OpenVPN分別在Linux和Windows（帶GUI）下安裝筆記

一. OpenVPN 安裝環境

Server 端的環境
redhat, kernel版本: 2.4.20-31.9, IP 為 70.8.7.6
kernel 需要支援 tun 裝置, 需要載入 iptables 模組.

檢查 tun 是否安裝:

代碼:
root@a [/]# modinfo tun
filename:    /lib/modules/2.4.20-31.9/kernel/drivers/net/tun.o
description: 
author:      
license:     "GPL"

如果沒有 modinfo 命令, 直接找一下, 看看 kernel 裡是否有 tun.o 檔案:

代碼:
find -name tun.o
./lib/modules/2.4.20/kernel/drivers/net/tun.o

檢查iptables 模組, 查看是否有下列檔案:

/etc/init.d/iptables

OpenSSL。如果需要啟用 SSL 串連，則需要先安裝 OpenSSL。安裝　OpenSSL 的方法在這裡不做介紹，具體可以用 Google 搜尋。CentOS 下可以用 yum

install:
yum install openssl
yum install openssl-devel

安裝的 OpenVPN 的版本: 2.0.5. 現在似乎已經有一個更新的版本了. 可在http://openvpn.net 上下載.

Client 端的環境:
Windows XP PRO SP2
OpenVPN GUI For windows 1.0.3 , 可在 openvpn.se 下載

注意: OpenVPN GUI for windows 的版本要和 OpenVPN Server 的版本配套.

例如, 伺服器裝的是 OpenVPN 2.0.5, 那麼下載的 OpenVPN GUI fow windows 應該是: openvpn-2.0.5-gui-1.0.3-install.exe

OpenVPN GUI的所有曆史版本: http://openvpn.se/files/install_packages/

二. OpenVPN 服務端安裝過程

http://www.xiaohui.com/dev/server/20070514-install-openvpn.htm

用 SecureCRT 登入到 host, 進入根目錄 代碼:

cd /
下載 LZO，解壓到lzo-2.02.
地址: http://www.oberhumer.com/opensource/lzo/download/ 代碼:
wget http://www.oberhumer.com/opensource/lzo/download/lzo-2.02.tar.gz
下載 OpenVPN, 解壓到openvpn-2.0.5
地址: http://openvpn.net/download.html 代碼:
wget http://openvpn.net/release/openvpn-2.0.5.tar.gz
安裝 LZO 代碼:
cd /lzo-2.02
./configure
make
make check
make install

安裝 OpenVPN

代碼:
cd /openvpn-2.0.5
./configure
# 或用指定dir: (注:下述命令, 應該在一行寫完. 為了方便顯示, 這裡分成了四行)
# ./configure --with-lzo-headers=/usr/local/include
#  --with-lzo-lib=/usr/local/lib
#  --with-ssl-headers=/usr/local/include/openssl
#  --with-ssl-lib=/usr/local/lib
make
make install

產生認證Key

初始化 PKI
(如果沒有 export 命令也可以用 setenv [name] [value] 命令)

代碼:
cd /openvpn-2.0.5/easy-rsa
export D=`pwd`
export KEY_CONFIG=$D/openssl.cnf
export KEY_DIR=$D/keys
export KEY_SIZE=1024
export KEY_COUNTRY=CN
export KEY_PROVINCE=GD
export KEY_CITY=SZ
export KEY_ORG="xiaohui.com"
export KEY_EMAIL="your-email [at] xiaohui.com"

Build:

代碼:
./clean-all
./build-ca

Generating a 1024 bit RSA private key
................++++++
........++++++
writing new private key to 'ca.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]:
State or Province Name (full name) [GD]:
Locality Name (eg, city) [SZ]:
Organization Name (eg, company) [xiaohui.com]:
Organizational Unit Name (eg, section) []:xiaohui.com
Common Name (eg, your name or your server's hostname) []:server
Email Address [your-email [at] xiaohui.com]:
# 建立 server key 代碼: 代碼:
./build-key-server server

Generating a 1024 bit RSA private key
......++++++
....................++++++
writing new private key to 'server.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]:
State or Province Name (full name) [GD]:
Locality Name (eg, city) [SZ]:
Organization Name (eg, company) [xiaohui.com]:
Organizational Unit Name (eg, section) []:xiaohui.com
Common Name (eg, your name or your server's hostname) []:server
Email Address [your-email [at] xiaohui.com]:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:abcd1234
An optional company name []:xiaohui.com
Using configuration from /openvpn-2.0.5/easy-rsa/openssl.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName           :PRINTABLE:'CN'
stateOrProvinceName   :PRINTABLE:'GD'
localityName          :PRINTABLE:'SZ'
organizationName      :PRINTABLE:'xiaohui.com'
organizationalUnitName:PRINTABLE:'xiaohui.com'
commonName            :PRINTABLE:'server'
emailAddress          :IA5STRING:'your-email [at] xiaohui.com'
Certificate is to be certified until Mar 19 08:15:31 2016 GMT (3650 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
#產生用戶端 key
代碼:
./build-key client1
Generating a 1024 bit RSA private key
.....++++++
......++++++
writing new private key to 'client1.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]:
State or Province Name (full name) [GD]:
Locality Name (eg, city) [SZ]:
Organization Name (eg, company) [xiaohui.com]:
Organizational Unit Name (eg, section) []:xiaohui.com
Common Name (eg, your name or your server's hostname) []:client1    #重要: 每個不同的 client 產生的認證, 名字必須不同.
Email Address [your-email [at] xiaohui.com]:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:abcd1234
An optional company name []:xiaohui.com
Using configuration from /openvpn-2.0.5/easy-rsa/openssl.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName           :PRINTABLE:'CN'
stateOrProvinceName   :PRINTABLE:'GD'
localityName          :PRINTABLE:'SZ'
organizationName      :PRINTABLE:'xiaohui.com'
organizationalUnitName:PRINTABLE:'xiaohui.com'
commonName            :PRINTABLE:'client1'
emailAddress          :IA5STRING:'your-email [at] xiaohui.com'
Certificate is to be certified until Mar 19 08:22:00 2016 GMT (3650 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

依次類推產生其他用戶端認證/key
代碼:
./build-key client2
./build-key client3

注意在進入 Common Name (eg, your name or your server's hostname) []: 的輸入時, 每個認證輸入的名字必須不同.

產生 Diffie Hellman 參數 。代碼:
./build-dh

將 keys 下的所有檔案打包下載到本地
代碼:
tar -cf mykeys.tar /openvpn-2.0.5/easy-rsa/keys
cp mykeys.tar /home/xiaohui.comsys/public_html/mykeys.tar
將 mykeys.tar 移到 web public(絕對路徑因人而異) 上, 然後用 http://www.a.com/mykeys.tar 方式將其下載到本地儲存, 然後將其從server刪除: 代碼:
rm /home/xiaohui.comsys/public_html/mykeys.tar

也可以用其他方法把 key file搞到本地，例如 ftp.
建立服務端設定檔
從範例檔案建立:
代碼:
cd $dir/sample-config-files/ # 進入原始碼解壓目錄下的sample-config-files子目錄
cp server.conf /usr/local/etc  # cp伺服器設定檔到/usr/local/etc
vi /usr/local/etc/server.conf

我建立的server.conf 的內容稍後另附.
建立用戶端設定檔
代碼:
cd $dir/sample-config-files/  #進入原始碼解壓目錄下的sample-config-files子目錄
cp client.conf /usr/local/etc  #cp用戶端設定檔到/usr/local/etc
vi /usr/local/etc/client.conf
我建立的client.conf 的內容稍後另附.
啟動Openvpn: openvpn [server config file] 代碼:
/usr/local/sbin/openvpn --config /usr/local/etc/server.conf

三. OpenVPN GUI For Windows 用戶端安裝過程

安裝 OpenVPN GUI For Windows, 到 http://openvpn.se 下載. 目前的版本是 1.0.3. 注意: OpenVPN GUI 的版本要和 OpenVPN Server 的版本配套. 詳見第一節一. 安裝環境中的說明.

依螢幕指示安裝openvpn gui.

配置 openvpn gui

安裝結束後, 進入安裝資料夾下的 config 目錄, 然後將上面第 10 步建立的 client.conf 檔案從 server 上下載到此檔案夾, 並更名為 client.ovpn
同時, 將第8 步打包的 mykeys.tar 中的下列認證檔案解壓到此檔案夾:
代碼:
ca.crt
ca.key
client1.crt
client1.csr
client1.key

然後雙擊 client.ovpn 即可啟動 openvpn, 或者通過 OpenVPN GUI 的控制啟動 VPN.

如果雙擊 client.ovpn 沒有反應, 則在工作列點 OpenVPN GUI 的小表徵圖右鍵, 選擇 edit config, 將內容複寫過去再儲存. 然後再點右鍵中的 connect即可.

如果需要第二台機器上使用 vpn , 進行同樣的配置, 只需要將 client1.crt, client1.csr, client1.key 換成對應的 client2.xxx 即可, 然後將client.ovpn 中的對應key檔案值改掉.

四. OpenVPN 配置範例檔案

OpenVPN 服務端：server.conf
代碼:
local 70.8.7.6
port 1194
proto udp

dev tun

ca /openvpn-2.0.5/easy-rsa/keys/ca.crt
cert /openvpn-2.0.5/easy-rsa/keys/server.crt
key /openvpn-2.0.5/easy-rsa/keys/server.key  # This file should be kept secret
dh /openvpn-2.0.5/easy-rsa/keys/dh1024.pem

server 10.8.0.0 255.255.255.0

client-to-client
keepalive 10 120

comp-lzo

persist-key
persist-tun
status /openvpn-2.0.5/easy-rsa/keys/openvpn-status.log
verb 4

push "dhcp-option DNS 10.8.0.1"
push "dhcp-option DNS 70.88.98.10"  # name server 地址, 如何擷取見隨後說明
push "dhcp-option DNS 70.88.99.11"  # name server 地址, 如何擷取見隨後說明
說明: 有些 domain 被 GFW 封掉了, 這時, 如果要訪問這些網站, 應該將 server 上的 DNS push 到 client. 上面樣本中的 dns ip: 70.88.98.10, 70.88.99.10, 可以在 /etc/resolv.conf 中找到: 代碼:
vi /etc/resolv.conf
nameserver   70.88.98.10
nameserver   70.88.99.11
OpenVPN 用戶端端: client.ovpn
代碼:
client

dev tun
proto udp

remote 70.8.7.6 1194

persist-key
persist-tun
ca ca.crt
cert client1.crt
key client1.key
ns-cert-type server
comp-lzo
verb 3

redirect-gateway def1

五. OpenVPN 訪問外網的設定

開啟路由 VPN串連成功後, 還需要設定路由, 才能透過VPN訪問Internet. 在 linux host 上添加路由: 代碼:

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 70.8.7.6
/etc/init.d/iptables save
/etc/init.d/iptables restart

不同的機器，-o eth0 參數可能不一樣，具體可輸入 ifconfig 查看，搞清 ip(70.8.7.6)所在的網卡號.

同時, 需要將 ip forward 開啟. 不要用 echo 1 > /proc/sys/net/ipv4/ip_forward 的方式, 這種方式重啟後無效. 先查看一下:
代碼:

sysctl -a | grep for
#查看結果:
net.ipv4.conf.tun0.mc_forwarding = 0
net.ipv4.conf.tun0.forwarding = 1
net.ipv4.conf.eth0.mc_forwarding = 0
net.ipv4.conf.eth0.forwarding = 1
net.ipv4.conf.lo.mc_forwarding = 0
net.ipv4.conf.lo.forwarding = 1
net.ipv4.conf.default.mc_forwarding = 0
net.ipv4.conf.default.forwarding = 1
net.ipv4.conf.all.mc_forwarding = 0
net.ipv4.conf.all.forwarding = 1
net.ipv4.ip_forward = 1

如果你的主機上列數值不是為1, 則要將其改成1, 例如:
代碼:
sysctl -w net.ipv4.ip_forward=1
依此類推.
開啟網域名稱伺服器
如果你需要訪問一些已經被GFW封掉了網域名稱的網站, 但你的 OpenVPN 伺服器沒有被封的話，那麼你需要在你的主機上開啟 name server, 並將 dns push 給 client。 一般的外掛式主控件, 都帶有 private dns server.
代碼:
rpm -qa | grep bind
/etc/init.d/named start
另外, 必須保證 server.conf 配置中, 有這三個配置:
代碼:
push "dhcp-option DNS 10.8.0.1"
push "dhcp-option DNS 70.88.98.10"  # name server 地址
push "dhcp-option DNS 70.88.99.11"  # name server 地址
當 client 串連成功後, 在 cmd 下執行 ipconfig /all, 應該有這類似這樣的輸出:
代碼:
Ethernet adapter Local Area Connection 3:
        Connection-specific DNS Suffix  . :
        Description . . . . . . . . . . . : TAP-Win32 Adapter V8
        Physical Address. . . . . . . . . : 00-FF-AA-B0-60-2B
        Dhcp Enabled. . . . . . . . . . . : Yes
        Autoconfiguration Enabled . . . . : Yes
        IP Address. . . . . . . . . . . . : 10.8.0.6
        Subnet Mask . . . . . . . . . . . : 255.255.255.252
        Default Gateway . . . . . . . . . : 10.8.0.5
        DHCP Server . . . . . . . . . . . : 10.8.0.5
        DNS Servers . . . . . . . . . . . : 10.8.0.1
                                            70.88.98.10
                                            70.88.99.11
        Lease Obtained. . . . . . . . . . : 2006年5月25日 5:13:52
        Lease Expires . . . . . . . . . . : 2007年5月25日 5:13:52

六. 設定 OpenVPN 伺服器 reboot後自動啟動 openvpn
執行命令:
代碼:
vi /etc/rc.local

然後在最後面加入此行:
代碼:
/usr/local/sbin/openvpn --config /usr/local/etc/server.conf > /dev/null 2>&1 &

七. OpenVPN 測試

你可以用 VPN 登入上去之後, 測試 MSN, QQ, IE 等網路應用, 也可以嘗試訪問一些被 GFW 禁掉的網站, 當然, 前提是你的 VPN 伺服器不在境內.

八. 使用 OpenVPN 的強烈注意事項

不建議用 VPN 登入 paypal 帳戶和 google adsense 帳戶. 否則有可能導致帳戶受限或帶來其他風險.

十. 一些補充

2011.01.11 補充：今天用 yum -y update 升級了 CentOS 之後，發現 OpenVPN 串連不上去了，老是說使用者檢驗出錯。經檢查 server log，發現有以下日誌：
Thu Feb 10 11:13:07 2011 us=3362 222.244.***.**:45771 TLS: Initial packet from 222.244.***.**:45771, sid=eec450eb 8673ceef
Thu Feb 10 11:13:10 2011 us=798063 222.244.***.**:45771 openvpn_execve: external program may not be called unless '--script-secur ity 2' or higher is enabled. Use '--script-security 3 system' for backward compatibility with 2.1_rc8 and earlier. See --help t ext or man page for detailed info.
Thu Feb 10 11:13:10 2011 us=798127 222.244.***.**:45771 TLS Auth Error: user-pass-verify script failed to execute: /usr/bin/php - q /home/xiaohui/openvpn-manager/admin/openvpn-auth.php
Thu Feb 10 11:13:10 2011 us=798141 222.244.***.**:45771 TLS Auth Error: Auth Username/Password verification failed for peer

經查，原來是 CentOS 在進行 yum update 時，將 OpenVPN 也由2.0 升級到了 2.1。而 OpenVPN 2.1 最大的改變之一，就是加了一個 script-security參數。如果按我的這篇教程進行安裝，但裝的是 OpenVPN 2.1 及以上版本的話，記得在 server.conf 中再加上這麼一行配置即可：
script-security 3
=======================================
./configure --with-lzo-headers=/usr/local/include/ --with-lzo-lib=/usr/local/lib --with-ssl-headers=/usr/include/openssl/ --with-ssl-lib=/usr/lib/openssl/

http://www.oberhumer.com/opensource/lzo/download/
http://www.oberhumer.com/opensource/lzo/download/lzo-2.05.tar.gz

http://openvpn.net/index.php/open-source/downloads.html
wget http://swupdate.openvpn.org/community/releases/openvpn-2.2.1.tar.gz