The script to install openvpn (by quqi99)

1345人阅读 评论(0) 收藏 举报
分类:

作者:张华  发表于:2016-07-29
版权声明:可以任意转载,转载时请务必以超链接形式标明文章原始出处和作者信息及本版权声明

http://blog.csdn.net/quqi99 )

安装Server

#!/usr/bin/env bash

set -o xtrace
sudo apt-get -y install easy-rsa openssl
#Using easy-rsa to generate KEY and certificate
sudo cp -r /usr/share/easy-rsa/ /etc/openvpn
cd /etc/openvpn/easy-rsa
sudo chown -R `whoami`:root /etc/openvpn
mkdir -p /etc/openvpn/easy-rsa/keys
if [ ! -f "/etc/openvpn/easy-rsa/keys/ca.key" ]; then     
  source ./vars
  export KEY_COUNTRY=CN
  export KEY_PROVINCE=BJ
  export KEY_CITY=BJ
  export KEY_ORG=sts
  export KEY_OU=sts
  export KEY_NAME=sts
  export KEY_EMAIL=root@sts
  export KEY_NAME="server"
  ./clean-all
  ./build-ca
  ./build-key-server server
fi
cp /etc/openvpn/easy-rsa/keys/{server.crt,server.key,ca.crt} /etc/openvpn
openssl dhparam -out /etc/openvpn/dh2048.pem 2048

#Generate server configuration
#gunzip -c /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz > /etc/openvpn/server.conf
sudo bash -c 'cat > /etc/openvpn/server.conf' <<EOF
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key  # This file should be kept secret
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
;push "route 192.168.10.0 255.255.255.0"
push "redirect-gateway def1 bypass-dhcp"
;push "dhcp-option DNS 8.8.8.8"
;push "dhcp-option DNS 8.8.4.4"
keepalive 10 120
reneg-sec 0
;openssl dhparam -out /etc/openvpn/dh2048.pem 2048
dh dh2048.pem
;sudo openvpn --genkey --secret ta.key
tls-auth ta.key 0 # This file is secret
;Static Key
;secret /etc/openvpn/ta.key
;cipher BF-CBC        # Blowfish (default)
;cipher AES-128-CBC   # AES
;cipher DES-EDE3-CBC  # Triple-DES
comp-lzo
max-clients 100
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
;log         openvpn.log
;log-append  openvpn.log
verb 3
EOF

#Network Set up
sudo ufw diable
sudo iptables -A INPUT -p tcp -m state --state NEW --dport 1194 -j ACCEPT  
sudo iptables -A INPUT -p udp -m state --state NEW --dport 1194 -j ACCEPT  
sudo iptables -A FORWARD -j ACCEPT  
sudo iptables -t nat -A POSTROUTING -j MASQUERADE  
sudo sed -i '/net.ipv4.ip_forward/ s/.∗=.*/\11/' /etc/sysctl.conf  
sudo sysctl -p  
sudo sysctl -w net.ipv4.ip_forward=1 

#Start VPN Server
sudo /etc/init.d/openvpn restart
#sudo openvpn --config /etc/openvpn/server.conf


重要参数

1, tls-timeout=4 , 因为默认的默认的UDP超时时间是30秒,但是实际测试中发现无论在server配置tls-timeout为任何值均极易引发错误”TLS Error: TLS key negotiation failed to occur within 60 seconds“, 所以没敢tls-timeout值。但是修改了: sudo sysctl -w net.netfilter.nf_conntrack_udp_timeout=60
The tls-timeout specifies how many seconds elapse between retransmission of
packets if no response is recieved from the server. The default timeout is 2
seconds. You can change this timeout to some other value, but the client will
continue to attempt connections for 1 minute regardless of how the tls-timeout
interval is set.

2, "keepalive 10 120", 它相当于“ping 10,ping-restart 120", openvpn构建在udp之上,每隔120秒的时间窗服务端收不到客户端的数据将触发Timer重传。原来默认的60秒可能由于网络环境丢包频繁超时重发降低性能(10/60=16.7%的丢包率)。

3, enable HMAC, ta.key是一个公钥,能对tls数据进行摘要,当验证发现被篡改后能及时丢弃及时重传
#VPN Server端
;sudo openvpn --genkey --secret ta.key
tls-auth ta.key 0 # This file is secret

#VPN Client端
tls-auth ta.key 1

但现在报错: TLS Error: cannot locate HMAC in incoming packet from [AF_INET]123.14.249.122:29758


4, 用下列规则发现被篡改后的tls包及时丢弃及时重传(未测试)
sudo iptables iptables -I FORWARD -p tcp -s <vpn-ip>  --sport 1194 --tcp-flags RST RST -m state --state RELATED,ESTABLISHED -j DROP

5, 如使用用户名和密码登录的话,服务端加上如下配置,客户端加(auth-user-pass pass.txt)
# Username and Password authentication.
# sudo apt-get install libpam0g-dev liblzo2-dev  
client-cert-not-required
username-as-common-name
plugin /usr/share/openvpn/plugin/lib/openvpn-auth-pam.so login

useradd vpn -M -s /sbin/nologin
passwd vpn

客户端设置

#VPN Client
#It's ideal for each client connecting to the VPN to have its own unique certificate and key.
#This is preferable to generating one general certificate and key to use among all client devices.
cd /etc/openvpn/easy-rsa && ./build-key client1
#cp /usr/share/doc/openvpn/examples/sample-config-files/client.conf /etc/openvpn/easy-rsa/keys/client.ovpn
#scp ubuntu@<server>:/etc/openvpn/easy-rsa/keys/client1.crt /etc/openvpn/
#scp ubuntu@<server>:/etc/openvpn/easy-rsa/keys/client1.key /etc/openvpn/
#scp ubuntu@<server>:/etc/openvpn/easy-rsa/keys/client.ovpn /etc/openvpn/
#scp ubuntu@<server>:/etc/openvpn/easy-rsa/keys/ca.crt /etc/openvpn/
#scp ubuntu@<server>:/etc/openvpn/ta.key /etc/openvpn/
#Generate client configuration
sudo bash -c 'cat > /etc/openvpn/client.ovpn' <<EOF
client
dev tun
proto udp
remote <vpn-server> 1194
;remote my-server-2 1194
;remote-random
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
ca ca.crt
cert client1.crt
key client1.key
ns-cert-type server
tls-auth ta.key 1
comp-lzo
verb 3
redirect-gateway def1
tun-mtu 1500
mssfix 1420
;Static Key
;secret /etc/openvpn/ta.key
EOF
#Start VPN Client
sudo openvpn --config /etc/openvpn/client.ovpn



0
0

查看评论
* 以上用户言论只代表其个人观点,不代表CSDN网站的观点或立场
    个人资料
    • 访问:1407453次
    • 积分:16298
    • 等级:
    • 排名:第659名
    • 原创:300篇
    • 转载:10篇
    • 译文:0篇
    • 评论:299条