安装openvpn和easyrsa
sudo apt install openvpn easy-rsa
创建openpn-ca目录和复制程序文件
mkdir openvpn-ca
ln -s /usr/share/easy-rsa/easyrsa ./
ln -s /usr/share/easy-rsa/x509-types ./
cp /usr/share/easy-rsa/openssl-easyrsa.cnf ./
cp /usr/share/easy-rsa/vars.example vars
添加配置到vars文件
set_var EASYRSA_REQ_COUNTRY “US”
set_var EASYRSA_REQ_PROVINCE “CA”
set_var EASYRSA_REQ_CITY “SanFrancisco”
set_var EASYRSA_REQ_ORG “Code Order”
set_var EASYRSA_REQ_EMAIL “[email protected]”
set_var EASYRSA_REQ_OU “Code Order Unit”
创建用来存储证书、密钥和相关文件的pki目录
./easyrsa init-pki
生成根证书和密钥
./easyrsa build-ca nopass
生成服务器证书和密钥
./easyrsa gen-req server nopass
签署服务器证书
./easyrsa sign server server
生成客户端的证书和密钥
./easyrsa gen-req redmibookpro15 nopass
签署客户端证书
./easyrsa sign client redmibookpro15
生成Diffie-Hellman参数以加强OpenVPN的安全性
./easyrsa gen-dh
生成用于加密控制通道的TLS密钥
openvpn --genkey secret ta.key
服务端配置文件
cat server.conf port 48385 proto udp dev tun ca ca.crt cert server.crt key server.key dh dh.pem auth SHA256 tls-auth ta.key 0 key-direction 0 server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt #push "redirect-gateway def1 bypass-dhcp" #push "dhcp-option DNS 8.8.8.8" #push "dhcp-option DNS 8.8.4.4" keepalive 10 120 cipher AES-256-CBC user nobody group nogroup persist-key persist-tun status openvpn-status.log verb 3 explicit-exit-notify 1 client-to-client