Llinux OpenVPN安装

浏览数：33 / 时间：2015年06月20日

原理概述

OpenVpn的技术核心是虚拟网卡，其次是SSL协议实现这里重点对虚拟网卡及其在OpenVpn的中的工作机理进行介绍：

虚拟网卡是使用网络底层编程技术实现的一个驱动软件，安装后在主机上多出现一个网卡，可以像其它网卡一样进行配置。服务程序可以在应用层打开虚拟网卡，如果应用软件（如IE）向虚拟网卡发送数据，则服务程序可以读取到该数据，如果服务程序写合适的数据到虚拟网卡，应用软件也可以接收得到。虚拟网卡在很多的操作系统下都有相应的实现，这也是OpenVpn能够跨平台一个很重要的理由。

在OpenVpn中，如果用户访问一个远程的虚拟地址（属于虚拟网卡配用的地址系列，区别于真实地址），则操作系统会通过路由机制将数据包（TUN模式）或数据帧（TAP模式）发送到虚拟网卡上，服务程序接收该数据并进行相应的处理后，通过 SOCKET从外网上发送出去，远程服务程序通过SOCKET从外网上接收数据，并进行相应的处理后，发送给虚拟网卡，则应用软件可以接收到，完成了一个单向传输的过程，反之亦然。

安装环境描述

本安装过程在本地VM Ware虚拟机上进行。

Name	OS	IP	Type
node1	RHEL5.3	192.168.132.101	server
node2	RHEL5.3	192.168.132.102	client
PC	Windows 7	192.168.132.1	client

安装过程

Linux 系统kernel 需要支持 tun 设备, 需要加载 iptables 模块。

安装前需要检查 tun 是否安装（默认RHEL5.3是安装的）:
代码:

[root@node1 ~]#modinfo tun

filename: /lib/modules/2.6.18-128.el5/kernel/drivers/net/tun.ko

alias: char-major-10-200

license: GPL

description: Universal TUN/TAP device driver

srcversion: 2900E7452AC08E0F4F0B7B8

depends:

vermagic: 2.6.18-128.el5 SMP mod_unload 686REGPARM 4KSTACKS gcc-4.1

module_sig: 883f35049492fa531b497468cdd12cf11282cc09f73e2959263978972085b5f0e095465f98d5ed00a0a7fdda22567f18978160a3795fc70d2b73234

OpenVPN如果需要启用 SSL 连接，则需要先安装 OpenSSL。

代码：

[root@node1 ~]# rpm -qa | grep ssl

openssl-0.9.8e-7.el5

[root@node1 ~]# yum install openssl-devel

本实验安装的 OpenVPN 的版本:2.2.1 现在最新版本是2.2.2，可在http://openvpn.net上下载。

服务器的安装

1. 通过SecureCRT或者XShell等登录到服务器，上传LZO和OpenVPN，LZO用于数据压缩，如果不想安装，可以在安装的过程中禁用LZO

代码：

[root@node1 ~]# ls

lzo-2.06.tar.gz openvpn-2.2.1.tar.gz

2. 解压并安装lzo

代码：

[root@node1 ~]# tar zxf lzo-2.06.tar.gz

[root@node1 ~]# cd lzo-2.06

[root@node1 lzo-2.06]# ./configure

[root@node1 lzo-2.06]# make && makeinstall

3. 解压并安装OpenVPN

代码：

[root@node1 ~]# tar zxf openvpn-2.2.1.tar.gz

[root@node1 ~]# cd openvpn-2.2.1

[root@node1 openvpn-2.2.1]# ./configure&& make && make install

4. 生成证书Key

没有报错信息说明安装成功，下一步才做就是配置OpenVPN服务器

初始化PKI

[root@node1 openvpn-2.2.1]# mkdir/etc/openvpn

[root@node1 openvpn-2.2.1]# cp -reasy-rsa/2.0/ /etc/openvpn/easy-rsa

[root@node1 openvpn-2.2.1]# cd/etc/openvpn/easy-rsa/

[root@node1 easy-rsa]# vi vars

将最下面的部分按照需要自己更改一下，之上的部分一般不用理会，如下所示：

export KEY_COUNTRY="CN"

export KEY_PROVINCE="BJ"

export KEY_CITY="Beijing"

export KEY_ORG="gyyx"

export KEY_EMAIL="[email protected]"

export KEY_EMAIL=[email protected]

export KEY_CN=gyyx

export KEY_NAME=gyyx

export KEY_OU=gyyx

export PKCS11_MODULE_PATH=gyyx

export PKCS11_PIN=1q2w3e4r

当然，也可以自己手动export变量，用vars的好处就是不用每次手动export

#Build ca

执行一下命令，一路回车即可

代码：

[root@node1easy-rsa]# . ./vars

NOTE: Ifyou run ./clean-all, I will be doing a rm -rf on /etc/openvpn/easy-rsa/keys

[root@node1easy-rsa]# ./clean-all #只有在第一次生成证书的时候才需要执行

[root@node1easy-rsa]# ./build-ca

Generatinga 1024 bit RSA private key

.............................................++++++

...++++++

writing newprivate key to ‘ca.key‘

-----

You areabout to be asked to enter information that will be incorporated

into yourcertificate request.

What youare about to enter is what is called a Distinguished Name or a DN.

There arequite a few fields but you can leave some blank

For somefields there will be a default value,

If youenter ‘.‘, the field will be left blank.

-----

CountryName (2 letter code) [CN]:

State orProvince Name (full name) [BJ]:

LocalityName (eg, city) [Beijing]:

OrganizationName (eg, company) [gyyx]:

OrganizationalUnit Name (eg, section) [gyyx]:

Common Name(eg, your name or your server‘s hostname) [gyyx]:

Name[gyyx]:

EmailAddress [[email protected]]:

#生成 Diffie Hellman 参数

代码：

[root@node1 easy-rsa]# ./build-dh

Generating DH parameters, 1024 bitlong safe prime, generator 2

This is going to take a long time

...............................................................+.........................................................................................................................................+..+.......+...............+......+.++*++*++*

#建立 server key

几乎也是一路回车，但是最后要两次确认，一定要输入y

代码：

[root@node1easy-rsa]# ./build-key-server server

Generating a 1024bit RSA private key

..........++++++

...............................++++++

writing newprivate key to ‘server.key‘

-----

You are about tobe asked to enter information that will be incorporated

into yourcertificate request.

What you areabout to enter is what is called a Distinguished Name or a DN.

There are quite afew fields but you can leave some blank

For some fieldsthere will be a default value,

If you enter ‘.‘,the field will be left blank.

-----

Country Name (2letter code) [CN]:

State or ProvinceName (full name) [BJ]:

Locality Name(eg, city) [Beijing]:

Organization Name(eg, company) [gyyx]:

OrganizationalUnit Name (eg, section) [gyyx]:

Common Name (eg,your name or your server‘s hostname) [server]:

Name [gyyx]:

Email Address[[email protected]]:

Please enter thefollowing ‘extra‘ attributes

to be sent withyour certificate request

A challengepassword []:

An optionalcompany name []:

Usingconfiguration from /etc/openvpn/easy-rsa/openssl-0.9.8.cnf

Check that therequest matches the signature

Signature ok

The Subject‘sDistinguished Name is as follows

countryName :PRINTABLE:‘CN‘

stateOrProvinceName :PRINTABLE:‘BJ‘

localityName :PRINTABLE:‘Beijing‘

organizationName :PRINTABLE:‘gyyx‘

organizationalUnitName:PRINTABLE:‘gyyx‘

commonName :PRINTABLE:‘server‘

name :PRINTABLE:‘gyyx‘

emailAddress :IA5STRING:‘[email protected]‘

Certificate is tobe certified until Jan 7 06:51:48 2022GMT (3650 days)

Sign thecertificate? [y/n]:y

1 out of 1 certificaterequests certified, commit? [y/n]y

Write outdatabase with 1 new entries

Data Base Updated

#生成客户端 key

与上生成服务端key的方式类似

代码：

[root@node1 easy-rsa]#./build-key client1

Generating a 1024 bit RSAprivate key

......................................................................++++++

...........++++++

writing new private keyto ‘client1.key‘

-----

You are about to be askedto enter information that will be incorporated

into your certificaterequest.

What you are about toenter is what is called a Distinguished Name or a DN.

There are quite a fewfields but you can leave some blank

For some fields therewill be a default value,

If you enter ‘.‘, thefield will be left blank.

-----

Country Name (2 lettercode) [CN]:

State or Province Name(full name) [BJ]:

Locality Name (eg, city)[Beijing]:

Organization Name (eg,company) [gyyx]:

Organizational Unit Name(eg, section) [gyyx]:

Common Name (eg, yourname or your server‘s hostname) [client1]:

Name [gyyx]:

Email Address[[email protected]]:

Please enter the following‘extra‘ attributes

to be sent with yourcertificate request

A challenge password []:

An optional company name[]:

Using configuration from/etc/openvpn/easy-rsa/openssl-0.9.8.cnf

Check that the requestmatches the signature

Signature ok

The Subject‘s DistinguishedName is as follows

countryName :PRINTABLE:‘CN‘

stateOrProvinceName :PRINTABLE:‘BJ‘

localityName :PRINTABLE:‘Beijing‘

organizationName :PRINTABLE:‘gyyx‘

organizationalUnitName:PRINTABLE:‘gyyx‘

commonName :PRINTABLE:‘client1‘

name :PRINTABLE:‘gyyx‘

emailAddress :IA5STRING:‘[email protected]‘

Certificate is to becertified until Jan 7 06:53:12 2022 GMT(3650 days)

Sign the certificate?[y/n]:y

1 out of 1 certificaterequests certified, commit? [y/n]y

Write out database with 1new entries

Data Base Updated

如果要生成其他客户端，如法炮制，但名字不可重复

代码：

[root@node1 easy-rsa]#./build-key client2

[root@node1 easy-rsa]#./build-key client3

可以看到keys目录下生成的证书和keys，将ca.crt、dh1024.pem、server.crt、server.key复制到/etc/openvpn

[root@node1 easy-rsa]# ls keys/

01.pem 02.pem ca.crt ca.key client1.crt client1.csr client1.key dh1024.pem index.txt index.txt.attr index.txt.attr.old index.txt.old serial serial.old server.crt server.csr server.key

[root@node1 easy-rsa]# cd keys/

[root@node1 keys]# cp ca.crt dh1024.pem server.crt server.key/etc/openvpn/

[root@node1 keys]# cd ../..

[root@node1 openvpn]# ls

ca.crt dh1024.pem easy-rsa server.crt server.key

[root@node1 openvpn]# vi server.conf

server.conf 内容如下所示

代码：

local192.168.132.101

port 1194

proto udp

dev tun

ca ca.crt

cert server.crt

keyserver.key

dh dh1024.pem

server 10.8.0.0255.255.255.0

keepalive 10 120

comp-lzo

persist-key

persist-tun

log openvpn.log

log-append openvpn.log

status openvpn-status.log

verb 3

客户端的安装

1 Linux客户端的配置

客户端同样是RHEL5.3，安装方式同上面服务端的安装方法一样，只是配置文件和证书、key不一样而已，将node1的ca.crt client1.crt client1.key拷贝到node2的/etc/openvpn目录

下面是node2的操作：

[root@node2 openvpn]# cd

[root@node2 ~]# cd/etc/openvpn/

[root@node2 openvpn]# ls

ca.crt client1.crt client1.key client.conf

然后编辑配置文件：

[root@node2 openvpn]# viclient.conf

client

dev tun

proto udp

remote 192.168.132.1011194

resolv-retry infinite

nobind

user nobody

group nobody

persist-key

persist-tun

ca ca.crt

cert client1.crt

key client1.key

comp-lzo

verb 3

keepalive 10 120

2 Windows客户端的配置

Windows客户端需要到官网下载Windows版本，双击安装，允许安装TAP设备。配置方式是一样的，同样需要ca.crt client1.crt client1.key三个文件，然后拷贝到OpenVPN的安装目录下的config下即可，比如我的OpenVPN装在D盘的Program配置文件的写法和Linux客户端一样，只是名字改为client.ovpn即可，如下图所示：