基於偉大的 GFW 越來越牛Ｂ，網站的正常維護如 FTP、pop & smtp 的郵件收發、在 google 查技術資料，都經常被 GFW 強行斷開。為了解決這個問題，於是我在自己的國外主機上安裝了一個 OpenVPN，當時記錄了一下安裝的經過。今天正好又能一個朋友問及 OpenVPN 安裝的事情，於是我重新整理一下這個(Linux 下 OpenVPN 安裝和 Windows OpenVPN GUI 安裝的筆記(http://www.xiaohui.com/dev/server/20070514-install-openvpn.htm, 希望對大家有所幫助.
當時在安裝 OpenVPN 的時候，得到了 WenZK 的指導幫助。在此表示感謝。
一. OpenVPN 安裝環境
Server 端的環境
redhat, kernel版本: 2.4.20-31.9, IP 為 70.8.7.6
kernel 需要支持 tun 設備, 需要載入 iptables 模塊.
檢查 tun 是否安裝:
代碼:
root@a [/]# modinfo tun
filename: /lib/modules/2.4.20-31.9/kernel/drivers/net/tun.o
description:
author:
license: "GPL"
如果沒有 modinfo 命令, 直接找一下, 看看 kernel 里是否有 tun.o 文件:
代碼:
find -name tun.o
./lib/modules/2.4.20/kernel/drivers/net/tun.o
檢查iptables 模塊, 查看是否有下列文件:
/etc/init.d/iptables
安裝的 OpenVPN 的版本: 2.0.5. 現在似乎已經有一個更新的版本了. 可在http://openvpn.net 上下載.
Client 端的環境:
Windows XP PRO SP2
OpenVPN GUI For windows 1.0.3 , 可在 openvpn.se 下載
注意: OpenVPN GUI for windows 的版本要和 OpenVPN Server 的版本配套.
例如, 伺服器裝的是 OpenVPN 2.0.5, 那麼下載的 OpenVPN GUI fow windows 應該是: openvpn-2.0.5-gui-1.0.3-install.exe
OpenVPN GUI的所有歷史版本: http://openvpn.se/files/install_packages/
二. OpenVPN 服務端安裝過程
http://www.xiaohui.com/dev/server/20070514-install-openvpn.htm
1. 用 SecureCRT 登錄到 host, 進入根目錄 代碼:
cd /
2. 下載 LZO，解壓到lzo-2.02.
地址: http://www.oberhumer.com/opensource/lzo/download/ 代碼:
wget http://www.oberhumer.com/opensource/lzo/download/lzo-2.02.tar.gz
3.下載 OpenVPN, 解壓到openvpn-2.0.5
地址: http://openvpn.net/download.html 代碼:
wget http://openvpn.net/release/openvpn-2.0.5.tar.gz
4. 安裝 LZO 代碼:
cd /lzo-2.02
./configure
make
make check
make install
5. 安裝 OpenVPN
代碼:
cd /openvpn-2.0.5
./configure
# 或用指定dir: (注:下述命令, 應該在一行寫完. 為了方便顯示, 這裡分成了四行)
# ./configure --with-lzo-headers=/usr/local/include
# --with-lzo-lib=/usr/local/lib
# --with-ssl-headers=/usr/local/include/openssl
# --with-ssl-lib=/usr/local/lib
make
make install
6. 生成證書Key
初始化 PKI
(如果沒有 export 命令也可以用 setenv 命令)
代碼:
cd /openvpn-2.0.5/easy-rsa
export D=`pwd`
export KEY_CONFIG=$D/openssl.cnf
export KEY_DIR=$D/keys
export KEY_SIZE=1024
export KEY_COUNTRY=CN
export KEY_PROVINCE=GD
export KEY_CITY=SZ
export KEY_ORG="dvdmaster"
export KEY_EMAIL="support@cooldvd.com"
Build:
代碼:
./clean-all
./build-ca
Generating a 1024 bit RSA private key
................++++++
........++++++
writing new private key to 'ca.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) :
State or Province Name (full name) :
Locality Name (eg, city) :
Organization Name (eg, company) :
Organizational Unit Name (eg, section) []:dvdmaster
Common Name (eg, your name or your server's hostname) []:server
Email Address [support@cooldvd.com]:
# 建立 server key 代碼: 代碼:
./build-key-server server
Generating a 1024 bit RSA private key
......++++++
....................++++++
writing new private key to 'server.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) :
State or Province Name (full name) :
Locality Name (eg, city) :
Organization Name (eg, company) :
Organizational Unit Name (eg, section) []:dvdmaster
Common Name (eg, your name or your server's hostname) []:server
Email Address [support@cooldvd.com]:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:abcd1234
An optional company name []:dvdmaster
Using configuration from /openvpn-2.0.5/easy-rsa/openssl.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName :PRINTABLE:'CN'
stateOrProvinceName :PRINTABLE:'GD'
localityName :PRINTABLE:'SZ'
organizationName :PRINTABLE:'dvdmaster'
organizationalUnitName:PRINTABLE:'dvdmaster'
commonName :PRINTABLE:'server'
emailAddress :IA5STRING:'support@cooldvd.com'
Certificate is to be certified until Mar 19 08:15:31 2016 GMT (3650 days)
Sign the certificate? :y
1 out of 1 certificate requests certified, commit? y
Write out database with 1 new entries
Data Base Updated
#生成客戶端 key
代碼:
./build-key client1
Generating a 1024 bit RSA private key
.....++++++
......++++++
writing new private key to 'client1.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) :
State or Province Name (full name) :
Locality Name (eg, city) :
Organization Name (eg, company) :
Organizational Unit Name (eg, section) []:dvdmaster
Common Name (eg, your name or your server's hostname) []:client1 #重要: 每個不同的 client 生成的證書, 名字必須不同.
Email Address [support@cooldvd.com]:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:abcd1234
An optional company name []:dvdmaster
Using configuration from /openvpn-2.0.5/easy-rsa/openssl.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName :PRINTABLE:'CN'
stateOrProvinceName :PRINTABLE:'GD'
localityName :PRINTABLE:'SZ'
organizationName :PRINTABLE:'dvdmaster'
organizationalUnitName:PRINTABLE:'dvdmaster'
commonName :PRINTABLE:'client1'
emailAddress :IA5STRING:'support@cooldvd.com'
Certificate is to be certified until Mar 19 08:22:00 2016 GMT (3650 days)
Sign the certificate? :y
1 out of 1 certificate requests certified, commit? y
Write out database with 1 new entries
Data Base Updated
依次類推生成其他客戶端證書/key
代碼:
./build-key client2
./build-key client3
注意在進入 Common Name (eg, your name or your server's hostname) []: 的輸入時, 每個證書輸入的名字必須不同.
7. build: 代碼:
./build-dh
8. 將 keys 下的所有文件打包下載到本地
代碼:
tar -cf mykeys.tar /openvpn-2.0.5/easy-rsa/keys
cp mykeys.tar /home/dvdmastersys/public_html/mykeys.tar
將 mykeys.tar 移到 web public(絕對路徑因人而異) 上, 然後用 http://www.a.com/mykeys.tar 方式將其下載到本地保存, 然後將其從server刪除: 代碼:
rm /home/dvdmastersys/public_html/mykeys.tar
也可以用其他方法把 key file搞到本地，例如 ftp.
9. 創建服務端配置文件
從樣例文件創建:
代碼:
cd $dir/sample-config-files/ # 進入源代碼解壓目錄下的sample-config-files子目錄
cp server.conf /usr/local/etc # cp伺服器配置文件到/usr/local/etc
vi /usr/local/etc/server.conf
我建立的server.conf 的內容稍後另附.
10. 創建客戶端配置文件
代碼:
cd $dir/sample-config-files/ #進入源代碼解壓目錄下的sample-config-files子目錄
cp client.conf /usr/local/etc #cp客戶端配置文件到/usr/local/etc
vi /usr/local/etc/client.conf
我建立的client.conf 的內容稍後另附.
11. 啟動Openvpn: openvpn 代碼:
/usr/local/sbin/openvpn --config /usr/local/etc/server.conf
三. 客戶端安裝過程
安裝 OpenVPN GUI For windows, 到 openvpn.se 上下載. 目前的版本是 1.0.3. 注意: OpenVPN GUI 的版本要和 OpenVPN Server 的版本配套. 詳見第一節一. 安裝環境中的說明.
依屏幕指示安裝openvpn gui.
配置 openvpn gui
安裝結束后, 進入安裝文件夾下的 config 目錄, 然後將上面第 10 步建立的 client.conf 文件從 server 上下載到此文件夾, 並更名為 client.ovpn
同時, 將第8 步打包的 mykeys.tar 中的下列證書文件解壓到此文件夾:
代碼:
ca.crt
ca.key
client1.crt
client1.csr
client1.key
然後雙擊 client.ovpn 即可啟動 openvpn, 或者通過 OpenVPN GUI 的控制啟動 VPN.
如果雙擊 client.ovpn 沒有反應, 則在任務欄點 OpenVPN GUI 的小圖標右鍵, 選擇 edit config, 將內容複製過去再保存. 然後再點右鍵中的 connect即可.
如果需要第二台機器上使用 vpn , 進行同樣的配置, 只需要將 client1.crt, client1.csr, client1.key 換成對應的 client2.xxx 即可, 然後將 client.ovpn 中的對應key文件值改掉.
四. 配置樣例文件
server.conf
代碼:
local 70.8.7.6
port 1194
proto udp
dev tun
ca /openvpn-2.0.5/easy-rsa/keys/ca.crt
cert /openvpn-2.0.5/easy-rsa/keys/server.crt
key /openvpn-2.0.5/easy-rsa/keys/server.key # This file should be kept secret
dh /openvpn-2.0.5/easy-rsa/keys/dh1024.pem
server 10.8.0.0 255.255.255.0
client-to-client
keepalive 10 120
comp-lzo
persist-key
persist-tun
status /openvpn-2.0.5/easy-rsa/keys/openvpn-status.log
verb 4
push "dhcp-option DNS 10.8.0.1"
push "dhcp-option DNS 70.88.98.10" # name server 地址, 如何獲取見隨後說明
push "dhcp-option DNS 70.88.99.10" # name server 地址, 如何獲取見隨後說明
說明: 有些 domain 被 GFW 封掉了, 這時, 如果要訪問這些網站, 應該將 server 上的 dns push 到 client. 上面示例中的 dns ip: 70.88.98.10, 70.88.99.10, 可以在 /etc/resolv.conf 中找到: 代碼:
vi /etc/resolv.conf
nameserver 70.88.98.10
nameserver 70.88.99.10
client.ovpn
代碼:
client
dev tun
proto udp
remote 70.8.7.6 1194
persist-key
persist-tun
ca ca.crt
cert client1.crt
key client1.key
ns-cert-type server
comp-lzo
verb 3
redirect-gateway def1
五. 訪問外網的設置
打開路由 VPN連接成功后, 還需要設置路由, 才能透過VPN訪問Internet. 在 linux host 上添加路由: 代碼:
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 70.8.7.6
/etc/init.d/iptables save
/etc/init.d/iptables restart
不同的機器，-o eth0 參數可能不一樣，具體可輸入 ifconfig 查看，搞清 ip(70.8.7.6)所在的網卡號.
同時, 需要將 ip forward 打開. 不要用 echo 1 > /proc/sys/net/ipv4/ip_forward 的方式, 這種方式重啟后無效. 先查看一下:
代碼:
sysctl -a | grep for
#查看結果:
net.ipv4.conf.tun0.mc_forwarding = 0
net.ipv4.conf.tun0.forwarding = 1
net.ipv4.conf.eth0.mc_forwarding = 0
net.ipv4.conf.eth0.forwarding = 1
net.ipv4.conf.lo.mc_forwarding = 0
net.ipv4.conf.lo.forwarding = 1
net.ipv4.conf.default.mc_forwarding = 0
net.ipv4.conf.default.forwarding = 1
net.ipv4.conf.all.mc_forwarding = 0
net.ipv4.conf.all.forwarding = 1
net.ipv4.ip_forward = 1
如果你的主機上列數值不是為1, 則要將其改成1, 例如:
代碼:
sysctl -w net.ipv4.ip_forward=1
依此類推.
開啟域名伺服器
如果你需要訪問一些已經被GFW封掉了域名的網站, 但你的 OpenVPN 伺服器沒有被封的話，那麼你需要在你的主機上開啟 name server, 並將 dns push 給 client。 一般的獨立主機, 都帶有 private dns server.
代碼:
rpm -qa | grep bind
/etc/init.d/named start
另外, 必須保證 server.conf 配置中, 有這三個配置:
代碼:
push "dhcp-option DNS 10.8.0.1"
push "dhcp-option DNS 70.88.98.10" # name server 地址
push "dhcp-option DNS 70.88.99.10" # name server 地址
當 client 連接成功后, 在 cmd 下執行 ipconfig /all, 應該有這類似這樣的輸出:
代碼:
Ethernet adapter Local Area Connection 3:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : TAP-Win32 Adapter V8
Physical Address. . . . . . . . . : 00-FF-AA-B0-60-2B
Dhcp Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . : 10.8.0.6
Subnet Mask . . . . . . . . . . . : 255.255.255.252
Default Gateway . . . . . . . . . : 10.8.0.5
DHCP Server . . . . . . . . . . . : 10.8.0.5
DNS Servers . . . . . . . . . . . : 10.8.0.1
70.88.98.11
70.88.99.11
Lease Obtained. . . . . . . . . . : 2006年5月25日 5:13:52
Lease Expires . . . . . . . . . . : 2007年5月25日 5:13:52
六. 設置 host reboot后自動啟動 openvpn
執行命令:
代碼:
vi /etc/rc.local
然後在最後面加入此行:
代碼:
/usr/local/sbin/openvpn --config /usr/local/etc/server.conf > /dev/null 2>&1 &
七. 測試
你可以用 VPN 登錄上去之後, 測試 MSN, QQ, IE 等網路應用, 也可以嘗試訪問一些被 GFW 禁掉的網站, 當然, 前提是你的 VPN 伺服器不在境內.
八. 強烈注意
不建議用 VPN 登錄 paypal 帳戶和 google adsense 帳戶. 否則有可能導致帳戶受限或帶來其他風險.
[火星人 ] Linux 下 OpenVPN 安裝和 Windows OpenVPN GUI 安裝筆記已經有696次圍觀
