Эта статья поможет вам установить и настроить OpenVPN Server на CentOS 6 x64. А также подключить к серверу Windows, OS X и Linux клиентов. Но перед тем как начать, – вам необходимо подключить EPEL-репозиторий. Именно этом репозитории хранятся пакеты для OpenVPN Server.
wget http://dl.fedoraproject.org/pub/epel/6/i386/epel-release-6-8.noarch.rpm rpm -Uvh epel-release-6-8.noarch.rpm
Первоначальное конфигурация
Для начала произведем установку OpenVPN из EPEL
yum install openvpn -y
Вместе с пакетом OpenVPN-сервера идут примеры конфигурации, которые мы скопируем в каталог /etc/openvpn
cp /usr/share/doc/openvpn-2.*/sample/sample-config-files/server.conf /etc/openvpn
После того, как у нас в нужном каталоге появился основной файл конфигурации OpenVPN, приведем базовые настройки к виду
push "redirect-gateway def1 bypass-dhcp" push "dhcp-option DNS 8.8.8.8" push "dhcp-option DNS 8.8.4.4" user nobody group nobody
Генерация ключей и сертификатов
Только что мы закончили конфигурирование OpenVPN, и теперь нам необходимо сгенерировать ключи и сертификаты. Как и файл server.conf, скопируем необходимые скрипты в каталог /etc/openvpn. Только важно не забыть перед этим установить пакет easy-rsa.
yum install easy-rsa mkdir -p /etc/openvpn/easy-rsa/keys cp -rf /usr/share/easy-rsa/2.0/* /etc/openvpn/easy-rsa
После чего необходимо открыть файл /etc/openvpn/easy-rsa/vars любимым редактором и привести заполнить некоторые поля
export KEY_COUNTRY="US" export KEY_PROVINCE="NY" export KEY_CITY="New York" export KEY_ORG="Organization Name" export KEY_EMAIL="[email protected]" export KEY_CN=droplet.example.com export KEY_NAME=server export KEY_OU=server
OpenVPN может неверно определить версию OpenSSL на CentOS 6 и не запуститься. Чтобы исключить это скопируем openssl-1.0.0.cnf с именем openssl.cnf
cp /etc/openvpn/easy-rsa/openssl-1.0.0.cnf /etc/openvpn/easy-rsa/openssl.cnf
Изменим рабочий каталог на /etc/openvpn/easy-rsa и сгенерируем CA-сертификат
cd /etc/openvpn/easy-rsa source ./vars ./clean-all ./build-ca
После этого мы можем создать сертификат для нашего OpenVPN-сервера. В конце напишите yes
./build-key-server server
Также нам необходимо сгенерировать Diffie Hellman ключ, используя скрипт build-dh и скопировать все файлы в каталог /etc/openvpn
./build-dh cd /etc/openvpn/easy-rsa/keys cp dh1024.pem ca.crt server.crt server.key /etc/openvpn
И на последок, чтобы позволить клиентам подключаться, – нужно создать клиентские сертификаты. Вы можете проделать генерацию клиентских сертификатов и ключей любое количество раз
cd /etc/openvpn/easy-rsa ./build-key client
Маршрутизация и запуск OpenVPN
Создадим в iptables правило, позволяющее ходить пакетам за пределы подсетей OpenVPN
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE service iptables save
И разрешим IP Forwarding в sysctl. Открываем /etc/sysctl.conf и определяем параметр
net.ipv4.ip_forward = 1
Ну и в завершение сохраним настройки sysctl и включим OpenVPN в автозагрузку и запустим его
sysctl -p chkconfig openvpn on service openvpn start
Конфигурация OpenVPN клиентов
Итак, ваш OpenVPN сервер запущен и готов к подключению внешних клиентов. Процедура подключения в разных операционных системах может незначительно отличаться. Но, в общем и целом, она сводится к тому, чтобы программе клиенту подключить конфигурационный файл(без кавычек)
client dev tun proto udp remote x.x.x.x 1194 resolv-retry infinite nobind persist-key persist-tun comp-lzo verb 3 <ca> Contents of ca.crt </ca> <cert> Contents of client.crt </cert> <key> Contents of client.key </key>
Вместо x.x.x.x вам необходимо прописать IP-адрес OpenVPN-сервера. А в блоки ca, cert и key содержимое файлов /etc/openvpn/easy-rsa/keys/ca.crt, /etc/openvpn/easy-rsa/keys/client.crt и /etc/openvpn/easy-rsa/keys/client.key соответственно.
Сохраните файл конфигурации клиента с расширением .ovpn по следующей таблице
| Операционная система | Программа | Путь к файлу конфигурации |
| Windows | OpenVPN Community Edition binaries | C:\Program Files\OpenVPN\config |
| Mac OS X | Tunnelblick | ~/Library/Application Support/Tunnelblick/Configurations |
| Linux | openvpn | any |
В Linux подключение происходит следующей командой
sudo openvpn --config ~/path/to/client.ovpn
Примите мои поздравления – мы закончили установку, настройку и конфигурирование OpenVPN сервера на ОС CentOS 6!
Oh my goodness! an impressive post guy. Thank you Nonetheless I am experiencing issue with ur rss. Don?t know why Incapable to subscribe to it. Is there anybody obtaining similar rss problem? Anyone that recognizes kindly respond. Thnkx
Way cool! Some extremely valid points! I appreciate you writing this article and the rest of the site is really good.
A fascinating conversation is worth remark. I think that you ought to create much more on this topic, it could not be a taboo subject yet normally individuals are not nearly enough to speak on such subjects. To the following. Cheers
This is the right blog for anybody who wants to find out about this topic. You recognize a lot its practically difficult to say with you (not that I actually would want?HaHa). You absolutely put a brand-new spin on a subject thats been blogged about for years. Fantastic things, just terrific!
Hello! I simply would love to offer a significant thumbs up for the great info you have below on this blog post. I will certainly be coming back to your blog site for more quickly.
really good post, i definitely enjoy this internet site, keep on it
Would you be fascinated in exchanging web links?
Hello! I’m at work browsing your blog from my new apple iphone!
Just wanted to say I love reading through your blog and look forward to all your posts!
Keep up the outstanding work!
If some one needs to be updated with hottest technologies therefore he must be pay a visit this
site and be up to date all the time. 2CSYEon cheap flights
Whoa! This blog looks exactly like my old one!
It’s on a totally different topic but it has pretty much the same page layout and
design. Excellent choice of colors!
Hello! I simply wish to provide a huge thumbs up for the terrific information you have right here on this article. I will be coming back to your blog for even more quickly.
This piece of writing is really a good one it assists new internet visitors, who are wishing in favor of blogging.
This is my first time visit at here and i am in fact pleassant to read everthing at alone place.
I was really delighted to discover this web-site. I wanted to thanks for your time for this remarkable read!! I definitely appreciating every little of it as well as I have you bookmarked to take a look at new stuff you blog post.
Your location is valueble for me. Thanks !?
You made some suitable factors there. I viewed the internet for the problem and also located most people will certainly accompany with your website.
I was very pleased to discover this web-site. I intended to many thanks for your time for this remarkable read!! I most definitely enjoying every little of it and also I have you bookmarked to check out brand-new things you blog post.
After research a few of the blog posts on your internet site currently, as well as I absolutely like your way of blog writing. I bookmarked it to my book mark internet site list and also will be checking back soon. Pls check out my website as well and let me understand what you believe.
Your place is valueble for me. Thanks !?
When I originally commented I clicked the -Alert me when new comments are added- checkbox as well as now each time a remark is added I get four e-mails with the same comment. Exists any way you can remove me from that solution? Many thanks!
This web site is actually a walk-through for all of the details you wanted concerning this as well as didn?t recognize who to ask. Glance here, as well as you?ll definitely discover it.
Aw, this was an actually nice blog post. In idea I want to place in composing such as this additionally? requiring time and real initiative to make an excellent short article? however what can I state? I postpone alot as well as by no means appear to obtain something done.