centos7安装yum
[root@openvpn ~]# yum -y install easy-rsa openvpn libssl-dev openssl
配置服务器进行初始化
[root@openvpn ~]#mkdir -p /etc/openvpn/easy-rsa && cp -r /usr/share/easy-rsa/* /etc/openvpn/easy-rsa/
配置pki
[root@openvpn 2.0]# pwd
/etc/openvpn/easy-rsa/2.0
[root@openvpn 2.0]# grep -vE '^#|^$' vars
export EASY_RSA="pwd"
export OPENSSL="openssl"
export PKCS11TOOL="pkcs11-tool"
export GREP="grep"
export KEY_CONFIG=$EASY_RSA/whichopensslcnf $EASY_RSA
export KEY_DIR="$EASY_RSA/keys"
echo NOTE: If you run ./clean-all, I will be doing a rm -rf on $KEY_DIR
export PKCS11_MODULE_PATH="dummy"
export PKCS11_PIN="dummy"
export KEY_SIZE=2048
export CA_EXPIRE=3650
export KEY_EXPIRE=3650
export KEY_COUNTRY="CN"
export KEY_PROVINCE="BeiJing"
export KEY_CITY="BeiJing"
export KEY_ORG="9F"
export KEY_EMAIL="me@9fbank.cc"
export KEY_OU="MyOrganizationalUnit"
export KEY_NAME=server
export KEY_CN="www.9f.com"
产生ca证书
[root@openvpn 2.0]# source ./vars
NOTE: If you run ./clean-all, I will be doing a rm -rf on /etc/openvpn/easy-rsa/2.0/keys
配置证书
1.清空原有证书
[root@openvpn 2.0]# ./clean-all
2.生产服务器端和客户端ca证书
[root@openvpn 2.0]# ./build-ca
注：缺省配置一路回车，记住名字后面用到
[root@openvpn 2.0]# ./build-key-server server
注：缺省配置一路回车，记住名字后面用到
[root@openvpn 2.0]# ./build-ca client
注：缺省配置一路回车，记住名字后面用到
3.生成DH验证文件
[root@openvpn 2.0]# ./build-dh
注：生成diffie hellman参数用于增强openvpn安全性生成需要漫长等待让服务器飞一会。
配置openvpn server文件
[root@openvpn openvpn]# grep -vE '^$|^;|^#' server.conf
local 101.200.81.189
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 10.160.0.0 255.240.0.0"
duplicate-cn
keepalive 10 120
tls-auth ta.key 0 # This file is secret
cipher AES-256-CBC
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
verb 3
explicit-exit-notify 1
启动并设置开启自动启动openvpn服务
[root@openvpn openvpn]# systemctl start openvpn@server 启动服务
[root@openvpn openvpn]# systemctl enable openvpn@server 开机启动