Rocky9.3安装openVPN

一、安装openvpn

1.首先必须启用EPEL 存储库，server和client端都需要

sudo yum update

yum install epel-release

2.安装openvpn，server和client端都需要

sudo yum install -y openvpn easy-rsa

二、创建证书

1.创建CA证书，使用root操作

#到easy-rsa目录
cd /usr/share/easy-rsa/3

#设置easy-rsa初始参数
echo "set_var EASYRSA_ALGO ec" > vars
echo "set_var EASYRSA_DIGEST sha512" >> vars

#初始化
./easyrsa init-pki

#生成server证书
./easyrsa --batch --req-cn="$SERVER" build-ca nopass
./easyrsa --batch build-server-full "$SERVER" nopass

#生成client证书
./easyrsa --batch build-client-full "$CLIENT" nopass

#生成其他
openvpn --genkey tls-auth ta.key
openssl dhparam -out dh2048.pem 2048

#服务端复制
cp pki/ca.crt pki/issued/$SERVER.crt pki/private/$SERVER.key ta.key dh2048.pem  /etc/openvpn/server/

#客户端复制
cp pki/ca.crt pki/issued/$CLIENT.crt pki/private/$CLIENT.key ta.key dh2048.pem /etc/openvpn/client/

三、配置服务端

1.复制默认配置文件

sudo cp /usr/share/doc/openvpn/sample/sample-config-files/server.conf /etc/openvpn/

2.修改server.conf

#把这行的注释去掉，注释为;或#
;topology subnet
topology subnet

4启动openvpn查看

sudo openvpn --config server.conf
#没有报错的话不要关，打开新窗口，是用ifconfig查看，如果有tun0启动成功
ifconfig
#结果
tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1500
        inet 10.8.0.1  netmask 255.255.255.0  destination 10.8.0.1
        inet6 fe80::9655:749:96a2:857d  prefixlen 64  scopeid 0x20<link>
        unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 500  (UNSPEC)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 5  bytes 240 (240.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

5.是用systemctl控制openvpn

#是用systemctl控制openvpn
systemctl start openvpn-server@server.service
#开机启动
systemctl enable openvpn-server@server.service

6.服务器启用端口转发

echo 'net.ipv4.ip_forward=1' >/etc/sysctl.d/99-openvpn.conf
echo 'net.ipv6.conf.all.forwarding=1' >>/etc/sysctl.d/99-openvpn.conf
sysctl --system

#添加路由规则
#!/bin/sh
NIC=eth0
PROTOCOL=tcp
PORT=1194

iptables -t nat -I POSTROUTING 1 -s 10.8.0.0/24 -o $NIC -j MASQUERADE
iptables -I INPUT 1 -i tun0 -j ACCEPT
iptables -I FORWARD 1 -i $NIC -o tun0 -j ACCEPT
iptables -I FORWARD 1 -i tun0 -o $NIC -j ACCEPT
iptables -I INPUT 1 -i $NIC -p $PROTOCOL --dport $PORT -j ACCEPT

#删除路由规则
#!/bin/sh
NIC=eth0
PROTOCOL=tcp
PORT=1194
iptables -t nat -D POSTROUTING -s 10.8.0.0/24 -o $NIC -j MASQUERADE
iptables -D INPUT -i tun0 -j ACCEPT
iptables -D FORWARD -i $NIC -o tun0 -j ACCEPT
iptables -D FORWARD -i tun0 -o $NIC -j ACCEPT
iptables -D INPUT -i $NIC -p $PROTOCOL --dport $PORT -j ACCEPT