    │   │   └── my-server0.key
+    │   ├── reqs
+    │   │   ├── my-client0.req
+    │   │   └── my-server0.req
+    │   ├── serial
+    │   ├── serial.old
+    │   └── ta.key
+    ├── vars
+    └── x509-types
+        ├── ca
+        ├── client
+        ├── COMMON
+        ├── san
+        └── server
+    ```
+- **该证书目录 /opt/easyrsa 需妥善保管，后期增加其他客户端证书时会用到**
+
+# 配置 vpn-server
+- 开启路由转发，修改 /etc/sysctl.conf
+    ```bash
+    sysctl -w 'net.ipv4.ip_forward = 1'
+    sysctl -p
+    ```
+- 复制服务端证书到 openvpn 配置目录下
+    ```bash
+    mkdir -p /etc/openvpn/server/my-server0/
+    cd /opt/easy-rsa/pki
+    cp ca.crt dh.pem issued/my-server0.crt private/my-server0.key ta.key \
+        /etc/openvpn/server/my-server0/
+    ```
+- 创建 /etc/openvpn/server/my-server0.conf
+    ```bash
+    cd /usr/share/doc/openvpn-2.4.7/sample/sample-config-files
+    cp server.conf /etc/openvpn/server/my-server0.conf
+    ```
+- 修改 /etc/openvpn/server/my-server0.conf
+    ```
+    ca my-server0/ca.crt
+    cert my-server0/my-server0.crt
+    key my-server0/my-server0.key
+    dh my-server0/dh.pem
+    tls-auth my-server0/ta.key 0
+    ```
+
+# 启动 vpn-server 服务
+- 启动 openvpn-server@my-server0.service 服务
+    ```bash
+    systemctl start openvpn-server@my-server0.service
+    ```
+- 如需提供 ca 密码
+    ```bash
+    systemd-tty-ask-password-agent --query
+    ```
+
+# 配置 vpn-client
+- 复制 vpn-server 上的客户端证书到 openvpn 配置目录下
+    ```bash
+    mkdir -p /etc/openvpn/client/my-client0
+    scp vpn-server:/opt/easy-rsa/pki/{ca.crt,issued/my-client0.crt,private/my-client0.key,ta.key} /etc/openvpn/client/my-client0/
+    ```
+- 创建 /etc/openvpn/client/my-client0.conf
+    ```bash
+    cd /usr/share/doc/openvpn-3.0.3/sample/sample-config-files
+    cp client.conf /etc/openvpn/client/my-client0.conf
+    ```
+- 修改 /etc/openvpn/client/my-client0.conf
+    ```
+    remote 192.168.1.90 1194 # vpn server 地址
+    ca my-client0/ca.crt
+    cert my-client0/client.crt
+    key my-client0/client.key
+    tls-auth my-client0/ta.key 1
+    ```
+
+# 启动 vpn-client 服务
+- 启动 openvpn-client@my-client0 服务
+    ```bash
+    systemctl start openvpn-client@my-client0.service
+    ```
+- 如需提供 ca 密码
+    ```bash
+    systemd-tty-ask-password-agent --query
+    ```
+
+# 验证
+- vpn server 新增网卡 tun0，地址是 10.8.0.1/24
+- vpn client 新增网卡 tun0，地址是 10.8.0.2/24
+
+# 参考
+- [创建证书](https://blog.csdn.net/zhuwei_clark/article/details/87949043)
+