181 lines
5.1 KiB
Markdown
181 lines
5.1 KiB
Markdown
---
|
||
title: "CentOS7 安装 Openvpn"
|
||
date: 2019-10-30T01:12:40+08:00
|
||
lastmod: 2019-10-30T01:12:40+08:00
|
||
tags: ["openvpn"]
|
||
categories: ["network"]
|
||
---
|
||
|
||
## 环境
|
||
|
||
角色 | 主机名 | 操作系统 | IP
|
||
---- | ---- | ---- | ----
|
||
vpn 服务端 | vpn-server | CentOS7 | 192.168.1.90
|
||
vpn 客户端 | vpn-client | CentOS7 | 192.168.1.91
|
||
|
||
## 两台服务器初始准备
|
||
- 关闭 SELinux
|
||
- 关闭防火墙或放行 udp 端口 1194
|
||
- 安装 openvpn
|
||
```bash
|
||
yum install epel-release
|
||
yum clean all
|
||
yum makecache fast
|
||
yum install easy-rsa openvpn
|
||
```
|
||
|
||
## 在 vpn-server 上创建证书
|
||
- 复制 easy-rsa 脚本到 /opt/easy-rsa/ 下
|
||
```bash
|
||
cp -af /usr/share/easy-rsa/3.0.3/ /opt/easy-rsa
|
||
# vars 文件包含证书相关配置，可修改
|
||
cp /usr/share/doc/easy-rsa-3.0.3/vars.example /opt/easy-rsa/vars
|
||
```
|
||
- 初始化 pki 目录结构
|
||
```bash
|
||
cd /opt/easy-rsa
|
||
./easyrsa init-pki
|
||
```
|
||
- 修改 /opt/easy-rsa/pki/safessl-easyrsa.conf 中如下配置，增加证书有效时间为 10 年
|
||
```
|
||
default_days = 3650
|
||
default_crl_days = 3650
|
||
```
|
||
- 生成免密 ca 证书
|
||
```bash
|
||
# 使用默认 common name 即可
|
||
./easyrsa build-ca nopass
|
||
```
|
||
- 生成服务端免密证书
|
||
```bash
|
||
# 参数 my-server0 指定生成的客户端证书文件名及其 common name
|
||
./easyrsa build-server-full my-server0 nopass
|
||
```
|
||
- 生成客户端免密证书
|
||
```bash
|
||
# 参数 my-client0 指定生成的客户端证书文件名及其 common name
|
||
# 不同的客户端需指定不同的 common name
|
||
# 方便在 client-conf-dir 目录下创建对应的同名客户端配置文件
|
||
./easyrsa build-client-full my-client0 nopass
|
||
```
|
||
- 生成 dh.pem
|
||
```bash
|
||
./easyrsa gen-dh
|
||
```
|
||
- 生成 ta.key
|
||
```bash
|
||
openvpn --genkey --secret pki/ta.key
|
||
```
|
||
- 查看证书目录
|
||
```
|
||
/opt/easy-rsa/
|
||
├── easyrsa
|
||
├── openssl-1.0.cnf
|
||
├── pki
|
||
│ ├── ca.crt
|
||
│ ├── certs_by_serial
|
||
│ │ ├── 1835C740AD1421868300998618C0641F.pem
|
||
│ │ └── 4F3AF1ED7D42ED56CCF26CC7622F4F50.pem
|
||
│ ├── dh.pem
|
||
│ ├── index.txt
|
||
│ ├── index.txt.attr
|
||
│ ├── index.txt.attr.old
|
||
│ ├── index.txt.old
|
||
│ ├── issued
|
||
│ │ ├── my-client0.crt
|
||
│ │ └── my-server0.crt
|
||
│ ├── private
|
||
│ │ ├── ca.key
|
||
│ │ ├── my-client0.key
|
||
│ │ └── my-server0.key
|
||
│ ├── reqs
|
||
│ │ ├── my-client0.req
|
||
│ │ └── my-server0.req
|
||
│ ├── serial
|
||
│ ├── serial.old
|
||
│ └── ta.key
|
||
├── vars
|
||
└── x509-types
|
||
├── ca
|
||
├── client
|
||
├── COMMON
|
||
├── san
|
||
└── server
|
||
```
|
||
- **该证书目录 /opt/easyrsa 需妥善保管，后期增加其他客户端证书时会用到**
|
||
|
||
## 配置 vpn-server
|
||
- 开启路由转发，修改 /etc/sysctl.conf
|
||
```bash
|
||
sysctl -w 'net.ipv4.ip_forward = 1'
|
||
sysctl -p
|
||
```
|
||
- 复制服务端证书到 openvpn 配置目录下
|
||
```bash
|
||
mkdir -p /etc/openvpn/server/my-server0/
|
||
cd /opt/easy-rsa/pki
|
||
cp ca.crt dh.pem issued/my-server0.crt private/my-server0.key ta.key \
|
||
/etc/openvpn/server/my-server0/
|
||
```
|
||
- 创建 /etc/openvpn/server/my-server0.conf
|
||
```bash
|
||
cd /usr/share/doc/openvpn-2.4.7/sample/sample-config-files
|
||
cp server.conf /etc/openvpn/server/my-server0.conf
|
||
```
|
||
- 修改 /etc/openvpn/server/my-server0.conf
|
||
```
|
||
ca my-server0/ca.crt
|
||
cert my-server0/my-server0.crt
|
||
key my-server0/my-server0.key
|
||
dh my-server0/dh.pem
|
||
tls-auth my-server0/ta.key 0
|
||
```
|
||
|
||
## 启动 vpn-server 服务
|
||
- 启动 openvpn-server@my-server0.service 服务
|
||
```bash
|
||
systemctl start openvpn-server@my-server0.service
|
||
```
|
||
- 如需提供 ca 密码
|
||
```bash
|
||
systemd-tty-ask-password-agent --query
|
||
```
|
||
|
||
## 配置 vpn-client
|
||
- 复制 vpn-server 上的客户端证书到 openvpn 配置目录下
|
||
```bash
|
||
mkdir -p /etc/openvpn/client/my-client0
|
||
scp vpn-server:/opt/easy-rsa/pki/{ca.crt,issued/my-client0.crt,private/my-client0.key,ta.key} /etc/openvpn/client/my-client0/
|
||
```
|
||
- 创建 /etc/openvpn/client/my-client0.conf
|
||
```bash
|
||
cd /usr/share/doc/openvpn-3.0.3/sample/sample-config-files
|
||
cp client.conf /etc/openvpn/client/my-client0.conf
|
||
```
|
||
- 修改 /etc/openvpn/client/my-client0.conf
|
||
```
|
||
remote 192.168.1.90 1194 # vpn server 地址
|
||
ca my-client0/ca.crt
|
||
cert my-client0/client.crt
|
||
key my-client0/client.key
|
||
tls-auth my-client0/ta.key 1
|
||
```
|
||
|
||
## 启动 vpn-client 服务
|
||
- 启动 openvpn-client@my-client0 服务
|
||
```bash
|
||
systemctl start openvpn-client@my-client0.service
|
||
```
|
||
- 如需提供 ca 密码
|
||
```bash
|
||
systemd-tty-ask-password-agent --query
|
||
```
|
||
|
||
## 验证
|
||
- vpn server 新增网卡 tun0，地址是 10.8.0.1/24
|
||
- vpn client 新增网卡 tun0，地址是 10.8.0.2/24
|
||
|
||
## 参考
|
||
- [创建证书](https://blog.csdn.net/zhuwei_clark/article/details/87949043)
|
||
|