安装参考 http://qicheng0211.blog.51cto.com/3958621/1575273
http://freeloda.blog.51cto.com/2033581/1354858
一、环境
系统: CentOS 6.4x64最小化安装
eth0: 192.168.3.75 *** server
eth1: 172.16.1.1 *** server
win7: 192.168.3.76
client: 172.16.1.2 内网服务器
目的:用户通过win7能连接到内部网络172.16.1.0/24网段,且172.16.1.0/24能访问外网
二、安装yum源,同步时间
[root@***-server ~]# rpm -ivh http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm [root@***-server ~]# sed -i 's@#b@b@g' /etc/yum.repos.d/epel.repo [root@***-server ~]# sed -i 's@mirrorlist@#mirrorlist@g' /etc/yum.repos.d/epel.repo [root@***-server ~]# yum install ntpdate -y [root@***-server ~]# echo "*/10 * * * * /usr/sbin/ntpdate asia.pool.ntp.org &>/dev/null" >/var/spool/cron/root [root@***-server ~]# crontab -l */10 * * * * /usr/sbin/ntpdate asia.pool.ntp.org &>/dev/null
三、安装基础软件
[root@***-server ~]# yum install openssl openssl-devel lzo -y
四、安装open***和easy-rsa
[root@***-server ~]# yum install open*** easy-rsa -y #修改vars文件信息 [root@***-server 2.0]# pwd /usr/share/easy-rsa/2.0 [root@***-server 2.0]# vim vars #修改下面几项 export KEY_COUNTRY="CN" export KEY_PROVINCE="GUANGDONG" export KEY_CITY="GUANGZHOU" export KEY_ORG="MY COMPANY" export KEY_EMAIL="lyao@weyee.com" #重新加载环境变量 [root@***-server 2.0]# source vars #清除所有证书和相关文件 [root@***-server 2.0]# ./clean-all #生成新的根证书和根秘钥 [root@***-server 2.0]# ./build-ca #整个过程回车即可 Generating a 2048 bit RSA private key .....................................................+++ .........................................................+++ writing new private key to 'ca.key' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [CN]: #这里的信息是我们在上面事先设置的 State or Province Name (full name) [GUANGDONG]: Locality Name (eg, city) [GUANGZHOU]: Organization Name (eg, company) [MY COMPANY]: Organizational Unit Name (eg, section) [MyOrganizationalUnit]: Common Name (eg, your name or your server's hostname) [MY COMPANY CA]: Name [EasyRSA]: Email Address [lyao@weyee.com]:
给服务器端生成证书和秘钥
[root@***-server 2.0]# ./build-key-server server Generating a 2048 bit RSA private key .+++ ...........+++ writing new private key to 'server.key' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [CN]: State or Province Name (full name) [GUANGDONG]: Locality Name (eg, city) [GUANGZHOU]: Organization Name (eg, company) [MY COMPANY]: Organizational Unit Name (eg, section) [MyOrganizationalUnit]: Common Name (eg, your name or your server's hostname) [server]: Name [EasyRSA]: Email Address [lyao@weyee.com]: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: Using configuration from /usr/share/easy-rsa/2.0/openssl-1.0.0.cnf Check that the request matches the signature Signature ok The Subject's Distinguished Name is as follows countryName :PRINTABLE:'CN' stateOrProvinceName :PRINTABLE:'GUANGDONG' localityName :PRINTABLE:'GUANGZHOU' organizationName :PRINTABLE:'MY COMPANY' organizationalUnitName:PRINTABLE:'MyOrganizationalUnit' commonName :PRINTABLE:'server' name :PRINTABLE:'EasyRSA' emailAddress :IA5STRING:'lyao@weyee.com' Certificate is to be certified until May 24 07:01:16 2025 GMT (3650 days) Sign the certificate? [y/n]:y #输入y 1 out of 1 certificate requests certified, commit? [y/n]y #输入y Write out database with 1 new entries Data Base Updated
给***客户端创建证书和秘钥,这里我们给win7创建
[root@***-server 2.0]# ./build-key win7 Generating a 2048 bit RSA private key .........................+++ .........................+++ writing new private key to 'win7.key' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [CN]: State or Province Name (full name) [GUANGDONG]: Locality Name (eg, city) [GUANGZHOU]: Organization Name (eg, company) [MY COMPANY]: Organizational Unit Name (eg, section) [MyOrganizationalUnit]: Common Name (eg, your name or your server's hostname) [win7]: Name [EasyRSA]: Email Address [lyao@weyee.com]: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: Using configuration from /usr/share/easy-rsa/2.0/openssl-1.0.0.cnf Check that the request matches the signature Signature ok The Subject's Distinguished Name is as follows countryName :PRINTABLE:'CN' stateOrProvinceName :PRINTABLE:'GUANGDONG' localityName :PRINTABLE:'GUANGZHOU' organizationName :PRINTABLE:'MY COMPANY' organizationalUnitName:PRINTABLE:'MyOrganizationalUnit' commonName :PRINTABLE:'win7' name :PRINTABLE:'EasyRSA' emailAddress :IA5STRING:'lyao@weyee.com' Certificate is to be certified until May 24 07:09:16 2025 GMT (3650 days) Sign the certificate? [y/n]:y 1 out of 1 certificate requests certified, commit? [y/n]y Write out database with 1 new entries Data Base Updated
生成Diffie Hellman文件
#生成过程可能有点慢,等待一会就好 [root@***-server 2.0]# ./build-dh #生成ta.key文件(防DDos***、UDP淹没等恶意***) [root@***-server 2.0]# open*** --genkey --secret keys/ta.key
操作完成后查看keys路径下的文件
[root@***-server 2.0]# pwd /usr/share/easy-rsa/2.0 [root@***-server 2.0]# ll keys/ total 88 -rw-r--r-- 1 root root 5604 May 27 15:01 01.pem -rw-r--r-- 1 root root 5481 May 27 15:09 02.pem -rw-r--r-- 1 root root 1801 May 27 14:59 ca.crt -rw------- 1 root root 1708 May 27 14:59 ca.key -rw-r--r-- 1 root root 424 May 27 15:12 dh2048.pem -rw-r--r-- 1 root root 292 May 27 15:09 index.txt -rw-r--r-- 1 root root 21 May 27 15:09 index.txt.attr -rw-r--r-- 1 root root 21 May 27 15:01 index.txt.attr.old -rw-r--r-- 1 root root 147 May 27 15:01 index.txt.old -rw-r--r-- 1 root root 3 May 27 15:09 serial -rw-r--r-- 1 root root 3 May 27 15:01 serial.old -rw-r--r-- 1 root root 5604 May 27 15:01 server.crt -rw-r--r-- 1 root root 1098 May 27 15:01 server.csr -rw------- 1 root root 1704 May 27 15:01 server.key -rw------- 1 root root 636 May 27 15:14 ta.key -rw-r--r-- 1 root root 5481 May 27 15:09 win7.crt -rw-r--r-- 1 root root 1094 May 27 15:09 win7.csr -rw------- 1 root root 1704 May 27 15:09 win7.key
五、创建服务端配置文件
# 在open***的配置目录下新建一个keys目录 [root@***-server ~]# mkdir -p /etc/open***/keys #将open***服务端需要用到的证书和秘钥复制到/etc/open***/keys目录下 [root@***-server ~]# cp /usr/share/easy-rsa/2.0/keys/{ca.crt,server.{crt,key},dh2048.pem,ta.key} /etc/open***/keys/ [root@***-server ~]# ll /etc/open***/keys/ total 24 -rw-r--r-- 1 root root 1801 May 27 15:18 ca.crt -rw-r--r-- 1 root root 424 May 27 15:18 dh2048.pem -rw-r--r-- 1 root root 5604 May 27 15:18 server.crt -rw------- 1 root root 1704 May 27 15:18 server.key -rw------- 1 root root 636 May 27 15:18 ta.key #复制服务端配置文件到/etc/open*** [root@***-server ~]# cp /usr/share/doc/open***-2.3.6/sample/sample-config-files/server.conf /etc/open***/ #编辑server.conf文件参数 [root@***-server ~]# egrep -v "^#|^$|^;" /etc/open***/server.conf #open***监听的端口 port 1194 #这里请使用tcp协议,不要使用udp proto tcp dev tun #证书和秘钥的路径,我们放在/etc/open***/keys目录下 ca keys/ca.crt cert keys/server.crt key keys/server.key # This file should be kept secret dh keys/dh2048.pem #这里是默认的虚拟局域网网段,不要和实际网段相同 server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt #这里因为我的内网是172.16.1.0/24网段的,所以我修改成172.16.1.0网段 push "route 172.16.1.0 255.255.255.0" client-to-client keepalive 10 120 comp-lzo persist-key persist-tun #这是open***的日志文件,默认在/etc/open***/open***.log status open***-status.log #调试级别 verb 4
启动open***服务
#将open***添加到开机自启动 [root@***-server ~]# chkconfig open*** on [root@***-server ~]# service open*** start Starting open***: [ OK ] [root@***-server ~]# netstat -anpt |grep *** tcp 0 0 0.0.0.0:1194 0.0.0.0:* LISTEN 2889/open*** #在iptables中放行tcp的1194端口 [root@***-server ~]# iptables -I INPUT -p tcp --dport 1194 -j ACCEPT [root@***-server ~]# iptables -L -n Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:1194 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22 REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited Chain FORWARD (policy ACCEPT) target prot opt source destination REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited Chain OUTPUT (policy ACCEPT) target prot opt source destination
六、客户端安装及配置
Open××× 2.3.3 Windows 32位 安装文件:
http://swupdate.open***.org/community/releases/open***-install-2.3.3-I002-i686.exe
Open××× 2.3.3 Windows 64位 安装文件:
http://swupdate.open***.org/community/releases/open***-install-2.3.3-I002-x86_64.exe
将open***服务器上的ca.crt,win7.crt,win7.csr,win7.key,下载到C:\Program Files\Open×××\config目录下
新建客户端配置文件open***.o***
open***.o*** 文件内容:
client dev tun # 改为tcp proto tcp remote 192.168.3.75 1194 # Open×××服务器的外网IP和端口 resolv-retry infinite nobind persist-key persist-tun ca ca.crt cert win7.crt # win7的证书 key win7.key # win7的密钥 ns-cert-type server # 去掉前面的注释 #tls-auth ta.key 1 comp-lzo verb 3
连接***-server
此时只能ping通*** server的内网网卡即eth1:172.16.1.1,需要配置一SNAT才能ping通内网
#在filter表的FORWARD链中默认reject了转发请求 [root@***-server ~]# iptables -t fileter -F FORWARD [root@***-server ~]# iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to 172.16.1.1 #打开路由转发功能 [root@***-server ~]# sed -i '/net.ipv4.ip_forward/s/0/1/' /etc/sysctl.conf [root@***-server ~]# sysctl -p net.ipv4.ip_forward = 1 #需要此项为1
测试结果显示能ping通服务器的eth1网卡和内网的服务器
在服务器端查看日志文件
[root@***-server ~]# cat /etc/open***/open***-status.log Open××× CLIENT LIST Updated,Wed May 27 16:55:27 2015 Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since win7,192.168.3.76:33311,21385,16628,Wed May 27 16:36:07 2015 ROUTING TABLE Virtual Address,Common Name,Real Address,Last Ref 10.8.0.6,win7,192.168.3.2:33311,Wed May 27 16:52:52 2015 GLOBAL STATS Max bcast/mcast queue length,0 END
转载于:https://blog.51cto.com/ly36843/1655632