一、OpenVPN 证书制作

1.1、解压 easy-rsa-data.zip 文件

  1. 进入/opt/khalidfile/openvpn目录
1
cd /opt/khalidfile/openvpn
  1. 解压 easy-rsa-data.zip 文件
1
unzip easy-rsa-data.zip
  1. 进入目录
1
cd easy-rsa-data/2.2
  1. 修改权限
1
chmod 755 *

1.2、配置 vars

  1. 配置 vars

其中 xxx 变更为实际含义内容

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
# These are the default values for fields
# which will be placed in the certificate.
# Don't leave any of these fields blank.
export KEY_COUNTRY="cn"
export KEY_PROVINCE="zhejiang"
export KEY_CITY="hangzhou"
export KEY_ORG="xxx"
export KEY_EMAIL="xxx@163.com"
export KEY_OU="DevelopmentDepartment"

# X509 Subject Field
export KEY_NAME="xxx"

# PKCS11 Smart Card
# export PKCS11_MODULE_PATH="/usr/lib/changeme.so"
# export PKCS11_PIN=1234

# If you'd like to sign all keys with the same Common Name, uncomment the KEY_CN export below
# You will also need to make sure your OpenVPN server config has the duplicate-cn option set
# export KEY_CN="CommonName"
export KEY_CN="xxx"
  1. 让 vars 生效
1
source ./vars
  1. 清空原证书
1
./clean-all

1.3、生成根证书和密钥

  1. 命令
1
./build-ca
  1. 证书文件： ca.crt ca.key
1
2
ls keys/
# ca.crt  ca.key  index.txt  serial

1.4、生成服务端证书和密钥

  1. 命令

Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y

1
./build-key-server khalidlife-server
  1. 证书文件： khalidlife-server.crt khalidlife-server.key
1
2
ls keys/
01.pem  ca.crt  ca.key  index.txt  index.txt.attr  index.txt.old  khalidlife-server.crt  khalidlife-server.csr  khalidlife-server.key  serial  serial.old

1.5、生成客户端证书和密钥

  1. 命令

Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y

1
./build-key khalidlife-client
  1. 证书文件： khalidlife-client.crt khalidlife-client.key
1
2
3
ls keys/
01.pem  ca.crt  index.txt       index.txt.attr.old  khalidlife-client.crt  khalidlife-client.key  khalidlife-server.csr  serial
02.pem  ca.key  index.txt.attr  index.txt.old       khalidlife-client.csr  khalidlife-server.crt  khalidlife-server.key  serial.old

1.6、生成证书密钥交换文件

  1. 命令
1
./build-dh
  1. 证书密钥交换文件： dh2048.pem
1
2
01.pem  ca.crt  dh2048.pem  index.txt.attr      index.txt.old          khalidlife-client.csr  khalidlife-server.crt  khalidlife-server.key  serial.old
02.pem  ca.key  index.txt   index.txt.attr.old  khalidlife-client.crt  khalidlife-client.key  khalidlife-server.csr  serial

二、安装与配置 OpenVPN 服务端

2.1、安装 OpenVPN 服务端

1
yum -y install openvpn

2.2、配置 OpenVPN 服务端

  1. 创建 OpenVPN 配置目录下证书文件夹
1
mkdir -p /etc/openvpn/keys
  1. 进入 EasyRSA 下证书文件夹
1
cd keys
  1. 拷贝证书文件
1
cp {ca.crt,khalidlife-server.crt,khalidlife-server.key,dh2048.pem} /etc/openvpn/keys/
  1. 进入 OpenVPN 配置目录
1
cd /etc/openvpn
  1. 拷贝服务端配置模板文件
1
cp /usr/share/doc/openvpn-2.4.11/sample/sample-config-files/server.conf ./
  1. 编辑 server.conf文件
    1. 命令
1
vim server.conf
2. 证书位置名称修改

1
2
3
4
5
6
7
8
ca keys/ca.crt
cert keys/khalidlife-server.crt
key keys/khalidlife-server.key  # This file should be kept secret

# Diffie hellman parameters.
# Generate your own with:
#   openssl dhparam -out dh2048.pem 2048
dh keys/dh2048.pem
3. 修改vpn的ip地址

1
2
#server 10.8.0.0 255.255.255.0
server 10.1.0.0 255.255.255.0
4. 定义路由转发

1
2
push "route 10.1.0.0 255.255.255.0"
push "route 10.10.0.0 255.255.240.0"
5. 修改拒绝服务攻击证书文件路径

1
tls-auth keys/ta.key 0
6. 修改加密方式

1
2
#cipher AES-256-CBC
cipher AES-256-GCM

2.3、启用路由转发功能

  1. 修改/etc/sysctl.conf文件
1
echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf
  1. 让修改生效
1
sysctl -p

2.4、建立ta.key文件（拒绝服务攻击证书文件）

  1. 进入 OpenVPN 配置目录下的证书文件目录
1
cd /etc/openvpn/keys
  1. 生成 ta.key
1
openvpn --genkey --secret ta.key

2.5、启动 OpenVPN 服务

  1. 命令
1
openvpn --daemon --config /etc/openvpn/server.conf
  1. 查看效果
1
netstat -lntup | grep 1194

2.6、添加地址转换

1
iptables -t nat -A POSTROUTING -s 10.1.0.0/24 -j MASQUERADE

查看

1
iptables -t nat -L

三、安装与配置 OpenVPN 客户端

3.1、配置 OpenVPN 客户端

  1. 建立 client 文件夹
1
mkdir -p ~/client
  1. 进入 client 目录
1
cd ~/client
  1. 拷贝客户端配置模板文件
1
cp /usr/share/doc/openvpn-2.4.11/sample/sample-config-files/client.conf ~/client
  1. 编辑客户端配置模板文件
    1. 命令
1
vim client.conf
2. 修改证书名称

1
2
cert khalidlife-client.crt
key khalidlife-client.key
3. 修改加密方式

1
2
#cipher AES-256-CBC
cipher AES-256-GCM
4. 修改接口地址

1
remote 192.168.243.81 1194
  1. 拷贝证书
1
2
3
4
cp /opt/khalidfile/openvpn/easy-rsa-data/2.2/keys/khalidlife-client.key /root/client/
cp /opt/khalidfile/openvpn/easy-rsa-data/2.2/keys/khalidlife-client.crt /root/client/
cp /opt/khalidfile/openvpn/easy-rsa-data/2.2/keys/ca.crt /root/client/
cp /etc/openvpn/keys/ta.key /root/client/
  1. 检查证书文件
1
2
ls
ca.crt  client.conf  khalidlife-client.crt  khalidlife-client.key  ta.key
  1. 重命名配置文件
1
2
3
4
5
mv client.conf khalidlife.opvn

cd ..

mv client khalidlife
  1. 打包
1
zip -r khalidlife.zip khalidlife
  1. x

参考：https://www.bilibili.com/video/BV1mK411T7eg