搭建openvpn服务器桥接模式.doc

服务器 rhel5.8-64bit 软件版本openvpn-2.0.9.tar.gz (安装包)openvpn-2.0.9-gui-1.0.3-install.exe (客户端)lzo-2.03.tar.gzopenssl系统自带1.安装opensslrootsamba-wiki openvpn# yum install openssl.x86_64 -y2.安装lzorootsamba-wiki lzo-2.03# ./configurerootsamba-wiki lzo-2.03# make rootsamba-wiki lzo-2.03# make install3.安装OpenVPNrootsamba-wiki openvpn-2.0.9# ./configure -enable-pthreadrootsamba-wiki openvpn-2.0.9# make & make install 4.配置TUN/TAP驱动，并且启用IP转发rootsamba-wiki openvpn# modprobe tunrootsamba-wiki openvpn# lsmod |grep tuntun 82241 2rootsamba-wiki openvpn# vim /etc/sysctl.conf 修改net.ipv4.ip_forward = 0为1，使配置生效rootsamba-wiki openvpn# sysctl -p5.配置openvpnA.生成证书第一步，设置环境变量rootsamba-wiki openvpn# vim /root/.bash_profile在最后添加这几行DIR=/usr/src/openvpn/openvpn-2.0.9/easy-rsaKEY_CONFIG=$DIR/fKEY_DIR=$DIR/keysKEY_SIZE=1024KEY_COUNTRY=CNKEY_PROVINCE=BJKEY_CITY=BJKEY_ORG=crediteaseKEY_EMAIL=export KEY_CONFIG KEY_DIR KEY_SIZE KEY_COUNTRY KEY_PROVINCE KEY_CITY KEY_ORG KEY_EMAIL DIR使环境变量生效rootsamba-wiki openvpn# source /root/.bash_profile第二步，生成证书1.进入安装包的easy-rsa目录rootsamba-wiki easy-rsa# pwd/usr/src/openvpn/openvpn-2.0.9/easy-rsa2.生成CA证书rootsamba-wiki easy-rsa# ./clean-all rootsamba-wiki easy-rsa# ./build-ca 3.生成服务器Keyrootsamba-wiki easy-rsa# ./build-key-server server 4.生成客户端Keyrootsamba-wiki easy-rsa# ./build-key chenyu #这里以用户名字命名key rootsamba-wiki keys# ls chenyu.*chenyu.crt chenyu.csr chenyu.key #可以看到生成了chenyu的相关证书rootsamba-wiki easy-rsa# ./build-dh 5.生成ta.keyrootsamba-wiki easy-rsa# openvpn -genkey -secret ta.keyB.创建OpenVPN配置文件rootsamba-wiki easy-rsa# vi /usr/local/etc/server.confport 2194proto tcpdev tap0server-bridge 28 54push dhcp-option DNS 3push dhcp-option DNS 4ifconfig-pool-persist /usr/local/etc/ipp.txtca /usr/local/etc/keys/ca.crtcert /usr/local/etc/keys/server.crtkey /usr/local/etc/keys/server.keydh /usr/local/etc/keys/dh1024.pemtls-auth /usr/local/etc/keys/ta.key 0keepalive 10 120comp-lzostatus /var/log/openvpn-status.logverb 4persist-keypersist-tun把相应的ca.crt，server.crt，server.key，dh1024.pem，ta.key文件copy到相应的路径C.启动OpenVPN(后台进程)rootsamba-wiki easy-rsa# /usr/local/sbin/openvpn -daemon -config /usr/local/etc/server.confD.设置桥接网卡rootsamba-wiki easy-rsa# yum isntall -y bridge-utils.x86_642.编辑bridge-start脚本rootsamba-wiki sample-scripts# pwd/usr/src/openvpn/openvpn-2.0.9/sample-scriptsrootsamba-wiki sample-scripts# vim bridge-start修改如下# Define Bridge Interfacebr=br0 # Define list of TAP interfaces to be bridged,# for example tap=tap0 tap1 tap2.tap=tap0 # Define physical ethernet interface to be bridged# with TAP interface(s) above.eth=eth0eth_ip=eth_netmask=eth_broadcast=553.启动脚本，重启OpenVPN服务rootsamba-wiki sample-scripts# ./bridge-start6.客户端配置将ca.crt,dh1024.pem,ta.key,chenyu.crt,chenyu.key下载到客户端，安装openvpn-2.0.9-gui-1.0.3-install.exe客户端工具，将证书放在安装路径的config目录下，创建配置文件client.ovpn内容如下client dev