Ubuntu下openvpn搭建，tunnelblick Mac客户端使用

1sudo apt install openvpn
2sudo apt install easy-rsa

1cd /usr/share/easy-rsa/
2vim vars

1# 修改注册信息，比如公司地址、公司名称、部门名称等。
2export KEY_COUNTRY="CN"
3export KEY_PROVINCE="Shandong"
4export KEY_CITY="Qingdao"
5export KEY_ORG="MyOrganization"
6export KEY_EMAIL="me@myhost.mydomain"
7export KEY_OU="MyOrganizationalUnit"

 1# 初始化环境变量
 2source vars
 3
 4# 清除keys目录下所有与证书相关的文件
 5# 下面步骤生成的证书和密钥都在/usr/share/easy-rsa/keys目录里
 6./clean-all
 7
 8# 生成根证书ca.crt和根密钥ca.key（一路按回车即可）
 9./build-ca
10
11# 为服务端生成证书和私钥（一路按回车，直到提示需要输入y/n时，输入y再按回车，一共两次）
12./build-key-server server
13
14# 每一个登陆的VPN客户端需要有一个证书，每个证书在同一时刻只能供一个客户端连接，下面建立2份
15# 为客户端生成证书和私钥（一路按回车，直到提示需要输入y/n时，输入y再按回车，一共两次）
16./build-key client1
17./build-key client2
18
19# 创建迪菲·赫尔曼密钥，会生成dh2048.pem文件（生成过程比较慢，在此期间不要去中断它）
20./build-dh
21
22# 生成ta.key文件（防DDos攻击、UDP淹没等恶意攻击）
23openvpn --genkey --secret keys/ta.key

1root@xinjiapo_bi:/usr/share/easy-rsa/keys# ls
201.pem  ca.key       client2.crt  index.txt           serial      server.key
302.pem  client1.crt  client2.csr  index.txt.attr      serial.old  ta.key
403.pem  client1.csr  client2.key  index.txt.attr.old  server.crt
5ca.crt  client1.key  dh2048.pem   index.txt.old       server.csr

 1# 在openvpn的配置目录下新建一个keys目录
 2mkdir /etc/openvpn/keys
 3
 4# 将需要用到的openvpn证书和密钥复制一份到刚创建好的keys目录中
 5cp /usr/share/easy-rsa/keys/{ca.crt,server.{crt,key},dh2048.pem,ta.key} /etc/openvpn/keys/
 6
 7# 复制一份服务器端配置文件模板server.conf到/etc/openvpn/
 8gzip -d /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz
 9cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf /etc/openvpn/
10
11# 查看server.conf里的配置参数
12grep '^[^#;]' /etc/openvpn/server.conf
13
14
15# 创建用户 这个不用执行，有点问题， 配置 用户名 密码方式认证的时候， 权限有点问题。 
16# useradd -s /usr/sbin/nologin openvpn
17
18# 编辑server.conf
19vim /etc/openvpn/server.conf

 1root@xinjiapo_bi:/usr/share/easy-rsa/keys# cat /etc/openvpn/server.conf
 2port 1294
 3proto udp
 4dev tun  #路由模式
 5ca keys/ca.crt
 6cert keys/server.crt
 7key keys/server.key  # This file should be kept secret
 8dh keys/dh2048.pem #可选
 9server 10.8.0.0 255.255.255.0
10ifconfig-pool-persist /var/log/openvpn/ipp.txt
11#push "route 172.22.0.0 255.255.0.0" 内部用
12ifconfig-pool-persist ipp.txt
13push "redirect-gateway def1 bypass-dhcp"
14push "dhcp-option DNS 8.8.8.8"
15push "dhcp-option DNS 8.8.4.4"
16client-to-client #可选
17duplicate-cn # 多个客户端可以用一个证书
18keepalive 10 120
19#tls-auth keys/ta.key 0 # This file is secret 可选
20cipher AES-256-CBC
21
22# Enable compression on the VPN link and push the
23# option to the client (v2.4+ only, for earlier
24# versions see below)
25;compress lz4-v2
26;push "compress lz4-v2"
27
28# For compression compatible with older clients use comp-lzo
29# If you enable it here, you must also
30# enable it in the client config file.
31;comp-lzo
32# comp-lzo
33
34# The maximum number of concurrently connected
35# clients we want to allow.
36max-clients 100
37
38user nobody    
39group nogroup
40persist-key
41persist-tun
42
43status /var/log/openvpn/openvpn-status.log
44
45;log         /var/log/openvpn/openvpn.log
46# ;log-append  /var/log/openvpn/openvpn.log
47log-append  /var/log/openvpn/openvpn.log
48verb 3
49
50# Silence repeating messages.  At most 20
51# sequential messages of the same message
52# category will be output to the log.
53mute 20
54
55# Notify the client that when the server restarts so it
56# can automatically reconnect.
57# tcp 下面这行要注释掉,否则冲突
58explicit-exit-notify 1
59# 这里配置使用用户名和密码登录的支持，可以取代使用秘钥和证书登录
60auth-user-pass-verify /etc/openvpn/checkpsw.sh via-env
61
62# 这里非常重要，如果你启用了该选项，你就只需要通过用户名和密码登录了
63# 但是如果你注释了该选项，那你必须使用 用户名 + 密码 + 证书 才能登录成功，缺一不可。 目前是只要账号，密码即可
64verify-client-cert none
65username-as-common-name
66script-security 3

 1#!/bin/bash
 2###########################################################
 3# checkpsw.sh (C) 2004 Mathias Sundman <mathias@openvpn.se>
 4#
 5# This script will authenticate OpenVPN users against
 6# a plain text file. The passfile should simply contain
 7# one row per user with the username first followed by
 8# one or more space(s) or tab(s) and then the password.
 9PASSFILE="/etc/openvpn/psw-file"
10LOG_FILE="/etc/openvpn/openvpn-password.log"
11TIME_STAMP=`date "+%Y-%m-%d %T"`
12###########################################################
13if [ ! -r "${PASSFILE}" ]; then
14  echo "${TIME_STAMP}: Could not open password file \"${PASSFILE}\" for reading." >> ${LOG_FILE}
15  exit 1
16fi
17CORRECT_PASSWORD=`awk '!/^;/&&!/^#/&&$1=="'${username}'"{print $2;exit}' ${PASSFILE}`
18if [ "${CORRECT_PASSWORD}" = "" ]; then
19  echo "${TIME_STAMP}: User does not exist: username=\"${username}\", password=\"${password}\"." >> ${LOG_FILE}
20  exit 1
21fi
22if [ "${password}" = "${CORRECT_PASSWORD}" ]; then
23  echo "${TIME_STAMP}: Successful authentication: username=\"${username}\"." >> ${LOG_FILE}
24  exit 0
25fi
26echo "${TIME_STAMP}: Incorrect password: username=\"${username}\", password=\"${password}\"." >> ${LOG_FILE}
27exit 1

1user1 pass1
2user2 pass2
3user3 pass3

 1# 开启路由转发功能
 2echo 1 > /proc/sys/net/ipv4/ip_forward
 3或
 4sed -i '/net.ipv4.ip_forward/s/0/1/' /etc/sysctl.conf
 5sed -i '/net.ipv4.ip_forward/s/#//' /etc/sysctl.conf
 6sysctl -p
 7
 8# 配置防火墙，别忘记保存
 9iptables -I INPUT -p udp --dport 1294 -m comment --comment "openvpn" -j ACCEPT
10
11# 客户端过来的包以NAT方式访问外网
12iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j MASQUERADE
13
14iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to 服务器ip
15
16
17mkdir /etc/iptables
18iptables-save > /etc/iptables/iptables.conf
19
20# 关闭ufw防火墙，改成iptables，这一步按需要设置，比较ufw在Ubuntu默认关闭的。iptables和ufw任选一个即可。
21ufw disable
22
23# 启动openvpn并设置为开机启动
24openvpn server.conf
25或
26systemctl start openvpn@server
27systemctl enable openvpn@server

1# 复制一份client.conf模板命名为client.ovpn
2cp /usr/share/doc/openvpn/examples/sample-config-files/client.conf /etc/openvpn/client.ovpn

 1[ubuntu@xinjiapo_bi ~/openvpn-client 12:01:51]$pwd
 2/home/ubuntu/openvpn-client
 3➜  openvpn-client ls
 4ca.crt      client.ovpn client1.crt client1.key pass.txt    ta.key
 5[ubuntu@xinjiapo_bi ~/openvpn-client 12:01:56]$
 6
 7[ubuntu@xinjiapo_bi ~/openvpn-client 12:01:08]$cat client.ovpn
 8client
 9dev tun
10proto udp
11
12remote xx.xx.xx.xx 1294
13resolv-retry infinite
14nobind
15persist-key
16persist-tun
17ca ca.crt
18cert client1.crt
19key client1.key
20
21remote-cert-tls server
22
23# If a tls-auth key is used on the server
24# then every client must also have the key.
25# tls-auth ta.key 1
26
27# 服务器这边关了， 客户端也关
28# comp-lzo
29
30# Set log file verbosity.
31verb 5
32
33# Silence repeating messages
34;mute 20
35# 用来存放用户名和密码的文件路径，这样在连接的时候就不需要手动输入用户名密码了
36auth-user-pass pass.txt

1openvpn-client cat pass.txt
2user1
3pass1

1wget https://tunnelblick.net/release/Tunnelblick_3.8.8a_build_5776.dmg
2#双击安装

1 scp -r -p 2221 ubuntu@openvpn服务器ip:openvpn-client ./
2 mv openvpn-client ~/Desktop