{"id":200,"date":"2013-07-18T21:04:54","date_gmt":"2013-07-18T13:04:54","guid":{"rendered":"http:\/\/www.361.xxx\/?p=34"},"modified":"2013-07-18T21:04:54","modified_gmt":"2013-07-18T13:04:54","slug":"centos-6-openvpn","status":"publish","type":"post","link":"http:\/\/www.cyups.com\/?p=200","title":{"rendered":"centos 6 openvpn"},"content":{"rendered":"

centos 6 yum \u5b89\u88c5 openvpncentos 6 \u9ed8\u8ba4\u7684yum \u6e90\u6ca1\u6709openvpn,\u6240\u4ee5\u9700\u8981\u6dfb\u52a0\u5916\u90e8\u7684\u6e90
\n\u83b7\u53d6
\nwget http:\/\/apt.sw.be\/redhat\/el6\/en\/x ... 2.el6.rf.x86_64.rpm<\/a>
\nrpm -Uvh rpmforge-release-0.5.2-2.el6.rf.x86_64.rpm
\n\u7136\u540e\u8fd0\u884c
\nyum makecache
\nyum install openvpn
\n\u5b89\u88c5\u5b8c\u6210\u4ee5\u540e,\u5f00\u59cb\u914d\u7f6e
\n#cp -R \/usr\/share\/openvpn\/easy-rsa \/etc\/openvpn\/
\n# \u6216\u8005\u662f\u8fd9\u4e2a\u5fb7\u884c,\u8c8c\u4f3c\u4e0d\u540c\u7684\u7cfb\u7edf,\u8fd9\u4e2a\u4f4d\u7f6e\u4e0d\u4e00\u6837
\n\u6211\u7684\u662fcentos6.2 \u662f\u5728\u4e0b\u9762\u8fd9\u4e2a\u4f4d\u7f6e
\ncp -R \/usr\/share\/doc\/openvpn-2.2.2\/easy-rsa \/etc\/openvpn
\ncd \/etc\/openvpn\/easy-rsa\/2.0
\nchmod +x .\/*
\nsource .\/vars
\n\u4e0b\u9762\u5f00\u59cb\u751f\u6210key\u7b49\u6587\u4ef6,\u6240\u6709\u7684\u90fd\u56de\u8f66\u9ed8\u8ba4
\n.\/clean-all
\n\u521b\u5efaCA
\n.\/build-ca server
\n\u521b\u5efaCA\u4e4b\u540e\u6765\u751f\u6210\u670d\u52a1\u5668\u8bc1\u4e66\uff0c\u8f93\u5165
\n.\/build-key-server server
\n\u751f\u6210\u5ba2\u6237\u7aef\u8bc1\u4e66,\u540c\u6837,\u90fd\u662f\u9ed8\u8ba4\u56de\u8f66
\n.\/build-key client1
\n.\/build-key client2
\n\u6700\u540e\u751f\u6210Diffie Hellman\u53c2\u6570\uff1a
\n.\/build-dh
\n\u8bc1\u4e66\u7b49\u751f\u6210\u5b8c\u6bd5,\u5f00\u59cb\u8bbe\u7f6e\u914d\u7f6e\u6587\u4ef6,\u5982\u4e0b\u7684\u914d\u7f6e\u6587\u4ef6\u652f\u6301 \u5355server \u2014>> \u591aclient,\u800c\u4e14\u4e0d\u4f1a\u4fee\u6539\u9ed8\u8ba4\u7684\u7f51\u5173,\u6240\u4ee5\u8fd0\u884c\u540e,\u4e0d\u4f1a\u5f71\u54cd\u73b0\u6709\u7684
\n\u7f51\u7edc\u8def\u7531,\u8fd9\u6837\u53ef\u4ee5\u652f\u6301\u591a\u5ba2\u6237\u7aef\u4e4b\u95f4\u7684\u4e92\u76f8\u8fde\u63a5
\n\u4ee5\u4e0b\u6587\u4ef6\u4fdd\u5b58\u5728 \/etc\/openvpn\/server.conf
\nvim \/etc\/openvpn\/server.conf
\n\u5f15\u7528port 1194
\nproto udp
\ndev tun
\nca \/etc\/openvpn\/easy-rsa\/2.0\/keys\/ca.crt
\ncert \/etc\/openvpn\/easy-rsa\/2.0\/keys\/server.crt
\nkey \/etc\/openvpn\/easy-rsa\/2.0\/keys\/server.key
\ndh \/etc\/openvpn\/easy-rsa\/2.0\/keys\/dh1024.pem
\nstatus \/var\/run\/openvpn.status
\nserver 10.10.10.0 255.255.255.0
\nifconfig-pool-persist ipp.txt
\nclient-config-dir \/etc\/openvpn\/ccd
\nuser nobody
\ngroup nobody
\nclient-to-client
\nkeepalive 10 120
\ncomp-lzo
\npersist-key
\npersist-tun
\nscript-security 2
\nverb 3
\n\u5982\u679c\u60f3\u652f\u6301openvpn \u80fd\u8e22\u6389\u8fde\u63a5\u7684\u7528\u6237,\u53ef\u4ee5\u6253\u5f00openvpn \u7684 management \u529f\u80fd,\u65b9\u6cd5\u5c31\u662f\u5728\u914d\u7f6e\u6587\u4ef6\u91cc\u9762\u6dfb\u52a0\u5982\u4e0b
\n\u5f15\u7528
\nmanagement 127.0.0.1 9999
\n\u4f7f\u7528\u7684\u65b9\u6cd5\u5c31\u662f\u7528 telnet 127.0.0.1 9999
\n\u767b\u9646\u8fdb\u5165\u540e,help\u4e0b\u5c31\u77e5\u9053\u600e\u4e48\u64cd\u4f5c\u4e86,\u975e\u5e38\u7684\u65b9\u4fbf
\n\u5982\u679c\u8981\u60f3\u4fee\u6539\u5ba2\u6237\u7aef\u8fde\u63a5\u4ee5\u540e,\u81ea\u52a8\u4fee\u6539\u7f51\u5173\u4e3a\u670d\u52a1\u5668\u7684\u5730\u5740,\u5e76\u7528\u6765fan,\u7528\u4e0b\u9762\u7684\u914d\u7f6e\u6587\u4ef6
\n\u5f15\u7528port 1194
\nproto udp
\ndev tun
\nca \/etc\/openvpn\/easy-rsa\/2.0\/keys\/ca.crt
\ncert \/etc\/openvpn\/easy-rsa\/2.0\/keys\/server.crt
\nkey \/etc\/openvpn\/easy-rsa\/2.0\/keys\/server.key
\ndh \/etc\/openvpn\/easy-rsa\/2.0\/keys\/dh1024.pem
\nserver 10.10.10.0 255.255.255.0
\npush \u201credirect-gateway def1\u2033
\npush \u201cdhcp-option DNS 8.8.8.8\u2033
\nifconfig-pool-persist ipp.txt
\nclient-config-dir \/etc\/openvpn\/ccd
\nuser nobody
\ngroup nobody
\nclient-to-client
\nkeepalive 10 120
\ncomp-lzo
\npersist-key
\npersist-tun
\nscript-security 2
\nverb 3
\n\u5982\u679c\u60f3\u8ba9\u670d\u52a1\u7aef\u652f\u6301\u540c\u4e00\u4e2a\u5ba2\u6237\u591a\u6b21\u767b\u5f55\u7684\u5316\uff0c\u670d\u52a1\u5668\u7aef\u914d\u7f6e\u6587\u4ef6\u6dfb\u52a0\u5982\u4e0b
\n\u5f15\u7528duplicate-cn
\n\u4e0a\u9762\u7684 client-config-dir \/etc\/openvpn\/ccd \u8868\u793a\u56fa\u5b9a\u5ba2\u6237\u7684ip,\u5373\u6bcf\u4e2a\u5ba2\u6237\u62e8\u53f7\u4e0a\u6765\u4ee5\u540e,ip\u662f\u56fa\u5b9a\u7684
\n\u521b\u5efa \/etc\/openvpn\/ccd \u76ee\u5f55, \u5728\u76ee\u5f55\u91cc\u9762\u521b\u5efaCN\u7684\u540d\u5b57\u7684\u6587\u4ef6\u540d,\u5982\u4e0a,\u5e94\u8be5\u4e3a client1 client2 \u7b49\u6837\u5b50\u7684\u6587\u4ef6,\u5185\u5bb9\u5982\u4e0b
\nifconfig-push 10.10.10.5 10.10.10.6
\n\u6279\u91cf\u521b\u5efa\u8fd9\u4e2a\u6587\u4ef6\u7684\u547d\u4ee4
\nfor i in `seq 1 10`
\ndo
\n((IPA=i+4))
\n((IPB=i+5))
\necho \u201cifconfig-push 10.10.10.${IPA} 10.10.10.${IPB}\u201d > \/etc\/openvpn\/ccd\/client${i}
\ndone
\n\u6ce8\u610f, \u6bcf\u4e2aip\u4e4b\u95f4,ip\u95f4\u96944\u4e2a, 5,9,13 \u7b49,\u4f9d\u6b21\u7c7b\u63a8
\n\u914d\u7f6e\u5b8c\u6210openvpn\u4ee5\u540e,\u5f00\u59cb\u914d\u7f6eiptables,\u8bbe\u7f6e\u5f00\u542fipv4\u7684\u8def\u7531\u8f6c\u53d1
\nvim \/etc\/sysctl.conf
\n\u4fee\u6539\u4e3a
\n\u5f15\u7528net.ipv4.ip_forward = 1
\n\u8fd0\u884c\u5982\u4e0b\u547d\u4ee4,\u914d\u7f6enat
\niptables -t nat -A POSTROUTING -j MASQUERADE
\n\u4fdd\u6301\u5f00\u673a\u8fd0\u884c
\nchkconfig openvpn on
\necho \u2018iptables -t nat -A POSTROUTING -j MASQUERADE\u2019 >> \/etc\/rc.local
\n\u91cd\u65b0\u542f\u52a8openvpn\u670d\u52a1
\n\/etc\/init.d\/openvpn restart
\n\u6253\u5305 keys \u76ee\u5f55\u4e0b\u7684\u6587\u4ef6,\u5e76\u4e0b\u8f7d\u5230\u5ba2\u6237\u7aef,\u5177\u4f53\u914d\u7f6e\u65b9\u6cd5,\u4e0d\u505a\u8bf4\u660e\u4e86,\u914d\u7f6e\u6587\u4ef6\u5982\u4e0b
\n\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2013
\n\u4ee5\u4e0b\u4e3a\u5ba2\u6237\u7aef\u914d\u7f6e\u6587\u4ef6
\n\u5f15\u7528client
\ndev tun
\nproto udp
\nremote x.x.x.x 1194
\nresolv-retry infinite
\nnobind
\npersist-key
\npersist-tun
\nca ca.crt
\ncert client.crt
\nkey client.key
\ncomp-lzo
\nscript-security 2
\nverb 3
\nps: \u7ecf\u8fc7\u6211\u7684\u6d4b\u8bd5,\u5728\u7f51\u7edc\u4e0d\u597d\u7684\u60c5\u51b5\u4e0b,\u4f1a\u53d1\u751f\u6389\u5305\u7684\u60c5\u51b5,\u800c\u4e14\u6389\u5305\u6bd4\u8f83\u5389\u5bb3,\u91cd\u65b0\u8fde\u63a5\u53c8\u53ef\u4ee5\u7528.\u89e3\u51b3\u7684\u65b9\u6cd5\u5982\u4e0b:
\n\u5728\u5ba2\u6237\u7aef\u7684\u914d\u7f6e\u6587\u4ef6\u4e2d,\u6dfb\u52a0\u5982\u4e0b\u4e24\u884c,\u7ecf\u8fc7\u6d4b\u8bd5,\u8fd9\u4e2a\u65b9\u6cd5\u975e\u5e38\u6709\u6548,\u670d\u52a1\u7aef\u4e0d\u7528\u505a\u4fee\u6539
\n\u5f15\u7528mssfix 1300
\ntun-mtu-extra 32
\n\u5982\u679c\u662f\u7528\u7528\u6237\u540d\u548c\u5bc6\u7801\u7684\u65b9\u6cd5\u6765\u9a8c\u8bc1\u767b\u9646,\u9700\u8981 openvpn 2.2 \u7684\u7248\u672c,\u5b98\u65b9\u6700\u65b0\u7248\u672c\u7684\u5df2\u7ecf\u652f\u6301
\n\u914d\u7f6e\u6587\u4ef6\u5982\u4e0b,\u8fd9\u91cc\u4ec5\u4ec5\u9700\u8981 ca \u5c31\u53ef\u4ee5\u4e86,\u5176\u4ed6\u7684\u90fd\u4e0d\u9700\u8981
\n\u5f15\u7528
\nclient
\ndev tun
\nproto udp
\nremote xxxx 1194
\nresolv-retry infinite
\nnobind
\npersist-key
\npersist-tun
\nca ca.crt
\ncomp-lzo
\nscript-security 2
\nverb 3
\nauth-user-pass pass.txt
\nexplicit-exit-notify 2
\nno-replay
\n\u6807\u7b7e: centos 6, centos 6 openvpn, centos openvpn, centos openvpn2.2.2<\/p>\n","protected":false},"excerpt":{"rendered":"

centos 6 yum \u5b89\u88c5 openvpncentos 6 \u9ed8\u8ba4\u7684yum \u6e90\u6ca1\u6709openvpn,\u6240\u4ee5\u9700\u8981\u6dfb\u52a0\u5916\u90e8\u7684\u6e90 \u83b7\u53d6 w …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"emotion":"","emotion_color":"","title_style":"","license":"","footnotes":""},"categories":[14],"tags":[58,59,60,61],"class_list":["post-200","post","type-post","status-publish","format-standard","hentry","category-pcsoft","tag-centos-6","tag-centos-6-openvpn","tag-centos-openvpn","tag-centos-openvpn2-2-2"],"_links":{"self":[{"href":"http:\/\/www.cyups.com\/index.php?rest_route=\/wp\/v2\/posts\/200","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.cyups.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.cyups.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.cyups.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/www.cyups.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=200"}],"version-history":[{"count":0,"href":"http:\/\/www.cyups.com\/index.php?rest_route=\/wp\/v2\/posts\/200\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.cyups.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=200"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.cyups.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=200"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.cyups.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=200"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}