Open××× 實戰2：×××與網關在同一臺服器上
大綱c++
1、前言vim
2、概述安全
3、實戰拓撲bash
4、環境準備服務器
5、具體配置過程詳解curl
6、總結ide
注，實戰環境 CentOS 5.5 x86_64，軟件版本 Open××× 2.1，軟件下載：http://yunpan.cn/QzT8fGsX8S75a 訪問密碼 e8e4。測試
1、前言ui
在上一篇博客中咱們主要和你們講解一下，在內網中如何搭建一臺×××服務器，相信你們應該有所瞭解，但是有博友說了咱們沒有多餘的服務器作×××服務器，咱們只有一臺Linux網關服務器，那怎麼辦呢？能不能將×××服務器就搭建在網關服務器上呢？我想說這確定是能夠的，嘿嘿。那怎麼來搭建呢？讓咱們一塊兒來作吧！url
2、概述
在網關服務器上搭建×××服務器的要點就是作防火牆映射，下面是配置要點：
[root@gateway ~]# echo 1 > /proc/sys/net/ipv4/ip_forward [root@gateway keys]# iptables -t nat -A POSTROUTING -s 10.8.0.0/255.255.255.0 -j MASQUERADE [root@gateway keys]# iptables -t nat -A POSTROUTING -s 10.8.0.0/255.255.255.0 -d 192.168.18.0/255.255.255.0 -j SNAT --to-source 192.168.18.254
注，eth0是公網地址接口，eth1內網地址接口。下面咱們來看一下實戰拓撲，你們會看的更清楚一些！
3、實戰拓撲
說明：此拓撲圖是典型的中小型企業內部局部網的應用案例，本文中不會涉及NAT、Web、FTP等應用的配置，只會配置與Open×××的相關操做，如有其它問題歡迎你們交流討論，謝謝。
4、環境準備
1.安裝yum源
[root@gateway ~]# rpm -ivh http://dl.fedoraproject.org/pub/epel/5/x86_64/epel-release-5-4.noarch.rpm
Retrieving http://dl.fedoraproject.org/pub/epel/5/x86_64/epel-release-5-4.noarch.rpm
warning: /var/tmp/rpm-xfer.qnxpWE: Header V3 DSA signature: NOKEY, key ID 217521f6
Preparing... ########################################### [100%]
package epel-release-5-4.noarch is already installed
[root@gateway ~]# yum list
2.同步服務器時間
[root@gateway ~]# yum install -y ntp [root@gateway ~]# ntpdate 210.72.145.44 [root@gateway ~]# hwclock -w [root@gateway ~]# date [root@gateway ~]# hwclock
3.安裝相應的依賴包
[root@gateway ~]# yum -y install gcc gcc-c++ autoconf libjpeg libjpeg-devel libpng libpng-devel freetype freetype-devel libxml2 libxml2-devel zlib zlib-devel glibc glibc-devel glib2 glib2-devel bzip2bzip2-devel ncurses ncurses-devel curl curl-devel e2fsprogs e2fsprogs-devel krb5 krb5-devel libidn libidn-devel openssl openssl-devel openldap openldap-devel nss_ldap openldap-clients openldap-servers
5、具體配置過程詳解
注，簡單寫一下配置過程：
安裝lzo、open***軟件包
爲配置作準備，copy 相關文件
初始化 PKI
創建 server key
生成客戶端 key
生成 Diffie Hellman 參數
將keys下的全部文件打包下載到本地 ，讓客戶機用。
將keys下的ca.crt server.crt server.key dh1024.pem拷貝到/etc/open***
修改服務器配置文件/etc/open***/server.conf
啓動×××服務器
配置Windows客戶端
設置網關服務器的端口映射
測試Windows客戶端連Open×××
最後測試
好了，下面就讓咱們來完成上面的實戰步驟。
1.安裝lzo、open***軟件包
[root@gateway ~]# mkdir src [root@gateway ~]# cd src/ [root@gateway src]# ls lzo-2.04-3.2.x86_64.rpm open***-2.1-0.20.rc4.el5.kb.x86_64.rpm [root@gateway src]# rpm -ivh lzo-2.04-3.2.x86_64.rpm warning: lzo-2.04-3.2.x86_64.rpm: Header V3 DSA signature: NOKEY, key ID d164ce99 Preparing... ########################################### [100%] 1:lzo ########################################### [100%] [root@gateway src]# rpm -ivh open***-2.1-0.20.rc4.el5.kb.x86_64.rpm Preparing... ########################################### [100%] 1:open*** ########################################### [100%]
2.爲配置作準備，copy 相關文件
[root@gateway src]# cp -r /usr/share/open***/easy-rsa/2.0/ /etc/open*** [root@gateway src]# cd /etc/open*** [root@gateway open***]# ls 2.0 [root@gateway open***]# cp /usr/share/doc/open***-2.1/sample-config-files/server.conf /etc/open***/ [root@gateway open***]# ls 2.0 server.conf
3.初始化 PKI
[root@gateway open***]# cd 2.0/ [root@gateway 2.0]# ls build-ca build-key build-key-server clean-all Makefile pkitool sign-req build-dh build-key-pass build-req inherit-inter openssl-0.9.6.cnf README vars build-inter build-key-pkcs12 build-req-pass list-crl openssl.cnf revoke-full whichopensslcnf [root@gateway 2.0]# vim vars #修改下面幾項： export KEY_COUNTRY="CN" export KEY_PROVINCE="SH" export KEY_CITY="SH" export KEY_ORG="open***" export KEY_EMAIL="admin@free.com" [root@gateway 2.0]# env | grep KEY [root@gateway 2.0]# source ./vars NOTE: If you run ./clean-all, I will be doing a rm -rf on /etc/open***/2.0/keys [root@gateway 2.0]# env | grep KEY KEY_EXPIRE=3650 KEY_EMAIL=admin@free.com KEY_SIZE=1024 KEY_DIR=/etc/open***/2.0/keys KEY_CITY=SH KEY_PROVINCE=SH KEY_ORG=open*** KEY_CONFIG=/etc/open***/2.0/openssl.cnf KEY_COUNTRY=CN [root@gateway 2.0]# ./clean-all [root@gateway 2.0]# ls build-ca build-key-pass build-req-pass list-crl pkitool vars build-dh build-key-pkcs12 clean-all Makefile README whichopensslcnf build-inter build-key-server inherit-inter openssl-0.9.6.cnf revoke-full build-key build-req keys openssl.cnf sign-req [root@gateway 2.0]# ./build-ca Generating a 1024 bit RSA private key .++++++ .......................................++++++ writing new private key to 'ca.key' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [CN]: State or Province Name (full name) [SH]: Locality Name (eg, city) [SH]: Organization Name (eg, company) [open***]: Organizational Unit Name (eg, section) []: Common Name (eg, your name or your server's hostname) [open*** CA]: Email Address [admin@free.com]:
4.創建 server key
[root@gateway 2.0]# ./build-key-server server Generating a 1024 bit RSA private key .................++++++ .............++++++ writing new private key to 'server.key' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [CN]: State or Province Name (full name) [SH]: Locality Name (eg, city) [SH]: Organization Name (eg, company) [open***]: Organizational Unit Name (eg, section) []: Common Name (eg, your name or your server's hostname) [server]: Email Address [admin@free.com]: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: Using configuration from /etc/open***/2.0/openssl.cnf Check that the request matches the signature Signature ok The Subject's Distinguished Name is as follows countryName :PRINTABLE:'CN' stateOrProvinceName :PRINTABLE:'SH' localityName :PRINTABLE:'SH' organizationName :PRINTABLE:'open***' commonName :PRINTABLE:'server' emailAddress :IA5STRING:'admin@free.com' Certificate is to be certified until May 2 03:41:08 2024 GMT (3650 days) Sign the certificate? [y/n]:y 1 out of 1 certificate requests certified, commit? [y/n]y Write out database with 1 new entries Data Base Updated
5.生成客戶端 key（我這裏設置三個客戶端分別爲：client一、client二、client3，你能夠根據須要生成多個客戶端）
1).client1
[root@gateway 2.0]# ./build-key client1 Generating a 1024 bit RSA private key ......++++++ ...++++++ writing new private key to 'client1.key' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [CN]: State or Province Name (full name) [SH]: Locality Name (eg, city) [SH]: Organization Name (eg, company) [open***]: Organizational Unit Name (eg, section) []: Common Name (eg, your name or your server's hostname) [client1]: Email Address [admin@free.com]: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: Using configuration from /etc/open***/2.0/openssl.cnf Check that the request matches the signature Signature ok The Subject's Distinguished Name is as follows countryName :PRINTABLE:'CN' stateOrProvinceName :PRINTABLE:'SH' localityName :PRINTABLE:'SH' organizationName :PRINTABLE:'open***' commonName :PRINTABLE:'client1' emailAddress :IA5STRING:'admin@free.com' Certificate is to be certified until May 2 03:46:17 2024 GMT (3650 days) Sign the certificate? [y/n]:y 1 out of 1 certificate requests certified, commit? [y/n]y Write out database with 1 new entries Data Base Updated
2).client2與client3同上我這裏就不演示了，不清楚的博友能夠參考上一篇博文。
6.生成 Diffie Hellman 參數
[root@gateway 2.0]# ./build-dh Generating DH parameters, 1024 bit long safe prime, generator 2 This is going to take a long time ................................................................++*++*++*
7.將keys下的全部文件打包下載到本地 ，讓客戶機用。
[root@gateway 2.0]# cd keys/ [root@gateway keys]# ls 01.pem ca.crt client1.key client3.crt index.txt serial server.key 02.pem ca.key client2.crt client3.csr index.txt.attr serial.old 03.pem client1.crt client2.csr client3.key index.txt.attr.old server.crt 04.pem client1.csr client2.key dh1024.pem index.txt.old server.csr [root@gateway keys]# tar zcvf client.tar.gz ./* ./01.pem ./02.pem ./03.pem ./04.pem ./ca.crt ./ca.key ./client1.crt ./client1.csr ./client1.key ./client2.crt ./client2.csr ./client2.key ./client3.crt ./client3.csr ./client3.key ./dh1024.pem ./index.txt ./index.txt.attr ./index.txt.attr.old ./index.txt.old ./serial ./serial.old ./server.crt ./server.csr ./server.key [root@gateway keys]# ls 01.pem 04.pem client1.crt client2.crt client3.crt client.tar.gz index.txt.attr serial server.csr 02.pem ca.crt client1.csr client2.csr client3.csr dh1024.pem index.txt.attr.old serial.old server.key 03.pem ca.key client1.key client2.key client3.key index.txt index.txt.old server.crt
8.將keys下的ca.crt server.crt server.key dh1024.pem拷貝到/etc/open***
[root@gateway keys]# cp ca.* server.* dh1024.pem /etc/open***/ [root@gateway keys]# cd /etc/open***/ [root@gateway open***]# ls 2.0 ca.crt ca.key dh1024.pem server.conf server.crt server.csr server.key
9.修改服務器配置文件/etc/open***/server.conf
[root@gateway open***]# cp server.conf server.conf.bak.2014.5.5 [root@gateway open***]# ls 2.0 ca.crt ca.key dh1024.pem server.conf server.conf.bak.2014.5.5 server.crt server.csr server.key [root@gateway open***]# vim server.conf port 1194 proto udp dev tun ca ca.crt cert server.crt key server.key port 1194 proto udp dev tun ca ca.crt cert server.crt key server.key dh dh1024.pem server 10.8.0.0 255.255.255.0 client-to-client keepalive 10 120 comp-lzo persist-key persist-tun status open***-status.log verb 4 push "dhcp-option DNS 10.8.0.1" push "dhcp-option DNS 8.8.8.8" push "dhcp-option DNS 8.8.4.4"
10.啓動×××服務器
[root@gateway open***]# /etc/init.d/open*** start
正在啓動 open***： [肯定]
[root@gateway open***]# netstat -ntulp | grep 1194
udp 0 0 0.0.0.0:1194 0.0.0.0:* 19147/open***
[root@gateway open***]# ifconfig
tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.8.0.1 P-t-P:10.8.0.2 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)
11.配置Windows客戶端
(1).安裝一下客戶端（我就不演示了，你們本身安裝）
(2).將服務器上生成的客戶機證書文件放到config方件夾下
D:\Program Files\Open×××\config\test
(3).新建客戶端配置文件test.o***
D:\Program Files\Open×××\config
test.o*** 文件內容：
client dev tun proto udp remote x.x.x.x 1194 #工做單位外網IP persist-key persist-tun ca test\\ca.crt cert test\\client1.crt key test\\client1.key ns-cert-typeserver comp-lzo verb 3 redirect-gateway def1
12.設置網關服務器的端口映射(關鍵配置)並開啓路由轉發。
[root@gateway keys]# iptables -t nat -A POSTROUTING -s 10.8.0.0/255.255.255.0 -j MASQUERADE [root@gateway keys]# iptables -t nat -A POSTROUTING -s 10.8.0.0/255.255.255.0 -d 192.168.18.0/255.255.255.0 -j SNAT --to-source 192.168.18.254 [root@gateway keys]# iptables -L -t nat Chain PREROUTING (policy ACCEPT) target prot opt source destination Chain POSTROUTING (policy ACCEPT) target prot opt source destination MASQUERADE all -- localhost/24 anywhere SNAT all -- localhost/24 localhost/24 to:192.168.18.254 Chain OUTPUT (policy ACCEPT) target prot opt source destination [root@gateway keys]# vim /etc/sysctl.conf # Kernel sysctl configuration file for Red Hat Linux # # For binary values, 0 is disabled, 1 is enabled. See sysctl(8) and # sysctl.conf(5) for more details. # Controls IP packet forwarding net.ipv4.ip_forward = 1 [root@gateway keys]# sysctl -p net.ipv4.ip_forward = 1
13.鏈接並測試
1).鏈接×××
注，鏈接成功之後會出現一個綠色的小圖標。下面咱們ping一下試試！
2).測試ping一下
3).下面咱們來查看一下IP所在地
×××鏈接前：(辦公室)
×××鏈接後：（機房服務器）
好了，到這裏咱們的×××與網關在一塊兒的實戰配置就所有完成了，下面咱們來總結一下咱們實戰心得與問題彙總。
6、總結
前面提到的，都是由服務端先生成客戶端證書，而後分發到客戶端，讓客戶端經過證書鏈接到服務器上。但有時候，這樣的分發是比較麻煩的（也不安全）。這樣，咱們能夠考慮另一種方式： 只在服務端製做客戶端證書，而客戶端只須要有ca.crt文件，而不須要拿到客戶端證書，當登錄服務器的時候是經過用戶名和密碼便可登錄Open×××服務器。這個功能該怎麼實現呢？在下一篇博客中咱們將實現這個功能。
好了，最後但願你們有所收穫^_^……
相關文章
- 1. Open××× 實戰2：×××與網關在同一臺服器上
- 2. 2個或2個以上路由器串聯上網，在同一網段
- 3. 10分鐘實現MariaDB與MySQL在一臺服務器同時運行
- 4. 在同一臺服務器上配置多個Tomcat（轉載）
- 5. 在同一臺服務器上配置多個Tomcat
- 6. 如何在同一臺服務器上部署兩個tomcat
- 7. 當AD域與DNS不在一臺服務器上時配置
- 8. MariaDB 與 MySQL 安裝在同一臺服務器
- 9. 同一臺服務器上部署多個Tomcat服務器
- 10. SpringCloud實戰六：服務網關Zuul（一）
- 更多相關文章...
- • 服務器上的 XML - XML 教程
- • XSLT - 在服務器端 - XSLT 教程
- • Spring Cloud 微服務實戰(三) - 服務註冊與發現
- • Docker容器實戰(六) - 容器的隔離與限制
相關標籤/搜索
每日一句
-
每一个你不满意的现在，都有一个你没有努力的曾经。
歡迎關注本站公眾號,獲取更多信息
