1 配置如下:

[root@Open***-S config]# cat  server.conf

local 172.18.1.132

port 3889

proto udp

dev tap0

ca /root/open***-2.3.3/config/ca.crt

cert /root/open***-2.3.3/config/***S.crt

key /root/open***-2.3.3/config/***S.key  # This file should be kept secret

dh /root/open***-2.3.3/config/dh2048.pem

ifconfig-pool-persist /root/open***/config/ipp.txt

push "route 192.168.40.0 255.255.255.0" #推送服务端LAN路由

server-bridge 10.8.0.2 255.255.255.0 10.8.0.10 10.8.0.254 #设置隧道服务地址，以及客户端的地址池

client-to-client

duplicate-cn

keepalive 10 120

tls-auth /root/open***-2.3.3/config/ta.key 0 # This file is secret

cipher AES-128-CBC   # AES

comp-lzo

max-clients 100

user nobody

group nobody

persist-key

persist-tun

verb 3

mute 20

[root@Open***-C config]# cat client.conf

client

dev tap

proto udp

remote 172.18.1.132 3889

resolv-retry infinite

nobind

user nobody

group nobody

persist-key

persist-tun

reneg-sec 28800 #秘钥8小时重新协商

ca /root/open***-2.3.3/config/ca.crt

cert /root/open***-2.3.3/config/user1.crt

key  /root/open***-2.3.3/config/user1.key

tls-auth  /root/open***-2.3.3/config/ta.key 1

ns-cert-type server

cipher AES-128-CBC

comp-lzo

verb 3

mute 20

2 修改sample-scripts下的网桥脚本:

[root@Open***-S sample-scripts]# cat bridge-start

#!/bin/sh


#################################

# Set up Ethernet bridge on Linux

# Requires: bridge-utils

#################################


# Define Bridge Interface

br="br0"


# Define list of TAP interfaces to be bridged,

# for example tap="tap0 tap1 tap2".

tap="tap0"


# Define physical ethernet interface to be bridged

# with TAP interface(s) above.

eth="eth1" #服务器LAN网口

eth_ip="10.8.0.2"

eth_netmask="255.255.255.0"

eth_broadcast="10.8.0.255" #缺省广播地址


for t in $tap; do

    open*** --mktun --dev $t

done


brctl addbr $br

brctl addif $br $eth


for t in $tap; do

    brctl addif $br $t

done


for t in $tap; do

    ifconfig $t 0.0.0.0 promisc up

done


ifconfig $eth 0.0.0.0 promisc up



ifconfig $br $eth_ip netmask $eth_netmask broadcast $eth_broadcast

[root@Open***-S sample-scripts]# cat bridge-stop

#!/bin/sh


####################################

# Tear Down Ethernet bridge on Linux

####################################


# Define Bridge Interface

br="br0"


# Define list of TAP interfaces to be bridged together

tap="tap0"


ifconfig $br down

brctl delbr $br


for t in $tap; do

    open*** --rmtun --dev $t


done

3 启动程序:

先启动bridge-start，然后再启动***server

[root@Open***-S config]# ifconfig

br0       Link encap:Ethernet  HWaddr 00:0C:29:8C:24:CA

          inet addr:10.8.0.2  Bcast:10.8.0.255  Mask:255.255.255.0

          inet6 addr: fe80::20c:29ff:fe8c:24ca/64 Scope:Link

          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

          RX packets:133 errors:0 dropped:0 overruns:0 frame:0

          TX packets:43 errors:0 dropped:0 overruns:0 carrier:0

          collisions:0 txqueuelen:0

          RX bytes:18653 (18.2 KiB)  TX bytes:3366 (3.2 KiB)


eth0      Link encap:Ethernet  HWaddr 00:0C:29:8C:24:C0

          inet addr:172.18.1.132  Bcast:172.18.1.255  Mask:255.255.254.0

          inet6 addr: fe80::20c:29ff:fe8c:24c0/64 Scope:Link

          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

          RX packets:51116 errors:0 dropped:0 overruns:0 frame:0

          TX packets:19852 errors:0 dropped:0 overruns:0 carrier:0

          collisions:0 txqueuelen:1000

          RX bytes:7844729 (7.4 MiB)  TX bytes:7488984 (7.1 MiB)

          Interrupt:19 Base address:0x2000


lo        Link encap:Local Loopback

          inet addr:127.0.0.1  Mask:255.0.0.0

          inet6 addr: ::1/128 Scope:Host

          UP LOOPBACK RUNNING  MTU:65536  Metric:1

          RX packets:5 errors:0 dropped:0 overruns:0 frame:0

          TX packets:5 errors:0 dropped:0 overruns:0 carrier:0

          collisions:0 txqueuelen:0

          RX bytes:560 (560.0 b)  TX bytes:560 (560.0 b)


tap0      Link encap:Ethernet  HWaddr 8E:6A:1A:B7:E2:0F

          inet6 addr: fe80::8c6a:1aff:feb7:e20f/64 Scope:Link

          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1

          RX packets:80 errors:0 dropped:0 overruns:0 frame:0

          TX packets:65 errors:0 dropped:12 overruns:0 carrier:0

          collisions:0 txqueuelen:100


          RX bytes:6224 (6.0 KiB)  TX bytes:10182 (9.9 KiB)

结束时先断开server,然后再bridge-stop

请注意，这种桥接方式启动的Open***服务器上的tap0虚拟网卡没有IP地址，因为整个过程没有IP层的内容。

4 打印信息如下:

服务器

[root@Open***-S config]# /usr/local/sbin/open***  --config /root/open***-2.3.3/config/server.conf

Tue Sep  5 00:34:38 2017 Open*** 2.3.3 x86_64-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Aug 31 2017

Tue Sep  5 00:34:38 2017 NOTE: when bridging your LAN adapter with the TAP adapter, note that the new bridge adapter will often take on its own IP address that is different from what the LAN adapter was previously set to

Tue Sep  5 00:34:38 2017 WARNING: --ifconfig-pool-persist will not work with --duplicate-cn

Tue Sep  5 00:34:38 2017 Diffie-Hellman initialized with 2048 bit key

Tue Sep  5 00:34:38 2017 Control Channel Authentication: using '/root/open***-2.3.3/config/ta.key' as a Open*** static key file

Tue Sep  5 00:34:38 2017 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication

Tue Sep  5 00:34:38 2017 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication

Tue Sep  5 00:34:38 2017 Socket Buffers: R=[124928->131072] S=[124928->131072]

Tue Sep  5 00:34:38 2017 TUN/TAP device tap0 opened

Tue Sep  5 00:34:38 2017 TUN/TAP TX queue length set to 100

Tue Sep  5 00:34:38 2017 GID set to nobody

Tue Sep  5 00:34:38 2017 UID set to nobody

Tue Sep  5 00:34:38 2017 UDPv4 link local (bound): [AF_INET]172.18.1.132:3889

Tue Sep  5 00:34:38 2017 UDPv4 link remote: [undef]

Tue Sep  5 00:34:38 2017 MULTI: multi_init called, r=256 v=256

Tue Sep  5 00:34:38 2017 IFCONFIG POOL: base=10.8.0.10 size=245, ipv6=0

Tue Sep  5 00:34:38 2017 IFCONFIG POOL LIST

Tue Sep  5 00:34:38 2017 Initialization Sequence Completed

Tue Sep  5 00:34:43 2017 172.18.1.130:39446 TLS: Initial packet from [AF_INET]172.18.1.130:39446, sid=aae8c845 f1d49e60

Tue Sep  5 00:34:43 2017 172.18.1.130:39446 VERIFY OK: depth=1, C=CN, ST=GD, L=SZ, O=softown, OU=softown_admin, CN=Open***_CA, name=EasyRSA, emailAddress=admin@softown.cn

Tue Sep  5 00:34:43 2017 172.18.1.130:39446 VERIFY OK: depth=0, C=CN, ST=GD, L=SZ, O=softown, OU=softown_admin, CN=user1, name=EasyRSA, emailAddress=admin@softown.cn

Tue Sep  5 00:34:43 2017 172.18.1.130:39446 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key

Tue Sep  5 00:34:43 2017 172.18.1.130:39446 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication

Tue Sep  5 00:34:43 2017 172.18.1.130:39446 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key

Tue Sep  5 00:34:43 2017 172.18.1.130:39446 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication

Tue Sep  5 00:34:43 2017 172.18.1.130:39446 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 2048 bit RSA

Tue Sep  5 00:34:43 2017 172.18.1.130:39446 [user1] Peer Connection Initiated with [AF_INET]172.18.1.130:39446

Tue Sep  5 00:34:43 2017 user1/172.18.1.130:39446 MULTI_sva: pool returned IPv4=10.8.0.10, IPv6=(Not enabled)

Tue Sep  5 00:34:46 2017 user1/172.18.1.130:39446 PUSH: Received control message: 'PUSH_REQUEST'

Tue Sep  5 00:34:46 2017 user1/172.18.1.130:39446 send_push_reply(): safe_cap=940

Tue Sep  5 00:34:46 2017 user1/172.18.1.130:39446 SENT CONTROL [user1]: 'PUSH_REPLY,route 192.168.40.0 255.255.255.0,route-gateway 10.8.0.2,ping 10,ping-restart 120,ifconfig 10.8.0.10 255.255.255.0' (status=1)

Tue Sep  5 00:34:46 2017 user1/172.18.1.130:39446 MULTI: Learn: 3e:9f:94:51:1b:9c -> user1/172.18.1.130:39446

客户端

[root@Open***-C ~]# /usr/local/sbin/open***  --config /root/open***-2.3.3/config/client.conf

Tue Sep  5 00:33:39 2017 Open*** 2.3.3 x86_64-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Aug 31 2017

Tue Sep  5 00:33:39 2017 Control Channel Authentication: using '/root/open***-2.3.3/config/ta.key' as a Open*** static key file

Tue Sep  5 00:33:39 2017 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication

Tue Sep  5 00:33:39 2017 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication

Tue Sep  5 00:33:39 2017 Socket Buffers: R=[124928->131072] S=[124928->131072]

Tue Sep  5 00:33:39 2017 NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay

Tue Sep  5 00:33:39 2017 UDPv4 link local: [undef]

Tue Sep  5 00:33:39 2017 UDPv4 link remote: [AF_INET]172.18.1.132:3889

Tue Sep  5 00:33:39 2017 TLS: Initial packet from [AF_INET]172.18.1.132:3889, sid=f5c08706 546e7dad

Tue Sep  5 00:33:39 2017 VERIFY OK: depth=1, C=CN, ST=GD, L=SZ, O=softown, OU=softown_admin, CN=Open***_CA, name=EasyRSA, emailAddress=admin@softown.cn

Tue Sep  5 00:33:39 2017 VERIFY OK: nsCertType=SERVER

Tue Sep  5 00:33:39 2017 VERIFY OK: depth=0, C=CN, ST=GD, L=SZ, O=softown, OU=softown_admin, CN=***S, name=EasyRSA, emailAddress=admin@softown.cn

Tue Sep  5 00:33:39 2017 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key

Tue Sep  5 00:33:39 2017 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication

Tue Sep  5 00:33:39 2017 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key

Tue Sep  5 00:33:39 2017 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication

Tue Sep  5 00:33:39 2017 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 2048 bit RSA

Tue Sep  5 00:33:39 2017 [***S] Peer Connection Initiated with [AF_INET]172.18.1.132:3889

Tue Sep  5 00:33:41 2017 SENT CONTROL [***S]: 'PUSH_REQUEST' (status=1)

Tue Sep  5 00:33:41 2017 PUSH: Received control message: 'PUSH_REPLY,route 192.168.40.0 255.255.255.0,route-gateway 10.8.0.2,ping 10,ping-restart 120,ifconfig 10.8.0.10 255.255.255.0'

Tue Sep  5 00:33:41 2017 OPTIONS IMPORT: timers and/or timeouts modified

Tue Sep  5 00:33:41 2017 OPTIONS IMPORT: --ifconfig/up options modified

Tue Sep  5 00:33:41 2017 OPTIONS IMPORT: route options modified

Tue Sep  5 00:33:41 2017 OPTIONS IMPORT: route-related options modified

Tue Sep  5 00:33:41 2017 ROUTE_GATEWAY 172.18.1.254/255.255.254.0 IFACE=eth0 HWADDR=00:0c:29:b5:22:a8

Tue Sep  5 00:33:41 2017 TUN/TAP device tap0 opened

Tue Sep  5 00:33:41 2017 TUN/TAP TX queue length set to 100

Tue Sep  5 00:33:41 2017 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0

Tue Sep  5 00:33:41 2017 /sbin/ifconfig tap0 10.8.0.10 netmask 255.255.255.0 mtu 1500 broadcast 10.8.0.255

Tue Sep  5 00:33:41 2017 /sbin/route add -net 192.168.40.0 netmask 255.255.255.0 gw 10.8.0.2

Tue Sep  5 00:33:41 2017 GID set to nobody

Tue Sep  5 00:33:41 2017 UID set to nobody

Tue Sep  5 00:33:41 2017 Initialization Sequence Completed

5 添加客户端路由

服务端：ip route add 192.168.20.0/24 dev br0 或 ip route add 192.168.20.0/24 via 10.8.0.2 

6 测试
服务器 -> 客户端

[root@Open***-S config]# ping 10.8.0.10 #ping客户端隧道地址

PING 10.8.0.10 (10.8.0.10) 56(84) bytes of data.

64 bytes from 10.8.0.10: icmp_seq=1 ttl=64 time=0.580 ms

64 bytes from 10.8.0.10: icmp_seq=2 ttl=64 time=0.877 ms

64 bytes from 10.8.0.10: icmp_seq=3 ttl=64 time=0.891 ms

64 bytes from 10.8.0.10: icmp_seq=4 ttl=64 time=0.861 ms

^C

--- 10.8.0.10 ping statistics ---

4 packets transmitted, 4 received, 0% packet loss, time 3511ms

rtt min/avg/max/mdev = 0.580/0.802/0.891/0.130 ms

[root@Open***-S config]# ping 192.168.20.20 #ping客户端LAN地址

PING 192.168.20.20 (192.168.20.20) 56(84) bytes of data.

64 bytes from 192.168.20.20: icmp_seq=1 ttl=64 time=16.5 ms

64 bytes from 192.168.20.20: icmp_seq=2 ttl=64 time=0.472 ms

64 bytes from 192.168.20.20: icmp_seq=3 ttl=64 time=0.504 ms

64 bytes from 192.168.20.20: icmp_seq=4 ttl=64 time=0.439 ms

^C

--- 192.168.20.20 ping statistics ---

4 packets transmitted, 4 received, 0% packet loss, time 3477ms

rtt min/avg/max/mdev = 0.439/4.487/16.533/6.954 ms

[root@Open***-S ~]# ping  -I 192.168.40.40  192.168.20.20 #服务器LAN地址ping客户端LAN地址

PING 192.168.20.20 (192.168.20.20) from 192.168.40.40 : 56(84) bytes of data.

64 bytes from 192.168.20.20: icmp_seq=1 ttl=64 time=0.565 ms

64 bytes from 192.168.20.20: icmp_seq=2 ttl=64 time=0.987 ms

64 bytes from 192.168.20.20: icmp_seq=3 ttl=64 time=0.954 ms

64 bytes from 192.168.20.20: icmp_seq=4 ttl=64 time=0.920 ms

^C

--- 192.168.20.20 ping statistics ---

4 packets transmitted, 4 received, 0% packet loss, time 3830ms

rtt min/avg/max/mdev = 0.565/0.856/0.987/0.172 ms

客户端 -> 服务器

[root@Open***-C config]# ping  10.8.0.2 #ping服务端隧道

PING 10.8.0.2 (10.8.0.2) 56(84) bytes of data.

64 bytes from 10.8.0.2: icmp_seq=1 ttl=64 time=0.977 ms

64 bytes from 10.8.0.2: icmp_seq=2 ttl=64 time=0.872 ms

64 bytes from 10.8.0.2: icmp_seq=3 ttl=64 time=0.969 ms

64 bytes from 10.8.0.2: icmp_seq=4 ttl=64 time=0.761 ms

^C

--- 10.8.0.2 ping statistics ---

4 packets transmitted, 4 received, 0% packet loss, time 3609ms

rtt min/avg/max/mdev = 0.761/0.894/0.977/0.094 ms

[root@Open***-C config]# ping  192.168.40.40 #ping服务端LAN地址

PING 192.168.40.40 (192.168.40.40) 56(84) bytes of data.

64 bytes from 192.168.40.40: icmp_seq=1 ttl=64 time=0.645 ms

64 bytes from 192.168.40.40: icmp_seq=2 ttl=64 time=0.981 ms

64 bytes from 192.168.40.40: icmp_seq=3 ttl=64 time=0.879 ms

64 bytes from 192.168.40.40: icmp_seq=4 ttl=64 time=1.03 ms

^C

--- 192.168.40.40 ping statistics ---

4 packets transmitted, 4 received, 0% packet loss, time 3475ms

rtt min/avg/max/mdev = 0.645/0.884/1.031/0.148 ms

[root@Open***-C ~]# ping  -I  192.168.20.20 192.168.40.40 #客户端LAN地址ping服务端LAN地址

PING 192.168.40.40 (192.168.40.40) from 192.168.20.20 : 56(84) bytes of data.

64 bytes from 192.168.40.40: icmp_seq=1 ttl=64 time=1.56 ms

64 bytes from 192.168.40.40: icmp_seq=2 ttl=64 time=0.790 ms

64 bytes from 192.168.40.40: icmp_seq=3 ttl=64 time=0.742 ms

64 bytes from 192.168.40.40: icmp_seq=4 ttl=64 time=0.847 ms

^C

--- 192.168.40.40 ping statistics ---

4 packets transmitted, 4 received, 0% packet loss, time 3159ms

rtt min/avg/max/mdev = 0.742/0.986/1.567/0.338 ms

7 写一个自启动脚本

#!/bin/bash

#

# open*** This shell script takes care of starting and stopping

# chkconfig: 345 90 20  运行级别345（"-"表示所有运行级别）；开机顺序为90；关机顺序为20

#

# description: open*** is the NTPv4 daemon. 

. /etc/init.d/functions

prog=open***

lockfile=/var/lock/subsys/$prog

start() {

        [ -x /usr/local/sbin/open*** ] || exit 5

        /usr/sbin/bridge-start

        # Start daemons.

        echo -n $"Starting $prog................ "

        /usr/local/sbin/open*** --daemon  --config /root/open***-2.3.3/config/server.conf

        RETVAL=$?

        echo

        [ $RETVAL -eq 0 ] && touch $lockfile

        return $RETVAL

}

stop() {

        echo -n $"Shutting down $prog............... "

        killproc $prog

        RETVAL=$?

        echo

        [ $RETVAL -eq 0 ] && rm -f $lockfile

        /usr/sbin/bridge-stop

        return $RETVAL

}

# See how we were called.

case "$1" in

  start)

start

;;

  stop)

stop

;;

  status)

status $prog

;;

  reload)

stop

start

;;

  *)

echo $"Usage: $0 {start|stop|status|reload}"

exit 2

esac

 

[root@Open***-S ~]# /etc/init.d/open***

Usage: /etc/init.d/open*** {start|stop|status|reload}

start：

[root@Open***-S ~]# /etc/init.d/open*** start

Tue Sep 12 00:22:13 2017 TUN/TAP device tap0 opened

Tue Sep 12 00:22:13 2017 Persist state set to: ON

Starting open***................

[root@Open***-S ~]# ps -ef|grep open***

root       1656      1  0 00:22 ?        00:00:00 /usr/local/sbin/open*** --daemon --config /root/open***-2.3.3/config/server.conf

stop：

[root@Open***-S ~]# /etc/init.d/open*** stop

Shutting down open***...............                       [  OK  ]

Tue Sep 12 00:22:09 2017 TUN/TAP device tap0 opened

Tue Sep 12 00:22:09 2017 Persist state set to: OFF

status：

[root@Open***-S ~]# /etc/init.d/open*** status

open*** (pid 1923) is running...

reload：

[root@Open***-S ~]# /etc/init.d/open*** reload

Shutting down open***...............                       [  OK  ]

Tue Sep 12 00:23:54 2017 TUN/TAP device tap0 opened

Tue Sep 12 00:23:54 2017 Persist state set to: OFF

Tue Sep 12 00:23:54 2017 TUN/TAP device tap0 opened

Tue Sep 12 00:23:54 2017 Persist state set to: ON

Starting open***................

[root@Open***-S ~]# chkconfig open***  on #加入开机启动