• 安装依赖
# 安装必须的软件
yum install -y openvpn easy-rsa

# cd /usr/share/easy-rsa/2.0/ 编辑vars文件,修改字段如下
export KEY_COUNTRY="CN" 
export KEY_PROVINCE="SD" 
export KEY_CITY="JN" 
export KEY_ORG="IIII" 
export KEY_EMAIL="admin@IIII.org"

# 开始生成,顺序为ca文件,server文件,client文件,还有dh
. ./vars
./clean-all
./build-ca
./build-key-server server
./build-key wangyg
./build-dh
  • server配置
ca.crt
ca.key
server.conf
dh2048.pem
  • server.conf内容
port 9000
mode server
proto tcp
dev tun
status /var/log/openvpn/servertcp.log
management localhost 7505
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
client-to-client
server 192.168.10.0 255.255.255.255
#ifconfig-pool-persist servertcplist.txt
ifconfig-pool-persist ip.txt // 关键是这个
duplicate-cn //一定不要用这个
#push "dhcp-option DNS 119.29.29.29"
#push "redirect-gateway"
keepalive 10 120
comp-lzo
persist-key
persist-tun
verb 3
daemon
push "route 192.168.0.201 255.255.255.255"
push "route 192.168.0.203 255.255.255.255"
push "route 192.168.0.204 255.255.255.255"
  • client配置
ca.crt
c.crt
c.key
c.conf
  • c.conf配置
client
dev tun
proto tcp
remote 1.1.1.1 9000
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert wangyg.crt
key wangyg.key
#ns-cert-type server
comp-lzo
verb 3
route-method exe

如果是用户名和密码形式

# server.conf
port 59000
mode server
proto tcp
dev tun
status /var/log/openvpn/servertcp.log
management localhost 7505
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
client-to-client
server 192.168.9.0 255.255.255.0
#ifconfig-pool-persist servertcplist.txt
#ifconfig-pool-persist ip.txt // 关键是这个
duplicate-cn 
#push "dhcp-option DNS 119.29.29.29"
#push "redirect-gateway"
keepalive 10 120
comp-lzo
persist-key
persist-tun
verb 3
#daemon
push "route 192.168.10.0 255.255.255.0"

auth-user-pass-verify /etc/openvpn/checkpsw.sh via-env
client-cert-not-required
username-as-common-name
script-security 3

# clent.conf
client
dev tun
proto tcp
remote 192.168.10.123 59000
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
#cert wangyongge.crt
#key wangyongge.key
#ns-cert-type server
comp-lzo
verb 3
route-method exe
auth-user-pass
<ca>
ca.cert内容
</ca>

# /etc/openvpn/checkpsw.sh
#!/bin/sh
###########################################################
# checkpsw.sh (C) 2004 Mathias Sundman <mathias@openvpn.se>
#
# This script will authenticate OpenVPN users against
# a plain text file. The passfile should simply contain
# one row per user with the username first followed by
# one or more space(s) or tab(s) and then the password.

PASSFILE="/etc/openvpn/psw-file"
LOG_FILE="/var/log/openvpn-password.log"
TIME_STAMP=`date "+%Y-%m-%d %T"`

###########################################################

if [ ! -r "${PASSFILE}" ]; then
  echo "${TIME_STAMP}: Could not open password file \"${PASSFILE}\" for reading." >> ${LOG_FILE}
  exit 1
fi

CORRECT_PASSWORD=`awk '!/^;/&&!/^#/&&$1=="'${username}'"{print $2;exit}' ${PASSFILE}`

if [ "${CORRECT_PASSWORD}" = "" ]; then 
  echo "${TIME_STAMP}: User does not exist: username=\"${username}\", password=\"${password}\"." >> ${LOG_FILE}
  exit 1
fi

if [ "${password}" = "${CORRECT_PASSWORD}" ]; then 
  echo "${TIME_STAMP}: Successful authentication: username=\"${username}\"." >> ${LOG_FILE}
  exit 0
fi

echo "${TIME_STAMP}: Incorrect password: username=\"${username}\", password=\"${password}\"." >> ${LOG_FILE}
exit 1

# psw-file
xxx xxx
Copyright © opschina.org 2017 with zzlyzq@gmail.com all right reserved,powered by Gitbook该文件修订时间: 2017-07-11 11:32:48

results matching ""

    No results matching ""