搭建Open***初嘗試

 

Open×××服務器端安裝和配置
一、安裝lzo
#tar -zxvf lzo-2.03.tar.gz
#cd lzo-2.03
# ./configure   --prefix=/usr/local/lzo
#make 
#Make install
二、安裝open***
   tar -zxvf open***-2.0.9.tar.gz
   cd open***-2.0.9
  ./configure --prefix=/usr/local/open*** --with-lzo-headers=/usr/local/lzo/include --with-lzo-lib=/usr/local/lzo/lib  --

with-ssl-headers=/usr/include/openssl --with-ssl-lib=/usr/lib
   make
   make install
三、生成證書和Key
#cd easy-rsa/
#vi vars
export D=`pwd`
    export KEY_CONFIG=$D/openssl.cnf
    export KEY_DIR=$D/keys
    echo NOTE: when you run ./clean-all, I will be doing a rm -rf on $KEY_DIR
    export KEY_SIZE=1024
    export KEY_COUNTRY=CN
    export KEY_PROVINCE=BJ
    export KEY_CITY=BJ
    export KEY_ORG="Open×××-TEST"
    export KEY_EMAIL=wjpheart@126.com
#chmod a+x vars
[root@localhost easy-rsa]# ./vars
NOTE: when you run ./clean-all, I will be doing a rm -rf on /home/weijunping/open***-2.0.9/easy-rsa/keys
[root@localhost easy-rsa]# ./clean-all
you must define KEY_DIR
[root@localhost easy-rsa]# export D=`pwd`
[root@localhost easy-rsa]# export KEY_CONFIG=$D/openssl.cnf
[root@localhost easy-rsa]# export KEY_DIR=$D/keys
[root@localhost easy-rsa]# export KEY_SIZE=1024
[root@localhost easy-rsa]# export KEY_COUNTRY=CN
[root@localhost easy-rsa]# export KEY_PROVINCE=BJ
[root@localhost easy-rsa]# export KEY_CITY=BJ
[root@localhost easy-rsa]# export KEY_ORG="Open×××-TEST"
[root@localhost easy-rsa]# export KEY_EMAIL=wjpheart@126.com
[root@localhost easy-rsa]# ./clean-all
[root@localhost easy-rsa]# ./build-ca
Generating a 1024 bit RSA private key
....++++++
........++++++
writing new private key to 'ca.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]:CN
State or Province Name (full name) [BJ]:BJ
Locality Name (eg, city) [BJ]:BJ
Organization Name (eg, company) [Open×××-TEST]:bokee
Organizational Unit Name (eg, section) []:blogchina
Common Name (eg, your name or your server's hostname) []:bokee-inc.com
Email Address [wjpheart@126.com]:
[root@localhost easy-rsa]# ./build-key-server server
Generating a 1024 bit RSA private key
..........++++++
..........++++++
writing new private key to 'server.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]:CN
State or Province Name (full name) [BJ]:BJ
Locality Name (eg, city) [BJ]:BJ
Organization Name (eg, company) [Open×××-TEST]:bokee
Organizational Unit Name (eg, section) []:blogchina
Common Name (eg, your name or your server's hostname) []:bokee-inc.com
Email Address [wjpheart@126.com]:
 
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:wjpinrain
An optional company name []:bokee
Using configuration from /home/weijunping/open***-2.0.9/easy-rsa/openssl.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName           :PRINTABLE:'CN'
stateOrProvinceName   :PRINTABLE:'BJ'
localityName          :PRINTABLE:'BJ'
organizationName      :PRINTABLE:'bokee'
organizationalUnitName:PRINTABLE:'blogchina'
commonName            :PRINTABLE:'bokee-inc.com'
emailAddress          :IA5STRING:'wjpheart@126.com'
Certificate is to be certified until Sep 12 03:40:48 2021 GMT (3650 days)
Sign the certificate? [y/n]:y
 
 
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
[root@localhost easy-rsa]#
 [root@localhost easy-rsa]# 創建 Diffie Hellman 參數
[root@localhost easy-rsa]# ./build-dh
Generating DH parameters, 1024 bit long safe prime, generator 2
This is going to take a long time
.......+...........................................................+...............................+..+..+...................

.............+...........................................................................................+....................+...............................................................+..................+......................................+...................+.......................+......++*++*++*
四、建立服務端配置文件
#mkdir /usr/local/open***/etc/
[root@localhostopen***]#cd /home/weijunping/open***-2.9/sample-config-files/
[root@localhost sample-config-files]# cp server.conf /usr/local/open***/etc/
[root@localhost sample-config-files]# vi /usr/local/open***/etc/server.conf
編輯後的server.conf文件內容以下：
port 1194
proto udp
dev tun
ca /home/weijunping/open***-2.0.9/easy-rsa/keys/ca.crt
cert /home/weijunping/open***-2.0.9/easy-rsa/keys/server.crt
key /home/weijunping/open***-2.0.9/easy-rsa/keys/server.key
dh /home/weijunping/open***-2.0.9/easy-rsa/keys/dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway"
push "dhcp-option DNS 202.106.0.20" (指定DNS服務器的地址)
client-to-client
keepalive 10 120
comp-lzo
max-clients 100
user nobody
group nobody
persist-key
persist-tun
status /home/weijunping/open***-2.0.9/easy-rsa/keys/open***-status.log
verb 4
五、部署server端key文件
#mkdir /usr/local/open***/etc/keys
#cd /home/weijunping/open***-2.0.9/easy-rsa/keys
#cp ca.crt server.crt server.key dh1024.pem /usr/local/open***/etc/keys
6,啓動open*** server
#/usr/local/open***/sbin/open*** –daemon –config /usr/local/open***/etc/server.conf
[root@localhost keys]# netstat -unlp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address               Foreign Address             State       PID/Program name  
udp        0      0 0.0.0.0:1194                0.0.0.0:*                               28763/open***  
2、open***客戶端安裝配置
[root@localhost ~]# cd /home/weijunping/open***-2.0.9/easy-rsa/
[root@localhost easy-rsa]# ./build-key weijunping
Generating a 1024 bit RSA private key
....++++++
writing new private key to 'weijunping.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]:CN
State or Province Name (full name) [BJ]:BJ
Locality Name (eg, city) [BJ]:BJ
Organization Name (eg, company) [Open×××-TEST]:bokee
Organizational Unit Name (eg, section) []:blogchina
Common Name (eg, your name or your server's hostname) []:weijunping
Email Address [wjpheart@126.com]:
 
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:123456
An optional company name []:bokee
Using configuration from /home/weijunping/open***-2.0.9/easy-rsa/openssl.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName           :PRINTABLE:'CN'
stateOrProvinceName   :PRINTABLE:'BJ'
localityName          :PRINTABLE:'BJ'
organizationName      :PRINTABLE:'bokee'
organizationalUnitName:PRINTABLE:'blogchina'
commonName            :PRINTABLE:'weijunping'
emailAddress          :IA5STRING:'wjpheart@126.com'
Certificate is to be certified until Sep 12 03:42:31 2021 GMT (3650 days)
Sign the certificate? [y/n]:y
 
 
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
2.進入指定目錄將指定文件下載到windows本地
#/home/weijunping/open***-2.0.9/easy-rsa/keys
將裏面的ca.crt、ca.key、weijunping.crt、weijunping.csr、weijunping.key下載到本地
而後下載客戶端配置文件client.conf 重命名該文件爲：client.o***
內容以下
client
dev tun
proto udp
remote 172.16.10.231 1194
resolv-retry infinite
nobind
user nobody
group nobody
persist-key
persist-tun
ca "C:\\Program Files\\Open×××\\config\\ca.crt"
cert "C:\\Program Files\\Open×××\\config\\weijunping.crt"
key "C:\\Program Files\\Open×××\\config\\weijunping.key"
comp-lzo
verb 3
安裝客戶端軟件方法：
雙擊open***-2.0.9-gui-1.0.3-install.exe軟件，按照默認安裝路徑安裝
將ca.crt、ca.key、weijunping.crt、weijunping.csr、weijunping.key、client.o***文件移動到C:\Program Files\Open×××\config目錄下
以後右擊右下角的小圖標，選擇connect ，就能夠正常使用了！
3、Open***訪問外網的設置
1.開啓路由功能
在linux上開啓路由功能其實很簡單，只須要執行一條命令就OK了，其實這個命令的做用是修改/proc/sys/net/opv4/ip_forward文件，默認這

個文件裏的值是0，就是不轉發數據包，咱們要作的就是修改這個文件把0修改爲1就OK了。
#echo 1 > /proc/sys/net/ipv4/ip_forward
[root@localhost ~]# more /proc/sys/net/ipv4/ip_forward
1
若是系統重啓的話就不生效了，若是想永久加上去就須要修改/etc/sysctl.conf
把net.ipv4.ip_forward=0 0修改爲1就能夠了。
***鏈接成功後，還須要設置路由，才能透過×××訪問internet
#iptables –t nat –A POSTROUTING –s 10.8.0.0/24 –o eth1 –j SNAT –to-source 172.16.10.231 記住這個地址要是公網地址哦，此處特地修改了內網地址