-
安裝 EPEL 套件:
#yum install epel-release
-
安裝 OpenVPN 以及快速加密套件:
#yum install -y openvpn easy-rsa
-
利用 OpenVPN 範例檔,加快設定速度:
#cp /usr/share/doc/openvpn-*/sample/sample-config-files/server.conf /etc/openvpn
-
開啟 /etc/openvpn/server.conf, 修改以下設定::
#vim /etc/openvpn/server.conf ### 修改 "dh" 設定: dh dh2048.pem ### 找到 "redirect-gateway def1 bypass-dhcp" 並將它解註解: push "redirect-gateway def1 bypass-dhcp" ### 修改 DNS 伺服器設定: push "dhcp-option DNS 8.8.8.8" push "dhcp-option DNS 8.8.4.4" ### 修改 "user" 及 "group" 設定: user nobody group nobody ### 註解 tls 認證功能 #### #tls-auth ta.key 0 ### 開啟標頭壓縮功能 #### comp-lzo
-
建立 Easy RSA 設定檔目錄、及建立相關設定檔:
# mkdir -p /etc/openvpn/easy-rsa/keys # cp -rf /usr/share/easy-rsa/2.0/* /etc/openvpn/easy-rsa # cp /etc/openvpn/easy-rsa/openssl-1.0.0.cnf /etc/openvpn/easy-rsa/openssl.cnf
-
修改 /etc/openvpn/easy-rsa/vars 設定值:
#vim /etc/openvpn/easy-rsa/vars export KEY_COUNTRY=TW export KEY_PROVINCE=Taiwan export KEY_CITY=Kaohsiung export KEY_ORG="Happy Heaven" export KEY_EMAIL="test@gmail.com" export KEY_CN="" export KEY_NAME=""
-
用 Easy RSA 產生金鑰:
# cd /etc/openvpn/easy-rsa # source ./vars # ./clean-all # ./build-ca # ./build-key-server server # ./build-dh
-
將金鑰複製到 OpenVPN 目錄:
#cd /etc/openvpn/easy-rsa/keys #cp dh2048.pem ca.crt server.crt server.key /etc/openvpn
-
在 OpenVPN Server 產生 Client 端的認證金鑰:
# cd /etc/openvpn/easy-rsa # ./build-key client
-
設定防火牆:
#firewall-cmd --permanent --add-service=openvpn #firewall-cmd --permanent --add-masquerade #firewall-cmd --reload
-
編修 /etc/sysctl.conf:
#vim /etc/sysctl.conf net.ipv4.ip_forward = 1
-
重新導入 /etc/sysctl.conf:
# sysctl -p
-
啟動 OpenVPN:
#systemctl restart NetworkManager #systemctl -f enable openvpn@server #systemctl start openvpn@server
※補充建議:
- 請事先安裝好 HTTP Server,並且啟動!
-
複製下列三個檔案到 /var/www/html/keys 目錄下:
#mkdir /var/www/html/keys #cp /etc/openvpn/easy-rsa/keys/ca.crt /etc/openvpn/easy-rsa/keys/client.crt /etc/openvpn/easy-rsa/keys/client.key /var/www/html/keys
-
編修 client.ovpn 檔案:
#vim /var/www/html/keys/client.ovpn client dev tun proto udp remote your_server_ip 1194 resolv-retry infinite nobind persist-key persist-tun comp-lzo verb 3 ca /opt/keys/ca.crt cert /opt/keys/client.crt key /opt/keys/client.key
-
修正檔案權限設定:
#cd /var/www/html/keys #chown apache.apache * #restoreconf -R /var/www/html
Client 端快速設定流程:
傋註:以 Linux 作業系統為例!
-
下載 Server 端上的四個檔案:
#mkdir /opt/keys #cd /opt/keys #wget http://192.168.5.244/keys/client.crt #wget http://192.168.5.244/keys/ca.crt #wget http://192.168.5.244/keys/client.key #wget http://192.168.5.244/keys/client.ovpn ##restoreconf -R /opt/keys
-
安裝 OpenVPN :
#yum install -y openvpn
-
連線 OpenVPN :
#openvpn –config /path/to/client.ovpn
-
補充說明 client.ovpn 放入 key 值的設定 :
#vim client.ovpn 在檔案最下方,刪去 ca、cert、key 三行設定! 接下來,加入下列設定.... <ca> (把 ca.crt 檔案內容完整複製過來...) </ca> <key> (把 client.key 檔案內容完整複製過來...) </key> <cert> (把 client.crt 檔案內容完整複製過來...) </cert>
參考文獻:
- http://www.phpini.com/linux/centos-7-install-openvpn-server
- http://www.tecmint.com/setup-openvpn-server-with-linux-and-windows-clients-in-centos-rhel/
- http://dreamtails.pixnet.net/blog/post/30797812-centos-7-install-openvpn