1、环境搭建的详细步骤
说明：
vpn client 192.168.8.16/24
openvpn server：
eth0: 192.168.8.41
eth1: 172.16.1.10
app server:
172.16.1.20
app server和openvpn的eth1都在vmnet2上
openvpn server
# ifconfig
eth0 Link encap:Ethernet HWaddr 00:0C:29:6C:85:A0
inet addr:192.168.8.41 Bcast:192.168.8.255 Mask:255.255.255.0
inet6 addr: fe80::20c:29ff:fe6c:85a0/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:9587674 errors:0 dropped:0 overruns:0 frame:0
TX packets:5211921 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:1241650018 (1.1 GiB) TX bytes:1238208023 (1.1 GiB)
eth1 Link encap:Ethernet HWaddr 00:0C:29:6C:85:AA
inet addr:172.16.1.10 Bcast:172.16.1.255 Mask:255.255.255.0
inet6 addr: fe80::20c:29ff:fe6c:85aa/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:122 errors:0 dropped:0 overruns:0 frame:0
TX packets:73 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:11314 (11.0 KiB) TX bytes:6306 (6.1 KiB)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:1572 errors:0 dropped:0 overruns:0 frame:0
TX packets:1572 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:141358 (138.0 KiB) TX bytes:141358 (138.0 KiB)
2、时间同步：
# ntpdate 192.168.8.102
3、创建openvpn的安装目录
# mkdir -pv /home/tools/openvpn
mkdir: created directory `/home/tools'
mkdir: created directory `/home/tools/openvpn'
# cd /home/tools/openvpn/
上传安装软件到该目录
# ls -l
total 1464
-rw-r--r-- 1 root root 583045 Jun 29 17:30 lzo-2.06.tar.gz
-rw-r--r-- 1 root root 911158 Jun 29 17:30 openvpn-2.2.2.tar.gz
4、安装依赖包
# yum install -y gcc*
# yum install -y openssl*
编译安装依赖包，通过执行 echo $?可以判断步骤是否正确
tar zxf lzo-2.06.tar.gz
cd lzo-2.06
./configure
make
make install
安装openvpnserver
# tar zxf openvpn-2.2.2.tar.gz
# cd openvpn-2.2.2
# ./configure --with-lzo-headers=/usr/local/include --with-lzo-lib=/usr/local/lib
# make && make install
验证是否安装成功
# ll /usr/local/sbin/openvpn
-rwxr-xr-x 1 root root 2545339 Jun 29 17:55 /usr/local/sbin/openvpn
# which openvpn
/usr/local/sbin/openvpn
5、配置openvpn server的各种密钥
# cd /home/tools/openvpn/openvpn-2.2.2/easy-rsa/2.0
# vim vars
export KEY_COUNTRY="CN"
export KEY_PROVINCE="SZ"
export KEY_CITY="shenzhen"
export KEY_ORG="chinasoft"
export KEY_EMAIL="[email protected]"
export [email protected]
export KEY_CN=CN
export KEY_NAME=chinasoft
export KEY_OU=chinasoft
export PKCS11_MODULE_PATH=changeme
export PKCS11_PIN=1234
使配置生效
[root@node3 2.0]# source vars
NOTE: If you run ./clean-all, I will be doing a rm -rf on /home/tools/openvpn/openvpn-2.2.2/easy-rsa/2.0/keys
[root@node3 2.0]# ./clean-all
[root@node3 2.0]# ./build-ca
Generating a 1024 bit RSA private key
................................................++++++
....................++++++
writing new private key to 'ca.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]:
State or Province Name (full name) [SZ]:
Locality Name (eg, city) [shenzhen]:
Organization Name (eg, company) [chinasoft]:
Organizational Unit Name (eg, section) [chinasoft]:
Common Name (eg, your name or your server's hostname) [CN]:chinasoft
Name [chinasoft]:
Email Address [[email protected]]:
# ll keys/
total 12
-rw-r--r-- 1 root root 1367 Jun 29 18:09 ca.crt
-rw------- 1 root root 916 Jun 29 18:09 ca.key
-rw-r--r-- 1 root root 0 Jun 29 18:08 index.txt
-rw-r--r-- 1 root root 3 Jun 29 18:08 serial
生成服务器端证书和秘钥key文件
# ./build-key-server server
Generating a 1024 bit RSA private key
.................................++++++
...............++++++
writing new private key to 'server.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]:
State or Province Name (full name) [SZ]:
Locality Name (eg, city) [shenzhen]:
Organization Name (eg, company) [chinasoft]:
Organizational Unit Name (eg, section) [chinasoft]:
Common Name (eg, your name or your server's hostname) [server]:chinasoft
Name [chinasoft]:
Email Address [[email protected]]:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:123456
An optional company name []:chinasoft
Using configuration from /home/tools/openvpn/openvpn-2.2.2/easy-rsa/2.0/openssl-1.0.0.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName :PRINTABLE:'CN'
stateOrProvinceName :PRINTABLE:'SZ'
localityName :PRINTABLE:'shenzhen'
organizationName :PRINTABLE:'chinasoft'
organizationalUnitName:PRINTABLE:'chinasoft'
commonName :PRINTABLE:'chinasoft'
name :PRINTABLE:'chinasoft'
emailAddress :IA5STRING:'[email protected]'
Certificate is to be certified until Jun 27 10:13:59 2026 GMT (3650 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
建立2份客户端证书，分别为client和ett
[root@node3 2.0]# ./build-key test
注意：./build-key test 这条命令不能配置成 ./build-key chinasoft及其他和组织等名称相同的文件名，否则无法通信
Generating a 1024 bit RSA private key
.......++++++
................................++++++
writing new private key to 'test.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]:
State or Province Name (full name) [SZ]:
Locality Name (eg, city) [shenzhen]:
Organization Name (eg, company) [chinasoft]:
Organizational Unit Name (eg, section) [chinasoft]:
Common Name (eg, your name or your server's hostname) [test]:chinasoft
Name [chinasoft]:
Email Address [[email protected]]:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:123456
An optional company name []:chinasoft
Using configuration from /home/tools/openvpn/openvpn-2.2.2/easy-rsa/2.0/openssl-1.0.0.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName :PRINTABLE:'CN'
stateOrProvinceName :PRINTABLE:'SZ'
localityName :PRINTABLE:'shenzhen'
organizationName :PRINTABLE:'chinasoft'
organizationalUnitName:PRINTABLE:'chinasoft'
commonName :PRINTABLE:'chinasoft'
name :PRINTABLE:'chinasoft'
emailAddress :IA5STRING:'[email protected]'
Certificate is to be certified until Jun 27 13:29:36 2026 GMT (3650 days)
Sign the certificate? [y/n]:y
failed to update database
TXT_DB error number 2
创建加密的客户端key
# ./build-key-pass ett
Generating a 1024 bit RSA private key
........................................++++++
................++++++
writing new private key to 'ett.key'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]:
State or Province Name (full name) [SZ]:
Locality Name (eg, city) [shenzhen]:
Organization Name (eg, company) [chinasoft]:
Organizational Unit Name (eg, section) [chinasoft]:
Common Name (eg, your name or your server's hostname) [ett]:chinasoft
Name [chinasoft]:
Email Address [[email protected]]:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:123456
An optional company name []:chinasoft
Using configuration from /home/tools/openvpn/openvpn-2.2.2/easy-rsa/2.0/openssl-1.0.0.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName :PRINTABLE:'CN'
stateOrProvinceName :PRINTABLE:'SZ'
localityName :PRINTABLE:'shenzhen'
organizationName :PRINTABLE:'chinasoft'
organizationalUnitName:PRINTABLE:'chinasoft'
commonName :PRINTABLE:'chinasoft'
name :PRINTABLE:'chinasoft'
emailAddress :IA5STRING:'[email protected]'
Certificate is to be certified until Jun 27 10:24:44 2026 GMT (3650 days)
Sign the certificate? [y/n]:y
failed to update database
TXT_DB error number 2
生成传输进行密钥交换时用到的交换密钥协议文件
# ./build-dh
# ll keys/dh1024.pem
-rw-r--r-- 1 root root 245 Jun 29 19:05 keys/dh1024.pem
为防止恶意攻击，如DOS、UDP port flooding，我们生成一个HMAC firewall
# openvpn --genkey --secret keys/ta.key
[root@node3 2.0]# ll keys/ta.key
-rw------- 1 root root 636 Jun 29 19:07 keys/ta.key
6、配置openvpn.conf文件
# mkdir /etc/openvpn
# cp -a keys /etc/openvpn/
[root@node3 2.0]# cp ../../sample-config-files/server.conf /etc/openvpn/
[root@node3 2.0]# tree /etc/op
openldap/ openvpn/ opt/
[root@node3 2.0]# tree /etc/openvpn/
-bash: tree: command not found
[root@node3 2.0]# tree /etc/openvpn/
/etc/openvpn/
├── keys
│ ├── 01.pem
│ ├── ca.crt
│ ├── ca.key
│ ├── chinasoft.crt
│ ├── chinasoft.csr
│ ├── chinasoft.key
│ ├── dh1024.pem
│ ├── ett.crt
│ ├── ett.csr
│ ├── ett.key
│ ├── index.txt
│ ├── index.txt.attr
│ ├── index.txt.old
│ ├── serial
│ ├── serial.old
│ ├── server.crt
│ ├── server.csr
│ ├── server.key
│ └── ta.key
└── server.conf
# vim /etc/openvpn/server.conf
local 192.168.8.41 # 监听地址
port 52155 # 监听端口
proto tcp
dev tun
ca /etc/openvpn/keys/ca.crt # ca证书
cert /etc/openvpn/keys/server.crt # 服务证书
key /etc/openvpn/keys/server.key # 服务key
dh /etc/openvpn/keys/dh1024.pem
server 10.8.0.0 255.255.255.0 # vpn server动态分配给vpn client的地址池，一般不需要修改
push "route 172.16.1.0 255.255.255.0" # vpn server所在的内网网段，如果有多个可写写多个push
ifconfig-pool-persist /etc/openvpn/keys/ipp.txt
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3
client-to-client
duplicate-cn
log /var/log/openvpn.log
打开路由转发功能
# vim /etc/sysctl.conf
net.ipv4.ip_forward = 1
使配置生效
# sysctl -p
net.ipv4.ip_forward = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.default.accept_source_route = 0
kernel.sysrq = 0
kernel.core_uses_pid = 1
net.ipv4.tcp_syncookies = 1
error: "net.bridge.bridge-nf-call-ip6tables" is an unknown key
error: "net.bridge.bridge-nf-call-iptables" is an unknown key
error: "net.bridge.bridge-nf-call-arptables" is an unknown key
kernel.msgmnb = 65536
kernel.msgmax = 65536
kernel.shmmax = 68719476736
kernel.shmall = 4294967296
8、启动openvpn server服务
# /usr/local/sbin/openvpn --config /etc/openvpn/server.conf &
检查服务是否正常启动
# netstat -lntup|grep vpn
tcp 0 0 0.0.0.0:52155 0.0.0.0:* LISTEN 28959/openvpn
加入启动脚本
# echo '/usr/local/sbin/openvpn --config /etc/openvpn/server.conf &' >> /etc/rc.local
[root@node3 openvpn]# tail -1 /etc/rc.local
tail: inotify cannot be used, reverting to polling
/usr/local/sbin/openvpn --config /etc/openvpn/server.conf &
将openvpn添加为服务的形式
# cp /home/tools/openvpn/openvpn-2.2.2/sample-scripts/openvpn.init /etc/init.d/openvpn
[root@node3 openvpn]# chkconfig --add openvpn
[root@node3 openvpn]# chkconfig --list openvpn
openvpn 0:off1:off2:off3:on4:on5:on6:off
[root@node3 openvpn]# chmod +x /etc/init.d/openvpn
[root@node3 openvpn]# chkconfig openvpn on
[root@node3 openvpn]# chkconfig --list openvpn
openvpn 0:off1:off2:on3:on4:on5:on6:off
[root@node3 openvpn]# killall openvpn
[root@node3 openvpn]# service openvpn start
Starting openvpn: [ OK ]
[1]+ Done /usr/local/sbin/openvpn --config /etc/openvpn/server.conf
[root@node3 openvpn]# service openvpn restart
Shutting down openvpn: [ OK ]
Starting openvpn: [ OK ]
# ifconfig
eth0 Link encap:Ethernet HWaddr 00:0C:29:6C:85:A0
inet addr:192.168.8.41 Bcast:192.168.8.255 Mask:255.255.255.0
inet6 addr: fe80::20c:29ff:fe6c:85a0/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:9941129 errors:0 dropped:0 overruns:0 frame:0
TX packets:5344611 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:1366753019 (1.2 GiB) TX bytes:1255169492 (1.1 GiB)
eth1 Link encap:Ethernet HWaddr 00:0C:29:6C:85:AA
inet addr:172.16.1.10 Bcast:172.16.1.255 Mask:255.255.255.0
inet6 addr: fe80::20c:29ff:fe6c:85aa/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:414 errors:0 dropped:0 overruns:0 frame:0
TX packets:78 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:28834 (28.1 KiB) TX bytes:6644 (6.4 KiB)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:1738 errors:0 dropped:0 overruns:0 frame:0
TX packets:1738 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:155542 (151.8 KiB) TX bytes:155542 (151.8 KiB)
tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.8.0.1 P-t-P:10.8.0.2 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:4 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:240 (240.0 b) TX bytes:0 (0.0 b)
如果启动报错：
需要修改服务启动服务脚本/etc/init.d/openvpn
for c in `/bin/ls *.conf 2>/dev/null`; do
改为
for c in `/bin/ls server.conf 2>/dev/null`; do
9、windows客户端openvpn-2.2.2-install.exe安装
在vpn server中安装文件传输工具，将下列文件传送给客户端，放置在E:\Program Files (x86)\OpenVPN\config\test目录下
client.conf 改名为 test.ovpn
# yum install -y lrzsz
# sz -y ca.crt test.crt test.key client.conf
报错：
failed to update database
TXT_DB error number 2
解决办法：
vim /home/tools/openvpn/openvpn-2.2.2/easy-rsa/2.0/keys/index.txt.attr
将unique_subject = yes 改为unique_subject = no
在vpn客户端连通后ping 172.16.1.20
通过在appserver 172.16.1.20上抓包发现只有请求的数据包，没有回应
# tcpdump -nnn -s 10000|grep -i icmp
将appserver的网关指向vpnserver的内网网卡后可以ping通，访问nginx服务http://172.16.1.20也正常
# route add default gw 172.16.1.10
或者添加静态路由
# route add -net 10.8.0.0/24 gw 172.16.1.10
如果要是永久生效，有如下几种方法：
方法一：
vi /etc/sysconfig/network-scripts/route-eth0 #默认不存在此文件
加入如下内容：
10.8.0.0/24 via 172.16.1.10
提示：写到配置里，重启网络服务和重启系统都会生效！
方法二：
vi /etc/sysconfig/static-routes #默认不存在此文件
加入如下内容:
any net 10.8.0.0/24 gw 172.16.1.10
提示：写到配置里，重启网络服务和重启系统都会生效！
方法三：
vi /etc/rc.local
加入如下内容：
route add -net 10.8.0.0/24 gw 172.16.1.10
PS: 方法一推荐生产环境使用
提示：方法三写到/etc/rc.local里只在开机时加载，当手工重启网络后会失效，但是重启系统后会生效！
注意：如果当VPN客户端的网关不是VPNSERVER内网地址的时候，所有的VPN客户端都要加网络路由，当VPN客户端的网关是VPNSETVER内网地址就不需要添加静态路由了
