Openvpn service built on the intranet of a single Nic In Centos

Openvpn service built on the intranet of a single Nic In Centos

Centos single NicBuild openvpn service on Intranet

The topology is as follows:

Overview:

1. Implemented functions:... 1

2. Preparations before installation: 1

3. Install openvpn. 2

4. Generate the Certificate file:... 2

5. Create a server configuration file... 2

6. Configure kernel route forwarding and iptables forwarding:... 3

7. Create a client configuration file:... 4

8. Client installation and configuration: 4

1. Implemented functions:

Connecting to the vpn through the openvpn client, you can obtain the ip address and access the intranet work zone PC.

2. Preparations before installation:

Disable selinux

Map the Internet IP address and port to port 1194 of the openvpn Server

3. Install openvpn

#rpm-ivhhttp://mirrors.sohu.com/fedora-epel/6/x86_64/epel-release-6-8.noarch.rpm

#yum-yinstallopensslopenssl-devel lzo openvpn easy-rsa

4. Generate the Certificate file:

# cd/usr/share/easy-rsa/2.0/

# rm -rf vars&& vi vars

ExportEASY_RSA = "'pwd '"

ExportOPENSSL = "openssl"

ExportPKCS11TOOL = "pkcs11-tool"

ExportGREP = "grep"

ExportKEY_CONFIG = '$ EASY_RSA/whichopensslcnf $ EASY_RSA'

ExportKEY_DIR = "$ EASY_RSA/keys"

Echo NOTE: If you run./clean-all, I will be doing a rm-rf on $ KEY_DIR

ExportPKCS11_MODULE_PATH = "dummy"

ExportPKCS11_PIN = "dummy"

Export KEY_SIZE = 2048

Export CA_EXPIRE = 3650

ExportKEY_EXPIRE = 3650

ExportKEY_COUNTRY = "CN"

ExportKEY_PROVINCE = "GD"

ExportKEY_CITY = "Zhuhai"

ExportKEY_ORG = "smartsoft"

ExportKEY_EMAIL = "me@myhost.mydomain"

ExportKEY_OU = "smartsoft"

ExportKEY_NAME = "EasyRSA"

# Source vars // reinitialize the Certificate Information Environment Variable

#./Clean-all // clear all certificate-related files in the keys directory

#./Build-ca // generate the root certificate ca. crt and Root key ca. key (Press enter all the way)

#. /Build-key-server // generate the certificate and key for the server (Press enter all the way until y/n is required, enter y and press ENTER twice)

#./Build-key smartsoft // generate the certificate and key for the client (Press enter all the way until y/n is required, enter y and press ENTER twice)

#./Build-dh // create the difi Herman key and generate the dh2048.pem File

# Openvpn-genkey-secret keys/ta. key // generate the ta. key File (Anti-DDos, UDP flood, and other malicious attacks)

5. Create a server configuration file

# Mkdir/etc/openvpn/keys

# Cp/usr/share/easy-rsa/2.0/keys/{ca. crt, server. {crt, key}, dh2048.pem, ta. key}/etc/openvpn/keys/

# Vim/etc/openvpn/server. conf

; Mode server

; Tls-server

Port 1194

Proto tcp

; Topology subnet

Dev tun

Ca keys/ca. crt

Cert keys/server. crt

Key keys/server. key

Dh keys/dh2048.pem

Script-security 3

Username-as-common-name

; Plugin/usr/lib64/openvpn/plugin/lib/openvpn-auth-ldap.so "/etc/openvpn/server/ldap. conf"

Server 10.10.10.0 255.255.255.0

Ifconfig-pool-persist ipp.txt

Push "redirect-gateway"

Push "route 172.16.112.0 255.255.255.255.0"

Push "route 0.0.0.0 0.0.0.0"

Push "dhcp-option DNS 192.168.21.2"

Push "dhcp-option DNS 114.114.114.114"

Duplicate-cn

Client-to-client

Keepalive 10 120

Comp-lzo

Persist-key

Persist-tun

Status openvpn-status.log

# Verify the vpn login user by using the user authentication Password File

Auth-user-pass-verify/etc/openvpn/users/checkpsw. sh via-env

; Client-cert-not-required

Username-as-common-name

Verb 5

Mute 10

Reneg-sec 1800

6. Configure kernel route forwarding and iptables forwarding:

# Sed-I '/net. ipv4.ip _ forward/s/0/1/'/etc/sysctl. conf

# Sysctl-p

// You can first familiarize yourself with how to define iptables policies

# Vi/etc/sysconfig/iptables (the red part indicates an important policy)

# Generated by iptables-save v1.4.7 on Mon Nov 2 19:19:12 2015

* Nat

: Prerouting accept [0: 0]

: Postrouting accept [0: 0]

: Output accept [0: 0]

# Access to the 10.0.9/8/7/6. * network segment is not allowed. This is because the Intranet has established a vpn connection with another network, so you do not want to use Openvpn to directly access another network.

-A prerouting-d 10.0.9.0/24-p tcp-m tcp -- dport 22-j DNAT -- to-destination 127.0.0.1

-A prerouting-d 10.0.8.0/27-p tcp-m tcp -- dport 22-j DNAT -- to-destination 127.0.0.1

-A prerouting-d 10.0.8.128/25-p tcp-m tcp -- dport 22-j DNAT -- to-destination 127.0.0.1

-A prerouting-d 10.0.8.32/27-p tcp-m tcp -- dport 22-j DNAT -- to-destination 127.0.0.1

-A prerouting-d 10.0.8.64/27-p tcp-m tcp -- dport 22-j DNAT -- to-destination 127.0.0.1

-A prerouting-d 10.0.7.0/25-p tcp-m tcp -- dport 22-j DNAT -- to-destination 127.0.0.1

-A prerouting-d 10.0.7.128/26-p tcp-m tcp -- dport 22-j DNAT -- to-destination 127.0.0.1

-A prerouting-d 10.0.7.192/26-p tcp-m tcp -- dport 22-j DNAT -- to-destination 127.0.0.1

-A prerouting-d 10.0.6.0/26-p tcp-m tcp -- dport 22-j DNAT -- to-destination 127.0.0.1

-A prerouting-d 10.0.6.64/26-p tcp-m tcp -- dport 22-j DNAT -- to-destination 127.0.0.1

-A prerouting-d 10.0.6.128/26-p tcp-m tcp -- dport 22-j DNAT -- to-destination 127.0.0.1

-A prerouting-d 10.0.6.192/26-p tcp-m tcp -- dport 22-j DNAT -- to-destination 127.0.0.1

# Data disguised as 10.10.0/24

-A postrouting-s 10.10.10.0/24-o eth0-j MASQUERADE

# Address translation

-A postrouting-s 10.10.10.0/24-d 172.16.112.0/24-j SNAT -- to-source 172.16.112.171

COMMIT

# Completed on Mon Nov 2 19:19:12 2015

# Generated by iptables-save v1.4.7 on Mon Nov 2 19:19:12 2015

* Filter

: Input accept [603: 48381]

: Forward accept [594: 717393]

: Output accept [1777: 901584]

-A input-I lo-j ACCEPT

-A input-p tcp-m tcp -- dport 22-j ACCEPT

-A input-p tcp-m tcp -- dport 80-j ACCEPT

-A input-p tcp-m tcp -- dport 389-j ACCEPT

-A input-p tcp-m tcp -- dport 943-j ACCEPT

-A input-p tcp-m tcp -- dport 8080-j ACCEPT

-A input-p tcp-m tcp -- dport 8088-j ACCEPT

-A input-p tcp-m tcp -- dport 3306-j ACCEPT

-A input-p tcp-m tcp -- dport 3389-j ACCEPT

-A input-p icmp-m icmp -- icmp-type 8-j ACCEPT

-A input-m state -- state ESTABLISHED-j ACCEPT

-A input-s 172.16.112.0/24-p tcp-j ACCEPT

-A input-s 172.16.113.0/24-p tcp-j ACCEPT

-A input-s 172.16.114.0/24-p tcp-j ACCEPT

-A input-s 192.168.21.0/24-p tcp-j ACCEPT

-A input-s 10.10.10.0/24-d 172.16.112.0/24-I eth0-p tcp-m tcp -- dport 1194-j ACCEPT

-A input-I tun0-j ACCEPT

-A forward-I tun0-j ACCEPT

COMMIT

# Completed on Mon Nov 2 19:19:12 2015

# Service openvpn start

# Chkconfig openvpn on

# Chkconfig iptables on

# Service iptables restart

7. Create a client configuration file:

// Name the created file smartsoft. ovpn

# Viclient. ovpn

Client

Dev tun

Proto tcp

Remote 1.1.1.1 1010

Resolv-retry infinite

Nobind

Persist-key

Persist-tun

Ca. crt

Cert smartsoft. crt

Key smartsoft. key

Ns-cert-type server

Comp-lzo

Verb 5

8. Client installation and configuration:

// OpenVPN 2.3.3 Windows 32-bit installation file:

Http://swupdate.openvpn.org/community/releases/openvpn-install-2.3.3-I002-i686.exe

// OpenVPN 2.3.3 Windows 64-bit installation file:

Http://swupdate.openvpn.org/community/releases/openvpn-install-2.3.3-I002-x86_64.exe

// Set smartsoft on the OpenVPN server. ovpn, ca. crt, smartsoft. crt, smartsoft. key, ta. key to the config folder under the Windows Client installation directory (C: \ Program Files \ OpenVPN \ config)

// Open the Service Manager and start the openvpn Service

// Start OpenVPN GUI

Right-click the openvpn icon in the lower-right corner of the computer and select Connect ". Normally, the connection is successful and a normal IP address is allocated.

Finally, you can connect to the openvpn service through the openvpn client, and finally you can access the company's intranet. You cannot access the vpn Network established between the company's intranet and the company's network, more or less realize the network security of the partner company