基于linux操作系统架构openvpn总结

Organizational Unit Name (eg, section) []:

Common Name (eg, your name or your server's hostname) []:hbrouteserver 输入主机名或随便一个名字

Email Address [me@myhost.mydomain]:

Please enter the following 'extra' attributes

to be sent with your certificate request

A challenge password []:

An optional company name []:

Sign the certificate? [y/n]:y 输入y

1 out of 1 certificate requests certified, commit? [y/n]y 输入y

Write out database with 1 new entries

Data Base Updated

其它的按回车。

4.5.1.3 创建3个client端cert和key文件

与创建server端的非常相似.

./build-key gz

./build-key hb

./build-key hz

注意gz、hb和hz不能一样，否则两个相同名字的client只能有一个能连接进来。

如果想使用带密码的client key，可以使用build-key-pass脚本。

如建立广州的：

代码:

./build-key gz

Country Name (2 letter code) [KG]:

State or Province Name (full name) [NA]:

Locality Name (eg, city) [BISHKEK]:

Organization Name (eg, company) [OpenVPN-TEST]:mycorp

Organizational Unit Name (eg, section) []:

Common Name (eg, your name or your server's hostname) []:gz 键入"gz"

Email Address [me@myhost.mydomain]:

Certificate is to be certified until Mar 14 08:15:16 2015 GMT (3650 days)

Sign the certificate? [y/n]:y 键入“y”

1 out of 1 certificate requests certified, commit? [y/n]y 键入“y”

Write out database with 1 new entries

Data Base Updated

4.5.1.4 建立 Diffie Hellman文件

Diffie Hellman参数必须要在openvpn server中使用。

./build-dh

4.5.1.5 所有文件的列表及使用的主机

代码:

Filename Needed By Purpose Secret

ca.crt server + all clients Root CA certificate NO

ca.key key signing machine only Root CA key YES

Dh{n}.pem server only Diffie Hellman parameters NO

server.crt server only Server Certificate NO

server.key server only Server Key YES

gz.crt 广州 only gz Certificate NO

Gz.key 广州 only gz Key YES

hcrt 河北 only hb Certificate NO

hb.key 河北 only hb Key YES

hz.crt 杭州 only hz Certificate NO

hz.key 杭州 only hz Key YES

根据上表，把所有的文件拷贝到需要这些文件的主机上。

4.5.2 OpenVPN Server端的配置

刚安装完openvpn的时候，/opt/openvpn目录下只有sbin和man两个文件夹，为方便起见，我们可以在该目录下建立其它的文件夹。

代码:

目录名 作用

Sbin 放置openvpn的主程序“openvpn”

Conf 放置配置文件

Ccd 放置各client的独立配置文件

Log 放置server的日志文件

Keys 放置认证文件

Man 放置man文档

配置文件：./conf/server.conf

代码:

port 1194

proto udp

dev tun

ca /opt/openvpn/keys/ca.crt

cert /opt/openvpn/keys/server.crt

key /opt/openvpn/keys/server.key

dh /opt/openvpn/keys/dh1024.pem

server 10.99.0.0 255.255.255.0

ifconfig-pool-persist /opt/openvpn/log/ipp.txt

client-config-dir ccd

route 10.1.0.0 255.255.0.0

route 10.2.0.0 255.255.0.0

route 10.3.0 255.255.0.0

push "route 10.10.0 255.255.0.0"

push "route 10.2.0.0 255.255.0.0"

push "route 10.3.0.0 255.255.0.0"

client-to-client