openvpn 搭建

  • 企业级 OpenVPN 搭建
    • OpenVPN 单机搭建
      • OpenVPN 安装
      • 证书文件生成
      • OpenVPN 服务端配置
      • 客户端证书创建、客户端工具下载安装
    • OpenVPN 跨机房部署
      • 办公网络访问 阿里云网络、IDC 网络
      • 在外人员访问阿里云网络、IDC 网络、办公网络
      • 实现 IDC 网络、阿里云网络、公司网络互通

OpenVPN 单机搭建

1.0 环境

1.1 系统配置
  • openvpn_version: 2.4.11
系统版本eth0eth1描述
centos 7.9ens33: 192.168.1.230ens36: 10.10.10.100最低配置: 1C/2G/100G
1.2 tun 模式部署
1
2
3
4
// tun 模式: 客户端服务器模式
// 常见场景:
    1. 在外办公人员
    2. 方便在家办公人员

2.0 OpenVPN 安装

2.1 安装前准备
1
2
3
4
// openvpn 对时间要求较高,部署前需将时间校准
# yum -y install ntpdate ntp
# timedatectl set-timezone Asia/Shanghai
# echo '*/10 * * * * /usr/sbin/ntpdate -u ntp1.aliyun.com >/dev/null 2>&1; /sbin/hwclock -w' >> /var/spool/cron/root
2.2 OpenVPN yum 安装
1
2
3
# yum -y install openvpn easy-rsa iptables*
# mkdir -p /data/{apps/openvpn,logs/openvpn}
# cp -R /usr/share/easy-rsa/ /data/apps/openvpn/

3.0 证书文件生成

3.1 pki 和 证书
初始化 pki
1
2
# cd /data/apps/openvpn/easy-rsa/3/
# ./easyrsa init-pki                                        # 初始化 pki
创建根证书
1
2
3
4
5
# ./easyrsa build-ca nopass                                 # 创建私有 ca
    nopass 参数表示,不需要密码
    Common Name (eg: your user, host, or server name) [Easy-RSA CA]:ink8s.com
    /data/apps/openvpn/easy-rsa/3/pki/ca.crt
# openssl x509 -in pki/ca.crt -text -noout                  # 查看 ca 的约束是否为TRUE
创建服务器证书
1
2
3
4
# ./easyrsa build-server-full ovpn01.ink8s.com nopass        # 创建服务器证书
    ovpn01.ink8s.com        # 证书名称
    nopass                  # 不使用密码
# openssl x509 -noout -text -in /data/apps/openvpn/easy-rsa/3/pki/issued/ovpn01.ink8s.com.crt	# 校验产生的服务器证书信息
其它证书
1
2
3
4
5
6
7
8
# ./easyrsa gen-dh                                        # 生成加密证书
    /data/apps/openvpn/easy-rsa/3/pki/dh.pem
    
// 使用 tls 增加远端 vpn 的安全性
# openvpn --genkey --secret ta.key                        # 产生 tls 认证秘钥;防止 DoS 和 TLS 攻击

// 可选; 检查服务器证书是否有可扩展属性。有将会一定程度上增加安全性
# openssl x509 -text -noout -in /data/apps/openvpn/easy-rsa/3/pki/issued/ovpn01.ink8s.com.crt | grep -C 1 "Key Usage"
创建一个吊销列表
1
2
3
// 用于客户端证书吊销管理
# ./easyrsa gen-crl
# openssl crl -noout -text -in /data/apps/openvpn/easy-rsa/3/pki/crl.pem	# 查看吊销列表里面的吊销证书
整理证书文件
1
2
3
4
5
6
7
8
9
10
11
12
# mkdir -p /data/apps/openvpn/cert
// 根证书
# chmod 700 /data/apps/openvpn/cert
# cp -a pki/private/ca.key /data/apps/openvpn/cert
# cp -a pki/ca.crt /data/apps/openvpn/cert/
// 服务器证书
# cp -a pki/private/ovpn01.ink8s.com.key /data/apps/openvpn/cert/
# cp -a pki/issued/ovpn01.ink8s.com.crt /data/apps/openvpn/cert/
// 其它证书
# cp -a ta.key /data/apps/openvpn/cert/
# cp -a pki/dh.pem /data/apps/openvpn/cert/
# cp -a /data/apps/openvpn/easy-rsa/3/pki/crl.pem /data/apps/openvpn/cert/

4.0 OpenVPN 服务端配置

4.1 主配置文件
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
# cat /data/apps/openvpn/openvpn-server.conf
proto tcp                                                # 使用协议 tcp [推荐]
port 1200                                                # 监听端口 1194 [可自定义修改其它端口]
dev tun                                                  # 采用设备 tun; 只服务器端侦听端口 1194
server 10.200.0.0 255.255.255.0                          # tun 分配所有设备的地址段
topology subnet                                          # 解决 windows 客户端掩码 /30 问题
persist-key                                              # key也是持久连接
persist-tun                                              # 建立持久连接会话
cipher AES-256-CBC                                       # 加密传输
comp-lzo                                                 # 开启openvpn 连接压缩,服务端开启则客户端也需开启
max-clients 1000                                         # 定义最大客户端并发连接数量
sndbuf 393216                                            # 设置 tcp/udp 发送缓冲区大小;增加吞吐率
rcvbuf 393216                                            # 设置 tcp/udp 接收缓冲区大小;增加吞吐率
keepalive 10 60                                          # 保持连接是 10s,重试60s

tls-auth /data/apps/openvpn/cert/ta.key 0                # tls 认证; 0 表示服务端方向
dh /data/apps/openvpn/cert/dh.pem                        # 加密证书
ca /data/apps/openvpn/cert/ca.crt                        # 根证书
cert /data/apps/openvpn/cert/ovpn01.ink8s.com.crt        # 服务器证书
key /data/apps/openvpn/cert/ovpn01.ink8s.com.key         # 服务器证书
crl-verify /data/apps/openvpn/cert/crl.pem		 # 开启 crl 验证功能

user  openvpn                                            # 使用 openvpn 用户启服务
group openvpn                                            # openvpn 用户组
verb 3                                                   # 日志输出级别; 默认级别 1,推荐级别 3
daemon                                                   # 以守护进程方式启动

push "dhcp-option DNS 223.5.5.5"                         # 公网 DNS
push "dhcp-option DNS 10.10.10.114"                      # 内网 DNS
push "route 10.10.10.0 255.255.255.0"                    # 客户端去到 IDC 内网的网段
# push "route 101.66.48.19 255.255.255.255"              # 允许路由到指定服务器。(安全组互相放行 IP:PORT 即可互通,如 GitLab 不在同一个内网等)

log-append /data/logs/openvpn/openvpn-server.log         # 以追加的方式写到日志文件里
status     /data/logs/openvpn/openvpn-status.log         # 状态文件,记录客户端连接的详细信息
ifconfig-pool-persist /data/logs/openvpn/openvpn-ipp.txt # 记录已分配的虚拟 IP 和客户端的对应关系; openvpn 重启会续继续借此对应 IP
4.2 日志目录赋权
1
# chown openvpn:openvpn /data/logs/openvpn
4.3 启用 IP 转发 和 防火墙配置
1
2
3
4
5
6
7
8
9
# echo -e "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf
# echo -e "net.core.rmem_default = 393216" >> /etc/sysctl.conf
# echo -e "net.core.wmem_default = 393216" >> /etc/sysctl.conf
# sysctl -p

# systemctl start iptables && systemctl enable iptables
# iptables -F
# iptables -t nat -A POSTROUTING -s 10.200.0.0/24 -j MASQUERADE
# iptables-save > /etc/sysconfig/iptables
4.4 OpenVPN 启动配置文件
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
# cat > /usr/lib/systemd/system/openvpn.service << _EOF_
[Unit]
Description=OpenVPN Service
After=network.target
    
[Service]
Type=forking
ExecStart=/usr/sbin/openvpn --daemon --config /data/apps/openvpn/openvpn-server.conf
ExecStop=/usr/bin/kill -s QUIT $MAINPID
TimeoutStopSec=0
SendSIGKILL=on

[Install]
WantedBy=multi-user.target
_EOF_
# systemctl daemon-reload
# systemctl start openvpn && systemctl enable openvpn
# netstat -nlput|grep 1200

5.0 客户端证书

5.1 客户端证书创建
1
2
# mkdir /data/apps/openvpn/client_cert_file		# 创建客户端证书备份目录
# touch /data/apps/openvpn/ovpnuser			# 添加或删除的用户名写在此文件中
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
#!/bin/bash
# Dest: OpenVPN 客户端证书文件创建并合并为一个证书文件

APPS_DIR='/data/apps/openvpn'
EASY_SRA_DIR="${APPS_DIR}/easy-rsa/3/"
CLIENT_CERT_FILE_DIR="${APPS_DIR}/client_cert_file/"
OVPN_USER_INDEX="${APPS_DIR}/easy-rsa/3/pki/index.txt"
OVPN_REMOTE_IP='ovpn.ink8s.com'
OVPN_PORT='1200'


# 判断是否为空参数
if [ -z $1 ]; then
    echo "参数为空,输入参数: ovpnuser。请将需要添加的用户名写入此参数文件中"
    exit 1
# 判断参数是否输入错误
elif [ $1 != 'ovpnuser' ]; then
    echo "参数输入错误,输入参数: ovpnuser。请将需要添加的用户名写入此参数文件中"
    exit 2
else
   OVPN_USER_FILE=$(cat ${APPS_DIR}/$1)
fi

create_ovpn_cert() {
    cd ${EASY_SRA_DIR}
    ./easyrsa build-client-full ${OVPN_USER} nopass &> /dev/null
    echo -e "client\nproto tcp\nremote ${OVPN_REMOTE_IP}\nport ${OVPN_PORT}\ndev tun\nnobind\ncomp-lzo\ncipher AES-256-CBC\nsndbuf 393216\nrcvbuf 393216\nresolv-retry infinite\nremote-cert-tls server\nverb 3" >  ${CLIENT_CERT_FILE_DIR}/${OVPN_USER}.ovpn
    echo '<ca>' >>  ${CLIENT_CERT_FILE_DIR}/${OVPN_USER}.ovpn; cat pki/ca.crt >> ${CLIENT_CERT_FILE_DIR}/${OVPN_USER}.ovpn; echo '</ca>' >> ${CLIENT_CERT_FILE_DIR}/${OVPN_USER}.ovpn
    echo '<cert>' >> ${CLIENT_CERT_FILE_DIR}/${OVPN_USER}.ovpn; cat pki/issued/${OVPN_USER}.crt >> ${CLIENT_CERT_FILE_DIR}/${OVPN_USER}.ovpn; echo '</cert>' >>  ${CLIENT_CERT_FILE_DIR}/${OVPN_USER}.ovpn
    echo '<key>' >> ${CLIENT_CERT_FILE_DIR}/${OVPN_USER}.ovpn; cat pki/private/${OVPN_USER}.key >> ${CLIENT_CERT_FILE_DIR}/${OVPN_USER}.ovpn; echo '</key>' >> ${CLIENT_CERT_FILE_DIR}/${OVPN_USER}.ovpn
    echo '<tls-auth>' >> ${CLIENT_CERT_FILE_DIR}/${OVPN_USER}.ovpn; grep -v '^#' ${APPS_DIR}/cert/ta.key >> ${CLIENT_CERT_FILE_DIR}/${OVPN_USER}.ovpn; echo -e "</tls-auth>\nkey-direction 1" >> ${CLIENT_CERT_FILE_DIR}/${OVPN_USER}.ovpn
    echo "${OVPN_USER} Create success."
    true > ${APPS_DIR}/ovpnuser
}

delete_ovpn_cert() {
    cd ${EASY_SRA_DIR}
    echo -e 'yes\n' | ./easyrsa revoke ${OVPN_USER} &> /dev/null
    ./easyrsa gen-crl &> /dev/null
    rm -f ${EASY_SRA_DIR}pki/issued/${OVPN_USER}.crt
    rm -f ${EASY_SRA_DIR}pki/private/${OVPN_USER}.key
    rm -f ${APPS_DIR}/client_cert_file/${OVPN_USER}.ovpn
    \cp ${EASY_SRA_DIR}pki/crl.pem ${APPS_DIR}/cert/
    echo "${OVPN_USER} Delete success."
    # 重启 openvpn 服务端注销生效,所有客户端会重新进行连接
    # systemctl restart openvpn
    true > ${APPS_DIR}/ovpnuser
}

# 添加 openvpn 用户
add_user() {
    for OVPN_USER in ${OVPN_USER_FILE}; do
        # 查询用户名是否已存在
        EXISTED_USER=$(grep "$OVPN_USER" "$OVPN_USER_INDEX" | awk -F= '/^V/{print $2}')
        if [ -z $EXISTED_USER ]; then
            create_ovpn_cert
        else
            echo "${OVPN_USER} 用户已存在"
            exit 3
        fi
    done
}

# 删除 openvpn 用户
del_user() {
    for OVPN_USER in ${OVPN_USER_FILE} ;do
        delete_ovpn_cert
    done
}

PS3="Run command: "
select choice in add_user del_user exit; do
    case $choice in
        add_user)
           $choice
           exit
           ;;
        del_user)
           $choice
           exit
           ;;
        exit)
           echo "Bye~"
           exit
           ;;
    esac
done
5.2 Windows OpenVPN 客户端安装
Windows 客户端连接
1
2
3
4
5
1. PC客户端官方下载链接: https://openvpn.net/community-downloads/				   # 图1
2. Windows 10 OpenVPN安装: Next > I Agree > Next > Install > Next > Finish
  桌面"OpenVPN GUI"右键属性 > 选择"兼容性"： 勾选"以管理员身份运行此程序" > 应用.确定		   # 图2
3. 将服务器上创建的客户端证书文件放到OpenVPN客户端指定目录下: C:\Program Files\OpenVPN\config	   # 图3
4. PC客户端即可正常连接到内网。如登录报错可右键显示日志,查看报错原因

upload successful

upload successful

upload successful

upload successful

5.3 Mac OpenVPN 客户端安装
Mac OS客户端连接
1
2
3
1. 安装不介绍
2. 证书配置基本和Windows类似。不一样的地方是没有config配置文件,在安装目录新建一个conf配置文件夹将证书文件放进去即可
3. 下载链接: https://tunnelblick.net/index.html

upload successful

OpenVPN 跨机房部署

6.0 架构拓扑图

upload successful

6.1 部署环境
主机IP描述
IDC 服务器wan_192.168.3.160模拟公网IP地址,实际配置vmware局域网桥接模式
lan_10.10.10.100模拟纯内网IP地址,实际为vmware 10.10.10.0/24网段的仅主机模式网络
云厂商 服务器wan_192.168.3.170模拟公网IP地址,实际配置vmware局域网桥接模式
lan_10.10.20.200模拟纯内网IP地址,实际为vmware 10.10.20.0/24网段的仅主机模式网络
办公室 服务器wan_192.168.3.dhcp模拟办公室拨号出口公网IP地址,会不定期变动
lan_10.10.30.200模拟纯内网IP地址,实际为vmware 10.10.30.0/24网段的仅主机模式网络
6.2 环境
1
2
3
4
5
6
7
// 使用 vmware 工具实现全部实验演示。实际生产环境部署,根据具体需求调整
// 涉及路由部分,采用 pfsense 软路由配置静态路由; 生产环境协同网络工程师完成路由指向

os_version: centos 7.9
openvpn_version: 2.4.11
pfsense_version: 2.5.1

7.0 预备环境及安装

openvpn 安装
1
2
3
4
5
6
7
8
9
// openvpn server 端安装
// host
    192.168.3.160	IDC 服务器
    192.168.3.170	云厂商服务器
    192.168.3.dhcp	办公室服务器

# yum -y install openvpn easy-rsa iptables*
# mkdir -p /data/{apps/openvpn/cert,logs/openvpn}
# cp -R /usr/share/easy-rsa/ /data/apps/openvpn/
7.1 证书准备
IDC 服务器
1
2
3
4
5
6
7
// 创建 ca 证书
# cd /data/apps/openvpn/easy-rsa/3/
# ./easyrsa init-pki                                        # 初始化 pki
# ./easyrsa build-ca
    Enter New CA Key Passphrase: ink8s.com
    Re-Enter New CA Key Passphrase: ink8s.com
    Common Name (eg: your user, host, or server name) [Easy-RSA CA]:ca.ink8s.com
IDC 服务器
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
// 创建 IDC 服务器证书
# ./easyrsa build-server-full idc.ink8s.com
Enter PEM pass phrase: ink8s.com
Verifying - Enter PEM pass phrase: ink8s.com
Enter pass phrase for /data/apps/openvpn/easy-rsa/3/pki/private/ca.key: ink8s.com

// 创建 云厂商 服务器证书
# ./easyrsa build-server-full ali.ink8s.com
Enter PEM pass phrase: ink8s.com
Verifying - Enter PEM pass phrase: ink8s.com
Enter pass phrase for /data/apps/openvpn/easy-rsa/3/pki/private/ca.key: ink8s.com

// 创建 办公室 服务器证书
# ./easyrsa build-server-full office.ink8s.com
Enter PEM pass phrase: ink8s.com
Verifying - Enter PEM pass phrase: ink8s.com
Enter pass phrase for /data/apps/openvpn/easy-rsa/3/pki/private/ca.key: ink8s.com

// 创建 出差办公人员 服务器证书
# ./easyrsa build-server-full access.ink8s.com
Enter PEM pass phrase: ink8s.com
Verifying - Enter PEM pass phrase: ink8s.com
Enter pass phrase for /data/apps/openvpn/easy-rsa/3/pki/private/ca.key: ink8s.com

// 校验服务器证书
# openssl x509 -noout -text -in /data/apps/openvpn/easy-rsa/3/pki/issued/idc.ink8s.com.crt
# openssl x509 -noout -text -in /data/apps/openvpn/easy-rsa/3/pki/issued/ali.ink8s.com.crt
# openssl x509 -noout -text -in /data/apps/openvpn/easy-rsa/3/pki/issued/office.ink8s.com.crt
# openssl x509 -noout -text -in /data/apps/openvpn/easy-rsa/3/pki/issued/access.ink8s.com.crt
IDC 服务器
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
// 创建客户端证书

# ./easyrsa build-client-full idc-client.ink8s.com
Enter PEM pass phrase: ink8s.com
Verifying - Enter PEM pass phrase: ink8s.com
Enter pass phrase for /data/apps/openvpn/easy-rsa/3/pki/private/ca.key: ink8s.com

# ./easyrsa build-client-full ali-client.ink8s.com
Enter PEM pass phrase: ink8s.com
Verifying - Enter PEM pass phrase: ink8s.com
Enter pass phrase for /data/apps/openvpn/easy-rsa/3/pki/private/ca.key: ink8s.com

# ./easyrsa build-client-full office-client.ink8s.com
Enter PEM pass phrase: ink8s.com
Verifying - Enter PEM pass phrase: ink8s.com
Enter pass phrase for /data/apps/openvpn/easy-rsa/3/pki/private/ca.key: ink8s.com

# ./easyrsa build-client-full access-client.ink8s.com
Enter PEM pass phrase: ink8s.com
Verifying - Enter PEM pass phrase: ink8s.com
Enter pass phrase for /data/apps/openvpn/easy-rsa/3/pki/private/ca.key: ink8s.com

# ./easyrsa build-client-full user01.ink8s.com nopass
Enter pass phrase for /data/apps/openvpn/easy-rsa/3/pki/private/ca.key: ink8s.com

// 校验客户端证书
# openssl x509 -noout -text -in /data/apps/openvpn/easy-rsa/3/pki/issued/idc-client.ink8s.com.crt
# openssl x509 -noout -text -in /data/apps/openvpn/easy-rsa/3/pki/issued/ali-client.ink8s.com.crt
# openssl x509 -noout -text -in /data/apps/openvpn/easy-rsa/3/pki/issued/office-client.ink8s.com.crt
# openssl x509 -noout -text -in /data/apps/openvpn/easy-rsa/3/pki/issued/access-client.ink8s.com.crt
# openssl x509 -noout -text -in /data/apps/openvpn/easy-rsa/3/pki/issued/user01.ink8s.com.crt
IDC 服务器
1
2
3
4
5
6
7
// idc 服务器证书整理
# chmod -R 700 /data/apps/openvpn/cert
# cd /data/apps/openvpn/cert
# cp /data/apps/openvpn/easy-rsa/3/pki/private/{idc,ali,office,access}.ink8s.com.key ./
# cp /data/apps/openvpn/easy-rsa/3/pki/issued/{idc,ali,office,access}.ink8s.com.crt ./
# cp /data/apps/openvpn/easy-rsa/3/pki/private/{idc-client,ali-client,office-client,access-client}.ink8s.com.key ./
# cp /data/apps/openvpn/easy-rsa/3/pki/issued/{idc-client,ali-client,office-client,access-client}.ink8s.com.crt ./
IDC 服务器
1
2
3
// 创建 tls-auth 证书和 dh 证书
# openvpn --genkey --secret ta.key --keysize 512
# openssl dhparam -out dh2048.pem 2048
创建一个吊销列表
1
2
3
4
5
// 用于客户端证书吊销管理
# ./easyrsa gen-crl
# cp /data/apps/openvpn/easy-rsa/3/pki/crl.pem /data/apps/openvpn/cert/crl.pem
# openssl crl -noout -text -in /data/apps/openvpn/cert/crl.pem	# 查看吊销列表里面的吊销证书

IDC 服务器
1
2
3
4
5
6
7
8
9
// 将各自证书拷贝到指定服务器

# chmod 600 /data/apps/openvpn/cert/*
// 传到云厂商服务器上
# scp ta.key ca.crt dh2048.pem ali-client.ink8s.com.{crt,key} [email protected]:/data/apps/openvpn/cert/
# scp ali.ink8s.com.{crt,key} [email protected]:/data/apps/openvpn/cert/
// 传到公司服务器上
# scp ta.key ca.crt dh2048.pem office-client.ink8s.com.{crt,key} [email protected]:/data/apps/openvpn/cert/
# scp office.ink8s.com.{crt,key} [email protected]:/data/apps/openvpn/cert/

8.0 跨 OpenVPN 区域之间互通

8.1 IDC 机房服务器和云厂商互通
IDC 服务器
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
// server 配置

# cat /data/apps/openvpn/idc-to-ali.conf
proto tcp-server
dev tun
local 192.168.3.160
lport 1200
remote 192.168.3.170
rport 1300
ifconfig 10.200.0.1 10.200.0.2
tls-server
tls-auth /data/apps/openvpn/cert/ta.key 0
dh /data/apps/openvpn/cert/dh2048.pem
ca /data/apps/openvpn/cert/ca.crt
cert /data/apps/openvpn/cert/idc.ink8s.com.crt
key /data/apps/openvpn/cert/idc.ink8s.com.key
persist-key 
persist-tun
cipher AES256 
auth SHA512
route 10.10.20.0 255.255.255.0 
keepalive 10 60
ping-timer-rem
user  openvpn
group openvpn
verb 3
daemon
log-append /data/logs/openvpn/idc-to-ali.log

# echo -e "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf
# echo -e "net.core.rmem_default = 393216" >> /etc/sysctl.conf
# echo -e "net.core.wmem_default = 393216" >> /etc/sysctl.conf
# sysctl -p
# sysctl -a | grep "net.ipv4.ip_forward = 1"
# systemctl start iptables && systemctl enable iptables
# iptables -F
# iptables -t nat -A POSTROUTING -s 10.200.0.0/24 -j MASQUERADE
# iptables -t nat -A POSTROUTING -s 10.1.0.0/24 -j MASQUERADE
# iptables-save > /etc/sysconfig/iptables
# openvpn --config /data/apps/openvpn/idc-to-ali.conf
// 上面命令执行后,另起窗口执行如下
# systemd-tty-ask-password-agent
    Enter Private Key Password: ink8s.com		# 密码输入正确,则进程启动
云厂商服务器
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
// client 配置

# cat /data/apps/openvpn/ali-to-idc.conf
proto tcp-client
local 192.168.3.170
lport 1300
remote 192.168.3.160
rport 1200
dev tun
ifconfig 10.200.0.2 10.200.0.1
remote-cert-tls server
tls-client
tls-auth /data/apps/openvpn/cert/ta.key 1
ca /data/apps/openvpn/cert/ca.crt
cert /data/apps/openvpn/cert/ali-client.ink8s.com.crt
key /data/apps/openvpn/cert/ali-client.ink8s.com.key
persist-key
persist-tun
cipher AES256 
auth SHA512
route 10.10.10.0 255.255.255.0 
keepalive 10 60
ping-timer-rem
user  openvpn
group openvpn
verb 3 
daemon
log-append /data/logs/openvpn/ali-to-idc.log

# echo -e "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf
# echo -e "net.core.rmem_default = 393216" >> /etc/sysctl.conf
# echo -e "net.core.wmem_default = 393216" >> /etc/sysctl.conf
# sysctl -p
# sysctl -a | grep "net.ipv4.ip_forward = 1"
# systemctl start iptables && systemctl enable iptables
# iptables -F
# iptables -t nat -A POSTROUTING -s 10.200.0.0/24 -j MASQUERADE
# iptables -t nat -A POSTROUTING -s 10.1.0.0/24 -j MASQUERADE
# iptables-save > /etc/sysconfig/iptables
# openvpn --config /data/apps/openvpn/ali-to-idc.conf
// 上面命令执行后,另起窗口执行如下
# systemd-tty-ask-password-agent
    Enter Private Key Password: ink8s.com		# 通过 "ip a s " 查看网卡是否起来和 ping 对端 tun_ip 地址
8.2 云厂商服务器和公司服务器互通
云厂商服务器
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
// server 配置

# cat /data/apps/openvpn/ali-to-office.conf
proto tcp-server
port 1301
rport 1200
dev tun
ifconfig 10.200.0.9 10.200.0.10 
tls-server
tls-auth /data/apps/openvpn/cert/ta.key 0
dh /data/apps/openvpn/cert/dh2048.pem
ca /data/apps/openvpn/cert/ca.crt
cert /data/apps/openvpn/cert/ali.ink8s.com.crt
key /data/apps/openvpn/cert/ali.ink8s.com.key
persist-key 
persist-tun
cipher AES256 
auth SHA512
route 10.10.30.0 255.255.255.0 
keepalive 10 60
ping-timer-rem
user  openvpn
group openvpn
verb 3 
daemon
log-append /data/logs/openvpn/ali-to-office.log

# openvpn --config /data/apps/openvpn/ali-to-office.conf
// 上面命令执行后,另起窗口执行如下
# systemd-tty-ask-password-agent
    Enter Private Key Password: ink8s.com
公司服务器
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
// client 配置

# cat /data/apps/openvpn/office-to-ali.conf
proto tcp-client
dev tun
remote 192.168.3.170
rport 1301
lport 1200
ifconfig 10.200.0.10 10.200.0.9
tls-client
tls-auth /data/apps/openvpn/cert/ta.key 1
dh /data/apps/openvpn/cert/dh2048.pem
ca /data/apps/openvpn/cert/ca.crt
cert /data/apps/openvpn/cert/office-client.ink8s.com.crt
key /data/apps/openvpn/cert/office-client.ink8s.com.key
tun-mtu 1600
persist-key 
persist-tun
cipher AES256 
auth SHA512
route 10.10.20.0 255.255.255.0 
keepalive 10 60
ping-timer-rem
user  openvpn
group openvpn
verb 3 
daemon
log-append /data/logs/openvpn/office-to-ali.log

# echo -e "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf
# echo -e "net.core.rmem_default = 393216" >> /etc/sysctl.conf
# echo -e "net.core.wmem_default = 393216" >> /etc/sysctl.conf
# sysctl -p
# sysctl -a | grep "net.ipv4.ip_forward = 1"
# systemctl start iptables && systemctl enable iptables
# iptables -F
# iptables -t nat -A POSTROUTING -s 10.200.0.0/24 -j MASQUERADE
# iptables -t nat -A POSTROUTING -s 10.1.0.0/24 -j MASQUERADE
# iptables-save > /etc/sysconfig/iptables
# openvpn --config /data/apps/openvpn/office-to-ali.conf
// 上面命令执行后,另起窗口执行如下
# systemd-tty-ask-password-agent
    Enter Private Key Password: ink8s.com
8.3 公司服务器和 IDC 服务器互通
IDC 服务器
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
// server 配置

# cat /data/apps/openvpn/idc-to-office.conf
proto tcp-server 
port 1201
rport 1201
dev tun
ifconfig 10.200.0.5 10.200.0.6
tls-server
tls-auth /data/apps/openvpn/cert/ta.key 0
dh /data/apps/openvpn/cert/dh2048.pem
ca /data/apps/openvpn/cert/ca.crt
cert /data/apps/openvpn/cert/office.ink8s.com.crt
key /data/apps/openvpn/cert/office.ink8s.com.key
persist-key 
persist-tun
cipher AES256 
auth SHA512
route 10.10.30.0 255.255.255.0 
keepalive 10 60
ping-timer-rem
user  openvpn
group openvpn
verb 3 
daemon
log-append /data/logs/openvpn/idc-to-office.log

# openvpn --config /data/apps/openvpn/idc-to-office.conf
// 上面命令执行后,另起窗口执行如下
# systemd-tty-ask-password-agent
    Enter Private Key Password: ink8s.com
公司服务器
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
// client 配置

# cat /data/apps/openvpn/office-to-idc.conf
proto tcp-client
dev tun
remote 192.168.3.160
rport 1201
lport 1201
ifconfig 10.200.0.6 10.200.0.5
tls-client
tls-auth /data/apps/openvpn/cert/ta.key 1
dh /data/apps/openvpn/cert/dh2048.pem
ca /data/apps/openvpn/cert/ca.crt
cert /data/apps/openvpn/cert/office-client.ink8s.com.crt
key /data/apps/openvpn/cert/office-client.ink8s.com.key
tun-mtu 1600
persist-key
persist-tun
user  openvpn
group openvpn
cipher AES256 
auth SHA512
route 10.10.10.0 255.255.255.0 
keepalive 10 60
ping-timer-rem
verb 3
daemon
log-append /data/logs/openvpn/office-to-idc.log

# openvpn --config /data/apps/openvpn/office-to-idc.conf
// 上面命令执行后,另起窗口执行如下
# systemd-tty-ask-password-agent
    Enter Private Key Password: ink8s.com
8.4 出差人员与IDC、办公室、阿里云实现互通
IDC 服务器
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
# cat /data/apps/openvpn/access-ovpn.conf
proto tcp
port 1202
dev tun
server 10.1.0.0 255.255.0.0
topology subnet
persist-key
persist-tun
comp-lzo
sndbuf 393216
rcvbuf 393216
keepalive 10 60
tls-auth /data/apps/openvpn/cert/ta.key 0
dh /data/apps/openvpn/cert/dh2048.pem
ca /data/apps/openvpn/cert/ca.crt
cert /data/apps/openvpn/cert/access.ink8s.com.crt
key /data/apps/openvpn/cert/access.ink8s.com.key
crl-verify /data/apps/openvpn/cert/crl.pem
user  openvpn
group openvpn
verb 3
daemon
log-append /data/logs/openvpn/openvpn-access.log
status     /data/logs/openvpn/openvpn-status.log
ifconfig-pool-persist /data/logs/openvpn/openvpn-ipp.txt

push "route 10.10.10.0 255.255.255.0" 
push "route 10.10.20.0 255.255.255.0" 
push "route 10.10.30.0 255.255.255.0" 

# openvpn --config /data/apps/openvpn/access-ovpn.conf
// 上面命令执行后,另起窗口执行如下
# systemd-tty-ask-password-agent
    Enter Private Key Password: ink8s.com

9.0 OpenVPN 客户端证书

9.1 windows 客户端证书文件(出差人员)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
// 相关证书文件必须同 ovpn 文件在同级目录
# cat user01.ovpn
client
proto tcp
remote 192.168.3.160
port 1202
dev tun
sndbuf 393216
rcvbuf 393216
nobind
comp-lzo
remote-cert-tls server
verb 3
tls-auth ta.key 1               # ta.key 文件; 1 表示方向
ca ca.crt                       # ca 证书
cert user01.ink8s.com.crt       # crt 客户端证书
key user01.ink8s.com.key        # key 客户端证书
9.2 windows 客户端软件安装,参考 5.2 部分
9.3 openvpn 脚本自动化创建证书,参考 5.1 部分

10.0 静态路由指向

  • 将 IDC 机房的 VPN 服务器当做网关,当有去向 10.10.20.0/24、10.10.30.0/24网段的路由时,将网络路由过去
  • 将云厂商的 VPN 服务器当做网关,当有去向 10.10.10.0/24、10.10.30.0/24网段的路由时,将网络路由过去
  • 将办公室的 VPN 服务器当做网关,当有去向 10.10.10.0/24、10.10.20.0/24网段的路由时,将网络路由过去
  • 如上 3 条配置,参考如下图 模拟 IDC 机房的 pfSense 软路由的路由指向截图
    upload successful

upload successful

  • IDC 机房地址段路由添加去向的路由表; 其它区域的路由指向根据实际区域的网段变通即可
    upload successful

upload successful

微信

加微信,入技术群

微信

扫一扫，分享到微信

tag:

    缺失模块。
    1、请确保node版本大于6.2
    2、在博客根目录（注意不是yilia-plus根目录）执行以下命令：
    npm i hexo-generator-json-content --save

    3、在根目录_config.yml里添加配置： 

      jsonContent:
    meta: false
    pages: false
    posts:
      title: true
      date: true
      path: true
      text: false
      raw: false
      content: false
      slug: false
      updated: false
      comments: false
      link: false
      permalink: false
      excerpt: false
      categories: false
      tags: true

运维技术面：
1. Linux 基础、脚本、服务部署、虚拟化
2. Linux 自动化、服务器硬件
3. Kubernetes、kube 服务部署
4. Windows 客户端,服务端的便捷应用

微信： wnn_chat

写博客的动力,源自于个人爱好!