Connect two remote LAN segments based on OpenVPN

Source: Internet
Author: User

Connect two remote LAN system environments based on OpenVPN: SERVER: RHEL5 [2.6.18-8. el5xen] software environment: Reference: Purpose: Build an OpenVPN server to connect two remote LAN segments across the Internet. | --------------- | <--> Internet <--> | --------------- | LAN2 <--> | Router2 (Client) | Router1 (Server) | --> LAN1 | --------------- | <--> ssl vpn Tun <--> | ------------- | (Beijing) Server (router1) network parameters: eth0 eth1 (as the gateway of LAN1 in this example) LAN1: (Guangzhou) Client (router2) network parameters: eth0 eth2 (as the gateway of LAN2 in this example) LAN2: ############################## ####################################### 1, install the OpenVPN Software Package (perform the following operations on router1 and router2, install it in the/usr/local directory by default) 1. Install lzo (compress SSL data) shell & gt; tar zxvf lzo-2.03.tar.gz-C/usr/srcshell & gt; cd/usr/src/lzo-2.03shell & gt. /configure & make install 2, install openvpnshell> tar zxvf openvpn-2.0.9.tar.gz-C/usr/srcshell> cd/usr/src/openvpn-2.0.9shell>. /configure & make install 2. configure OpenVPN Server End (router1) 1. Create a certificate and related key file (refer to/usr/src/openvpn-2.0.9/easy-rsa/README) 1) adjust and predefine variables shell> mkdir/etc/openvpnshell> cd/usr/src/openvpn-2.0.9/easy-rsashell> vi vars export D = 'pwd' export KER_CONFIG = $ D/ openssl. cnfexport KEY_DIR = "/etc/openvpn/keys/" # // modify the storage location of the generated key and other files. export KEY_SIZE = 1024 export KEY_COUNTRY = CN # // The following is used for each key the predefined information in export KEY_PROVINCE = BJexport KEY_CITY = BJexport KEY_ORG = "BJ-GZ" expor T KEY_EMAIL = "TsengYiashell>" shell>. varsshell>. /clean-all 2) create certificates, keys, and other files shell>. /build-ca # // generate CA certificate shell>. /build-dh # // generate the dh (Diffie-Hellman) file shell>. /build-key-server router1 # // generate the server key shell>. /build-key router2 # // generate client key shell>/usr/local/sbin/openvpn -- genkey -- secret/etc/openvpn/keys/ta. key # // generate tls-auth key 2, create OpenVPN service configuration file shell> cp/usr/src/openvpn-2.0.9/sample-config-files/server. co Nf/etc/openvpn/shell> vi/etc/openvpn/server. conflocal # // specify the interface address of the VPN service listener (the address of the eth0 Nic In this example) port 1194 # // specify the port proto udp dev tunca keys/ca that the VPN service listens. crtcert keys/router1.crtkey keys/router1.keydh keys/dh1024.pemserver # // specify the virtual subnet of the vpn tunnel. The vpn server automatically uses the first IP address, for example, ipp.txt push "route" # // notify the client of the server's LAN1 network segment client-c Onfig-dir ccd # // specify the client configuration file that calls the ccd subdirectory, you can specify the peer IP address in the file: route # // route client-to-client that is added to the LAN2 network segment of the server # // allow mutual access between clients duplicate-cn # // allow the client key to be reused keepalive 10 120tls-auth keys/ta. key 0 # // specify the tls authentication key cipher BF-CBC # // specify the cipher encryption algorithm comp-lzomax-clients 100 # // specify the maximum number of concurrent connections user nobodygroup nobodypersist-keypersist-tunstatus/tmp openvpn-status.logverb 3 mute 20 shell> Mkdir/etc/openvpn/ccdshell> vi/etc/openvpn/ccd/router2 # // specify the IP address parameter iroute 255.255.0ifconfig-push in the independent configuration file of the client # // tun0 local address, p-t-P peer address 3. Prepare STARTUP script, start OpenVPNshell> cp-p/usr/src/openvpn-2.0.9/sample-scripts/openvpn. init/etc/init. d/shell> vi/etc/init. d/openvpnshell> chkconfig -- add openvpnshell> chkconfig -- level 35 openvpn onshell> service openvpn start 3. Configure the OpenVPN Client (router2) 1. Download the certificate and related key file 1) and download the ca generated on the server. crt, router2.crt, router2.key, and ta. key File, back up 2) copy the above file to the/etc/openvpn/keys directory of router2 2, modify the Client configuration file shell> cp/usr/src/openvpn-2.0.9/sample-config-files/client. conf/etc/openvpn/shell> vi/etc/openvpn/client. confclientdev tunproto udpremote 1194resolv-retry infinitenobinduser nobodygroup nobodypersist-keypersist-tunca keys /Ca. crtcert keys/router2.crtkey keys/router2.keyns-cert-type servertls-auth keys/ta. key 1 cipher BF-CBCcomp-lzoverb 3 mute 20 4. Prepare the startup script and start OpenVPN (perform the following operations on router1 and router2) shell> cp-p/usr/src/openvpn-2.0.9/sample-scripts/openvpn. init/etc/init. d/shell> vi/etc/init. d/openvpnshell> chkconfig -- add openvpnshell> chkconfig -- level 35 openvpn onshell> service openvpn start v. connectivity test 1. You can test the connection in r On outer1 and router2, view the tun0 information of router1 with the tun0 parameter (ifconfig tun0): inet addr: P-t-P: router2 tun0 information: inet addr: P-t-P: 2. You can view the route table information of route Entry 1 in route Entry 1 and route entry 2 respectively: destination Gateway Genmask Flags Metric Ref Use Iface route tables 255.0 UG 0 0 0 0 tun0router2 route table information should have a route record to the LAN1 network segment: Destination Gateway Genmask Flags Metric Ref Use Iface UG 0 0 0 tun0 3, LAN1, LAN2 two network segments client interconnection test, for example: Beijing and Guangzhou can ping each other. This article is from feino.

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.