Build an OpenVPN server in CentOS

Build an OpenVPN server in CentOS
• OpenVPN Overview

OpenVPN is a free open-source software used to create a Virtual Private Network (VPC) encrypted channel. OpenVPN allows you to easily build a dedicated network channel similar to a LAN between different network access sites, such as home, office, and hotel accommodation. OpenVPN is easy to use and has excellent running performance. It supports Solaris and Linux 2.2 + (Linux 2.2 + indicates Linux 2.2 and later versions, the same below) openBSD 3.0 +, FreeBSD, NetBSD, Mac OS X, Android, and Windows 2000 + operating systems, and use high-strength data encryption, coupled with its open-source free features, this makes OpenVPN the preferred product for small and medium-sized enterprises and individuals. Using OpenVPN with a specific proxy server can be used to access restricted websites such as Youtube, FaceBook, and Twitter, or to break through the company's network restrictions.

• Tools/Raw Materials

Server: CentOS6.5
Customer: Windows7
Server Software: epel-release-6-8.noarch.rpm, openvpn, easy-rsa
Client Software: openvpn-install-2.3.4

• Server installation and configuration

1. Disable SELINUX

Setenforce0 // temporarily disable sed-I '^ SELINUX =/c \ SELINUX = disabled'/etc/selinux/config // restart

2. Install the "EPEL" Source

Wget http://dl.fedoraproject.org/pub/epel/6/i386/epel-release-6-8.noarch.rpm // download centos6 32-bit EPEL source rpm-ivh epel-release-6-8.noarch.rpm // install EPEL source yum makecache // update local cache

3. Install openvpn

yum -y install openvpn easy-rsa

4. easy-rsa Configuration

 mkdir -p /etc/openvpn/easy-rsa/keys cp -rf/usr/share/easy-rsa/2.0/* /etc/openvpn/easy-rsa/

5. Create a CA certificate and key

Vi/etc/openvpn/easy-rsa/vars // change your country, province, city, mailbox, etc... source. /vars // initialize the certificate authorization center. /clean-all // clear the files under the keys directory. /build-ca // create a ca certificate Generating a 1024 bit RSA private key. ++ ...................... ++ writing new private key to 'Ca. key' ----- You are about to be asked to enter information that will be inreceivatedinto your certificate request. what you are about to enter is what is called a Distinguished Name or a DN. there are quite a few fields but you can leave some blankFor some fields there will be a default value, If you enter '. ', the field will be left blank. ----- Country Name (2 letter code) [CN]: State or Province Name (full name) [CA]: Locality Name (eg, city) [HZ]: Organization Name (eg, company) [HZ]: Organizational Unit Name (eg, section) [changeme]: Common Name (eg, your name or your server's hostname) [changeme]: name [changeme]: Email Address [mail@host.domain]:

6. Create a server certificate and key

./build-key-server serverGenerating a 1024 bit RSA private key.....++++++.................++++++writing new private key to 'server.key'-----You are about to be asked to enter information that will be incorporatedinto your certificate request.What you are about to enter is what is called a Distinguished Name or a DN.There are quite a few fields but you can leave some blankFor some fields there will be a default value,If you enter '.', the field will be left blank.-----Country Name (2 letter code) [CN]:State or Province Name (full name) [CA]:Locality Name (eg, city) [HZ]:Organization Name (eg, company) [HZ]:Organizational Unit Name (eg, section) [changeme]:Common Name (eg, your name or your server's hostname) [server]:Name [changeme]:Email Address [mail@host.domain]: Please enter the following 'extra' attributesto be sent with your certificate requestA challenge password []:An optional company name []:Using configuration from /etc/easy-rsa/2.0/openssl.cnfCheck that the request matches the signatureSignature okThe Subject's Distinguished Name is as followscountryName :PRINTABLE:'CN'stateOrProvinceName :PRINTABLE:'CA'localityName :PRINTABLE:'HZ'organizationName :PRINTABLE:'HZ'organizationalUnitName:PRINTABLE:'changeme'commonName :PRINTABLE:'server'name :PRINTABLE:'changeme'emailAddress :IA5STRING:'mail@host.domain'Certificate is to be certified until Mar 28 03:05:21 2022 GMT (3650 days)Sign the certificate? [y/n]:y 1 out of 1 certificate requests certified, commit? [y/n]y Write out database with 1 new entriesData Base Update

7. Create the client certificate and key

./build-key client1Generating a 1024 bit RSA private key...++++++...............++++++writing new private key to 'client1.key'-----You are about to be asked to enter information that will be incorporatedinto your certificate request.What you are about to enter is what is called a Distinguished Name or a DN.There are quite a few fields but you can leave some blankFor some fields there will be a default value,If you enter '.', the field will be left blank.-----Country Name (2 letter code) [CN]:State or Province Name (full name) [CA]:Locality Name (eg, city) [HZ]:Organization Name (eg, company) [HZ]:Organizational Unit Name (eg, section) [changeme]:Common Name (eg, your name or your server's hostname) [client1]:Name [changeme]:Email Address [mail@host.domain]: Please enter the following 'extra' attributesto be sent with your certificate requestA challenge password []:An optional company name []:Using configuration from /etc/easy-rsa/2.0/openssl.cnfCheck that the request matches the signatureSignature okThe Subject's Distinguished Name is as followscountryName :PRINTABLE:'CN'stateOrProvinceName :PRINTABLE:'CA'localityName :PRINTABLE:'HZ'organizationName :PRINTABLE:'HZ'organizationalUnitName:PRINTABLE:'changeme'commonName :PRINTABLE:'client1'name :PRINTABLE:'changeme'emailAddress :IA5STRING:'mail@host.domain'Certificate is to be certified until Mar 28 03:21:06 2022 GMT (3650 days)Sign the certificate? [y/n]:y 1 out of 1 certificate requests certified, commit? [y/n]y Write out database with 1 new entriesData Base Updated

8. Create the key exchange parameter of difeholman

 ./build-dh

9. Copy the server certificate and key

 cp /etc/openvpn/easy-rsa/keys/{server.crt,server.key,dh2048.pem,ca.crt} /etc/openvpn

10. Configure the VPN Server

Cp/usr/share/doc/openvpn-2.3. */sample-config-files/server. conf/etc/openvpn // copy the configuration file to/etc/openvpn

Modify the server configuration file:

Cat server. conf | grep "^ [^ # | ^;]" // list uncommented content

Local 10.17.1.20 # Listening address port 1194 # listening port proto tcp # Listening protocol dev tun # using the routing tunnel mode ca. crt # ca certificate path cert server. crt # server certificate key server. key # This file shoshould be kept secret server key dh dh2048.pem # key Exchange Protocol file server 10.8.0.0 255.255.255.0 # assign an address pool to the client. Note: the private network segment of the VPN Server cannot be the same as ifconfig-pool-persist ipp.txt push "route 192.168.20.0 255.255.255.0" # Allow the client to access the private network segment of 20.0. Push "dhcp-option DNS 8.8.8.8" # dhcp assigns dns client-to-client # keepalive 10 120 # survival time, ping once every 10 seconds, 120 If no response is received, it is considered as a disconnection comp-lzo # data transmission compression max-clients 100 # a maximum of 100 clients are allowed to connect to user nobody # user group persist-key persist-tun status /var/log/openvpn/openvpn-status.log log/var/log/openvpn. log 3

11. iptables configuration

Clear iptables configuration: iptables-F iptables-X configure the openvpn nat Function to forward all packets in the CIDR block to the eth0 Port: iptables-t nat-a postrouting-o eth0-j MASQUERADE add FORWARD whitelist: iptables-a forward-I tun +-j ACCEPT enable the system routing function: echo "1">/proc/sys/net/ipv4/ip_forward service iptables save // save iptables configuration service iptables restart // restart iptables

12. Start openvpn

 service openvpn start

13. Configure the client

Copy client configuration file client. ovpn:

 cp /usr/share/doc/openvpn-2.3.*/sample/sample-config-files/client.conf /etc/openvpn/client.ovpn

Modify the client configuration file:

 cat server.conf | grep "^[^#|^;]"

Change client devtun prototcp // to tcp remote203.195.xxx. xxx1194 // OpenVPN server's Internet IP address and port resolv-retryinfinite nobind persist-key persist-tun caca. certificate certclient of crt // client1. crt keyclient. key // key of client1 ns-cert-typeserver comp-lzo verb3

• OpenVPN client Configuration

1. copy/etc/openvpn/easy-rsa/keys/{ca. crt, client. crt, client, key} and/etc/openvpn/client. ovpn to Windows 7 Client
2. Download The openvpn Client installation
: Http://pan.baidu.com/s/1ZsgpS
3. Copy the copied Files to the config directory under the openvpn Client installation directory (C: \ Program Files \ OpenVPN \ config)
4. Start OpenVPN GUI
Right-click the openvpn icon in the lower-right corner of the computer and select Connect ". Normally, the connection is successful and a normal IP address is allocated.

Original Reprinted from the Linux on this learning: http://www.linuxprobe.com