Install openvpn on centos6 (route mode certificate authentication)

Server Configuration 1 , Installation Openvpn

Rpm-IVHHttp://pkgs.repoforge.org/rpmforge-release/rpmforge-release-0.5.2-2.el6.rf.x86_64.rpm

Yum install openvpn-y

Of course, you can also download from this page:Http://openvpn.net/index.php/download.html

2 , Configure the server 2.1 Initialize the server

CD/etc/openvpn/

CP/usr/share/doc/openvpn-2.2.2/sample-config-files/server. conf.

Mkdir-P easy-RSA/keys & CD easy-RSA

CP-RF/usr/share/doc/openvpn-2.2.2/easy-RSA/2.0/*. & chmod + x *

2.2 Configuration PKI

VI vars

Find"Export key_size ="In this line1024Change2048Or4096

Then locate the end and you will see something similar to the following:

Export
Key_country = "us"

Export
Key_province = "ca"

Export
Key_city = "sanfrancisco"

Export
Key_org = "fort-Funston"

Export
Key_email = "me@myhost.mydomain"

Export
Key_email = mail@host.domain

Export
Key_cn = changeme

Export
Key_name = changeme

Export
Key_ou = changeme

Export
Pkcs11_module_path = changeme

Export
Pkcs11_pins = 1234

This can be changed as needed and run without modification. Actually not changedVarsThis file,VPNYou can also run it.

3 , Generate a certificate 3.1 , Generate CA Certificate

../VarsOr:
Source./vars

Note: there is a space before it.

./Clean-all
& Amp; CP openssl-1.0.0.cnf OpenSSL. CNF &./build-ca

RunYum
Install OpenSSL-y

Just press enter, or you can write some information at will.

3.2 , Generate server certificate

./Build-key-Server
Myserver

MyserverThat is, the server name, which can be used at will, but remember to use it later.

Press enter all the way. Enter all requestsY

3.3 , Generate DH Verification File

./Build-DH

There is nothing to say about this. Let the server fly.

3.4 Generate client certificates

./Build-Key
Client1

Client1Replace it with the user you want, and press enter all the way.Y

3.5 , Edit the service configuration file

VI
/Etc/openvpn/server. conf

• FindPortOne line, followed1194Yes. Adjust the port number as needed. (If the port number is not 1194, SELinux may not be allowed to pass. You can use the "setenforce 0" command to temporarily disable SELinux for testing)

• FindCA
  CA. CRTThis line,CA. CRTReplace/Etc/openvpn/easy-RSA/keys/CA. CRT

• CERTNext to this lineServer. CRTReplace/Etc/openvpn/easy-RSA/keys/myserver. CRT

• KeyNext to this lineServer. KeyReplace/Etc/openvpn/easy-RSA/keys/myserver. Key

• DHNext to this lineDh1024.pemReplace/Etc/openvpn/easy-RSA/keys/dh1024.pem

  NoteMyserver. CRTAndMyserver. KeyIs what was previously generated.

• Find; Push
  "Redirect-Gateway def1
  Bypass-DHCP", Remove the comment symbol at the beginning, and deleteDef1TheBypass-DHCP, That is, to replace this line:Push
  "Redirect-Gateway def1"

• Find; Push
  "DHCP-option DNS 208.67.222.222"And; Push
  "DHCP-option DNS 208.67.222.220"ReplacePush
  "DHCP-option DNS 8.8.8.8"AndPush
  "DHCP-option DNS 8.8.4.4"Remove the annotator. You can change the annotation according to your own situation.

You can save the configurations by default.

4 , Start the service

Service
Openvpn start

Or

/Etc/init. d/openvpn
Start

If the startup fails, you can add a line in the configuration file.Log-append
Openvpn. Log

Try again, and then/Etc/openvpn/CheckOpenvpn. LogFile to view the cause of the error. The last line is executed.

Chkconfig
-- Level 235 openvpn on

SetOpenvpnAdd a startup Item

Set Internet access

VI
/Etc/sysctl. conf

FindNet. ipv4.ip_forward
= 0

Set0Change1

Sysctl
-P

Iptables
-T Nat-A postrouting-s 10.8.0.0/24-j snat -- to-source 2.2.2.2

Set2.2.2.2Replace with yourselfVPSOfIP

/Etc/init. d/iptables
Save

/Etc/init. d/iptables
Restart

Client Configuration

:Http://openvpn.net/index.php/download.html

WindowsLink:Http://swupdate.openvpn.org/community/releases/openvpn-2.2.2-install.exe

EnterC: \ Program
Files \ openvpnDirectory, SetSample-configUnderClient. ovpnFile copyConfigDirectory, which is generated on the serverCA. CRT
Client1.key client1.crtCopyConfigDirectory.

Make the following changes:

Find"Remote
My-server-1 1194"To change the configuration of the server.

CA
CA. CRT

CERT
Client. CRT

Key
Client. Key

Change to the following Configuration:

CA
"C: \ Program Files \ openvpn \ config \ ca. CRT"

CERT
"C: \ Program Files \ openvpn \ config \ client1.crt"

Key
"C: \ Program Files \ openvpn \ config \ client1.key"

Others remain unchanged.

Connect here

Connection successful

Okay, that's all. I hope it will help you.