| OpenVPN : Configure VPN Server2022/07/21 |
| Install OpenVPN to Configure Virtual Private Network.This example is based on the environment like follows. By settings of OpenVPN Server/Client, [tun] interface will be configured automatically and when connecting with VPN from Client to Server, Client can access to the the local network of the Server.On this example, it needs to set IP Masquerading on Router, too. +———————-+ | [ OpenVPN Server ] |192.168.100.1 | dlp.srv.world +——–+ | |tun | +———–+———-+ | eth0|10.0.0.29 | | | | Local Network | 10.0.0.1| | +——+—–+ | ——-| Router |————-|—– +——+—–+ | | | | Internet | ————–+——————-|—– | | | Local Network | 192.168.0.100| | +———–+———-+ | | |tun | | VPN Client +——–+ | |192.168.100.x +———————-+ |
| [1] | Install OpenVPN. |
| [2] | Create CA and Certificates. |
| [root@dlp ~]# cd /usr/share/easy-rsa/3# initialize [root@dlp 3]# ./easyrsa init-pki init-pki complete; you may now create a CA or requests. Your newly created PKI dir is: /usr/share/easy-rsa/3/pki # create CA [root@dlp 3]# ./easyrsa build-ca Using SSL: openssl OpenSSL 3.0.1 14 Dec 2021 (Library: OpenSSL 3.0.1 14 Dec 2021) # set any pass-phrase Enter New CA Key Passphrase: Re-Enter New CA Key Passphrase: Enter PEM pass phrase: Verifying – Enter PEM pass phrase: —– You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter ‘.’, the field will be left blank. —– Common Name (eg: your user, host, or server name) [Easy-RSA CA]:Server-CA CA creation complete and you may now import and sign cert requests. Your new CA certificate file for publishing is at: /usr/share/easy-rsa/3/pki/ca.crt # create server certificates # any name is OK for [server1] name # (it is set for file name of certs or commonName) [root@dlp 3]# ./easyrsa build-server-full server1 nopass Using SSL: openssl OpenSSL 3.0.1 14 Dec 2021 (Library: OpenSSL 3.0.1 14 Dec 2021) Using configuration from /usr/share/easy-rsa/3/pki/easy-rsa-3233.tTgxXj/tmp.kQNNfp # answer with pass-phrase set on CA Enter pass phrase for /usr/share/easy-rsa/3/pki/private/ca.key: Check that the request matches the signature Signature ok The Subject’s Distinguished Name is as follows commonName :ASN.1 12:’server1′ Certificate is to be certified until Oct 10 06:31:42 2024 GMT (825 days) Write out database with 1 new entries Data Base Updated # create client certificates # any name is OK for [client1] name # (it is set for file name of certs or commonName) [root@dlp 3]# ./easyrsa build-client-full client1 nopass Using SSL: openssl OpenSSL 3.0.1 14 Dec 2021 (Library: OpenSSL 3.0.1 14 Dec 2021) Using configuration from /usr/share/easy-rsa/3/pki/easy-rsa-3312.bpp3lw/tmp.1bkU1Q # answer with pass-phrase set on CA Enter pass phrase for /usr/share/easy-rsa/3/pki/private/ca.key: Check that the request matches the signature Signature ok The Subject’s Distinguished Name is as follows commonName :ASN.1 12:’client1′ Certificate is to be certified until Oct 10 06:33:42 2024 GMT (825 days) Write out database with 1 new entries Data Base Updated # generate Diffie Hellman ( DH ) parameter [root@dlp 3]# ./easyrsa gen-dh Using SSL: openssl OpenSSL 3.0.1 14 Dec 2021 (Library: OpenSSL 3.0.1 14 Dec 2021) Generating DH parameters, 2048 bit long safe prime DH parameters of size 2048 created at /usr/share/easy-rsa/3/pki/dh.pem # create TLS-Auth key[root@dlp 3]# openvpn –genkey secret ./pki/ta.key# copy generated certs [root@dlp 3]# cp -pR /usr/share/easy-rsa/3/pki/{issued,private,ca.crt,dh.pem,ta.key} /etc/openvpn/server/ |
| [3] | Configure OpenVPN. It based on the environment Firewalld is running because of using routing rules. |
| # copy sample configuration[root@dlp ~]# cp /usr/share/doc/openvpn/sample/sample-config-files/server.conf /etc/openvpn/server/[root@dlp ~]# vi /etc/openvpn/server/server.conf# line 32 : change if need (listening port of OpenVPN)port 1194# line 35 : change if need (use udp on this example);proto tcp proto udp# line 53 : change if need (use tun on this example);dev tap dev tun# line 78 : specify certificatesca ca.crtcert issued/server1.crtkey private/server1.key# line 85 : specify DH filedh dh.pem# line 101 : specify network to be used on VPN # any network are OK except your local networkserver 192.168.100.0 255.255.255.0# line 142 : uncomment and change to your local networkpush “route 10.0.0.0 255.255.255.0″# line 231 : keepalive settingskeepalive 10 120# line 244 : specify TLS-Auth keytls-auth ta.key 0# line 281 : enable persist optionspersist-key persist-tun# line 287 : change log pathstatus /var/log/openvpn-status.log# line 296 : change log path log /var/log/openvpn.log log-append /var/log/openvpn.log # line 306 : specify log level (0 – 9, 9 means debug level)verb 3[root@dlp ~]# vi /etc/openvpn/server/add-bridge.sh# create new#!/bin/bash # network interface which can connect to local network IF=enp1s0 # interface VPN tunnel uses # for the case of this example like specifying [tun] on the config, generally this param is [tun0] VPNIF=tun0 # listening port of OpenVPN PORT=1194 firewall-cmd –zone=public –add-masquerade firewall-cmd –direct –add-rule ipv4 filter FORWARD 0 -i ${VPNIF} -o ${IF} -j ACCEPT firewall-cmd –direct –add-rule ipv4 nat POSTROUTING 0 -o ${IF} -j MASQUERADE firewall-cmd –add-port=${PORT}/udp [root@dlp ~]# vi /etc/openvpn/server/remove-bridge.sh# create new#!/bin/bash # network interface which can connect to local network IF=enp1s0 # interface VPN tunnel uses # for the case of this example like specifying [tun] on the config, generally this param is [tun0] VPNIF=tun0 # listening port of OpenVPN PORT=1194 firewall-cmd –zone=public –remove-masquerade firewall-cmd –direct –remove-rule ipv4 filter FORWARD 0 -i ${VPNIF} -o ${IF} -j ACCEPT firewall-cmd –direct –remove-rule ipv4 nat POSTROUTING 0 -o ${IF} -j MASQUERADE firewall-cmd –remove-port=${PORT}/udp [root@dlp ~]# chmod 700 /etc/openvpn/server/{add-bridge.sh,remove-bridge.sh} [root@dlp ~]# systemctl edit openvpn-server@server# create new[Service] ExecStartPost=/etc/openvpn/server/add-bridge.sh ExecStopPost=/etc/openvpn/server/remove-bridge.sh [root@dlp ~]# systemctl enable –now openvpn-server@server |
| [4] | Transfer certs follows you generated to Client Host you’d like to connect with VPN. It’s OK all for VPN Server settings.* /etc/openvpn/server/ca.crt * /etc/openvpn/server/ta.key * /etc/openvpn/server/issued/client1.crt * /etc/openvpn/server/private/client1.key |
正文完
可以使用微信扫码关注公众号（ID：xzluomor）
ufabet
มีเกมให้เลือกเล่นมากมาย: เกมเดิมพันหลากหลาย ครบทุกค่ายดัง
tornado crypto mixer
Discover the power of privacy with TornadoCash! Learn how this decentralized mixer ensures your transactions remain confidential.
ดูบอลสด
Very well presented. Every quote was awesome and thanks for sharing the content. Keep sharing and keep motivating others.
ดูบอลสด
Pretty! This has been a really wonderful post. Many thanks for providing these details.
ดูบอลสด
Pretty! This has been a really wonderful post. Many thanks for providing these details.
ดูบอลสด
Hi there to all, for the reason that I am genuinely keen of reading this website’s post to be updated on a regular basis. It carries pleasant stuff.
Obrazy Sztuka Nowoczesna
Thank you for this wonderful contribution to the topic. Your ability to explain complex ideas simply is admirable.
ufabet
Hi there to all, for the reason that I am genuinely keen of reading this website’s post to be updated on a regular basis. It carries pleasant stuff.
ufabet
Very well presented. Every quote was awesome and thanks for sharing the content. Keep sharing and keep motivating others.
