cd /usr/src wget http://www.oberhumer.com/opensource/lzo/download/lzo-2.06.tar.gz tar zxvf lzo-2.06.tar.gz cd lzo-2.06 ./configure --prefix=/usr/local/ make && make install
cd /usr/src tar -zxvf openvpn-2.4.6.tar.gz cd openvpn-2.4.6 ./configure --prefix=/usr/local/openvpn --with-lzo-lib=/usr/local/lzo/lib --with-lzo-headers=/usr/local/lzo/include/
Note: using Easy-RSA configuration from: ./vars Generating a 2048 bit RSA private key ......................+++ ................................................+++ writing new private key to '/etc/openvpn/easy-rsa/3.0.3/pki/private/ca.key.pClvaQ1GLD' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Common Name (eg: your user, host, or server name) [Easy-RSA CA]: 回车
CA creation complete and you may now import and sign cert requests. Your new CA certificate file for publishing is at: /etc/openvpn/easy-rsa/3.0.3/pki/ca.crt
[root@localhost 3.0.3]# ./easyrsa gen-req server nopass
Note: using Easy-RSA configuration from: ./vars Generating a 2048 bit RSA private key ...........................+++ ..............................................................................+++ writing new private key to '/etc/openvpn/easy-rsa/3.0.3/pki/private/server.key.wy7Q0fuG6A' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Common Name (eg: your user, host, or server name) [server]: 回车
Keypair and certificate request completed. Your files are: req: /etc/openvpn/easy-rsa/3.0.3/pki/reqs/server.req key: /etc/openvpn/easy-rsa/3.0.3/pki/private/server.key
[root@localhost 3.0.3]# ./easyrsa sign server server
Note: using Easy-RSA configuration from: ./vars
You are about to sign the following certificate. Please check over the details shown below for accuracy. Note that this request has not been cryptographically verified. Please be sure it came from a trusted source or that you have verified the request checksum with the sender.
Request subject, to be signed as a server certificate for 3650 days:
subject= commonName = server
Type the word 'yes' to continue, or any other input to abort. Confirm request details: yes Using configuration from ./openssl-1.0.cnf Check that the request matches the signature Signature ok The Subject's Distinguished Name is as follows commonName :ASN.1 12:'server' Certificate is to be certified until Apr 7 14:54:08 2028 GMT (3650 days)
Write out database with 1 new entries Data Base Updated
Certificate created at: /etc/openvpn/easy-rsa/3.0.3/pki/issued/server.crt
创建 Diffie-Hellman
1 2 3
[root@localhost 3.0.3]# ./easyrsa gen-dh ............................................................ DH parameters of size 2048 created at /etc/openvpn/easy-rsa/3.0.3/pki/dh.pem
创建客户端证书
复制文件
1 2 3 4 5
cp -r /usr/share/easy-rsa/ /etc/openvpn/client/easy-rsa cd /etc/openvpn/client/easy-rsa/ rm 3 3.0 cd 3.0.3/ find /usr/share/doc/easy-rsa-3.0.3/vars.example -type f -name "vars.example" | xargs -i cp {} . && mv vars.example vars
init-pki complete; you may now create a CA or requests. Your newly created PKI dir is: /etc/openvpn/client/easy-rsa/3.0.3/pki [root@localhost 3.0.3]# ./easyrsa gen-req joy01 nopass #客户证书名为joy01，木有密码
Note: using Easy-RSA configuration from: ./vars Generating a 2048 bit RSA private key ....................................................+++ ............+++ writing new private key to '/etc/openvpn/client/easy-rsa/3.0.3/pki/private/joy01.key.FkrLzXH9Bm' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Common Name (eg: your user, host, or server name) [joy01]: 回车
Keypair and certificate request completed. Your files are: req: /etc/openvpn/client/easy-rsa/3.0.3/pki/reqs/joy01.req key: /etc/openvpn/client/easy-rsa/3.0.3/pki/private/joy01.key
You are about to sign the following certificate. Please check over the details shown below for accuracy. Note that this request has not been cryptographically verified. Please be sure it came from a trusted source or that you have verified the request checksum with the sender.
Request subject, to be signed as a client certificate for 3650 days:
subject= commonName = joy01
Type the word 'yes' to continue, or any other input to abort. Confirm request details: yes Using configuration from ./openssl-1.0.cnf Check that the request matches the signature Signature ok The Subject's Distinguished Name is as follows commonName :ASN.1 12:'joy01' Certificate is to be certified until Apr 8 01:54:57 2028 GMT (3650 days)
Write out database with 1 new entries Data Base Updated
Certificate created at: /etc/openvpn/easy-rsa/3.0.3/pki/issued/joy01.crt
NAT 的原理 简单的说就是当内网主机访问外网时，当内网主机的数据包要通过路由器时，路由器将数据包中的源内网 IP 地址改为路由器上的公网 IP 地址，同时记录下该数据包的消息；当外网服务器响应这次由内而外发出的请求或数据交换时，当外网服务器发出的数据包经过路由器时，原本是路由器上的公网 IP 地址被路由器改为内网 IP 。
port 1194 proto udp dev tun ca ca.crt cert server.crt key server.key dh dh.pem server 172.16.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt client-config-dir ccd push "redirect-gateway def1 bypass-dhcp" push "dhcp-option DNS 208.67.222.222" push "dhcp-option DNS 208.67.220.220" client-to-client duplicate-cn keepalive 10 120
client dev tun proto udp remote 服务器外网IP resolv-retry infinite nobind user nobody group nobody persist-key persist-tun ca ca.crt cert xiajie.crt key xiajie.key comp-lzo verb 3 redirect-gateway def1
### 客户端（Windows） 