Openvpn部署

一、安装证书工具

yum -y install easy-rsa

二、生成证书

2.1、查询easy-rsa的文件列表

rpm -ql easy-rsa

2.2、制作证书

mkdir /easy-rsa

cp -a /usr/share/easy-rsa/3.0.8/* /easy-rsa/

cd /easy-rsa

./easyrsa init-pki        #初始化

./easyrsa build-ca        #创建根证书，会提示设置密码，注意记住，用于后续签名，忽略后续提示输入，直接回车

./easyrsa gen-req server nopass        #创建服务端私钥以及证书签名请求

./easyrsa sign server server        #创建服务端签名证书，需要输入yes，以及根证书的密码

./easyrsa gen-dh        #生成一个包含 Diffie-Hellman 参数的文件，通常命名为 dh.pem。这个文件中包含了用于密钥交换的素数和生成元，它们是 Diffie-Hellman 算法的核心参数。

./easyrsa gen-req client nopass               #创建客户端私钥以及证书签名请求

./easyrsa sign client client        #创建客户端签名证书，需要输入yes，以及根证书的密码

三、安装openvpn

yum install openvpn

四、配置openvpn服务端

cat /etc/openvpn/server.conf

五、启动openvpn服务端

openvpn --daemon --config /etc/openvpn/server.conf

六、配置openvpn客户端

6.1、linux客户端

把刚才生成的根证书和客户端密钥传给客户端主机，此处的客户端主机为192.168.12.155

scp /easy-rsa/pki/private/client.key root@192.168.12.155:/etc/openvpn/

scp /easy-rsa/pki/issued/client.crt  root@192.168.12.155:/etc/openvpn/

scp /easy-rsa/pki/ca.crt   root@192.168.12.155:/etc/openvpn/

编辑客户端配置文件

cat /etc/openvpn/client.conf        #本示例服务端IP为192.168.12.129

6.2、GUI客户端

查看证书相关内容

cat /easy-rsa/pki/ca.crt

cat /easy-rsa/pki/issued/client.crt

cat /easy-rsa/pki/private/client.key

根据证书内容编辑一个client.ovpn文件

内容如下

client
dev tap
proto udp
remote 192.168.12.129 1194
resolv-retry infinite
nobind
verb 3
persist-key
comp-lzo

<ca>
-----BEGIN CERTIFICATE-----
MIIDSzCCAjOgAwIBAgIUM2gLxszz62cZ2KIaB0zJIOAZ+5QwDQYJKoZIhvcNAQEL
BQAwFjEUMBIGA1UEAwwLRWFzeS1SU0EgQ0EwHhcNMjQwNjIxMDQ0OTU1WhcNMzQw
NjE5MDQ0OTU1WjAWMRQwEgYDVQQDDAtFYXN5LVJTQSBDQTCCASIwDQYJKoZIhvcN
AQEBBQADggEPADCCAQoCggEBAOT7GW8/WLqV7lrpYgOCn9WxA3SfRC2xJDmWxRh7
tYk3iJx6/nAD2hKicgBynzNOumgjUldDFpHKQlKSOexYob0Qir3EW002SLsWEiLp
hpBM/nYfVzSJ6LoRPFmM18UX03qsjXjQC6mzbnGtG6crt0iD/PwBEAqA2bumYdy+
ZdHgfGAIHY5yoNsP8HJBwbQEQUF4f4K9SHrC5vBRJ8oVKl4ahphEYIGwAeCVPlAw
PxjqhA5kV6pojjDRDWZZjNUAtVqGfi99gGsycxKbII0TaIOxJjAgqY/j4qgCeJVu
ccRwkydZw6samVbmogQNRwCFXs8OCUiJn8B8l93RSldlrG0CAwEAAaOBkDCBjTAd
BgNVHQ4EFgQUnMqVSOXrSIcPhKzXyD+SxHAExz8wUQYDVR0jBEowSIAUnMqVSOXr
SIcPhKzXyD+SxHAExz+hGqQYMBYxFDASBgNVBAMMC0Vhc3ktUlNBIENBghQzaAvG
zPPrZxnYohoHTMkg4Bn7lDAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBBjANBgkq
hkiG9w0BAQsFAAOCAQEABL/y7nVwHLhRRlRH2hPdiMFVH773bBeBfZaXKuHBwgru
ObQKDf6l9RDQnkfUeWPB5vWDXkgYNEEqnvFYdzmUj/h+fS8F+lVSxLDk2fe4tmN4
DTUHXdAwXXf1TSoA+NLDRNt8rBNCdOZWfZSR2GJFfPfwLZwqR94NQpVenZ5vstbm
GzLWAN3HR46+lKjgWBD5S53gncdPhW57y35h9XScCsaG4gLwIFtdJ/4AXMS272i1
HYc/MdJ50omYeFBLtczTgrM3ObiYdHyyBZZm0cDp/Q0GlqRNpZo1wP3krafuQ9TN
EjgovogVED/xhPmQwPwjJwewEalaqlAA4GGWNWZj1A==
-----END CERTIFICATE-----
</ca>
<cert>
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            fc:e3:6a:5e:a9:27:31:3d:28:3d:10:e0:59:8e:bc:29
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=Easy-RSA CA
        Validity
            Not Before: Jun 21 04:55:41 2024 GMT
            Not After : Sep 24 04:55:41 2026 GMT
        Subject: CN=client
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:ce:b3:42:ff:99:a4:e5:41:32:31:52:12:77:75:
                    b5:ce:6c:aa:bb:ab:10:c9:6a:d9:75:68:2d:8e:8e:
                    3a:c2:9c:85:23:46:6d:60:ed:85:5b:05:a8:07:63:
                    87:9a:e6:f4:37:90:23:33:a3:e0:8f:f1:6c:2a:63:
                    aa:67:ad:30:72:54:57:52:c6:82:01:9e:88:82:ea:
                    2a:2b:47:1a:ea:0a:1c:f4:40:d6:12:eb:ef:15:e5:
                    2c:c3:b6:ed:29:ea:ac:1b:dc:c7:66:53:35:6c:ce:
                    90:dc:42:fc:75:d2:a4:dd:ce:87:fe:b4:6c:d3:bf:
                    bd:df:67:0c:45:2f:88:b0:f8:d4:b6:0a:39:9e:61:
                    8a:f5:ff:c0:c1:11:75:69:2b:ad:1a:97:82:13:1d:
                    4c:c7:60:da:dd:98:75:85:97:d3:50:20:f1:1c:15:
                    5d:63:be:64:16:7c:0a:0e:80:83:6b:54:7d:20:f5:
                    3e:e7:21:9a:b7:28:07:75:61:af:f4:3d:85:12:b2:
                    2d:66:c6:f8:f5:f9:a4:f9:d7:bb:af:ff:d3:ec:9f:
                    31:44:21:0a:fd:b7:81:62:23:44:d8:5e:22:ff:42:
                    b3:ae:02:51:76:31:d1:66:93:f5:8e:6d:4b:e5:98:
                    19:ac:42:a1:e6:28:37:b3:8e:3a:c7:70:14:6d:4a:
                    9c:af
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            X509v3 Subject Key Identifier: 
                5C:D7:42:9B:8B:9B:08:90:9D:2E:95:01:12:37:60:78:29:E1:03:14
            X509v3 Authority Key Identifier: 
                keyid:9C:CA:95:48:E5:EB:48:87:0F:84:AC:D7:C8:3F:92:C4:70:04:C7:3F
                DirName:/CN=Easy-RSA CA
                serial:33:68:0B:C6:CC:F3:EB:67:19:D8:A2:1A:07:4C:C9:20:E0:19:FB:94

            X509v3 Extended Key Usage: 
                TLS Web Client Authentication
            X509v3 Key Usage: 
                Digital Signature
    Signature Algorithm: sha256WithRSAEncryption
         2b:ef:49:f4:02:db:87:20:b9:7b:e8:8f:56:a7:e1:b0:37:d7:
         1e:a5:b5:5c:66:2f:21:6a:a1:0e:56:7d:6f:4f:98:f4:1c:1b:
         bf:c0:ac:58:f8:2e:6f:63:45:97:b1:ac:aa:40:92:9e:c9:6c:
         a1:82:dc:32:0f:60:34:f2:13:6d:aa:70:ce:eb:1d:73:ac:b3:
         6a:9e:43:78:13:13:64:57:90:f1:0b:6e:d6:b4:de:4f:07:de:
         c7:54:66:97:f8:0f:82:08:24:a2:98:c0:d5:09:86:73:85:0f:
         40:bb:31:db:86:f0:cd:ed:4d:e3:c8:7c:89:4d:a3:cf:ac:db:
         2e:8f:7d:d2:f0:02:00:a2:af:24:d4:91:7c:b0:3e:94:ba:e4:
         b5:cc:cc:4c:50:a8:a1:f0:79:04:18:ef:8f:63:79:88:11:47:
         f9:87:f9:a3:eb:b9:2e:bd:66:71:93:30:d6:c1:f9:0e:1a:97:
         be:16:9a:f8:23:10:c9:41:d5:ec:4f:4c:74:75:dd:bf:32:0a:
         3f:a8:da:52:99:23:45:9a:d0:6c:d3:4a:12:80:9f:8b:f8:6a:
         5b:b0:c6:8e:f6:de:2b:62:b1:13:32:b9:81:0a:24:d3:4c:3f:
         10:84:b0:b5:97:a7:6c:f8:6f:27:f6:03:b1:11:5f:d0:30:24:
         eb:b5:49:1e
-----BEGIN CERTIFICATE-----
MIIDVTCCAj2gAwIBAgIRAPzjal6pJzE9KD0Q4FmOvCkwDQYJKoZIhvcNAQELBQAw
FjEUMBIGA1UEAwwLRWFzeS1SU0EgQ0EwHhcNMjQwNjIxMDQ1NTQxWhcNMjYwOTI0
MDQ1NTQxWjARMQ8wDQYDVQQDDAZjbGllbnQwggEiMA0GCSqGSIb3DQEBAQUAA4IB
DwAwggEKAoIBAQDOs0L/maTlQTIxUhJ3dbXObKq7qxDJatl1aC2OjjrCnIUjRm1g
7YVbBagHY4ea5vQ3kCMzo+CP8WwqY6pnrTByVFdSxoIBnoiC6iorRxrqChz0QNYS
6+8V5SzDtu0p6qwb3MdmUzVszpDcQvx10qTdzof+tGzTv73fZwxFL4iw+NS2Cjme
YYr1/8DBEXVpK60al4ITHUzHYNrdmHWFl9NQIPEcFV1jvmQWfAoOgINrVH0g9T7n
IZq3KAd1Ya/0PYUSsi1mxvj1+aT517uv/9PsnzFEIQr9t4FiI0TYXiL/QrOuAlF2
MdFmk/WObUvlmBmsQqHmKDezjjrHcBRtSpyvAgMBAAGjgaIwgZ8wCQYDVR0TBAIw
ADAdBgNVHQ4EFgQUXNdCm4ubCJCdLpUBEjdgeCnhAxQwUQYDVR0jBEowSIAUnMqV
SOXrSIcPhKzXyD+SxHAExz+hGqQYMBYxFDASBgNVBAMMC0Vhc3ktUlNBIENBghQz
aAvGzPPrZxnYohoHTMkg4Bn7lDATBgNVHSUEDDAKBggrBgEFBQcDAjALBgNVHQ8E
BAMCB4AwDQYJKoZIhvcNAQELBQADggEBACvvSfQC24cguXvoj1an4bA31x6ltVxm
LyFqoQ5WfW9PmPQcG7/ArFj4Lm9jRZexrKpAkp7JbKGC3DIPYDTyE22qcM7rHXOs
s2qeQ3gTE2RXkPELbta03k8H3sdUZpf4D4IIJKKYwNUJhnOFD0C7MduG8M3tTePI
fIlNo8+s2y6PfdLwAgCiryTUkXywPpS65LXMzExQqKHweQQY749jeYgRR/mH+aPr
uS69ZnGTMNbB+Q4al74WmvgjEMlB1exPTHR13b8yCj+o2lKZI0Wa0GzTShKAn4v4
aluwxo723itisRMyuYEKJNNMPxCEsLWXp2z4byf2A7ERX9AwJOu1SR4=
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDOs0L/maTlQTIx
UhJ3dbXObKq7qxDJatl1aC2OjjrCnIUjRm1g7YVbBagHY4ea5vQ3kCMzo+CP8Wwq
Y6pnrTByVFdSxoIBnoiC6iorRxrqChz0QNYS6+8V5SzDtu0p6qwb3MdmUzVszpDc
Qvx10qTdzof+tGzTv73fZwxFL4iw+NS2CjmeYYr1/8DBEXVpK60al4ITHUzHYNrd
mHWFl9NQIPEcFV1jvmQWfAoOgINrVH0g9T7nIZq3KAd1Ya/0PYUSsi1mxvj1+aT5
17uv/9PsnzFEIQr9t4FiI0TYXiL/QrOuAlF2MdFmk/WObUvlmBmsQqHmKDezjjrH
cBRtSpyvAgMBAAECggEAOTp2pVAD0JmBbRhdFogXoySBDN6rEiksNg529o44hKNT
VVXteLWqg24IfKs441Focm3M4UJRLWlZWk8n4faYgD8LwlZFrm8XOq/cpwjT0dKk
+5dr7ec21egSwclG1qErr7cr2g/Vrd9vShydy31bujGxg3qu2t2uk0jzo8AqZ1yt
itbRS+rILet7TngFlmp5sdThpqLgu+inzvCLOPSD/GDJEbFiSn2HyQOlUpmiKSEF
/qx/xhRyKGychIg3y4bEN3qPiQsqZIoA/AjGUhNMfPVinD5LlDxzy+w+A28mwpiH
LMEfTWJuGpXoyg2KwDU1T39rvg2qCg7pAfj9IkRlqQKBgQD9CSM96BRmk6q0WNVM
2mhDAUPpTm9o/2UeDJc1Wc3SdjWu2Jz7eUOA7ZwzsqUtblENA26JSlThm+NuEw8I
xfXmBOqgGAYQTR3bW5CTIsBYZeHtFCEEmIJw70DG1hKb++E3aglp0MDtqLW69SGW
9ClxnHTVYk4GtkwqMi8bN6ZL0wKBgQDRHymaHN6ZoWqaaR6D+ZtNXpsJJlwKbXUP
p08gsBMg/fg34xL4ZlPb8UfQEBvF6jt5tqO5dLpvXOPivyH87BMOcAGqPFw1te58
90OctbBCK94o1hLKuQMBr5fmr1zOwkQEDnfoz2O4LJeKKFZ9EAUsaxqv7KUgsqN4
K3fBa68uNQKBgQDvTl4LJVtt68gtCjqolYK3pBGzK+AIAEqEkcnLxiP3IJ8CvpAw
8O2bmJz688Bt6AA1e4Jly2vddw4vw0ybsoUtxoaTZEUP068iD0X7MYmR0MFL85aK
fyYWYt/zbPBqn1vPibRfY/OikMVWjJD47+/mJ98DFBbRGEWOPqn4ZrgaywKBgFVY
zYbLP4Id4b8RJdYg+eQSt119nVTYJU11MBMcKUJuxG4yq5xbTuBV0cQ1vtAAb7OV
+a4H2Mr4cz0oWnu58XET/2n15oA5NxMjayG6+SuYcbvi2pqH9ZUrj+gjK9JqcI3j
RcbrVTxmXpaRLfMupZ3iPGsOPrpgjdzOiLqU81L9AoGAF0cknqvleT4umJAAnEd8
QjVMam/3hZzMotbAJLCa0OMqW0iVS6c/e2OqM6LYPowbJ2d3Ob7ci3MofccptKv/
p7ogNkSUfUJoz4R1x8QcMqSwkiyecra1uAGysj3d+4F/EApLH1WiW7x03AWuoK1l
QN7j3JxHScMAqMGgbidtf70=
-----END PRIVATE KEY-----
</key>

七、启动openvpn客户端

7.1、linux客户端

openvpn --daemon --config /etc/openvpn/client.conf

7.2、GUI客户端

双击打开客户端，右下角生成小图标

右键单击选择导入配置文件

选择client.ovpn导入

然后点击client选择连接

八、其他

8.1、注意服务端防火墙放行对应的协议和端口号

8.2、使用用户名密码验证连接

服务端配置更改如下：

cat /etc/openvpn/server.conf

mkdir /etc/openvpn/ccd

编辑帐号密码验证脚本

cat /etc/openvpn/auth.sh

chmod +x /etc/openvpn/auth.sh

客户端帐号密码文件，注意用英文冒号分隔

客户端配置更改如下：

linux客户端配置改为

client
dev tap
proto udp
remote 192.168.12.129 1194
resolv-retry infinite
nobind
ca /etc/openvpn/ca.crt
verb 3
persist-key
comp-lzo

九、故障排查

9.1、openvpn版本差异导致tls协商失败

低版本侧错误日志如下：

TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
TLS Error: TLS handshake failed

高版本侧错误日志如下：

openvpn[12593]: 172.20.12.37:1194 TLS error: Unsupported protocol. This typically indicates that client and server have no common TLS version enabled. This can be caused by mismatched tls-version-min and tls-version-max options on client and server. If your OpenVPN client is between v2.3.6 and v2.3.2 try adding tls-version-min 1.0 to the client configuration to use TLS 1.0+ instead of TLS 1.0 only
openvpn[12593]: 172.20.12.37:1194 OpenSSL: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol
openvpn[12593]: 172.20.12.37:1194 TLS_ERROR: BIO read tls_read_plaintext error
openvpn[12593]: 172.20.12.37:1194 TLS Error: TLS object -> incoming plaintext read error
openvpn[12593]: 172.20.12.37:1194 TLS Error: TLS handshake failed

因为高版本可以向下兼容，所以此时应该在较高版本侧配置当中添加如下配置
tls-version-min 1.0