open证书生成和服务端安装

meinvwudi

yum install -y openssl lzo pam easy-rsa
mkdir /opt/easy-rsa
cd /opt/easy-rsa/
/usr/bin/cp -a /usr/share/easy-rsa/3.0.8/* ./
/usr/bin/cp -a /usr/share/doc/easy-rsa-3.0.8/vars.example ./vars
vim ./vars 
if [ -z "$EASYRSA_CALLER" ]; then
        echo "You appear to be sourcing an Easy-RSA 'vars' file." >&2
        echo "This is no longer necessary and is disallowed. See the section called" >&2
        echo "'How to use this file' near the top comments for more details." >&2
        return 1
fi
set_var EASYRSA_DN  "cn_only"
set_var EASYRSA_REQ_COUNTRY "CN"                    #所在的国家
set_var EASYRSA_REQ_PROVINCE "Shanghai"             #所在的省份
set_var EASYRSA_REQ_CITY "beijing"                 #所在的城市
set_var EASYRSA_REQ_ORG "txidc"                    #所在的组织
set_var EASYRSA_REQ_EMAIL "1968023646@qq.com"  #邮箱的地址
set_var EASYRSA_NS_SUPPORT "yes"

./easyrsa build-ca
./easyrsa gen-req server nopass

# req: /opt/easy-rsa/pki/reqs/server.req
# key: /opt/easy-rsa/pki/private/server.key
# Certificate created at: /opt/easy-rsa/pki/issued/server.crt

./easyrsa sign server server
./easyrsa gen-dh

./easyrsa gen-req client nopass

# req: /opt/easy-rsa/pki/reqs/client.req
# key: /opt/easy-rsa/pki/private/client.key
# Certificate created at: /opt/easy-rsa/pki/issued/client.crt

yum install openvpn -y
cd /etc/openvpn/
vim server.conf

cp /opt/easy-rsa/pki/ca.crt ./
cp /opt/easy-rsa/pki/issued/server.crt ./
cp /opt/easy-rsa/pki/private/server.key ./
cp /opt/easy-rsa/pki/dh.pem ./

echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf

systemctl restart network
systemctl -f enable openvpn@server.service
systemctl start openvpn@server.service
systemctl status openvpn@server.service

meinvwudi

[root@iZgc70d9cahv1p35n9sbzvZ openvpn]# vim  /etc/openvpn/check.sh 
You have new mail in /var/spool/mail/root
[root@iZgc70d9cahv1p35n9sbzvZ openvpn]# ls
ca.crt  check.sh  client  dh.pem  ipp.txt  openvpn-status.log  server  server.conf  server.crt  server.key
[root@iZgc70d9cahv1p35n9sbzvZ openvpn]# chmod +x /etc/openvpn/check.sh
[root@iZgc70d9cahv1p35n9sbzvZ openvpn]# cat /etc/openvpn/check.sh 
#!/bin/bash
PASSFILE="/etc/openvpn/openvpnfile"   #密码文件 用户名 密码明文
LOG_FILE="/var/log/openvpn-password.log"  #用户登录情况的日志
TIME_STAMP=`date "+%Y-%m-%d %T"`
if [ ! -r "${PASSFILE}" ]; then
    echo "${TIME_STAMP}: Could not open password file \"${PASSFILE}\" for reading." >> ${LOG_FILE}
    exit 1
fi
CORRECT_PASSWORD=`awk '!/^;/&&!/^#/&&$1=="'${username}'"{print $2;exit}'    ${PASSFILE}`
if [ "${CORRECT_PASSWORD}" = "" ]; then
    echo "${TIME_STAMP}: User does not exist: username=\"${username}\",password=\"${password}\"." >> ${LOG_FILE}
    exit 1
fi
if [ "${password}" = "${CORRECT_PASSWORD}" ]; then
    echo "${TIME_STAMP}: Successful authentication: username=\"${username}\"." >> ${LOG_FILE}
    exit 0
fi

meinvwudi

cat /etc/openvpn/server.conf        #添加配置文件
......
script-security 3                                   #允许使用自定义脚本
auth-user-pass-verify /etc/openvpn/check.sh via-env #指定认证脚本
username-as-common-name                             #用户密码登陆方式验证

meinvwudi

systemctl restart openvpn@server

meinvwudi

增加客户端固定IP

[root@iZgc70d9cahv1p35n9sbzvZ openvpn]# pwd
/etc/openvpn
[root@iZgc70d9cahv1p35n9sbzvZ openvpn]# cat ccd/txidc 
ifconfig-push 10.8.0.9 10.8.0.10

重启服务
systemctl restart openvpn@server

meinvwudi

客户端IP固定配对要求如下

    [  1,  2]   [  5,  6]   [  9, 10]   [ 13, 14]   [ 17, 18]
    [ 21, 22]   [ 25, 26]   [ 29, 30]   [ 33, 34]   [ 37, 38]
    [ 41, 42]   [ 45, 46]   [ 49, 50]   [ 53, 54]   [ 57, 58]
    [ 61, 62]   [ 65, 66]   [ 69, 70]   [ 73, 74]   [ 77, 78]
    [ 81, 82]   [ 85, 86]   [ 89, 90]   [ 93, 94]   [ 97, 98]
    [101,102]   [105,106]   [109,110]   [113,114]   [117,118]
    [121,122]   [125,126]   [129,130]   [133,134]   [137,138]
    [141,142]   [145,146]   [149,150]   [153,154]   [157,158]
    [161,162]   [165,166]   [169,170]   [173,174]   [177,178]
    [181,182]   [185,186]   [189,190]   [193,194]   [197,198]
    [201,202]   [205,206]   [209,210]   [213,214]   [217,218]
    [221,222]   [225,226]   [229,230]   [233,234]   [237,238]
    [241,242]   [245,246]   [249,250]   [253,254]

meinvwudi

安装代码

yum install -y openssl lzo pam easy-rsa
mkdir /opt/easy-rsa
cd /opt/easy-rsa/
cp -a /usr/share/easy-rsa/3.0.8/* ./
cp -a /usr/share/doc/easy-rsa-3.0.8/vars.example ./vars
vim ./vars 
if [ -z "$EASYRSA_CALLER" ]; then
        echo "You appear to be sourcing an Easy-RSA 'vars' file." >&2
        echo "This is no longer necessary and is disallowed. See the section called" >&2
        echo "'How to use this file' near the top comments for more details." >&2
        return 1
fi
set_var EASYRSA_DN  "cn_only"
set_var EASYRSA_REQ_COUNTRY "CN"                    #所在的国家
set_var EASYRSA_REQ_PROVINCE "Shanghai"             #所在的省份
set_var EASYRSA_REQ_CITY "beijing"                 #所在的城市
set_var EASYRSA_REQ_ORG "txidc"                    #所在的组织
set_var EASYRSA_REQ_EMAIL "1968023646@qq.com"  #邮箱的地址
set_var EASYRSA_NS_SUPPORT "yes"

#1.1.初始化生成根证书,有Pki了
./easyrsa init-pki
#创建根证书,并设置密码,后面签发证书使用
./easyrsa build-ca
#1.2.创建server端证书和私钥文件,nopass表示不加密私钥文件
./easyrsa gen-req server nopass

#1.3.签发服务端证书,输入yes,和CA证书的密码
./easyrsa sign server server
   req: /opt/easy-rsa/pki/reqs/server.req
   key: /opt/easy-rsa/pki/private/server.key
   Certificate : /opt/easy-rsa/pki/issued/server.crt

#1.4.客户端证书,密钥交换时的gen-dh算法
./easyrsa gen-dh
#创建客户端证书,输入密码,
./easyrsa gen-req client nopass
    req: /opt/easy-rsa/pki/reqs/client.req
    key: /opt/easy-rsa/pki/private/client.key
#签发下
./easyrsa client client nopass
   Certificatet: /opt/easy-rsa/pki/issued/client.crt

1.5.安装证书
yum install openvpn -y
配置文件路径:/usr/share/doc/openvpn-2.4.12/sample/sample-config-files/server.conf

meinvwudi

port 1194                               #端口
proto udp                               #协议
dev tun                                 #采用路由隧道模式tun
ca ca.crt                               #ca证书文件位置
cert server.crt                         #服务端公钥名称
key server.key                          #服务端私钥名称
dh dh.pem                               #交换证书
server 10.8.0.0 255.255.255.0           #给客户端分配地址池，注意：不能和VPN服务器内网网段有相同
push "route 172.23.0.0  255.255.0.0"   #允许客户端访问内网172.16.0.0网段
ifconfig-pool-persist ipp.txt           #地址池记录文件位置
keepalive 10 120                        #存活时间，10秒ping一次,120 如未收到响应则视为断线
max-clients 100                         #最多允许100个客户端连接
status openvpn-status.log               #日志记录位置
verb 3                                  #openvpn版本
client-to-client                        #客户端与客户端之间支持通信
log /var/log/openvpn.log                #openvpn日志记录位置
persist-key     #通过keepalive检测超时后，重新启动VPN，不重新读取keys，保留第一次使用的keys。
persist-tun     #检测超时后，重新启动VPN，一直保持tun是linkup的。否则网络会先linkdown然后再linkup
duplicate-cn
script-security 3                                   #允许使用自定义脚本
auth-user-pass-verify /etc/openvpn/check.sh via-env #指定认证脚本
username-as-common-name                             #用户密码登陆方式验证
client-config-dir ccd

meinvwudi

复制4个证书和密钥文件,dh 到配置文件目录下面

cd /etc/openvpn/
cp /opt/easy-rsa/pki/private/server.key ./
cp /opt/easy-rsa/pki/issued/server.crt ./
cp /opt/easy-rsa/pki/ca.crt ./
cp  /opt/easy-rsa/pki/dh.pem  ./

meinvwudi

启动服务

echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf
systemctl restart network
systemctl -f enable openvpn@server.service
systemctl start openvpn@server.service
systemctl status openvpn@server.service

meinvwudi

添加防火墙转发规则

firewall-cmd --add-service=openvpn
firewall-cmd --add-service=openvpn --permanent
firewall-cmd --add-masquerade 
firewall-cmd --add-masquerade --permanent