CentOS 7上安装OpenVPN

Wed, 17 Apr 2019 16:19:29 +0800

之前做的一些树莓派机器因为分布分散，不好远程调试，最近看了CentOS 7.0 Set Up OpenVPN Server In 5 Minutes，决定备份一下。
首先需要有一台公网服务器，比如阿里云、腾讯云服务器，以便这些设备能连接上。阿里云、腾讯云的服务器外部IP并不是直接绑定在你的服务器上的，而是NAT转发到服务器上的，这与Linode不一样，虽然可以方便换IP。查看服务器公网IP，也可以在云管理后台查看

ip a show eth0
dig +short myip.opendns.com @resolver1.opendns.com
dig TXT +short o-o.myaddr.l.google.com @ns1.google.com | awk -F'"' '{ print $2}'

然后是一键安装脚步

yum update
wget https://raw.githubusercontent.com/Angristan/openvpn-install/master/openvpn-install.sh -O centos7-vpn.sh
chmod +x centos7-vpn.sh
./centos7-vpn.sh

Welcome to the OpenVPN installer!
The git repository is available at: https://github.com/angristan/openvpn-install

I need to ask you a few questions before starting the setup.
You can leave the default options and just press enter if you are ok with them.

I need to know the IPv4 address of the network interface you want OpenVPN listening to.
Unless your server is behind NAT, it should be your public IPv4 address.
IP address: 10.0.2.15

It seems this server is behind NAT. What is its public IPv4 address or hostname?
We need it for the clients to connect to the server.
Public IPv4 address or hostname: 110.*.*.*

Checking for IPv6 connectivity...

Your host does not appear to have IPv6 connectivity.

Do you want to enable IPv6 support (NAT)? [y/n]: n

What port do you want OpenVPN to listen to?
 1) Default: 1194
 2) Custom
 3) Random [49152-65535]
Port choice [1-3]: 1

What protocol do you want OpenVPN to use?
UDP is faster. Unless it is not available, you shouldn't use TCP.
 1) UDP
 2) TCP
Protocol [1-2]: 1

What DNS resolvers do you want to use with the VPN?
 1) Current system resolvers (from /etc/resolv.conf)
 2) Self-hosted DNS Resolver (Unbound)
 3) Cloudflare (Anycast: worldwide)
 4) Quad9 (Anycast: worldwide)
 5) Quad9 uncensored (Anycast: worldwide)
 6) FDN (France)
 7) DNS.WATCH (Germany)
 8) OpenDNS (Anycast: worldwide)
 9) Google (Anycast: worldwide)
 10) Yandex Basic (Russia)
 11) AdGuard DNS (Russia)
DNS [1-10]: 3

Do you want to use compression? It is not recommended since the VORACLE attack make use of it.
Enable compression? [y/n]: n

Do you want to customize encryption settings?
Unless you know what you're doing, you should stick with the default parameters provided by the script.
Note that whatever you choose, all the choices presented in the script are safe. (Unlike OpenVPN's defaults)
See https://github.com/angristan/openvpn-install#security-and-encryption to learn more.

Customize encryption settings? [y/n]: n

Okay, that was all I needed. We are ready to setup your OpenVPN server now.
You will be able to generate a client at the end of the installation.
Press any key to continue...

这个脚本省掉了许许多多配置，基本上按照默认一路enter就可以了，唯一需要输入的就是你的公网IP和生成的OpenVPN客户端连接文件名字，比如client.ovpn
然后启动服务

systemctl stop openvpn@server
systemctl enable openvpn@server
systemctl restart openvpn@server
systemctl status openvpn@server

查看生成的服务器配置

[root@li846-239 ~]# cat /etc/openvpn/server.conf
port 1194
proto udp6
dev tun
user nobody
group nobody
persist-key
persist-tun
keepalive 10 120
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
#client-to-client
#push "dhcp-option DNS 1.0.0.1"
#push "dhcp-option DNS 1.1.1.1"
#push "redirect-gateway def1 bypass-dhcp"
#server-ipv6 fd42:42:42:42::/112
#tun-ipv6
#push tun-ipv6
#push "route-ipv6 2000::/3"
#push "redirect-gateway ipv6"
dh none
ecdh-curve prime256v1
tls-crypt tls-crypt.key 0
crl-verify crl.pem
ca ca.crt
cert server_Yfej6xnJrDu3vs6K.crt
key server_Yfej6xnJrDu3vs6K.key
auth SHA256
cipher AES-128-GCM
ncp-ciphers AES-128-GCM
tls-server
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
status /var/log/openvpn/status.log
verb 3

10.8.0.0是默认的组网网段，可以改成别的。腾讯云并不支持IPV6，注释掉。push “dhcp-option DNS 1.0.0.1″是推送DNS服务器给客户端。push “redirect-gateway def1 bypass-dhcp”是重定向客户端所有流量到服务器，建议按需添加需要互访的子网段（默认只有10.8.0.0可以互相访问)，否则所有流量重定向，可能会引起连接问题，比如ssh腾讯云服务器公网22端口进不去。Push和Route还有高级应用，建议参考OpenVPN: 2x HOW TO
查看连接状况。

journalctl --identifier openvpn -f

配置腾讯云服务器安全组，开放1194端口

将刚才生成的client.ovpn下载下来，mac上双击，使用Tunnelblick打开导入即可。但是使用最新的OpenVPN 2.6提示连不上，报错：tls-crypt unwrap error: packet too short。
在Linux上安装OpenVPN，启动连接

yum install openvpn
cp client.ovpn /etc/openvpn/client.conf #一定要复制到这里
openvpn --client --config /etc/openvpn/client.conf #测试一下
systemctl start openvpn@client
systemctl enable openvpn@client

测试一下

ping 10.8.0.1
ip route

如果有问题的话，可以查看iptable配置、网络及进程

cat /etc/iptables/add-openvpn-rules.sh
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
iptables -A INPUT -i tun0 -j ACCEPT
iptables -A FORWARD -i eth0 -o tun0 -j ACCEPT
iptables -A FORWARD -i tun0 -o eth0 -j ACCEPT
iptables -A INPUT -i eth0 -p udp --dport 1194 -j ACCEPT

iptables -t nat -L -n -v 
net.ipv4.ip_forward
netstat -tulpn | grep :1194
ps aux | grep openvpn

当再一次运行脚本的时候，会提示是否创建新用户配置，注意不同用户不能共享同一个配置。这里创建的用户可以是支持用户名密码也可以是无账号密码的。

[root@tc ~]# ./centos7-vpn.sh
Welcome to OpenVPN-install!
The git repository is available at: https://github.com/angristan/openvpn-install

It looks like OpenVPN is already installed.

What do you want to do?
 1) Add a new user
 2) Revoke existing user
 3) Remove OpenVPN
 4) Exit
Select an option [1-4]:

连上OpenVPN服务器都处于同一个网络了，可以使用内部IP访问。现在使用docker来部署OpenVPN服务也很方便，比如rancher-openvpn，支持LDAP验证。
如果是两个及以上的局域网互通，可以使用Openswan建立虚拟网络连接。
更新：发现resin更新成了balena，免费支持10台设备，并且开放了IOT相关的系统、软件。
发现一个新的组网服务zerotier，可以快速的创建属于自己的私有网络。

参考链接：
How To Set Up and Configure an OpenVPN Server on CentOS 7
Tunnel Your Internet Traffic Through an OpenVPN Server
OpenVPN configuration examples
云服务器 ECS Linux CentOS OpenVPN 配置概述
 使用OpenVPN搞定远程办公
 使用openvpn打通两个异地网络
 How To Install Openswan And Create Site-to-Site VPN On CentOS 7
Setting up an IPSEC VPN using OpenSwan in cloud environments
Openswan L2TP/IPsec VPN client setup
在Raspberry Pi上面运行Docker
使用 Zerotier 组建虚拟局域网实现内网穿透
 trying to route between two openvpn clients
Site-to-site VPN routing explained in detail

虚拟网络 on 勇气

CentOS 7上安装OpenVPN