关于OpenVPN的有关介绍及为何使用OpenVPN在此就不做赘述了,下面直接记录Centos7.2系统下部署OpenVPN环境的操作过程:

1) 先将本机的yum换成阿里云的yum源
[root@test-vm04 ~]# wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo
[root@test-vm04 ~]# yum clean all
[root@test-vm04 ~]# yum makecache
-----------------------------------------------------------------------------------------------------------
如果是centos5,则更换如下:
wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-5.repo

如果时centos6,则更换如下:
wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-6.rep
-----------------------------------------------------------------------------------------------------------

2)安装依赖的软件包
[root@test-vm04 ~]# yum install -y lzo lzo-devel openssl openssl-devel pam pam-devel

[root@test-vm04 ~]# wget http://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
[root@test-vm04 ~]# rpm -ivh epel-release-latest-7.noarch.rpm
[root@test-vm04 ~]# yum install -y pkcs11-helper pkcs11-helper-devel

确认已经安装完成:
[root@test-vm04 ~]# rpm -qa lzo lzo-devel openssl openssl-devel pam pam-devel pkcs11-helper pkcs11-helper-devel
pam-devel-1.1.8-18.el7.x86_64
pkcs11-helper-devel-1.11-3.el7.x86_64
pam-1.1.8-18.el7.x86_64
pkcs11-helper-1.11-3.el7.x86_64
lzo-devel-2.06-8.el7.x86_64
openssl-1.0.2k-8.el7.x86_64
lzo-2.06-8.el7.x86_64
openssl-devel-1.0.2k-8.el7.x86_64

3) 安装OpenVPN服务
下载openvpn的源码包
[root@test-vm04 ~]# wget http://oss.aliyuncs.com/aliyunecs/openvpn-2.2.2.tar.gz

使用rpmbuild将源码包编译成rpm包来进行安装
[root@test-vm04 ~]# rpmbuild -tb openvpn-2.2.2.tar.gz

执行上面这条命令以后就会正常开始编译了,编译完成以后会在 /root/rpmbuild/RPMS/x86_64 目录下生成 openvpn-2.2.2-1.x86_64.rpm 安装包。
[root@test-vm04 ~]# ls /root/rpmbuild/RPMS/x86_64/
openvpn-2.2.2-1.x86_64.rpm

执行rpm -ivh openvpn-2.2.2-1.x86_64.rpm 以rpm包的方式安装:
[root@test-vm04 ~]# rpm -ivh /root/rpmbuild/RPMS/x86_64/openvpn-2.2.2-1.x86_64.rpm
Preparing...                          ################################# [100%]
Updating / installing...
   1:openvpn-2.2.2-1                  ################################# [100%]
Restarting openvpn (via systemctl):                        [  OK  ]

4)配置OpenVPN服务(服务端)
初始化PKI
[root@test-vm04 ~]# cd /usr/share/doc/openvpn-2.2.2/easy-rsa/2.0

进入到 /usr/share/doc/openvpn-2.2.2/easy-rsa/2.0 目录下,找到 vars 证书环境文件,修改以下几行 export 定义的参数值
[root@test-vm04 2.0]# vim vars
......
export KEY_COUNTRY="CN"                                    //所在的国家
export KEY_PROVINCE="BJ"                                   //所在的省份
export KEY_CITY="BEIJING"                                  //所在的城市
export KEY_ORG="HUANQIU"                                   //所在的组织
export KEY_EMAIL="wangshibo@huanqiu.cn"          //邮件地址

上述参数的值可以自定义设置,对配置无影响。

生成服务端的证书
清除并删除keys目录下的所有key
[root@test-vm04 2.0]# ln -s openssl-1.0.0.cnf openssl.cnf
[root@test-vm04 2.0]# ll openssl*
-rwxr-xr-x. 1 root root 7768 Oct 21  2010 openssl-0.9.6.cnf
-rwxr-xr-x. 1 root root 8325 Nov 24  2011 openssl-0.9.8.cnf
-rwxr-xr-x. 1 root root 8222 Nov 24  2011 openssl-1.0.0.cnf
lrwxrwxrwx. 1 root root   17 Sep 21 05:19 openssl.cnf -> openssl-1.0.0.cnf

[root@test-vm04 2.0]# source ./vars
NOTE: If you run ./clean-all, I will be doing a rm -rf on /usr/share/doc/openvpn-2.2.2/easy-rsa/2.0/keys
[root@test-vm04 2.0]# ./clean-all

生成CA证书,刚刚上面已经在vars文件中配置了默认参数值,多次回车完成就可以:
[root@test-vm04 2.0]# ./build-ca
Generating a 1024 bit RSA private key
.....++++++
...................................++++++
writing new private key to 'ca.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]:
State or Province Name (full name) [BJ]:
Locality Name (eg, city) [BEIJING]:
Organization Name (eg, company) [HUANQIU]:
Organizational Unit Name (eg, section) [changeme]:
Common Name (eg, your name or your server's hostname) [changeme]:
Name [changeme]:
Email Address [mail@host.domain]:

生成服务器证书
如下huanqiuvpn是自定义的名字,一直回车,到最后会有两次交互,输入y确认,完成后会在keys目录下保存了huanqiuvpn.key、huanqiuvpn.csrl和huanqiuvpn.crt 三个文件。
[root@test-vm04 2.0]# ./build-key-server huanqiuvpn
Generating a 1024 bit RSA private key
........................................++++++
......++++++
writing new private key to 'huanqiuvpn.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]:
State or Province Name (full name) [BJ]:
Locality Name (eg, city) [BEIJING]:
Organization Name (eg, company) [HUANQIU]:
Organizational Unit Name (eg, section) [changeme]:
Common Name (eg, your name or your server's hostname) [huanqiuvpn]:
Name [changeme]:
Email Address [mail@host.domain]:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
Using configuration from /usr/share/doc/openvpn-2.2.2/easy-rsa/2.0/openssl-1.0.0.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName           :PRINTABLE:'CN'
stateOrProvinceName   :PRINTABLE:'BJ'
localityName          :PRINTABLE:'BEIJING'
organizationName      :PRINTABLE:'HUANQIU'
organizationalUnitName:PRINTABLE:'changeme'
commonName            :PRINTABLE:'huanqiuvpn'
name                  :PRINTABLE:'changeme'
emailAddress          :IA5STRING:'mail@host.domain'
Certificate is to be certified until Sep 19 09:52:18 2027 GMT (3650 days)
Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

[root@test-vm04 2.0]# ls keys/
01.pem  02.pem  03.pem  ca.crt  ca.key  huanqiuvpn.crt  huanqiuvpn.csr  huanqiuvpn.key  index.txt  index.txt.attr  index.txt.attr.old  index.txt.old  serial  serial.old

创建vpn登陆用户的秘钥与证书
如下,创建用户名为kevin的秘钥和证书,一直回车,到最后会有两次确认,只要按y确认即可。完成后,在keys目录下生成1024位RSA服务器密钥kevin.key、kevin.crt和kevin.csr 三个文件。
[root@test-vm04 2.0]# ./build-key kevin
Generating a 1024 bit RSA private key
...................++++++
.........++++++
writing new private key to 'kevin.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]:
State or Province Name (full name) [BJ]:
Locality Name (eg, city) [BEIJING]:
Organization Name (eg, company) [HUANQIU]:
Organizational Unit Name (eg, section) [changeme]:
Common Name (eg, your name or your server's hostname) [kevin]:
Name [changeme]:
Email Address [mail@host.domain]:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
Using configuration from /usr/share/doc/openvpn-2.2.2/easy-rsa/2.0/openssl-1.0.0.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName           :PRINTABLE:'CN'
stateOrProvinceName   :PRINTABLE:'BJ'
localityName          :PRINTABLE:'BEIJING'
organizationName      :PRINTABLE:'HUANQIU'
organizationalUnitName:PRINTABLE:'changeme'
commonName            :PRINTABLE:'kevin'
name                  :PRINTABLE:'changeme'
emailAddress          :IA5STRING:'mail@host.domain'
Certificate is to be certified until Sep 19 10:00:46 2027 GMT (3650 days)
Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]
CERTIFICATION CANCELED

[root@test-vm04 2.0]# ls keys/
01.pem  ca.crt  ca.key  huanqiuvpn.crt  huanqiuvpn.csr  huanqiuvpn.key  index.txt  index.txt.attr  index.txt.old  kevin.crt  kevin.csr  kevin.key  serial  serial.old

------------------------------------------------------------------------------------------------------------------------------------------------
如果创建用户证书时报错,可以将keys整个目录删除,然后从source ./vars这一步开始重新操作(慎重,否则之前在keys目录里的用户数据就会都删除)
------------------------------------------------------------------------------------------------------------------------------------------------

生成Diffie Hellman参数
[root@test-vm04 2.0]# ./build-dh
Generating DH parameters, 1024 bit long safe prime, generator 2
This is going to take a long time
.....+..............+..+..............................................................................+...................................................................................................+............................+................+............+..+...................+..............+........................................................................+............................................+.......................................................................................................................................+.....................................................+............+.......................+.......................................+............................................................................................................................................++*++*++*

执行了./build-dh后,会在 keys 目录下生成 dh 参数文件 dh1024.pem。该文件客户端验证的时候会用到
[root@test-vm04 2.0]# ls keys
01.pem  ca.crt  ca.key  dh1024.pem  huanqiuvpn.crt  huanqiuvpn.csr  huanqiuvpn.key  index.txt  index.txt.attr  index.txt.old  kevin.crt  kevin.csr  kevin.key  serial  serial.old

将/usr/share/doc/openvpn-2.2.2/easy-rsa/2.0/keys 目录下的所有文件复制到 /etc/openvpn下:
[root@test-vm04 2.0]# cp -a /usr/share/doc/openvpn-2.2.2/easy-rsa/2.0/keys/* /etc/openvpn/

复制openvpn服务端配置文件 server.conf 到 /etc/openvpn/ 目录下:
[root@test-vm04 2.0]# cp -a /usr/share/doc/openvpn-2.2.2/sample-config-files/server.conf /etc/openvpn/

server.conf文件的配置
[root@test-vm04 2.0]# egrep -v "^$|^#|^;" /etc/openvpn/server.conf
local 111.94.149.74          //监听地址(内网或外网地址),最好填写openvpn服务器的公网IP地址(使用"curl ifconfig.me"命令查看)。或者这一行直接注释掉!(我在线上配置的就是注释这行)
port 1194
proto udp
dev tun
ca ca.crt                   //CA证书路径
cert huanqiuvpn.crt         //此处crt以及下一行的key,请填写生成服务器端证书时用户自定义的名称
key huanqiuvpn.key
dh dh1024.pem               //秘钥交换协议文件
server 10.8.0.0 255.255.255.0   //给vpn客户机分配的地址池。最好别和openvpn部署机的内网ip在一个网段内
ifconfig-pool-persist ipp.txt
push "route 10.0.0.0 255.0.0.0"
client-to-client
keepalive 10 120
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
log         openvpn.log
verb 3

5)设置iptables
先设置转发
[root@test-vm04 2.0]# vim /etc/sysctl.conf
net.ipv4.ip_forward = 1
[root@test-vm04 2.0]# sysctl -p       //使内核参数生效

添加iptables规则,确保服务器可以转发数据包到外网:
[root@test-vm04 2.0]# iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j MASQUERADE
[root@test-vm04 2.0]# service iptables save
[root@test-vm04 2.0]# iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination        

Chain INPUT (policy ACCEPT)
target     prot opt source               destination        

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination        

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
MASQUERADE  all  --  localhost/24         anywhere

6)启动OpenVPN
[root@test-vm04 2.0]# /etc/init.d/openvpn start
Starting openvpn (via systemctl):                          [  OK  ]

[root@test-vm04 2.0]# lsof -i:1194
COMMAND  PID   USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
openvpn 8547 nobody    5u  IPv4  53264      0t0  UDP localhost:openvpn

如果1194端口启动不起来,可以通过查看/etc/openvpn/openvpn.log日志进行原因排查
-------------------------------------------------------------------------------------------------------------------------------
后续给同事开vpn账号,只需要下面几步(比如给zhangqiang同事开vpn)
[root@test-vm04 2.0]# pwd
/usr/share/doc/openvpn-2.2.2/easy-rsa/2.0
[root@test-vm04 2.0]# ./build-key zhangqiang
[root@test-vm04 2.0]# cp -a /usr/share/doc/openvpn-2.2.2/easy-rsa/2.0/keys/zhangqiang.* /etc/openvpn/
[root@test-vm04 2.0]# /etc/init.d/openvpn restart
[root@test-vm04 2.0]# lsof -i:1194

然后编写zhangqiang用户的config.ovpn客户端配置文件:
[root@test-vm04 2.0]# vim /tmp/config.ovpn
client
dev tun
proto udp
remote 111.94.149.74 1194        //注意这里的111.94.149.74是openvpn服务器端的外围ip。
resolv-retry infinite
nobind
mute-replay-warnings
ca  ca.crt
cert zhangqiang.crt
key zhangqiang.key
comp-lzo

然后将ca.crt、config.ovpn、zhangqiang.crt、zhangqiang.csr、zhangqiang.key这五个文件放到zhagnqiang用户下
[root@test-vm04 2.0]# mkdir /tmp/zhangqiang
[root@test-vm04 2.0]# cd keys/
[root@test-vm04 keys]# cp ca.crt /tmp/config.ovpn zhangqiang.crt zhangqiang.csr zhangqiang.key /tmp/zhangqiang
[root@test-vm04 keys]# cd /tmp && tar -zvcf zhangqiang.tar.gz zhangqiang

然后将/opt/zhangqiang.tar.gz文件拷贝给用户zhangqiang,让他在客户机上进行openvpn的连接。

-----------------------------------------openvpn使用说明----------------------------------------

一、windows用户
1. 需要向管理员申请openvpn的配置及秘钥文件(总共包括5个文件:ca.crt证书、config.ovpn客户端配置文件、用户.crt用户.csr用户.key)。(其中,config.ovpn客户端文件是直接配置好拷贝给客户机的,这个文件在服务器端是不存在的,需要自己编写)
2. 软件安装包见文末
3. 如果你的电脑没有安装过TAP,安装过程中会有下面的提示,选择安装。

4. 鼠标右键点击软件安装包以管理员方式运行,一直点next 或者agree即可
接着下一步,同意直到安装完成.
5. 安装完成后你的桌面会出现下面的图标,出现这个说明安装成功了。
6. 然后打开我的电脑,进到openvpn安装目录即 C:\Program Files\OpenVPN\config 这个文件夹下,然后拿出管理员给你的配置文件,放到这个目录下,如下
7. 回到桌面,右键openvpn的图标,选择以管理员身份运行
8. 这时候电脑右下角会出现openvpn的程序
9. 鼠标右键,选择connect
10. 程序图标变成绿色,就说明openvpn连接成功了
-----------------------------------------------------------------------------------------------------
二、mac 用户
1.向管理员申请配置及秘钥文件(即那5个文件:ca.crt、config.ovpn、wangshibo.crt、wangshibo.csr、wangshibo.key。将这5个文件打包成wangshibo.tar.gz,然后传给wangshibo用户).
2.安装文末的程序
3.删除管理员给你文档中的.csr结尾的文件
4.给上层文件夹加上.tblk,然后双击载入,添加到VPN的配置里面
5.在菜单栏,左键点击图标选择连接,连接成功就是以下状态.

例如:
管理员给wangshibo用户申请配置及秘钥文件,打包给wangshiyong用户,如下:
用户收到后将其解压成wangshibo文件夹,打开wangshibo文件夹,有以下五个文件:
接着删除其中的wangshibo.csr文件,然后回到上层文件夹即wangshibo文件夹,将该文件夹改名为wangshibo.tblk
最后双击这个.tblk文件夹就自动加载到Tunnelblick的VPN客户端里面了.出现如下标志就说明已经连接上VPN了。
 

连接到openvpn后,查看本机分配的vpn地址:
localhost:test-vm kevin$ ifconfig       //发现已经成功分配到上面定义的vpn地址范围内的地址了(10.8.0.10)
.......
utun1: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1500
	inet 10.8.0.10 --> 10.8.0.9 netmask 0xffffffff
---------------------------------------------------------------------------------------------------------------
注意:传给用户的config.ovpn文件是openvpn的客户端的配置文件,这个文件是不真实存在于openvpn的服务器端的,是手动配置好拿到客户机上的。
比如上面的wangshibo用户的config.ovpn文件配置如下:
每个用户的config.ovpn文件配置除了cert和key不一样之外,其他地方的配置完全一致!
client
dev tun
proto udp
remote 111.94.149.74 1194
resolv-retry infinite
nobind
mute-replay-warnings
ca  ca.crt
cert wangshibo.crt
key wangshibo.key
comp-lzo

补充一下,下面的mac客户端是可用的,安装后会提示升级,升级后有可能会导致不能使用,没有特殊原因的话,就不用升级了,如果已经升级,删除后安装下面这个就行了.
mac 用户下载下面这个:https://pan.baidu.com/s/1sl3CnwT      (提取密码:1j8g)
windows 用户下载下面这个:https://pan.baidu.com/s/1eS4E6Y2   (提取密码:fvkr)

Centos7.2下OpenVPN 环境完整部署记录的更多相关文章

  1. Elasticsearch学习总结 (Centos7下Elasticsearch集群部署记录)

    一.  ElasticSearch简单介绍 ElasticSearch是一个基于Lucene的搜索服务器.它提供了一个分布式多用户能力的全文搜索引擎,基于RESTful web接口.Elasticse ...

  2. Kubernetes容器集群管理环境 - 完整部署(下篇)

    在前一篇文章中详细介绍了Kubernetes容器集群管理环境 - 完整部署(中篇),这里继续记录下Kubernetes集群插件等部署过程: 十一.Kubernetes集群插件 插件是Kubernete ...

  3. Kubernetes容器集群管理环境 - 完整部署(中篇)

    接着Kubernetes容器集群管理环境 - 完整部署(上篇)继续往下部署: 八.部署master节点master节点的kube-apiserver.kube-scheduler 和 kube-con ...

  4. centos7系统下 docker 环境搭建

    运行环境: VMware Workstation Pro 在虚拟机中安装centos7系统, 选择最小安装, 网络连接方式选择的桥接(与宿主机在同一IP段)centos7一定要安装64位, docke ...

  5. Mac OS下 Redis2.6.14部署记录

    Mac OS下 Redis2.6.14部署记录 部署一个Redis作为缓存进行验证,记录部署过程. 官网:http://redis.io/,目前最近稳定版为2.6.14  解压,进入目录.按照READ ...

  6. CentOS7.1下生产环境Keepalived+Nginx配置

    CentOS7.1下生产环境Keepalived+Nginx配置 [日期:2015-07-20] 来源:Linux社区  作者:soulful [字体:大 中 小]   注:下文涉及到配置的,如无特别 ...

  7. Redis集群环境的部署记录

    Redis Cluster终于出了Stable,这让人很是激动,等Stable很久了,所以还是先玩玩. 一. 集群简单概念. Redis 集群是一个可以在多个 Redis 节点之间进行数据共享的设施( ...

  8. Centos6.9下RabbitMQ集群部署记录

    之前简单介绍了CentOS下单机部署RabbltMQ环境的操作记录,下面详细说下RabbitMQ集群知识,RabbitMQ是用erlang开发的,集群非常方便,因为erlang天生就是一门分布式语言, ...

  9. Centos6下zookeeper集群部署记录

    ZooKeeper是一个开放源码的分布式应用程序协调服务,它包含一个简单的原语集,分布式应用程序可以基于它实现同步服务,配置维护和命名服务等. Zookeeper设计目的 最终一致性:client不论 ...

随机推荐

  1. Debug JDK变量显形

    本文面向的朋友 本文主要说明在使用Eclipse Debug JDK时,看不到变量值的解决办法. 如果您看到上面绿色字体表示不敢兴趣,请一定果断back,如果您不爽,请在下面使劲的拍. Debug J ...

  2. 【Java】 环境变量如何配置?

    Java知识简介与环境变量配置问题 一.在学习一门语言中,不仅需要掌握其语法结构,开发平台以及环境也是很重要的.在开始Java学习之前首先对其进行压缩包的下载安装,以及开发平台环境下载安装.基于此下面 ...

  3. Java中的Comparable接口和Comparator接口

    Comparator位于包java.util下,比较器,是在集合外部定义排序.Comparable位于包java.lang下,代表当前对象可比较的,是在集合内部实现排序. Comparable代表一个 ...

  4. Ubuntu 14.10 下安装java反编译工具 jd-gui

    系统环境,Ubuntu 14.10 ,64位 1 下载JD-GUI,网址http://221.3.153.126/1Q2W3E4R5T6Y7U8I9O0P1Z2X3C4V5B/jd.benow.ca/ ...

  5. kettle 连接 mysql 出错 Driver class &#39;org.gjt.mm.mysql.Driver&#39; could not be found, make sure the ……

    解决办法:1: 首先,到官网下载mysql-connector-java. 2: 把驱动文件放置在data-integration\lib\ 目录下

  6. poj 3335 Rotating Scoreboard - 半平面交

    /* poj 3335 Rotating Scoreboard - 半平面交 点是顺时针给出的 */ #include <stdio.h> #include<math.h> c ...

  7. Linux系统date命令的参数及获取时间戳的方法

    date指令相关用法示例 date 用法: date [OPTION]... [+FORMAT]date [-u|--utc|--universal] [MMDDhhmm[[CC]YY][.ss]] ...

  8. ArrayList迭代过程删除问题

    一:首先看下几个ArrayList循环过程删除元素的方法(一下内容均基于jdk7): package list; import java.util.ArrayList; import java.uti ...

  9. 织梦CMS首页调用分类信息栏目及列表方法

    不懂代码,搜索学习一晚上,都是说调用特定栏目分类信息列表的,用这个代码 {dede:arclistsg row='10' titlelen='24' orderby='pubdate' channel ...

  10. Cent OS 6.4下安装JDK1.6

    步骤1:查看Linux自带的JDK是否已安装 (卸载CentOS已安装的JDK)  安装好的CentOS会自带OpenJDK,用命令"java -version"查看,会有下面的信 ...