OpenVPN虚拟专用通道

一、部署环境

系统	IP 地址	主机名
CentOS 7.9	192.168.15.201(外网) 172.16.1.201(内网)	vpnserver
Windows 11	192.168.15.1(外网)
CentOS 7.9	192.168.15.202(外网) 172.16.1.202(内网)	vpnclient
CentOS 7.9	101.201.149.222(外网) 10.0.0.27(内网)	aliyun

二、前期准备

1. 添加私网网卡

两台主机都要添加私网网卡，这里只演示出一台

确定保存就可

第二台主机也按该步骤添加网卡，保存后启动两台虚拟机

[root@cent01 ~]# ifconfig 
ens32: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.15.201  netmask 255.255.255.0  broadcast 192.168.15.255
        inet6 fe80::995c:6d07:6a98:e54  prefixlen 64  scopeid 0x20<link>
        ether 00:0c:29:78:3e:28  txqueuelen 1000  (Ethernet)
        RX packets 217  bytes 26494 (25.8 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 164  bytes 18700 (18.2 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

ens34: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500		# 查看新网卡的设备名称，本次私网网卡名称为ens34
......省略部分内容......
[root@cent01 ~]# nmcli connection add ifname ens34 con-name ens34 type ethernet ip4 172.16.1.201/24		
# 添加新网卡到系统设备，IP设置为上面设定好的LAN区段内的任意IP，网段为172.16.1.0/24，不要设置网关，否则就变成了公网网卡

# 客户端，也先ifconfig看一眼网卡名称，然后再创建，如果是eth开头的，ifname和con-name就需要修改
[root@cent01 ~]# nmcli connection add ifname ens34 con-name ens34 type ethernet ip4 172.16.1.202/24

# 查看两台主机的新网卡信息
# 服务端：
[root@cent01 ~]# ip a s ens34
3: ens34: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 00:0c:29:78:3e:32 brd ff:ff:ff:ff:ff:ff
    inet 172.16.1.201/24 brd 172.16.1.255 scope global noprefixroute ens34
       valid_lft forever preferred_lft forever
    inet6 fe80::bcbc:3e84:26f2:eb2d/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever

# 客户端：
[root@cent02 ~]# ip a s ens34
3: ens34: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 00:0c:29:a8:56:44 brd ff:ff:ff:ff:ff:ff
    inet 172.16.1.202/24 brd 172.16.1.255 scope global noprefixroute ens34
       valid_lft forever preferred_lft forever
    inet6 fe80::6d72:84f4:793a:5f94/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever
# 到此网卡配置完成

2. 安装必要工具

两台主机都安装

[root@cent01 ~]# yum -y install epel-release		# 安装epel源
[root@cent01 ~]# yum -y install easy-rsa openvpn zip lrzsz 

3. 更改主机名

# 服务端修改
[root@cent01 ~]# hostnamectl set-hostname vpnserver
[root@cent01 ~]# bash
bash
[root@vpnserver ~]# 

# 客户端修改
[root@cent02 ~]# hostnamectl set-hostname vpnclient
[root@cent02 ~]# bash
bash
[root@vpnclient ~]# 

三、证书颁发

1. 配置变量

[root@vpnserver ~]# mkdir /opt/easy-rsa
[root@vpnserver ~]# cd /opt/easy-rsa
[root@vpnserver easy-rsa]# cp -a /usr/share/easy-rsa/3.0.8/* .
[root@vpnserver easy-rsa]# cp -a /usr/share/doc/easy-rsa-3.0.8/vars.example ./vars
[root@vpnserver easy-rsa]# cat >> vars << EOF
> set_var EASYRSA_DN "cn_only"
> set_var EASYRSA_REQ_COUNTRY "CN"
> set_var EASYRSA_REQ_PROVINCE "Beijing"
> set_var EASYRSA_REQ_CITY "Shanghai"
> set_var EASYRSA_REQ_ORG "yang"
> set_var EASYRSA_REQ_EMAIL "888888@qq.comm"
> set_var EASYRSA_NS_SUPPORT "yes"
> EOF
[root@vpnserver easy-rsa]# egrep -v "^#|^$" vars
if [ -z "$EASYRSA_CALLER" ]; then
	echo "You appear to be sourcing an Easy-RSA 'vars' file." >&2
	echo "This is no longer necessary and is disallowed. See the section called" >&2
	echo "'How to use this file' near the top comments for more details." >&2
	return 1
fi
set_var EASYRSA_DN "cn_only"
set_var EASYRSA_REQ_COUNTRY "CN"
set_var EASYRSA_REQ_PROVINCE "Beijing"
set_var EASYRSA_REQ_CITY "Shanghai"
set_var EASYRSA_REQ_ORG "yang"
set_var EASYRSA_REQ_EMAIL "888888@qq.comm"
set_var EASYRSA_NS_SUPPORT "yes"

2. 配置证书

[root@vpnserver easy-rsa]# ./easyrsa init-pki

Note: using Easy-RSA configuration from: /opt/easy-rsa/vars

init-pki complete; you may now create a