参考资料
https://phoenixnap.com/kb/openvpn-centos 安装参考
https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage?cf_chl_jschl_tk=2ef2ce429812b6af8d89764730f64a2224053560-1616146799-0-ARxFX2pRsifexhxoXrH8mPbj7faD8nxJaECGR0kQgNEolVczUZJURwhSuvt8-7CF0Dmlj9IkjC19L9J10MEz21fQEq-W7qjdfNvw56Pl8guyYk6FlOkJiYH1mJu2drhcD4Z23JxhPDDHWNPIwgozsiY6oQMHpaZC-QN0_XuWsqZxX2msLn6NyxWA0by8CfTvbyAKd2uzJjwbwRdvqW1hHlCFew3FUJuxwNDbvMmUAlfyHL-81IqBKzBkbUfyafzC9EG56emXf5v6YxLbBvQwaCW1vx-Fl4prSIGoKoqwmxrPoiRXqJZVP7pXwKVhcw-0FcVk_XEPzxP60yaP4el5J0eN9rDv1ztCs3yj0ScfIf5_ 官方文档主要是找askpass参数
https://forums.openvpn.net/viewtopic.php?t=26024 别人的提问
https://openvpn.net/community-resources/how-to/#openvpn-quickstart 官方安装文档通过源码安装
1:Install OpenVPN
yum -y install epel*
yum -y update
yum install -y openvpn
2:Install Easy RSA
yum install -y wget
wget https://github.com/OpenVPN/easy-rsa/archive/v3.0.8.tar.gz
tar -xf v3.0.8.tar.gz
cd /etc/openvpn/
mkdir /etc/openvpn/easy-rsa
mv /root/easy-rsa-3.0.8 /etc/openvpn/easy-rsa
3:Configure OpenVPN 配置openvpn
cp -r /usr/share/doc/openvpn-2.4.10/sample/sample-config-files/server.conf /etc/openvpn/
find / -name server.conf
/etc/openvpn/server.conf
/usr/share/doc/openvpn-2.4.10/sample/sample-config-files/server.conf
/usr/share/doc/NetworkManager/examples/server.conf
vi /etc/openvpn/server.conf
要设置基本配置，需要通过删除分号来取消对以下行的注释。
To set up the basic configuration, you need to uncomment the following lines by removing the semicolons.
topology subnet (makes the OpenVPN installation function as a subnetwork)
push "redirect-gateway def1 bypass-dhcp" (instructs the client to redirect traffic through the OpenVPN server)
push "dhcp-option DNS 208.67.222.222" (uses an OpenDNS resolver to connect to OpenVPN)
push "dhcp-option DNS 208.67.220.220" (uses an OpenDNS resolver to connect to OpenVPN)
user nobody (runs OpenVPN with no privileges)
group nobody (runs OpenVPN with no privileges)
Then, generate a static encryption key to enable TLS authentication. To do that, locate the line tls-auth ta.key 0 and comment it by adding ; in front of it. Then, add a new line under it:
然后，生成一个静态加密密钥以启用TLS身份验证。为此，找到tls auth行助教钥匙0并在其前面添加；对其进行注释。然后，在下面添加新行：
tls-auth ta.key 0 # This file is secret 这个配置在在server.conf 文件中，根据以上这句话需要添加; 注释，他不是命令
[root@master easy-rsa]# tls-crypt myvpn.tlsauth
-bash: tls-crypt: 未找到命令
在server.conf文件中添加这个
tls-crypt myvpn.tlsauth
配置文件指定要用于连接到OpenVPN的DNS服务器。默认情况下，它被设置为使用OpenDNS解析器，这就是我们离开它的方式。
The configuration file specifies which DNS servers to use to connect to OpenVPN. By default, it is set to use OpenDNS resolvers, which is how we left it. Alternatively, you can change it to different DNS resolvers by modifying the push "dhcp-option DNS 208.67.222.222" and push "dhcp-option DNS 208.67.220.220" lines.
Save and exit the configuration file.
Finally, generate the static encryption key specified in the file with the command:
最后生成一个静态的加密的key通过以下命令
openvpn --genkey --secret /etc/openvpn/myvpn.tlsauth
ls
client easy-rsa myvpn.tlsauth server server.conf server.conf.bak
cat myvpn.tlsauth
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
45a69a183da20a8f7e7b17b0276786bd
b57d725692dc4200ec0f3024dc9da266
ac8c4ffb676db52cd17c5249b2eb8aeb
91c2e344218a7c183b92f588cace5a28
253f0f387d3d878e1f3023a52974c7c7
0f5fec0398ae041ac291fd133b70cac1
5fe6e54c13fdc25fa33af8b51aa7ba12
5fd6cae5ac8d385c61d0b1d5af445052
6cd825b30822dfa895b1944f6017b336
335cbf71ad99445054f51d1695f48400
009dbe69dc90d5033493b8b297872691
cfa4b3be751a03db85a8a7fe5ff4ebc4
2c518df59f26250468782532d0acf63c
4b4f98a93f533cdb363cf8e4763a8dc0
521c0afed8d137f08152eaa971c1428a
d1e0e97ed473d02e7bccfd4e38b20ed7
-----END OpenVPN Static key V1-----
4: 生成密钥和证书
Generate Keys and Certificates
cd /etc/openvpn/easy-rsa/easyrsa3
ls
easyrsa openssl-easyrsa.cnf vars.example x509-types
cp vars.example vars
vim vars
Scroll through the file and find the lines listed below.
滚动文件并找到下面列出的行。
#set_var EASYRSA_REQ_COUNTRY "US"
#set_var EASYRSA_REQ_PROVINCE "California"
#set_var EASYRSA_REQ_CITY "San Francisco"
#set_var EASYRSA_REQ_ORG "Copyleft Certificate Co"
#set_var EASYRSA_REQ_EMAIL "me@example.net"
#set_var EASYRSA_REQ_OU "My Organizational Unit"
通过删除#取消对行的注释，并用您的信息替换默认值
set_var EASYRSA_REQ_COUNTRY "US" 国家
set_var EASYRSA_REQ_PROVINCE "California" 省份
set_var EASYRSA_REQ_CITY "San Francisco" 市级单位
set_var EASYRSA_REQ_ORG "Copyleft Certificate Co"
set_var EASYRSA_REQ_EMAIL "me@example.net" 邮箱
set_var EASYRSA_REQ_OU "My Organizational Unit" 组织
set_var EASYRSA_REQ_COUNTRY "China"
set_var EASYRSA_REQ_PROVINCE "ZeJiang"
set_var EASYRSA_REQ_CITY "HangZhou"
set_var EASYRSA_REQ_ORG "Copyleft Certificate Co"
set_var EASYRSA_REQ_EMAIL "m15088694571@163.com"
set_var EASYRSA_REQ_OU "Persional"
set-var KEY_NAME "server"
set-var KEY_CN "openvpn.yourdomain.com"
然后，找到指定密钥名称的行并将其更改为“server”：
Then, find the line specifying the KEY_NAME and change it to "server":
没有找到，就添加
set_var KEY_NAME "server" 密钥名称
set_var KEY_CN "openvpn.yourdomain.com" 域名
#set_var EASYRSA_KEY_SIZE 2048
[root@master easyrsa3]# ./easyrsa clean-all
Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa/easyrsa3/vars
init-pki complete; you may now create a CA or requests.
Your newly created PKI dir is: /etc/openvpn/easy-rsa/easyrsa3/pki
ls /etc/openvpn/easy-rsa/easyrsa3/pki
openssl-easyrsa.cnf private reqs safessl-easyrsa.cnf
You will be asked to set a CA Key Passphrase and a common name for your CA.
系统将要求您为CA设置CA密钥密码短语和公用名称。
[root@master easyrsa3]# ./easyrsa build-ca
Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa/easyrsa3/vars
Using SSL: openssl OpenSSL 1.0.2k-fips 26 Jan 2017
Enter New CA Key Passphrase:
Re-Enter New CA Key Passphrase:
Error reading password from BIO
Error getting password
Easy-RSA error:
Failed create CA private key
[root@master easyrsa3]# ./easyrsa build-ca
Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa/easyrsa3/vars
Using SSL: openssl OpenSSL 1.0.2k-fips 26 Jan 2017
Enter New CA Key Passphrase: 这里需要输入密码1234(随便)
Re-Enter New CA Key Passphrase:
Generating RSA private key, 2048 bit long modulus
.............................................+++
.................+++
e is 65537 (0x10001)
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Common Name (eg: your user, host, or server name) [Easy-RSA CA]: 直接回车
CA creation complete and you may now import and sign cert requests.
Your new CA certificate file for publishing is at:
/etc/openvpn/easy-rsa/easyrsa3/pki/ca.crt
To skip password authentication each time you sign your certificates, you can use the ./easyrsa build-ca nopass command.
./easyrsa build-ca nopass 使用这个命令不需要输入密码
5:为服务器创建密钥和证书：
[root@master easyrsa3]# ./easyrsa build-server-full server
Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa/easyrsa3/vars
Using SSL: openssl OpenSSL 1.0.2k-fips 26 Jan 2017
Generating a 2048 bit RSA private key
........................+++
.......+++
writing new private key to '/etc/openvpn/easy-rsa/easyrsa3/pki/easy-rsa-48737.zw5a7
r/tmp.aqGMia'Enter PEM pass phrase:1234
Verifying - Enter PEM pass phrase:1234
-----
Using configuration from /etc/openvpn/easy-rsa/easyrsa3/pki/easy-rsa-48737.zw5a7r/t
mp.Q5pEoVEnter pass phrase for /etc/openvpn/easy-rsa/easyrsa3/pki/private/ca.key:
139858593519504:error:28069065:lib(40):UI_set_result:result too small:ui_lib.c:831:
You must type in 4 to 1023 charactersEnter pass phrase for /etc/openvpn/easy-rsa/easyrsa3/pki/private/ca.key:1234
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName :ASN.1 12:'server'
Certificate is to be certified until Jun 22 08:25:11 2023 GMT (825 days)
Write out database with 1 new entries
Data Base Updated
Next, generate a Diffie-Hellman key exchange file by running:
接下来，运行以下命令生成Diffie-Hellman密钥交换文件：
[root@master easyrsa3]# ./easyrsa gen-dh
....................................................................................................................................+............................................................................+..........................................................................+............................................................................................................................................................................+.........+.........++*++*
DH parameters of size 2048 created at /etc/openvpn/easy-rsa/easyrsa3/pki/dh.pem
您还需要为每个客户机提供证书。在服务器上生成它们，然后在客户端计算机上复制它们。
使用以下命令，我们为client1创建证书和密钥。您可以使用您选择的名称修改命令。
[root@master easyrsa3]# ./easyrsa build-client-full client1
Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa/easyrsa3/vars
Using SSL: openssl OpenSSL 1.0.2k-fips 26 Jan 2017
Generating a 2048 bit RSA private key
......+++
..................................+++
writing new private key to '/etc/openvpn/easy-rsa/easyrsa3/pki/easy-rsa-48964.d7rv5
O/tmp.pvCyVV'Enter PEM pass phrase:1234
Verifying - Enter PEM pass phrase:1234
-----
Using configuration from /etc/openvpn/easy-rsa/easyrsa3/pki/easy-rsa-48964.d7rv5O/t
mp.rWFiYSEnter pass phrase for /etc/openvpn/easy-rsa/easyrsa3/pki/private/ca.key:1234
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName :ASN.1 12:'client1'
Certificate is to be certified until Jun 22 08:27:41 2023 GMT (825 days)
Write out database with 1 new entries
Data Base Updated
一旦您生成了密钥和证书，就可以将它们从pki复制到openvpn目录中。为此，请通过运行以下操作导航到pki目录：
cd /etc/openvpn/easy-rsa/easyrsa3/pki
[root@master pki]# ls
ca.crt index.txt.attr openssl-easyrsa.cnf revoked
certs_by_serial index.txt.attr.old private safessl-easyrsa.cnf
dh.pem index.txt.old renewed serial
index.txt issued reqs serial.old
[root@master pki]# cp ca.crt dh.pem /etc/openvpn
[root@master pki]# cd private/
[root@master private]# cp ca.key server.key /etc/openvpn
[root@master private]# ls /etc/openvpn/
ca.crt client easy-rsa server server.conf.bak
ca.key dh.pem myvpn.tlsauth server.conf server.key
Firewall and Routing Configuration
防火墙和路由配置
[root@master private]# systemctl start firewalld
[root@master private]# firewall-cmd --get-active-zones
public
interfaces: ens33
[root@master private]# firewall-cmd --zone=public --add-service openvpn
success
[root@master private]# firewall-cmd --zone=public --add-service openvpn --permanent
success[root@master private]# firewall-cmd --list-services --zone=public
dhcpv6-client openvpn ssh
[root@master private]# firewall-cmd --add-masquerade
success
[root@master private]# firewall-cmd --add-masquerade --permanent
success
[root@master private]# firewall-cmd --query-masquerade
yes
Routing the Configuration
[root@master private]# VAR=$(ip route get 208.67.222.222 | awk 'NR==1 {print $(NF-2
)}')[root@master private]# echo $VAR
ens33
[root@master private]# firewall-cmd --permanent --direct --passthrough ipv4 -t nat
-A POSTROUTING -s 10.8.0.0/24 -o $VAR -j MASQUERADEsuccess
[root@master private]# firewall-cmd --reload
success
[root@master private]# vi /etc/sysctl.conf
net.ipv4.ip_forward = 1
Start OpenVPN
[root@master private]# systemctl -f start openvpn@server.service
Job for openvpn@server.service failed because the control process exited with error code. See "systemctl status openvpn@server.service" and "journalctl -xe" for details.
[root@master private]# systemctl -f status openvpn@server.service
● openvpn@server.service - OpenVPN Robust And Highly Flexible Tunneling Application On server
Loaded: loaded (/usr/lib/systemd/system/openvpn@.service; disabled; vendor preset: disabled)
Active: failed (Result: exit-code) since 五 2021-03-19 16:50:35 CST; 3s ago
Process: 63976 ExecStart=/usr/sbin/openvpn --cd /etc/openvpn/ --config %i.conf (code=exited, status=1/FAILURE)
Main PID: 63976 (code=exited, status=1/FAILURE)
3月 19 16:50:35 master systemd[1]: Starting OpenVPN Robust And Highly Flexible Tunneling Application On server...
3月 19 16:50:35 master openvpn[63976]: Options error: --dh fails with 'dh2048.pem': No such file or directory (errno=2)
3月 19 16:50:35 master openvpn[63976]: Options error: --cert fails with 'server.crt': No such file or directory (errno=2)
3月 19 16:50:35 master openvpn[63976]: Options error: Please correct these errors.
3月 19 16:50:35 master openvpn[63976]: Use --help for more information.
3月 19 16:50:35 master systemd[1]: openvpn@server.service: main process exited, code=exited, status=1/FAILURE
3月 19 16:50:35 master systemd[1]: Failed to start OpenVPN Robust And Highly Flexible Tunneling Application On server.
3月 19 16:50:35 master systemd[1]: Unit openvpn@server.service entered failed state.
3月 19 16:50:35 master systemd[1]: openvpn@server.service failed.
[root@master pki]# pwd
/etc/openvpn/easy-rsa/easyrsa3/pki
[root@master pki]# ls issued/
client1.crt server.crt
cp issued/server.crt /etc/openvpn
cd /etc/openvpn
cp dh.pem dh2048.pem
[root@master pki]# systemctl -f start openvpn@server.service
[root@master pki]#
Broadcast message from root@master (Fri 2021-03-19 17:02:13 CST):
Password entry required for 'Enter Private Key Password:' (PID 64678).
Please enter password with the systemd-tty-ask-password-agent tool!
[root@master pki]# systemctl -f status openvpn@server.service
● openvpn@server.service - OpenVPN Robust And Highly Flexible Tunneling Application On server
Loaded: loaded (/usr/lib/systemd/system/openvpn@.service; disabled; vendor preset: disabled)
Active: active (running) since 五 2021-03-19 17:02:13 CST; 12s ago
Main PID: 64677 (openvpn)
Status: "Pre-connection initialization successful"
CGroup: /system.slice/system-openvpn.slice/openvpn@server.service
├─64677 /usr/sbin/openvpn --cd /etc/openvpn/ --config server.conf
└─64678 /usr/bin/systemd-ask-password --icon network-vpn Enter Private Key Password:
3月 19 17:02:13 master systemd[1]: Starting OpenVPN Robust And Highly Flexible Tunneling Application On server...
3月 19 17:02:13 master openvpn[64677]: Fri Mar 19 17:02:13 2021 OpenVPN 2.4.10 x86_64-redhat-linux-gnu [Fedora EPEL patched] [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] b...on Dec 9 2020
3月 19 17:02:13 master openvpn[64677]: Fri Mar 19 17:02:13 2021 library versions: OpenSSL 1.0.2k-fips 26 Jan 2017, LZO 2.06
3月 19 17:02:13 master openvpn[64677]: Fri Mar 19 17:02:13 2021 Diffie-Hellman initialized with 2048 bit key
3月 19 17:02:13 master systemd[1]: Started OpenVPN Robust And Highly Flexible Tunneling Application On server.
openvpn ERROR: Failed retrieving username or password
[root@master openvpn]# egrep -v "^$|^#|^;" server.conf
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh2048.pem
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
keepalive 10 120
tls-crypt myvpn.tlsauth
cipher AES-256-CBC
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
verb 3
explicit-exit-notify 1
--askpass [file]
Get certificate password from console or file before we daemonize.
For the extremely security conscious, it is possible to protect your private key with a password. Of course this means that every time the OpenVPN daemon is started you must be there to type the password. The --askpass option allows you to start OpenVPN from the command line. It will query you for a password before it daemonizes. To protect a private key with a password you should omit the -nodes option when you use the openssl command line tool to manage certificates and private keys.
If file is specified, read the password from the first line of file. Keep in mind that storing your password in a file to a certain extent invalidates the extra security provided by using an encrypted key.
创建文件
/etc/openvpn/stdin.tx
vim server.conf
askpass "/etc/openvpn/stdin.txt"
egrep -v "^$|^#|^;" server.conf
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh2048.pem
askpass "/etc/openvpn/stdin.txt"
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
keepalive 10 120
tls-crypt myvpn.tlsauth
cipher AES-256-CBC
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
verb 3
explicit-exit-notify 1
完美解决--ok
[root@master openvpn]# systemctl -f status openvpn@server.service
● openvpn@server.service - OpenVPN Robust And Highly Flexible Tunneling Applicatio
n On server Loaded: loaded (/usr/lib/systemd/system/openvpn@.service; disabled; vendor prese
t: disabled) Active: active (running) since 五 2021-03-19 17:54:45 CST; 7min ago
Main PID: 67900 (openvpn)
Status: "Initialization Sequence Completed"
CGroup: /system.slice/system-openvpn.slice/openvpn@server.service
└─67900 /usr/sbin/openvpn --cd /etc/openvpn/ --config server.conf
3月 19 17:54:45 master openvpn[67900]: Fri Mar 19 17:54:45 2021 Could not det...ET
3月 19 17:54:45 master openvpn[67900]: Fri Mar 19 17:54:45 2021 Socket Buffer...2]
3月 19 17:54:45 master openvpn[67900]: Fri Mar 19 17:54:45 2021 UDPv4 link lo...94
3月 19 17:54:45 master openvpn[67900]: Fri Mar 19 17:54:45 2021 UDPv4 link re...C]
3月 19 17:54:45 master openvpn[67900]: Fri Mar 19 17:54:45 2021 GID set to nobody
3月 19 17:54:45 master openvpn[67900]: Fri Mar 19 17:54:45 2021 UID set to nobody
3月 19 17:54:45 master openvpn[67900]: Fri Mar 19 17:54:45 2021 MULTI: multi_...56
3月 19 17:54:45 master openvpn[67900]: Fri Mar 19 17:54:45 2021 IFCONFIG POOL...=0
3月 19 17:54:45 master openvpn[67900]: Fri Mar 19 17:54:45 2021 IFCONFIG POOL LIST
3月 19 17:54:45 master openvpn[67900]: Fri Mar 19 17:54:45 2021 Initializatio...ed
Hint: Some lines were ellipsized, use -l to show in full.
网友评论