准备工作
# 关闭防火墙
[root@localhost ~]#?systemctl stop firewalld
[root@localhost ~]# systemctl disable firewalld
# 关闭selinux
[root@localhost ~]#?sed -i 's/enforcing/disabled/' /etc/selinux/config
[root@localhost ~]#?setenforce 0
————————————————
一、证书制作
1.下载并解压easy-rsa软件包
[root@localhost ~]# yum -y install wget unzip net-tools
[root@localhost ~]# wget -P /root http://down.i4t.com/easy-rsa.zip
[root@localhost ~]# cd /root
[root@localhost ~]# ls
anaconda-ks.cfg ?easy-rsa.zip
[root@localhost ~]# unzip -d ./ easy-rsa.zip
[root@localhost ~]# ls
anaconda-ks.cfg ?easy-rsa-old-master ?easy-rsa.zip
2.制作CA证书之前，需要编辑vars文件，修改相关选项
[root@localhost ~]# cd /root/easy-rsa-old-master/easy-rsa/2.0/
[root@localhost ~]# vi vars
修改后：
3.使环境变量生效
[root@localhost 2.0]# source vars
[root@localhost 2.0]# ./clean-all
4.生成根证书和秘钥（ca.crt，ca.key）
[root@localhost 2.0]# cd /root/easy-rsa-old-master/easy-rsa/2.0/
[root@localhost 2.0]# ./build-ca
[root@localhost 2.0]# ls keys/
5.生成服务证书和秘钥（server.crt，server.key）
[root@localhost 2.0]# ./build-key-server server
6.生成客户端证书和秘钥（client.crt，client.key）
[root@localhost 2.0]# ./build-key client
7.生成秘钥交换文件（dh2048.pem）
[root@localhost 2.0]# ./build-dh
二、配置服务端
1.安装
[root@localhost 2.0]# cd /etc/yum.repos.d/
[root@localhost yum.repos.d]# curl -o epel.repo http://mirrors.aliyun.com/repo/epel-7.repo
[root@localhost yum.repos.d]# yum clean all
[root@localhost yum.repos.d]# yum makecache
[root@localhost yum.repos.d]# yum -y install openvpn
2.配置
[root@localhost yum.repos.d]# cd /etc/openvpn/
[root@localhost openvpn]# mkdir keys
[root@localhost openvpn]# cd /root/easy-rsa-old-master/easy-rsa/2.0/keys/
[root@localhost keys]# cp {ca.crt,server.crt,server.key,dh2048.pem} /etc/openvpn/keys/
[root@localhost keys]# cd /etc/openvpn/
[root@localhost openvpn]# cp /usr/share/doc/openvpn-2.4.12/sample/sample-config-files/server.conf ./
[root@localhost openvpn]# vi server.conf
?server.conf修改后：
?
（说明：push后面的内网网段，有多少写多少个）
3.启用路由转发功能
[root@localhost openvpn]# echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf
[root@localhost openvpn]# sysctl -p
4.建立ta.key文件（拒绝服务攻击证书）
[root@localhost openvpn]# cd /etc/openvpn/keys
[root@localhost keys]# openvpn --genkey --secret ta.key
?
5.启动服务
[root@localhost keys]# cd /etc/openvpn/
[root@localhost openvpn]# openvpn --daemon --config server.conf
[root@localhost openvpn]# netstat -lntup | grep 1194
三、配置客户端
1.客户端配置
[root@localhost openvpn]# cp /usr/share/doc/openvpn-2.4.12/sample/sample-config-files/client.conf /root/
[root@localhost openvpn]# cd /root
[root@localhost ~]# mkdir client
[root@localhost ~]# mv client.conf client
[root@localhost ~]# cd client/
[root@localhost client]# vi client.conf
?client.conf修改后：
（说明：remote 公网地址 1194）
2.客户端证书文件
[root@localhost client]# cp /root/easy-rsa-old-master/easy-rsa/2.0/keys/{client.key,client.crt,ca.crt} /root/client/
[root@localhost client]# cp /etc/openvpn/keys/ta.key /root/client/
?[root@localhost client]# mv client.conf client.ovpn
[root@localhost client]# cd ..
[root@localhost ~]# tar -zcvf client.tar.gz client
四、Windows客户端测试
1.右击管理员安装
2.下载client文件夹下文件到本地config
3.openvpn配置--高级--config和log目录设置
配置iptables的nat功能：
[root@localhost client]# iptables -t nat -A POSTROUTING -s 10.0.1.0/24 -j MASQUERADE
查看：
[root@localhost client]# iptables -t nat -L
五、需要把内网主机，映射到公网，这一步需要路由器或者防火墙有映射功能。
六、如果vpn设置账号密码登录需要进行以下操作
1.修改配置文件server.conf。（添加下列配置）
script‐security 3 #加入script‐security消除以下警告 不是很了解，不加拨号失败
（允许OPenvpn使用用户自动以脚本）
?client‐cert‐not‐required #取消客户端的证书认证 如果双重验证注释掉此行，客户
端配置文件证书路径保留。
username‐as‐common‐name
auth‐user‐pass‐verify /etc/openvpn/checkpsw.sh via‐env #开启用户密码脚本
新增内容：
script-security 3
username-as-common-name
auth-user-pass-verify /usr/local/openvpn/server/checkpsw.sh via-env
找到server.conf
[root@localhost client]# find / -name server.conf
/usr/share/doc/NetworkManager/examples/server.conf
/usr/share/doc/openvpn-2.4.12/sample/sample-config-files/server.conf
/usr/local/openvpn/server/server.conf
[root@localhost client]# cd /usr/local/openvpn/server
2.添加验证脚本，密码文件
[root@localhost server]# vi checkpsw.sh
[root@localhost server]# chmod +x checkpsw.sh
脚本内容：
#!/bin/sh
###########################################################
# checkpsw.sh (C) 2004 Mathias Sundman <mathias@openvpn.se>
#
# This script will authenticate OpenVPN users against
# a plain text file. The passfile should simply contain
# one row per user with the username first followed by
# one or more space(s) or tab(s) and then the password.
PASSFILE="/etc/openvpn/psw-file"
LOG_FILE="/etc/openvpn/openvpn-password.log"
TIME_STAMP=`date "+%Y-%m-%d %T"`
###########################################################
if [ ! -r "${PASSFILE}" ]; then
??echo "${TIME_STAMP}: Could not open password file \"${PASSFILE}\" for reading." >> ${LOG_FILE}
??exit 1
fi
CORRECT_PASSWORD=`awk '!/^;/&&!/^#/&&$1=="'${username}'"{print $2;exit}' ${PASSFILE}`
if [ "${CORRECT_PASSWORD}" = "" ]; then
??echo "${TIME_STAMP}: User does not exist: username=\"${username}\", password=\"${password}\"." >> ${LOG_FILE}
??exit 1
fi
if [ "${password}" = "${CORRECT_PASSWORD}" ]; then
??echo "${TIME_STAMP}: Successful authentication: username=\"${username}\"." >> ${LOG_FILE}
??exit 0
fi
echo "${TIME_STAMP}: Incorrect password: username=\"${username}\", password=\"${password}\"." >> ${LOG_FILE}
exit 1
3.密码验证文件：
[root@localhost server]# vi psw-file
[root@localhost server]# chmod 777 psw-file
密码内容：
#A
#阿里云
aliyun aly123456
4.设置客户端client.ovpn
再添加这一行，添加这行，就会提示输入用户名和密码
auth-nocache
auth-user-pass
完整内容：
client
dev tun
proto udp
resolv-retry infinite
nobind
#remote 192.168.2.69 1194
remote 220.180.229.94 1194
comp-lzo
ca ca.crt
cert client.crt
key client.key
cipher AES-256-CBC
tls-auth ta.key 1
keepalive 10 120
persist-key
persist-tun
verb 3
status client-status.log
log-append client.log
auth-nocache
auth-user-pass