Erik's Blog

OpenVPN

(更新于 )VPN#OpenVPN

OpenVPN是一个用于创建虚拟专用网络加密通道的软件包，最早由James Yonan编写，源码托管在github上。 OpenVPN 十分强大，它允许创建的VPN使用公开密钥、电子证书、或者用户名／密码来进行身份验证，能在Solaris、Linux、OpenBSD、FreeBSD、NetBSD、Mac OS X与Microsoft Windows以及Android和iOS上运行。 详细介绍可以查看维基百科。 本文主要介绍 OpenVPN 在Linux下的安装和配置，以及各平台下的使用。

Ubuntu Linux 环境下的安装

以下为 OpenVPN 在 Ubuntu 14.04 中的安装和环境配置

安装 OpenVPN

打开shell，输入以下命令：

# update Ubuntu's repository lists
apt-get update

# install OpenVPN and Easy-RSA
apt-get install openvpn easy-rsa

# incorporate the example VPN server configuration file into our setup
gunzip -c /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz > /etc/openvpn/server.conf

# edit server.conf
vim /etc/openvpn/server.conf

找到如下片段：

# Diffie hellman parameters.
# Generate your own with:
#   openssl dhparam -out dh1024.pem 1024
# Substitute 2048 for 1024 if you are using
# 2048 bit keys.
dh dh1024.pem
# If enabled, this directive will configure
# all clients to redirect their default
# network gateway through the VPN, causing
# all IP traffic such as web browsing and
# and DNS lookups to go through the VPN
# (The OpenVPN server machine may need to NAT
# or bridge the TUN/TAP interface to the internet
# in order for this to work properly).
;push "redirect-gateway def1 bypass-dhcp"
# Certain Windows-specific network settings
# can be pushed to clients, such as DNS
# or WINS server addresses.  CAVEAT:
# http://openvpn.net/faq.html#dhcpcaveats
# The addresses below refer to the public
# DNS servers provided by opendns.com.
;push "dhcp-option DNS 208.67.222.222"
;push "dhcp-option DNS 208.67.220.220"
# You can uncomment this out on
# non-Windows systems.
;user nobody
;group nogroup

修改 dh1024.pem 成

dh2048.pem

去掉以下行的注释

push "redirect-gateway def1 bypass-dhcp"

push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"

包转发

启用包转发

echo 1 > /proc/sys/net/ipv4/ip_forward

修改sysctl.conf

vim /etc/sysctl.conf

找到

# Uncomment the next line to enable packet forwarding for IPv4
#net.ipv4.ip_forward=1

去掉 net.ipv4.ip_forward 的注释

net.ipv4.ip_forward=1

配置 Uncomplicated Firewall (ufw)

允许ssh，允许1194端口的udp

ufw allow ssh
ufw allow 1194/udp
vim /etc/default/ufw

修改

DEFAULT_FORWARD_POLICY="DROP"

成

DEFAULT_FORWARD_POLICY="ACCEPT"

add additional ufw rules for network address translation and IP masquerading of connected clients.

添加如下信息到/etc/ufw/before.rules

# START OPENVPN RULES
# NAT table rules
*nat
:POSTROUTING ACCEPT [0:0]
# Allow traffic from OpenVPN client to eth0
-A POSTROUTING -s 10.8.0.0/8 -o eth0 -j MASQUERADE
COMMIT
# END OPENVPN RULES

使之如下：

#
# rules.before
#
# Rules that should be run before the ufw command line added rules. Custom
# rules should be added to one of these chains:
#   ufw-before-input
#   ufw-before-output
#   ufw-before-forward
#

# START OPENVPN RULES
# NAT table rules
*nat
:POSTROUTING ACCEPT [0:0]
# Allow traffic from OpenVPN client to eth0
-A POSTROUTING -s 10.8.0.0/8 -o eth0 -j MASQUERADE
COMMIT
# END OPENVPN RULES

# Don't delete these required lines, otherwise there will be errors
*filter

开启ufw，查看状态

ufw enable
ufw status

证书密钥的生成

OpenVPN使用证书来加密流量。

配置和生成证书颁发机构

#copy Easy RSA's scripts
cp -r /usr/share/easy-rsa/ /etc/openvpn

#make the key storage directory
mkdir /etc/openvpn/easy-rsa/keys

#edit variables file
vim /etc/openvpn/easy-rsa/vars

修改如下变量

export KEY_COUNTRY="US"
export KEY_PROVINCE="TX"
export KEY_CITY="Dallas"
export KEY_ORG="My Company Name"
export KEY_EMAIL="sammy@example.com"
export KEY_OU="MYOrganizationalUnit"

export KEY_NAME="server"

生成 Diffie-Hellman 变量

openssl dhparam -out /etc/openvpn/dh2048.pem 2048

通过调用一个互动的OpenSSL命令建立认证中心（CA）

cd /etc/openvpn/easy-rsa
. ./vars
./clean-all
./build-ca

生成服务器的证书和密钥

生成build-key-server，按 Enter 键和 y 继续

cd /etc/openvpn/easy-rsa

#build the server's key
./build-key-server server

启用OpenVPN

将上一部生成的文件移动到/etc/openvpn

#move the Server Certificates and Keys
cp /etc/openvpn/easy-rsa/keys/{server.crt,server.key,ca.crt} /etc/openvpn

启动OpenVPN 并查看运行状态

service openvpn start
service openvpn status

生成的客户端证书和密钥

Key and Certificate Building

执行以下命令生成客户端证书和密钥

cd /etc/openvpn/easy-rsa.

./build-key ClientName

cp /usr/share/doc/openvpn/examples/sample-config-files/client.conf /etc/openvpn/easy-rsa/keys/client.ovpn

Transferring Certificates and Keys to Client Devices

上个步骤生成的文件存在于/etc/openvpn/easy-rsa/keys目录中。 下载所需文件

/etc/openvpn/easy-rsa/keys/ClientName.crt
/etc/openvpn/easy-rsa/keys/ClientName.key
/etc/openvpn/easy-rsa/keys/client.ovpn
/etc/openvpn/ca.crt
scp root@your-server-ip:/etc/openvpn/easy-rsa/keys/client1.key Downloads/

创建统一的OpenVPN客户端设备配置文件

复制 client.ovpn 文件到 ClientName.ovpn 修改以下部分

# The hostname/IP and port of the server.
# You can have multiple remote entries
# to load balance between the servers.
remote my-server-1 1194
# Downgrade privileges after initialization (non-Windows only)
user nobody
group nogroup
# SSL/TLS parms.
# . . .
#ca ca.crt
#cert client.crt
#key client.key

添加内容

<ca>
(insert ca.crt here)
</ca>
<cert>
(insert client1.crt here)
</cert>
<key>
(insert client1.key here)
</key>

final

<ca>
-----BEGIN CERTIFICATE-----
. . .
-----END CERTIFICATE-----
</ca>

<cert>
Certificate:
. . .
-----END CERTIFICATE-----
. . .
-----END CERTIFICATE-----
</cert>

<key>
-----BEGIN PRIVATE KEY-----
. . .
-----END PRIVATE KEY-----
</key>

测试 打开 DNSLeakTest