一、部署***_server
1、安装lzo
2、open***
3、配置***服务端
# mkdir -p /etc/open***/key 《---该目录存放证书
# cp /usr/src/open***-2.0.2/sample-scripts/open***.init /etc/rc.d/init.d/open***
# chmod 755 /etc/rc.d/init.d/open***
# cp -a /usr/src/open***-2.0.2/easy-rsa/ /etc/open***/ <---生成证书的脚本工具
# vim /etc/open***/easy-rsa/vars <----设定一些工具运行时候需要用到的一些环境变量
....
export KEY_DIR="/etc/open***/key/"
....
export KEY_SIZE=1024
export KEY_COUNTRY=CN
export KEY_PROVINCE=GD
export KEY_CITY=SHENZHEN
export KEY_ORG="UPLOOKING"
export KEY_EMAIL="im@tanpao.com"
# cd /etc/open***/easy-rsa
# . vars
# ./clean-all
1) 生成根证书 (ca)
# ./build-ca
。。。。
Country Name (2 letter code) [CN]:
State or Province Name (full name) [GD]:
Locality Name (eg, city) [SHENZHEN]:
Organization Name (eg, company) [UPLOOKING]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:***server 《--随意
Email Address [im@tanpao.com]:
2) 生成服务端的密钥对
# ./build-key-server ***
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []: 密码留空,不用输入
An optional company name []:
Certificate is to be certified until Jun 23 07:11:53 2022 GMT (3650 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
3) 生成dh密钥对。
# ./build-dh
4)生成客户端证书
只要客户端在拨号的时候出示证书,就能够连接服务器
# ./build-key client1
确定声称了这些文件:
# ls /etc/open***/key/client1.*
/etc/open***/key/client1.crt
/etc/open***/key/client1.key
/etc/open***/key/client1.csr
5、设定配置文件
# cp /usr/src/open***-2.0.2/sample-config-files/server.conf /etc/open***/
# vim /etc/open***/server.conf
port 1194
proto udp
dev tun
ca /etc/open***/key/ca.crt
cert /etc/open***/key/***.crt
key /etc/open***/key/***.key
dh /etc/open***/key/dh1024.pem
server 10.8.0.0 255.255.255.0
push "route 192.168.1.0 255.255.255.0" <---客户端拨号之后能够看到的连接***服务端的内网
client-to-client
comp-lzo
启动
# service open*** start
# ifconfig tun0
# lsof -i:1194
二、配置客户端
1、安装软件
lzo
open***
./configure --disable-server
2、准备拨号用的证书
这些证书都是在服务端上生成的,需要从服务端上拷贝到客户端
例如: client1.xxx
# mkdir -p /etc/open***
# ls /etc/open***/
ca.crt client1.crt client1.key
# cp /usr/src/open***-2.0.2/sample-config-files/client.conf /etc/open***/
# vim /etc/open***/client.conf
client
dev tun
proto udp
remote 2.2.2.128 1194
ca /etc/open***/ca.crt
cert /etc/open***/client1.crt
key /etc/open***/client1.key
comp-lzo
# open*** --config /etc/open***/client.conf --daemon
# ifconfig tun0
停止拨号
# skill -9 open***
客户端测试
# ping 192.168.1.1
==============================
sp:10244
dp:1194
sip:1.1.1.128
dip:2.2.2.128
------------------
icmp:
sip:10.8.0.6
dip:192.168.1.1
------------------
===============================
# ping 192.168.1.128
转载于:https://blog.51cto.com/study51/989216