openvpn配置

Linux Server端配置

本机IP：192.168.200.138 openvpn安装

cd /etc/openvpn/easy-rsa/2.0 source vars ./clean-all ./build-ca

./build-key-server server ./build-key client1 ./build-key client2 ./build-dh cd ./keys/

cp -ra ca.crt server.crt server.key dh1024.pem /etc/openvpn vim server.conf

local 192.168.200.138 port 5555 proto udp dev tun ca ca.crt cert server.crt key server.key dh dh1024.pem server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt client-to-client keepalive 10 120 comp-lzo max-clients 100 user nobody group nobody persist-key persist-tun status openvpn-status.log log-append /var/log/openvpn.log verb 3 /etc/init.d/openvpn start

openvpn启动失败：

* Starting virtual private network daemon(s)... * Autostarting VPN 'server' [fail]

检查Log文件：

tail -n 10 /var/log/openvpn.log 有如下一条：

Sat Apr 28 10:48:43 2012 failed to find GID for group nobody

重新修改server.conf，去除group nobody： 重新启动openvpn：

* Starting virtual private network daemon(s)... * Autostarting VPN 'server' [ OK ] ip a查看：

9: tun0: mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 100 link/none

inet 10.8.0.1 peer 10.8.0.2/32 scope global tun0

Linux Client端配置

本机IP：192.168.200.139

在Server端将ca.crt client1.crt client1.key复制到linux端： cd /etc/openvpn/easy-rsa/2.0/keys

scp ca.crt. client1.crt client1.key root@192.168.200.139:/etc/openvpn 回到client端： cd /etc/openvpn vim client.conf

client dev tun proto udp remote 192.168.200.138 5555 resolv-retry infinite nobind user nobody route 192.168.0.0 255.255.0.0 persist-key persist-tun ca ca.crt cert client1.crt key client1.key comp-lzo verb 3

/etc/init.d/openvpn start

* Starting virtual private network daemon(s)... * Autostarting VPN 'client' [ OK ]

正常启动，但是ip a查看，没有tun

可能是同一网段的问题，在server端修改server.conf： 添加一条：

push “redirect-gateway”

使所有数据都通过vpn传输

ping 192.168.200.134

在server端抓包，是从10.8.0.6到192.168.200.134：

13:57:42.188044 IP 10.8.0.6 > 192.168.200.134: ICMP echo request, id 3389, seq 22, length 64 13:57:42.188366 IP 192.168.200.134 > 10.8.0.6: ICMP echo reply, id 3389, seq 22, length 64 在192.168.200.134抓包，显示的是从10.8.0.6来的包：

13:57:48.067226 IP 10.8.0.6 > 192.168.200.134: ICMP echo request, id 3389, seq 28, length 64 13:57:48.067254 IP 192.168.200.134 > 10.8.0.6: ICMP echo reply, id 3389, seq 28, length 64 但是client端没有回包：

如果数据包不从tun0走的话，可以在client端删除 route del -net 192.168.200.0/24 这条路由。

client端没有回包，需要在192.168.200.134加下面这条路由： route add -net 10.8.0.0/24 gw 192.168.200.138 dev eth0

client端有回包。 server端抓包：

11:34:23.799611 IP 10.8.0.6 > 192.168.200.134: ICMP echo request, id 3059, seq 9, length 64 11:34:23.800134 IP 192.168.200.134 > 10.8.0.6: ICMP echo reply, id 3059, seq 9, length 64 192.168.200.134抓包：

11:23:41.705067 IP 10.8.0.6 > 192.168.200.134: ICMP echo request, id 3043, seq 53, length 64 11:23:41.705085 IP 192.168.200.134 > 10.8.0.6: ICMP echo reply, id 3043, seq 53, length 64

Windos Client端配置

将client2.crt client2.key ca.crt拷贝到openvpn的config目录下，然后创建client.ovpn文件，写入：

client dev tun proto udp

remote 192.168.200.138 5555 resolv-retry infinite

nobind

user nobody group nobody persist-key persist-tun ca ca.crt

cert client2.crt key client2.key comp-lzo verb 3

keepalive 10 120

运行，openvpn，连接，运行正常。

本文来源：https://www.bwwdw.com/article/auar.html