一、部署环境
系统 |
IP 地址 |
主机名 |
CentOS 7.9 |
192.168.15.201(外网) 172.16.1.201(内网) |
vpnserver |
Windows 11 |
192.168.15.1(外网) |
|
CentOS 7.9 |
192.168.15.202(外网) 172.16.1.202(内网) |
vpnclient |
CentOS 7.9 |
101.201.149.222(外网) 10.0.0.27(内网) |
aliyun |
二、前期准备
1. 添加私网网卡
两台主机都要添加私网网卡,这里只演示出一台
确定保存就可
第二台主机也按该步骤添加网卡,保存后启动两台虚拟机
[root@cent01 ~]# ifconfig
ens32: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 192.168.15.201 netmask 255.255.255.0 broadcast 192.168.15.255
inet6 fe80::995c:6d07:6a98:e54 prefixlen 64 scopeid 0x20<link>
ether 00:0c:29:78:3e:28 txqueuelen 1000 (Ethernet)
RX packets 217 bytes 26494 (25.8 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 164 bytes 18700 (18.2 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
ens34: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 # 查看新网卡的设备名称,本次私网网卡名称为ens34
......省略部分内容......
[root@cent01 ~]# nmcli connection add ifname ens34 con-name ens34 type ethernet ip4 172.16.1.201/24
# 添加新网卡到系统设备,IP设置为上面设定好的LAN区段内的任意IP,网段为172.16.1.0/24,不要设置网关,否则就变成了公网网卡
# 客户端,也先ifconfig看一眼网卡名称,然后再创建,如果是eth开头的,ifname和con-name就需要修改
[root@cent01 ~]# nmcli connection add ifname ens34 con-name ens34 type ethernet ip4 172.16.1.202/24
# 查看两台主机的新网卡信息
# 服务端:
[root@cent01 ~]# ip a s ens34
3: ens34: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether 00:0c:29:78:3e:32 brd ff:ff:ff:ff:ff:ff
inet 172.16.1.201/24 brd 172.16.1.255 scope global noprefixroute ens34
valid_lft forever preferred_lft forever
inet6 fe80::bcbc:3e84:26f2:eb2d/64 scope link noprefixroute
valid_lft forever preferred_lft forever
# 客户端:
[root@cent02 ~]# ip a s ens34
3: ens34: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether 00:0c:29:a8:56:44 brd ff:ff:ff:ff:ff:ff
inet 172.16.1.202/24 brd 172.16.1.255 scope global noprefixroute ens34
valid_lft forever preferred_lft forever
inet6 fe80::6d72:84f4:793a:5f94/64 scope link noprefixroute
valid_lft forever preferred_lft forever
# 到此网卡配置完成
2. 安装必要工具
两台主机都安装
[root@cent01 ~]# yum -y install epel-release # 安装epel源
[root@cent01 ~]# yum -y install easy-rsa openvpn zip lrzsz
3. 更改主机名
# 服务端修改
[root@cent01 ~]# hostnamectl set-hostname vpnserver
[root@cent01 ~]# bash
bash
[root@vpnserver ~]#
# 客户端修改
[root@cent02 ~]# hostnamectl set-hostname vpnclient
[root@cent02 ~]# bash
bash
[root@vpnclient ~]#
三、证书颁发
1. 配置变量
[root@vpnserver ~]# mkdir /opt/easy-rsa
[root@vpnserver ~]# cd /opt/easy-rsa
[root@vpnserver easy-rsa]# cp -a /usr/share/easy-rsa/3.0.8/* .
[root@vpnserver easy-rsa]# cp -a /usr/share/doc/easy-rsa-3.0.8/vars.example ./vars
[root@vpnserver easy-rsa]# cat >> vars << EOF
> set_var EASYRSA_DN "cn_only"
> set_var EASYRSA_REQ_COUNTRY "CN"
> set_var EASYRSA_REQ_PROVINCE "Beijing"
> set_var EASYRSA_REQ_CITY "Shanghai"
> set_var EASYRSA_REQ_ORG "yang"
> set_var EASYRSA_REQ_EMAIL "888888@qq.comm"
> set_var EASYRSA_NS_SUPPORT "yes"
> EOF
[root@vpnserver easy-rsa]# egrep -v "^#|^$" vars
if [ -z "$EASYRSA_CALLER" ]; then
echo "You appear to be sourcing an Easy-RSA 'vars' file." >&2
echo "This is no longer necessary and is disallowed. See the section called" >&2
echo "'How to use this file' near the top comments for more details." >&2
return 1
fi
set_var EASYRSA_DN "cn_only"
set_var EASYRSA_REQ_COUNTRY "CN"
set_var EASYRSA_REQ_PROVINCE "Beijing"
set_var EASYRSA_REQ_CITY "Shanghai"
set_var EASYRSA_REQ_ORG "yang"
set_var EASYRSA_REQ_EMAIL "888888@qq.comm"
set_var EASYRSA_NS_SUPPORT "yes"
2. 配置证书
[root@vpnserver easy-rsa]# ./easyrsa init-pki
Note: using Easy-RSA configuration from: /opt/easy-rsa/vars
init-pki complete; you may now create a