一、VPN概述
vpn虚拟专用网络,是依靠isp和其他NSP，在公共网络中建立专用的数据通信网络的技术，可以为企业之间或者个人与企业之间提供安全的数据传输隧道服务。在VPN中任意两点之间的连接并没有传统专网所需的端到端的物理链路，而是利用公共网络资源动态组成的，可以理解为通过私有的隧道技术在公共数据网络上模拟出来的和专网有同样功能的点到点的专线技术，所谓虚拟是指不需要去使用实际的长途物理线路，而是借用Internet公共网络实现。
OpenVPN是一个用于创建虚拟专用网络加密通道的软件包，最早由James Yonan编写。OpenVPN允许创建的VPN使用公开密钥、电子证书、或者用户名／密码来进行身份验证。 它大量使用了OpenSSL加密库中的SSLv3/TLSv1协议函数库。 目前OpenVPN能在Solaris、Linux、OpenBSD、FreeBSD、NetBSD、Mac OS X与Microsoft Windows以及Android和iOS上运行，并包含了许多安全性的功能。它并不是一个基于Web的VPN软件，也不与IPsec及其他VPN软件包兼容。
1、openvpn可以解决什么问题
openvpn能让我们在环境隔离的场景中像在隔离环境的内网上远程登录集群中其他的服务器主机,比如我们在阿里云环境中创建基于VPC不同网络正式环境,测试环境，自动化工具平台环境等,我们就可以利用openvpn这样的基础服务打通测试环境和生产环境与自动化工具平台环境之间的通信,这样既隔离了测试与生产环境又能通过持续集成和持续部署完成业务的上下线。
2、openvpn实现原理：
OpenVPN的技术核心是虚拟网卡，其次是SSL协议实现。OpenVPN中的虚拟网卡
虚拟网卡是使用网络底层编程技术实现的一个驱动软件。安装此类程序后主机上会增加一个非真实的网卡，并可以像其它网卡一样进行配置。服务程序可以在应用层打开虚拟网卡，如果应用软件（如网络浏览器）向虚拟网卡发送数据，则服务程序可以读取到该数据。如果服务程序写合适的数据到虚拟网卡，应用软件也可以接收得到。虚拟网卡在很多的操作系统中都有相应的实现，这也是OpenVPN能够跨平台使用的一个重要原因。
在OpenVPN中，如果用户访问一个远程的虚拟地址（属于虚拟网卡配用的地址系列，区别于真实地址），则操作系统会通过路由机制将数据包（TUN模式）或数据帧（TAP模式）发送到虚拟网卡上，服务程序接收该数据并进行相应的处理后，会通过SOCKET从外网上发送出去。这完成了一个单向传输的过程，反之亦然。当远程服务程序通过SOCKET从外网上接收到数据，并进行相应的处理后，又会发送回给虚拟网卡，则该应用软件就可以接收到。
3、如何保证openvpn负载高可用性
通过客户端多配置文件实现负载：如果同一个办公室人员使用openvpn访问环境,我们可以通过使用多个openvpn server来避免流量拥堵，此时我们可以在openvpn server上将服务的配置文件拷贝到其他的服务器上，使用不同的IP地址启动另外一个openvpn server,这样我们本地可以使用不同的配置文件来避免openvpn的访问慢流量拥堵的问题。
通过使用remote-random实现负载：和多配置文件一样需要多个Openvpn server端完成该方案，但是这个方案显得更智能，客户端不在需要手动的去选择使用哪个配置文件来连接哪个openvpnserver，这些Openvpn GUI自动的帮你实现，你只需要在客户端的配置文件中添加 remote-random和多个 remote配置段即可
4、加密和身份验证
加密：OpenVPN使用OpenSSL库来加密数据与控制信息。这意味着，它能够使用任何OpenSSL支持的算法。它提供了可选的数据包HMAC功能以提高连接的安全性。此外，OpenSSL的硬件加速也能提高它的性能。2.3.0以后版本引入PolarSSL。
身份验证：OpenVPN提供了多种身份验证方式，用以确认连接双方的身份，最常用的有以下三种：
预享私钥
第三方证书
用户名／密码组合预享密钥最为简单，但同时它只能用于创建点对点的VPN；基于PKI的第三方证书提供了最完善的功能，但是需要额外维护一个PKI证书系统。OpenVPN2.0后引入了用户名／口令组合的身份验证方式，它可以省略客户端证书，但是仍需要一份服务器证书用作加密。
二、openvpn部署流程及环境要求：
1、部署流程：
安装lzo,用于压缩通讯数据加快传输速度, 编译安装的lzo,需要在编译安装openvpn时候指定lzo的位置安装openvpn和easy-rsa, esay-rsa是用来生成ca根证书和服务端客户端的证书以及通信key 生成服务端证书 生成客户端用户签署证书 生成迪菲・赫尔曼密钥，会生成dh2048.pem文件 生成防止ddos的key文件
2、环境要求：
服务端：Centos7.6-1810客户端：Windows10
openvpn版本：OpenVPN 2.4.9 x86_64-redhat-linux-gnu easy-rsa版本：easy-rsa-3.0.5 3、在GitHub上下载最新版本的easy-rsa： [https://github.com/OpenVPN/easy-rsa]
三、openvpn部署配置：
1、部署openvpn 和easy-rsa（该包用来制作ca证书）
1、安装epel仓库源
[root@localhost ~]# wget http://dl.fedoraproject.org/pub/epel/6/i386/epel-release-6-8.noarch.rpm
[root@localhost ~]# rpm -Uvh epel-release-6-8.noarch.rpm //安装epel 仓库源
2、安装openvpn
[root@localhost ~]# yum install openvpn
Installed:
openvpn.x86_64 0:2.4.9-1.el6
Dependency Installed:
pkcs11-helper.x86_64 0:1.11-3.el6
Complete!
3、安装easy-rsa：将GitHub上下载的包上传到服务器：easy-rsa-3.0.5.zip
[root@localhost ~]# unzip easy-rsa-3.0.5.zip
[root@localhost ~]# mv easy-rsa-3.0.5 easy-rsa
[root@localhost ~]# ls
easy-rsa easy-rsa-master.zip配置/etc/openvpn配置文件
1、创建目录，并复制easy-rsa 目录到openvpn目录下
[root@localhost ~]# mkdir -p /etc/openvpn/
[root@localhost ~]# cp -a easy-rsa /etc/openvpn/
2、配置，编辑vars文件，根据自己环境配置
[root@localhost ~]# cd /etc/openvpn/easy-rsa/easyrsa3
[root@localhost easyrsa3]# cp vars.example vars
[root@localhost easyrsa3]# vim vars
set_var EASYRSA_REQ_COUNTRY "CN"
set_var EASYRSA_REQ_PROVINCE "Zhejiang"
set_var EASYRSA_REQ_CITY "Hangzhou"
set_var EASYRSA_REQ_ORG "Openvpn"
set_var EASYRSA_REQ_EMAIL "[email protected]"
set_var EASYRSA_REQ_OU "My OpenVPN"2、创建服务端证书及key：
1、切换/etc/openvpn/easy-rsa/easyrsa3/目录并初始化
[root@localhost ~]# cd /etc/openvpn/easy-rsa/easyrsa3/
[root@localhost easyrsa3]# ./easyrsa init-pki
Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa/easyrsa3/vars
init-pki complete; you may now create a CA or requests.
Your newly created PKI dir is: /etc/openvpn/easy-rsa/easyrsa3/pki //新创建的pki目录地址
2、创建根证书
[root@localhost easyrsa3]# ./easyrsa build-ca
Enter New CA Key Passphrase: //EPM密码：123456，
Re-Enter New CA Key Passphrase: //后期为证书签名是会用到:123456
Common Name (eg: your user, host, or server name) [Easy-RSA CA]:Openvpn-ca //设置common name通用名：Openvpn-ca
Your new CA certificate file for publishing is at:
/etc/openvpn/easy-rsa/easyrsa3/pki/ca.crt //ca证书文件地址
3、创建服务器端证书：
[root@localhost easyrsa3]# ./easyrsa gen-req server nopass
Common Name (eg: your user, host, or server name) [server]:Openvpn-server
Keypair and certificate request completed. Your files are:
req: /etc/openvpn/easy-rsa/easyrsa3/pki/reqs/server.req
key: /etc/openvpn/easy-rsa/easyrsa3/pki/private/server.key
//该过程中需要输入common name，随意但是不要跟之前的根证书的一样2.1、签约服务端证书
[root@localhost easyrsa3]# ./easyrsa sign server server
Type the word 'yes' to continue, or any other input to abort.
Confirm request details: yes //键入yes表示生成
Using configuration from /etc/openvpn/easy-rsa/easyrsa3/pki/easy-rsa-106473.G6htKP/tmp.PK2ZW1
Enter pass phrase for /etc/openvpn/easy-rsa/easyrsa3/pki/private/ca.key: 123456 //键入创建CA时的密码，如果忘记了，重头再来一次吧。
Certificate created at: /etc/openvpn/easy-rsa/easyrsa3/pki/issued/server.crt //server.crt证书位置3、创建Diffie-Hellman
//创建Diffie-Hellman，确保key穿越不安全网络的命令
[root@localhost easyrsa3]# ./easyrsa gen-dh
Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa/easyrsa3/vars
Using SSL: openssl OpenSSL 1.0.2k-fips 26 Jan 2017
Generating DH parameters, 2048 bit long safe prime, generator 2
This is going to take a long time
...................+......+............................................++*++*
DH parameters of size 2048 created at /etc/openvpn/easy-rsa/easyrsa3/pki/dh.pem //2048DH参数文件位置4、创建客户端证书
1、在root目录下新建client文件夹，cp之前解压的easy-ras目录到client文件夹
[root@localhost ~]# mkdir client
[root@localhost ~]# cp -r /etc/openvpn/easy-rsa/ client/
[root@localhost ~]# cd client/easy-rsa/easyrsa3/
2、初始化
[root@localhost easyrsa3]# ./easyrsa init-pki //需输入yes 确定
Type the word 'yes' to continue, or any other input to abort.
Confirm removal: yes
init-pki complete; you may now create a CA or requests.
Your newly created PKI dir is: /root/client/easy-rsa/easyrsa3/pki //pki文件地址
3、创建客户端key及生成证书（记住生成是自己客户端登录输入的密码）
[root@localhost easyrsa3]# ./easyrsa gen-req openvpn-client //名字自己定义
Enter PEM pass phrase:654321 //设置客户端登录时的密码
Verifying - Enter PEM pass phrase:654321 //此密码后期登录客户端时需用到
Common Name (eg: your user, host, or server name) [openvpn-client]:openvpn-client //设置定义客户端的名字
Keypair and certificate request completed. Your files are:
req: /root/client/easy-rsa/easyrsa3/pki/reqs/openvpn-client.req
key: /root/client/easy-rsa/easyrsa3/pki/private/openvpn-client.key //客户但key整数地址
4、将得到的openvpn-client.req导入然后签约证书
[root@localhost easyrsa3]# cd /etc/openvpn/easy-rsa/easyrsa3/ //切换到/etc/openvpn/easy-rsa/easyrsa3/目录下
[root@localhost easyrsa3]# ./easyrsa import-req /root/client/easy-rsa/easyrsa3/pki/reqs/openvpn-client.req openvpn-client //导入req
The request has been successfully imported with a short name of: openvpn-client
You may now use this name to perform signing operations on this request.
[root@localhost easyrsa3]# ./easyrsa sign client openvpn-client //签约证书 //这里生成client所以必须为client,openvpn-client名字要与之前导入名字一致
Type the word 'yes' to continue, or any other input to abort.
Confirm request details: yes //yes同意执行
Using configuration from /etc/openvpn/easy-rsa/easyrsa3/pki/easy-rsa-106795.0lVxFk/tmp.ky2xRR
Enter pass phrase for /etc/openvpn/easy-rsa/easyrsa3/pki/private/ca.key:123456 //输入之前创建的CA的密码
Data Base Updated
Certificate created at: /etc/openvpn/easy-rsa/easyrsa3/pki/issued/openvpn-client.crt //openvpn-client.crt文件地址5、把服务器端必要文件放到etc/openvpn/ 目录下：ca的证书、服务端的证书、秘钥
[root@localhost ~]# cp /etc/openvpn/easy-rsa/easyrsa3/pki/ca.crt /etc/openvpn/
[root@localhost ~]# cp /etc/openvpn/easy-rsa/easyrsa3/pki/private/server.key /etc/openvpn/
[root@localhost ~]# cp /etc/openvpn/easy-rsa/easyrsa3/pki/issued/server.crt /etc/openvpn/
[root@localhost ~]# cp /etc/openvpn/easy-rsa/easyrsa3/pki/dh.pem /etc/openvpn/
[root@localhost ~]# ls /etc/openvpn/
ca.crt dh.pem server.crt server.key6、把客户端必要文件放到root/openvpn/ 目录下：客户端的证书、秘钥
[root@localhost ~]# cp /etc/openvpn/easy-rsa/easyrsa3/pki/ca.crt /root/client/
[root@localhost ~]# cp /etc/openvpn/easy-rsa/easyrsa3/pki/issued/openvpn-client.crt /root/client/
[root@localhost ~]# cp /root/client/easy-rsa/easyrsa3/pki/private/openvpn-client.key /root/client/
[root@localhost ~]# ls /root/client/
ca.crt openvpn-client.crt openvpn-client.key7、配置服务端配置文件
1、将server.conf配置文件cp到/etc/openvpn目录下
[root@localhost ~]# rpm -ql openvpn |grep server.conf
/usr/share/doc/openvpn-2.4.9/sample/sample-config-files/server.conf
//当openvpn部署完成后，会给我们提供一个server配置的文件例子，
//在/usr/share/doc/openvpn-2.4.9/sample/sample-config-files/ 下有一个server.conf文件，
[root@localhost ~]# cp /usr/share/doc/openvpn-2.4.9/sample/sample-config-files/server.conf /etc/openvpn/
2、编辑配置文件server.conf
[root@localhost ~]# vim /etc/openvpn/server.conf
[root@localhost ~]# grep '^[^#|;]' /etc/openvpn/server.conf //修改后的版本如下
;local 0.0.0.0 //监听地址
port 1194 //监听端口
proto tcp //监听协议
dev tun //采用路由隧道模式
ca /etc/openvpn/ca.crt //ca证书路径
cert /etc/openvpn/server.crt //服务器证书
key /etc/openvpn/server.key //服务器秘钥
dh /etc/openvpn/dh.pem //密钥交换协议文件
server 10.10.0.0 255.255.255.0 //给客户端分配地址池，注意：不能和VPN服务器内网网段有相同
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp" //给网关
;push "dhcp-option DNS 8.8.8.8" //dhcp分配dns
;client-to-client //客户端之间互相通信
keepalive 30 600
cipher AES-256-CBC //存活时间，10秒ping一次,120 如未收到响应则视为断线
# tls-auth ta.key 0 //这个文件是设置保密秘钥的，暂时没有配置，客户端处应关闭
comp-lzo //传输数据压缩
;max-clients 100 //最多允许 100 客户端连接
;user openvpn //用户
;group openvpn //用户组
persist-key
persist-tun
status /var/log/openvpn/openvpn-status.log //连接状态文件地址
log /var/log/openvpn/openvpn.log //日志文件地址
;verb 3
explicit-exit-notify 0
3、配置文件创建完成后，创建openvpn.log文件地址及创建openvpn用户和组：
[root@localhost ~]# mkdir /var/log/openvpn
[root@localhost ~]# chown -R openvpn.openvpn /var/log/openvpn/
[root@localhost ~]# chown -R openvpn.openvpn /etc/openvpn/*以下为配置文件注释删除版
port 1194
proto tcp
dev tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key # This file should be kept secret
dh /etc/openvpn/dh.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
keepalive 30 600
cipher AES-256-CBC
comp-lzo
persist-key
persist-tun
status /var/log/openvpn/openvpn-status.log
log /var/log/openvpn/openvpn.log
explicit-exit-notify 0以下为全版配置文件
#################################################
# Sample OpenVPN 2.0 config file for #
# multi-client server. #
# #
# This file is for the server side #
# of a many-clients <-> one-server #
# OpenVPN configuration. #
# #
# OpenVPN also supports #
# single-machine <-> single-machine #
# configurations (See the Examples page #
# on the web site for more info). #
# #
# This config should work on Windows #
# or Linux/BSD systems. Remember on #
# Windows to quote pathnames and use #
# double backslashes, e.g.: #
# "C:\\Program Files\\OpenVPN\\config\\foo.key" #
# #
# Comments are preceded with '#' or ';' #
#################################################
# Which local IP address should OpenVPN
# listen on? (optional)
;local a.b.c.d
;local 0.0.0.0
# Which TCP/UDP port should OpenVPN listen on?
# If you want to run multiple OpenVPN instances
# on the same machine, use a different port
# number for each one. You will need to
# open up this port on your firewall.
port 1194
# TCP or UDP server?
proto tcp
;proto udp
# "dev tun" will create a routed IP tunnel,
# "dev tap" will create an ethernet tunnel.
# Use "dev tap0" if you are ethernet bridging
# and have precreated a tap0 virtual interface
# and bridged it with your ethernet interface.
# If you want to control access policies
# over the VPN, you must create firewall
# rules for the the TUN/TAP interface.
# On non-Windows systems, you can give
# an explicit unit number, such as tun0.
# On Windows, use "dev-node" for this.
# On most systems, the VPN will not function
# unless you partially or fully disable
# the firewall for the TUN/TAP interface.
;dev tap
dev tun
# Windows needs the TAP-Win32 adapter name
# from the Network Connections panel if you
# have more than one. On XP SP2 or higher,
# you may need to selectively disable the
# Windows firewall for the TAP adapter.
# Non-Windows systems usually don't need this.
;dev-node MyTap
# SSL/TLS root certificate (ca), certificate
# (cert), and private key (key). Each client
# and the server must have their own cert and
# key file. The server and all clients will
# use the same ca file.
#
# See the "easy-rsa" directory for a series
# of scripts for generating RSA certificates
# and private keys. Remember to use
# a unique Common Name for the server
# and each of the client certificates.
#
# Any X509 key management system can be used.
# OpenVPN can also use a PKCS #12 formatted key file
# (see "pkcs12" directive in man page).
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key # This file should be kept secret
# Diffie hellman parameters.
# Generate your own with:
# openssl dhparam -out dh2048.pem 2048
dh /etc/openvpn/dh.pem
# Network topology
# Should be subnet (addressing via IP)
# unless Windows clients v2.0.9 and lower have to
# be supported (then net30, i.e. a /30 per client)
# Defaults to net30 (not recommended)
;topology subnet
# Configure server mode and supply a VPN subnet
# for OpenVPN to draw client addresses from.
# The server will take 10.8.0.1 for itself,
# the rest will be made available to clients.
# Each client will be able to reach the server
# on 10.8.0.1. Comment this line out if you are
# ethernet bridging. See the man page for more info.
server 10.8.0.0 255.255.255.0
# Maintain a record of client <-> virtual IP address
# associations in this file. If OpenVPN goes down or
# is restarted, reconnecting clients can be assigned
# the same virtual IP address from the pool that was
# previously assigned.
ifconfig-pool-persist ipp.txt
# Configure server mode for ethernet bridging.
# You must first use your OS's bridging capability
# to bridge the TAP interface with the ethernet
# NIC interface. Then you must manually set the
# IP/netmask on the bridge interface, here we
# assume 10.8.0.4/255.255.255.0. Finally we
# must set aside an IP range in this subnet
# (start=10.8.0.50 end=10.8.0.100) to allocate
# to connecting clients. Leave this line commented
# out unless you are ethernet bridging.
;server-bridge 10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100
# Configure server mode for ethernet bridging
# using a DHCP-proxy, where clients talk
# to the OpenVPN server-side DHCP server
# to receive their IP address allocation
# and DNS server addresses. You must first use
# your OS's bridging capability to bridge the TAP
# interface with the ethernet NIC interface.
# Note: this mode only works on clients (such as
# Windows), where the client-side TAP adapter is
# bound to a DHCP client.
;server-bridge
# Push routes to the client to allow it
# to reach other private subnets behind
# the server. Remember that these
# private subnets will also need
# to know to route the OpenVPN client
# address pool (10.8.0.0/255.255.255.0)
# back to the OpenVPN server.
;push "route 192.168.10.0 255.255.255.0"
;push "route 192.168.20.0 255.255.255.0"
# To assign specific IP addresses to specific
# clients or if a connecting client has a private
# subnet behind it that should also have VPN access,
# use the subdirectory "ccd" for client-specific
# configuration files (see man page for more info).
# EXAMPLE: Suppose the client
# having the certificate common name "Thelonious"
# also has a small subnet behind his connecting
# machine, such as 192.168.40.128/255.255.255.248.
# First, uncomment out these lines:
;client-config-dir ccd
;route 192.168.40.128 255.255.255.248
# Then create a file ccd/Thelonious with this line:
# iroute 192.168.40.128 255.255.255.248
# This will allow Thelonious' private subnet to
# access the VPN. This example will only work
# if you are routing, not bridging, i.e. you are
# using "dev tun" and "server" directives.
# EXAMPLE: Suppose you want to give
# Thelonious a fixed VPN IP address of 10.9.0.1.
# First uncomment out these lines:
;client-config-dir ccd
;route 10.9.0.0 255.255.255.252
# Then add this line to ccd/Thelonious:
# ifconfig-push 10.9.0.1 10.9.0.2
# Suppose that you want to enable different
# firewall access policies for different groups
# of clients. There are two methods:
# (1) Run multiple OpenVPN daemons, one for each
# group, and firewall the TUN/TAP interface
# for each group/daemon appropriately.
# (2) (Advanced) Create a script to dynamically
# modify the firewall in response to access
# from different clients. See man
# page for more info on learn-address script.
;learn-address ./script
# If enabled, this directive will configure
# all clients to redirect their default
# network gateway through the VPN, causing
# all IP traffic such as web browsing and
# and DNS lookups to go through the VPN
# (The OpenVPN server machine may need to NAT
# or bridge the TUN/TAP interface to the internet
# in order for this to work properly).
push "redirect-gateway def1 bypass-dhcp"
# Certain Windows-specific network settings
# can be pushed to clients, such as DNS
# or WINS server addresses. CAVEAT:
# http://openvpn.net/faq.html#dhcpcaveats
# The addresses below refer to the public
# DNS servers provided by opendns.com.
;push "dhcp-option DNS 208.67.222.222"
;push "dhcp-option DNS 208.67.220.220"
# Uncomment this directive to allow different
# clients to be able to "see" each other.
# By default, clients will only see the server.
# To force clients to only see the server, you
# will also need to appropriately firewall the
# server's TUN/TAP interface.
;client-to-client
# Uncomment this directive if multiple clients
# might connect with the same certificate/key
# files or common names. This is recommended
# only for testing purposes. For production use,
# each client should have its own certificate/key
# pair.
#
# IF YOU HAVE NOT GENERATED INDIVIDUAL
# CERTIFICATE/KEY PAIRS FOR EACH CLIENT,
# EACH HAVING ITS OWN UNIQUE "COMMON NAME",
# UNCOMMENT THIS LINE OUT.
;duplicate-cn
# The keepalive directive causes ping-like
# messages to be sent back and forth over
# the link so that each side knows when
# the other side has gone down.
# Ping every 10 seconds, assume that remote
# peer is down if no ping received during
# a 120 second time period.
keepalive 30 600
# For extra security beyond that provided
# by SSL/TLS, create an "HMAC firewall"
# to help block DoS attacks and UDP port flooding.
#
# Generate with:
# openvpn --genkey --secret ta.key
#
# The server and each client must have
# a copy of this key.
# The second parameter should be '0'
# on the server and '1' on the clients.
#tls-auth ta.key 0 # This file is secret
# Select a cryptographic cipher.
# This config item must be copied to
# the client config file as well.
# Note that v2.4 client/server will automatically
# negotiate AES-256-GCM in TLS mode.
# See also the ncp-cipher option in the manpage
cipher AES-256-CBC
# Enable compression on the VPN link and push the
# option to the client (v2.4+ only, for earlier
# versions see below)
;compress lz4-v2
;compress lz4-v2
;push "compress lz4-v2"
# For compression compatible with older clients use comp-lzo
# If you enable it here, you must also
# enable it in the client config file.
;comp-lzo
comp-lzo
# The maximum number of concurrently connected
# clients we want to allow.
;max-clients 100
# It's a good idea to reduce the OpenVPN
# daemon's privileges after initialization.
#
# You can uncomment this out on
# non-Windows systems.
;user openvpn
;group openvpn
# The persist options will try to avoid
# accessing certain resources on restart
# that may no longer be accessible because
# of the privilege downgrade.
persist-key
persist-tun
# Output a short status file showing
# current connections, truncated
# and rewritten every minute.
#status openvpn-status.log
status /var/log/openvpn/openvpn-status.log
# By default, log messages will go to the syslog (or
# on Windows, if running as a service, they will go to
# the "\Program Files\OpenVPN\log" directory).
# Use log or log-append to override this default.
# "log" will truncate the log file on OpenVPN startup,
# while "log-append" will append to it. Use one
# or the other (but not both).
log /var/log/openvpn/openvpn.log
;log-append openvpn.log
# Set the appropriate level of log
# file verbosity.
#
# 0 is silent, except for fatal errors
# 4 is reasonable for general usage
# 5 and 6 can help to debug connection problems
# 9 is extremely verbose
#verb 3
# Silence repeating messages. At most 20
# sequential messages of the same message
# category will be output to the log.
;mute 20
# Notify the client that when the server restarts so it
# can automatically reconnect.
explicit-exit-notify 08、开启防火墙iptables 设置nat 规则和打开路由转发
[root@localhost ~]# iptables -t nat -A POSTROUTING -s 10.10.0.0/24 -j MASQUERADE
[root@localhost ~]# iptables -vnL -t nat
0 0 MASQUERADE all -- * * 10.10.0.0/24 0.0.0.0/0
[root@localhost ~]# vim /etc/sysctl.conf //打开路由转发
net.ipv4.ip_forward = 1
[root@localhost ~]# sysctl -p
net.ipv4.ip_forward = 19、开启openvpn 服务
[root@localhost ~]# systemctl start openvpn.service
[root@localhost ~]# systemctl enable openvpn.service
[root@localhost ~]# systemctl status openvpn.service
systemctl status [email protected]
[root@localhost ~]# openvpn /etc/openvpn/server.conf //开启服务
[root@localhost sbin]# ss -tunlp |grep 1194
tcp 32 *:1194 *:* users:(("openvpn",pid=107194,fd=6))
//若是开启后没有打开1194端口，没说明开启服务失败，可能配置文件错误，也可能是权限不够，查询日志定位问题四、在window下通过客户端连接openvpn
1、Windows下openvpn2.4.9客户端地址： [http://www.npackd.org/p/openvpn64/2.4.9] 2、配置客户端client配置文件 sample-config——>打开client.ovpn模板——>修改内容如下所示——>并复制知道config目录下——>END
// openvpn客户端client.ovpn配置说明：
client //定义是一个客户端
;dev tap //定义使用设备类型，与服务端一致
dev tun
;dev-node(示例） //定义Windows下使用的网卡名称,linux不需要
proto tcp //定义使用的协议，与服务端一致
;proto udp
remote 192.168.1.59 1194 //指定服务端地址和端口,可以用多行指定多台服务器;实现负载均衡（从上往下尝试）
;remote my-server-2 1194 //openvpn服务器的外网ip地址和端口，ip或域名都可以
;remote-random //若上面配置了多台服务器，让客户端随机连接
# Keep trying indefinitely to resolve the //解析服务器域名
# host name of the OpenVPN server. Very useful
# on machines which are not permanently connected
# to the internet such as laptops.
resolv-retry infinite
# Most clients do not need to bind to //客户端不需要绑定端口
# a specific local port number.
nobind
;user nobody // nobody用户和组：是为了让Openvpn也nobody运行（安全）
;group nobody //注意：Windows不能设置
# Try to preserve some state across restarts.
persist-key
persist-tun
;http-proxy-retry # retry on connection failures //若客户端通过HTTP Proxy，在这里设置
;http-proxy [proxy server] [proxy port #] //要使用Proxy，不能使用UDP为VPN的通讯协议
;mute-replay-warnings //无线网络有很多多余的头文件，设置忽略它
ca "D:\\openvpn\\config\\ca.crt" //ca证书地址：重点，就是指定ca和客户端的证书
cert "D:\\openvpn\\config\\openvpn-client.crt" //证书地址：注意，下面的两个号是连在一起的，之间没有空格
key "D:\\openvpn\\config\\openvpn-client.key" //秘钥地址：注意：因为配置文件\是脚本内容模式，使用\\代表单斜杠定义
;auth-user-pass // 如果服务端打开了PAM认证模块，如mysql，LDAP数据库验证，客户端需要另其有效
# Verify server certificate by checking //一些安全措施
# that the certicate has the nsCertType
# field set to “server”. This is an
# important precaution to protect against
# a potential attack discussed here:
# http://openvpn.net/howto.html#mitm
# To use this feature, you will need to generate
# your server certificates with the nsCertType
# field set to “server”. The build-key-server
# script in the easy-rsa folder will do this.
;ns-cert-type server
# then every client must also have the key. //增强验证加密，如果你在服务器端生成了ta.key，那么这里就需要加上
;tls-auth ta.key 1 //重点：服务端配置文件没有开启ta.key验证，所以不用启用
# Select a cryptographic cipher.
# If the cipher option is used on the server
# then you must also specify it here.
;cipher x
comp-lzo # 使用lzo压缩，与服务端一致
# Set log file verbosity.
verb 3
# Silence repeating messages
;mute 20
;auth-user-pass //采用用户名密码方式验证,若不用证书的话,可以考虑这种方式,可以结合LDAP或者mysql
route-method exe //windows7上会报错,建议加上此行
route-delay 2 //强行指定添加路由前的延时
auth-nocache //不存储验证缓存
ip-win32 dynamic 0 7200 //设置IP地址过期时间3、通过验证可以连接上的client配置如下
client
dev tun
proto tcp
remote 公网ip 1149 #公网ip 1149为openvpn端口
remote-cert-tls server
route-nopull
route 10.8.0.0 255.255.0.0 vpn_gateway
route 内网网段 255.255.255.0 vpn_gateway
resolv-retry infinite
nobind
persist-key
persist-tun
comp-lzo
verb 3
cipher AES-256-CBC
auth-nocache
ca ca.crt
cert 马治.crt
key 马治.key把服务器端的证书文件ca.crt openvpn-client.crt openvpn-client.key复制到config 目录下
4、启动客户端并测试运行是否OK
启动客户端——>以root管理员权限运行——>输入当时设置Openvpn-client密码：654321——>连接成功（图标变为绿色）——>测试——>IE中输入ip测试IP地址是否为服务器所在地址
1、连接成功时显示日志：
Thu Nov 26 17:01:52 2020 Successful ARP Flush on interface [43] {F09886D2-EE14-4D64-A031-DD6F748763B8}
Thu Nov 26 17:01:52 2020 MANAGEMENT: >STATE:1606381312,ASSIGN_IP,,10.10.0.6,,,,
2、测试本地client端IP地址：在CMD窗口下
C:\Users\Administrator>ipconfig
以太网适配器 VMware Network Adapter VMnet1:
IPv4 地址 . . . . . . . . . . . . : 10.10.0.6 //当时配置的是10.0.0网段的地址
子网掩码 . . . . . . . . . . . . : 255.255.255.252证书吊销
./easyrsa revoke targetkey(证书名)
./easyrsa gen-crl一：openvpn吊销证书删除用户
[root@openvpnservice ~]# cd /etc/openvpn/easy-rsa/easyrsa3
[root@vpnserver easyrsa3]# ./easyrsa revoke 张三_test
Note: using Easy-RSA configuration from: ./vars
Using SSL: openssl OpenSSL 1.0.2k-fips 26 Jan 2017
Please confirm you wish to revoke the certificate with the following subject:
subject=
commonName = \U5F20\U4E09_test
Type the word 'yes' to continue, or any other input to abort.
Continue with revocation: yes
Using configuration from /etc/openvpn/easy-rsa/easyrsa3/pki/safessl-easyrsa.cnf
Enter pass phrase for /etc/openvpn/easy-rsa/easyrsa3/pki/private/ca.key:
Revoking Certificate F59EC5461D5973A904460A2CEB994E0A.
Data Base Updated
IMPORTANT!!!
Revocation was successful. You must run gen-crl and upload a CRL to your
infrastructure in order to prevent the revoked cert from being accepted.[root@vpnserver easyrsa3]# ./easyrsa gen-crl #gen-crl会生成一份吊销证书的名单，放在pki/crl.pem文件里
Note: using Easy-RSA configuration from: ./vars
Using SSL: openssl OpenSSL 1.0.2k-fips 26 Jan 2017
Using configuration from /etc/openvpn/easy-rsa/easyrsa3/pki/safessl-easyrsa.cnf
Enter pass phrase for /etc/openvpn/easy-rsa/easyrsa3/pki/private/ca.key:
An updated CRL has been created.
CRL file: /etc/openvpn/easy-rsa/easyrsa3/pki/crl.pem最后在server.conf文件中增加此项
crl-verify /etc/openvpn/easy-rsa/easyrsa3/pki/crl.pem