Open×××服务器的安装与客户端的调试
Open×××所有的通信都基于一个单一的IP端口，默认且推荐使用UDP协议通讯，同时TCP也被支持。Open×××连接能通过大多数的代理服务器，并且能够在NAT的环境中很好地工作。服务端具有向客户端“推送”某些网络配置信息的功能，这些信息包括：IP地址、路由设置等。Open×××提供了两种虚拟网络接口：通用Tun/Tap驱动，通过它们，可以建立三层IP隧道，或者虚拟二层以太网，后者可以传送任何类型的二层以太网络数据。传送的数据可通过LZO算法压缩。IANA（Internet Assigned Numbers Authority）指定给Open×××的官方端口为1194。Open××× 2.0以后版本每个进程可以同时管理数个并发的隧道。
服务器端配置：192.168.229.201为×××服务器内网IP；192.168.90.10为外网IP；
演示环境中服务器的eth0为虚拟机的桥接网卡，可连接公网，eth1为vm9，模拟内网，客户端的网卡也为vm9,默认不能连接公网！
[root@server1 ~]# ifconfig |grep 'inet addr'
inet addr:192.168.90.10 Bcast:192.168.90.255 Mask:255.255.255.0
inet addr:192.168.229.201 Bcast:192.168.229.255 Mask:255.255.255.0
inet addr:127.0.0.1 Mask:255.0.0.0
服务器系统版本为rhel5.4，open***版本为2.0.9，lzo版本为2.0.3
[root@server1 ~]# modinfo tun
filename: /lib/modules/2.6.18-8.el5/kernel/drivers/net/tun.ko
alias: char-major-10-200
license: GPL
author: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
description: Universal TUN/TAP device driver
srcversion: C0FE3C11A88F4A24924EFDD
depends:
vermagic: 2.6.18-8.el5 SMP mod_unload 686 REGPARM 4KSTACKS gcc-4.1
下载源码包并编译安装：
[root@server1 ~]# cd /usr/local/src/tarbag/
[root@server1 tarbag]# wget http://www.oberhumer.com/opensource/lzo/download/lzo-2.03.tar.gz
[root@server1 tarbag]# wget http://open***.net/release/open***-2.0.9.tar.gz
[root@server1 tarbag]# tar zxvf lzo-2.03.tar.gz -C ../software/
[root@server1 tarbag]# tar -zxvf open***-2.0.9.tar.gz -C ../software/
LZO是一个实时无损压缩工具，在安装open***时需要安装LZO软件包, 这个软件包是一个解压缩库文件,open***所使用的一个软件包, 如在configure时没有发现此包将会出现configure错误.
[root@server1 tarbag]# cd ../software/lzo-2.03/
[root@server1 lzo-2.03]# ./configure --prefix=/usr/local/lzo && make && make install
[root@server1 lzo-2.03]# ls /usr/local/lzo/
include lib
编译安装open***需要有openssl库支持
[root@server1 lzo-2.03]# cd ../open***-2.0.9/
[root@server1 open***-2.0.9]#./configure --prefix=/usr/local/open*** --with-lzo-headers=/usr/local/lzo/include --with-lzo-lib=/usr/local/lzo/lib --with-ssl-headers=/usr/include/openssl --with-ssl-lib=/usr/lib && make && make install
[root@server1 open***-2.0.9]# echo $?
0
[root@server1 open***-2.0.9]# ls /usr/local/open***/
man sbin
[root@server1 ~]#mkdir /usr/local/open***/etc
[root@server1 ~]# cp -r /usr/local/src/software/open***-2.0.9/easy-rsa/ /usr/local/open***/etc/
[root@server1 ~]# cp /usr/local/src/software/open***-2.0.9/sample-config-files/server.conf /usr/local/open***/etc/
[root@server1 ~]# tail -n 5 /usr/local/open***/etc/easy-rsa/2.0/vars
export KEY_COUNTRY="CN"
export KEY_PROVINCE="FJ"
export KEY_CITY="FZ"
export KEY_ORG="yang.com"
export KEY_EMAIL="root@yang.com"
[root@server1 ~]# cd /usr/local/open***/etc/easy-rsa/2.0/
[root@server1 2.0]# source ./vars
NOTE: If you run ./clean-all, I will be doing a rm -rf on /usr/local/open***/etc/easy-rsa/2.0/keys
[root@server1 2.0]# ./clean-all
生成ca证书，用于签发server和client
[root@server1 2.0]# ./build-ca
Generating a 1024 bit RSA private key
...............++++++
...........++++++
writing new private key to 'ca.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]:
State or Province Name (full name) [FJ]:
Locality Name (eg, city) [FZ]:
Organization Name (eg, company) [yang.com]:
Organizational Unit Name (eg, section) []:JSB
Common Name (eg, your name or your server's hostname) [yang.com CA]:server1.yang.com
Email Address [root@yang.com]:
[root@server1 2.0]# ./build-dh
Generating DH parameters, 1024 bit long safe prime, generator 2
This is going to take a long time
生成服务器证书
[root@server1 2.0]# ./build-key-server server1
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName :PRINTABLE:'CN'
stateOrProvinceName :PRINTABLE:'FJ'
localityName :PRINTABLE:'FZ'
organizationName :PRINTABLE:'yang.com'
organizationalUnitName:PRINTABLE:'JSB'
commonName :PRINTABLE:'server1.yang.com'
emailAddress :IA5STRING:'root@yang.com'
Certificate is to be certified until Jan 19 16:38:10 2020 GMT (3650 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
生成客户端证书
[root@server1 2.0]# ./build-key bleach
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName :PRINTABLE:'CN'
stateOrProvinceName :PRINTABLE:'FJ'
localityName :PRINTABLE:'FZ'
organizationName :PRINTABLE:'yang.com'
organizationalUnitName:PRINTABLE:'JSB'
commonName :PRINTABLE:'bleach.yang.com'
emailAddress :IA5STRING:'root@yang.com'
Certificate is to be certified until Jan 19 16:40:09 2020 GMT (3650 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
[root@server1 2.0]# cd keys/
[root@server1 keys]# mkdir /usr/local/open***/etc/keys
[root@server1 keys]# cp ca.crt dh1024.pem server1.crt server1.key /usr/local/open***/etc/keys/
[root@server1 keys]# ls /usr/local/open***/etc/keys/
ca.crt dh1024.pem server1.crt server1.key
[root@server1 ~]# vi /usr/local/open***/etc/server.conf
local 192.168.229.201
port 1194
proto tcp
dev tun
ca /usr/local/open***/etc/keys/ca.crt
cert /usr/local/open***/etc/keys/server1.crt
key /usr/local/open***/etc/keys/server1.key
dh /usr/local/open***/etc/keys/dh1024.pem
server 1.1.1.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway"
push "dhcp-option DNS 8.8.8.8"
client-to-client
keepalive 10 120
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status /var/log/open***-status.log
verb 3
（注：先前未声明 “push "redirect-gateway"”参数，客户端拨号后出现"NOTE: unable to redirect default gateway -- Cannot read current default gateway from system"，未获取到网关，声明该参数后重启服务，客户端即可获取到网关，万事ok! 若实在获取不到网关，可在客户端上手动添加一条路由，windows下的命令为 ：route add 网络地址 mask 子网掩码 网关ip；LINUX：route add default gw "网关ip"）
启动服务：
[root@server1 keys]# /usr/local/open***/sbin/open*** --daemon --config /usr/local/open***/etc/server.conf
[root@server1 ~]# netstat -ntpl |grep 1194
tcp 0 0 192.168.229.201:1194 0.0.0.0:* LISTEN 30517/open***
[root@server1 ~]# tail -f /var/log/messages
Jan 21 12:17:29 server1 open***[30517]: GID set to nobody
Jan 21 12:17:29 server1 open***[30517]: UID set to nobody
Jan 21 12:17:29 server1 open***[30517]: Listening for incoming TCP connection on 192.168.229.201:1194
Jan 21 12:17:29 server1 open***[30517]: TCPv4_SERVER link local (bound): 192.168.229.201:1194
Jan 21 12:17:29 server1 open***[30517]: TCPv4_SERVER link remote: [undef]
Jan 21 12:17:29 server1 open***[30517]: MULTI: multi_init called, r=256 v=256
Jan 21 12:17:29 server1 open***[30517]: IFCONFIG POOL: base=1.1.1.4 size=62
Jan 21 12:17:29 server1 open***[30517]: IFCONFIG POOL LIST
Jan 21 12:17:29 server1 open***[30517]: MULTI: TCP INIT maxclients=1024 maxevents=1028
Jan 21 12:17:29 server1 open***[30517]: Initialization Sequence Completed
[root@server1 ~]# ifconfig tun0
tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:1.1.1.1 P-t-P:1.1.1.2 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:924 errors:0 dropped:0 overruns:0 frame:0
TX packets:1242 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:96400 (94.1 KiB) TX bytes:964018 (941.4 KiB)
开启服务器路由功能并使其生效
[root@server1 ~]# grep ipv4 /etc/sysctl.conf
net.ipv4.ip_forward = 1
[root@server1 ~]# sysctl -p
net.ipv4.ip_forward = 1
设定防火墙，之前写过一篇PPTP ×××的配置，里面未涉及到修改路由部分，下面的步骤同样也适用于PPTP ×××
[root@server1 ~]# cat iptables.sh
#!/bin/sh
iptables -F
iptables -Z
iptables -X
iptables -P INPUT ACCEPT
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -t nat -A POSTROUTING -s 1.1.1.0/24 -o eth0 -j MASQUERADE
service iptables save
这里的网卡要指定为服务器外网的接口
[root@server1 ~]# iptables -L -t nat
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- 1.1.1.0/24 anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
客户端配置：
客户端软件下载地址:http://open***.se/files/install_packages/
注意：客户端软件需要与服务器端匹配，安装软件直接狂点“下一步“即可完成。
将×××服务器/usr/local/open***/etc/easy-rsa/2.0/keys目录下的ca.crt，bleach.crt，bleach.key和/usr/local/src/software/open***-2.0.9/sample-config-files目录下的client.conf文件复制到windows客户端的C:\Program Files\Open×××\config路径下：需要将客户端配置文件client.conf需要更名为client.o***,并修改如下内容！
client
dev tun
proto tcp
remote 192.168.229.201 1194
persist-key
persist-tun
ca ca.crt
cert bleach.crt
key bleach.key
ns-cert-type server
comp-lzo
verb 3
redirect-gateway def1
拨号前：
C:\>ipconfig /all
Ethernet adapter 本地连接:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : AMD PCNET Family PCI Ethernet Adapte
r
Physical Address. . . . . . . . . : 00-0C-29-E7-4C-9C
Dhcp Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 192.168.229.20
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.229.20
Ethernet adapter 本地连接 2:
Media State . . . . . . . . . . . : Media disconnected
Description . . . . . . . . . . . : TAP-Win32 Adapter V8
Physical Address. . . . . . . . . : 00-FF-1A-71-28-B7
C:\>ping www.g.cn
Ping request could not find host www.g.cn. Please check the name and try again.
C:\>ping 192.168.229.201
Pinging 192.168.229.201 with 32 bytes of data:
Reply from 192.168.229.201: bytes=32 time=2ms TTL=64
Reply from 192.168.229.201: bytes=32 time<1ms TTL=64
Reply from 192.168.229.201: bytes=32 time=2ms TTL=64
Reply from 192.168.229.201: bytes=32 time<1ms TTL=64
Ping statistics for 192.168.229.201:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 2ms, Average = 1ms
拨号后：
C:\>ipconfig /all
Ethernet adapter 本地连接:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : AMD PCNET Family PCI Ethernet Adap
r
Physical Address. . . . . . . . . : 00-0C-29-E7-4C-9C
Dhcp Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 192.168.229.20
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.229.20
Ethernet adapter 本地连接 2:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : TAP-Win32 Adapter V8
Physical Address. . . . . . . . . : 00-FF-1A-71-28-B7
Dhcp Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . : 1.1.1.6
Subnet Mask . . . . . . . . . . . : 255.255.255.252
Default Gateway . . . . . . . . . : 1.1.1.5
DHCP Server . . . . . . . . . . . : 1.1.1.5
DNS Servers . . . . . . . . . . . : 8.8.8.8
Lease Obtained. . . . . . . . . . : 2010年2月4日 15:02:02
Lease Expires . . . . . . . . . . : 2011年2月4日 15:02:02
C:\>ping www.g.cn
Pinging www.g.cn [203.208.37.160] with 32 bytes of data:
Reply from 203.208.37.160: bytes=32 time=46ms TTL=127
Reply from 203.208.37.160: bytes=32 time=42ms TTL=127
Reply from 203.208.37.160: bytes=32 time=43ms TTL=127
Reply from 203.208.37.160: bytes=32 time=42ms TTL=127
Ping statistics for 203.208.37.160:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 42ms, Maximum = 46ms, Average = 43ms
附上客户端关键日志信息：
Thu Feb 04 14:16:17 2010 TCPv4_CLIENT link remote: 192.168.229.201:1194
Thu Feb 04 14:16:17 2010 TLS: Initial packet from 192.168.229.201:1194, sid=16e16dcb 1554f9a8
Thu Feb 04 14:16:17 2010 VERIFY OK: depth=1, /C=CN/ST=FJ/L=FZ/O=yang.com/OU=JSB/CN=server1.yang.com/emailAddress=root@yang.com
Thu Feb 04 14:16:17 2010 VERIFY OK: nsCertType=SERVER
Thu Feb 04 14:16:17 2010 VERIFY OK: depth=0, /C=CN/ST=FJ/L=FZ/O=yang.com/OU=JSB/CN=server1.yang.com/emailAddress=root@yang.com
Thu Feb 04 14:16:18 2010 [server1.yang.com] Peer Connection Initiated with 192.168.229.201:1194
Thu Feb 04 14:16:19 2010 SENT CONTROL [server1.yang.com]: 'PUSH_REQUEST' (status=1)
Thu Feb 04 14:16:19 2010 PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS 8.8.8.8,redirect-gateway,route 1.1.1.0 255.255.255.0,ping 10,ping-restart 120,ifconfig 1.1.1.6 1.1.1.5'
Thu Feb 04 14:16:19 2010 OPTIONS IMPORT: timers and/or timeouts modified
Thu Feb 04 14:16:19 2010 OPTIONS IMPORT: --ifconfig/up options modified
Thu Feb 04 14:16:19 2010 OPTIONS IMPORT: route options modified
Thu Feb 04 14:16:19 2010 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Thu Feb 04 14:16:19 2010 TAP-WIN32 device [本地连接 2] opened: \\.\Global\{1A7128B7-DFA4-4EC2-8F89-31A803DDAA70}.tap
Thu Feb 04 14:16:21 2010 route ADD 192.168.229.201 MASK 255.255.255.255 192.168.229.20
Thu Feb 04 14:16:21 2010 Route addition via IPAPI succeeded
Thu Feb 04 14:16:21 2010 route ADD 0.0.0.0 MASK 128.0.0.0 1.1.1.5
Thu Feb 04 14:16:21 2010 Route addition via IPAPI succeeded
Thu Feb 04 14:16:21 2010 route ADD 128.0.0.0 MASK 128.0.0.0 1.1.1.5
Thu Feb 04 14:16:21 2010 Route addition via IPAPI succeeded
Thu Feb 04 14:16:21 2010 route ADD 1.1.1.0 MASK 255.255.255.0 1.1.1.5
Thu Feb 04 14:16:21 2010 Route addition via IPAPI succeeded
Thu Feb 04 14:16:21 2010 Initialization Sequence Completed
Open×××客户端证书的吊销
吊销test用户的证书
[root@Open***222 ~]# cd /usr/local/open***/etc/easy-rsa/2.0/
[root@Open***222 2.0]# ./revoke-full test
Using configuration from /usr/local/open***/etc/easy-rsa/2.0/openssl.cnf
Revoking Certificate 07.
Data Base Updated
Using configuration from /usr/local/open***/etc/easy-rsa/2.0/openssl.cnf
test.crt: /C=CN/ST=FJ/L=FZ/O=766.com/CN=test/emailAddress=admin@766.com
error 23 at 0 depth lookup:certificate revoked
[root@Open***222 2.0]# file keys/crl.pem
keys/crl.pem: ASCII text
[root@Open***222 2.0]# cp /usr/local/open***/etc/easy-rsa/2.0/keys/crl.pem /usr/local/open***/etc/keys/
修改配置文件并重启服务
[root@Open***222 ~]# tail -n 1 /usr/local/open***/etc/server.conf
crl-verify /usr/local/open***/etc/keys/crl.pem
[root@Open***222 ~]# killall open***
[root@Open***222 ~]# /usr/local/open***/sbin/open*** --daemon --config /usr/local/open***/etc/server.conf
本文摘自斩月百度空间http://hi.baidu.com/naruto6006/item/74dfe5b471298370254b09af
http://ylw6006.blog.51cto.com/
转载于:https://blog.51cto.com/ljl2013/1348592
1438
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
