⑴ Centos7使用docker搭建openvpn
執行完命令後可在目錄 /data/openvpn 中看到相應的配置文件；
執行過程中需要先設置ca密碼（如123456），Common Name可不設置直接按回車繼續，接著需要輸入ca密碼更新密鑰庫以及生成crl文件；
其中 openvpn-client 為自定義名稱，生成的過程需要輸入ca密碼；
注意 openvpn-client 名稱需與第三步生成時命名一致，此時生成的配置文件 openvpn-client.ovpn 即可用於客戶端連接；
需要注意防火牆規則，其中1194為udp埠，可在其他機器上通過nc命令測試是否可連接
修改配置文件 /etc/sysconfig/iptables ，在*filter中的COMMIT命令前增加以下配置
重啟iptables， systemctl restart iptables ，如未生效需重啟docker
安裝好客戶端後，導入openvpn客戶端配置文件即可，ccip.cc檢查當前ip；
⑵ 如何使用OpenVPN和PrivacyIDEA搭建雙因素認證的遠程接入
第一種，使用PAM的privacyidea_pam.py模塊。OpneVPN使用PAM認證，PAM調用privacyidea_pam.py模塊和PrivacyIDEA做驗證。
第二種，直接集成OpenVPN和FreeRADIUS。OpenVPN使用radius認證，FreeRADIUS向PrivacyIDEA驗證。
第三種，在OpenVPN中使用RADIUS的PAM模塊。
⑶ Openvpn構建線上區域網
參考大佬鏈接，搭建沒有問題，在調試階段不對 CentOS 7 搭建OpenVPN伺服器_Centos7搭建vpn | abcdocker運維博客 (i4t.com)
每一個登陸的VPN客戶端需要有一個證書，每個證書在同一時刻只可以一個客戶端連接(可以修改配置文件)
生成過程比較慢，在此期間不要去中斷它
啟動成功會多一個 tun0的虛擬網卡
要導出對應的client端key 根證書 ca.crt , client.crt , client.key , ta.key
安裝client http://down.i4t.com/openvpn-install-2.4.7-I606-Win10.exe
配置如下
如果一直鏈接不上請確認
我是在安全組卡了很久，這兩只是client 與服務端鏈接成功，說明我們搭建openvpn已經完成了
這時已經可以直接登錄到server端；
到這我們搭建openvpn已經完成了
這時已經可以直接登錄到server端，但是無法登錄區域網內的其他機器，因為server端未開轉發
開轉發還會遇到安全組問題，因此要使用SNAT替換訪問的ip
參考鏈接 基礎知識Iptables - (jianshu.com)
工具使用tcpmp 監聽網卡 參考鏈接 tcpmp詳細教程 - (jianshu.com)
#監聽tun0網卡上訪問 192.168.10.118數據
tcpmp -n -i tun0 host 192.168.10.118
在客戶端ping ，發現有去無會，一看ip都是10.8.x.x 肯定無法過安全組，因此用iptables替換ip，整個服務就可用了
⑷ openvpn設置clientopenwrt
方法如下：
1、將OP的路由通過無線client模式連接到上級無線路由器（inter）端，網路介面中的wwan（無線client介面）使用DHCP或者PPPOE認證到上級路由，設置完畢保存應用。
2、將OP的路由通過無線client模式鏈接到上級無線路由器（inter）端，無線設置中將介面選擇為lan，進行橋接，網路介面中的br-lan關閉DHCP配置，防火牆轉發開啟、出入開啟請自行測試。
⑸ 如何在Windows環境下安裝並配置OpenVPN
Step 1 OpenVPN安裝配置
1.1 下載openvpn 並安裝
· 下載openvpn-2.0.5-gui-1.0.3版，地址 http://openvpn.se/files/install_packages/openvpn-2.0.5-gui-1.0.3-install.exe，安裝。(例如：安裝到F:\OPENVPN目錄下，下文舉例都用此目錄)
· 安裝完成後生成一個新網卡，並在網路連接里出現本地連接[X]，把tcp/ip屬性改成手動配置,192.168.10.1(根據實際情況更改) ,255.255.255.0，其餘不填。
1.2 生成證書
· 修改F:\OpenVPN\easy-rsa\vars.bat.sample的以下部分
CODE:
set HOME=%ProgramFiles%\OpenVPN\easy-rsa
set KEY_COUNTRY=US
set KEY_PROVINCE=CA
set KEY_CITY=SanFrancisco
set KEY_ORG=FortFunston
set [email protected]
（請根據自身情況修改）改為
CODE:
set HOME=F:\OpenVPN\easy-rsa
set KEY_COUNTRY=CN
set KEY_PROVINCE=Hubei
set KEY_CITY=Wuhan
set KEY_ORG=51NB
set [email protected]
· 生成證書
o OpenVPN 有兩種安全模式，一種基於使用 RSA 證書和密鑰的 SSL/TLS，一種使用預先分享的靜態密鑰。本文採用SSL/TLS 模式。TLS模式的優點是安全，而且便於管理用戶。默認情況下證書和用戶是一對一的，多個用戶使用同一證書會被踢出。
o 開始-->運行-->鍵入cmd，回車，進入命令提示符-->進入F:\OpenVPN\easy-rsa目錄
QUOTE:
F:\OpenVPN\easy-rsa>
o 執行如下命令
CODE:
init-config
QUOTE:
F:\OpenVPN\easy-rsa>init-config
F:\OpenVPN\easy-rsa> vars.bat.sample vars.bat
已復制 1 個文件。
F:\OpenVPN\easy-rsa> openssl.cnf.sample openssl.cnf
已復制 1 個文件。
CODE:
vars
CODE:
clean-all
QUOTE:
F:\OpenVPN\easy-rsa>vars
F:\OpenVPN\easy-rsa>clean-all
系統找不到指定的文件。
已復制 1 個文件。
已復制 1 個文件。
CODE:
vars
build-ca
build-dh
QUOTE:
F:\OpenVPN\easy-rsa>vars
F:\OpenVPN\easy-rsa>build-ca #生成根證書
Loading 'screen' into random state - done
Generating a 1024 bit RSA private key
writing new private key to 'keys\ca.key'
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
Country Name (2 letter code) [CN]:
State or Province Name (full name) [Hubei]:
Locality Name (eg, city) [Wuhan]:
Organization Name (eg, company) [51NB]:
Organizational Unit Name (eg, section) []:CMWAP
Common Name (eg, your name or your server's hostname) []:fangzy #填自己的名字
Email Address [[email protected]]:
F:\OpenVPN\easy-rsa>build-dh #這個有點慢，估計要半分鍾
Loading 'screen' into random state - done
Generating DH parameters, 1024 bit long safe prime, generator 2
This is going to take a long time
CODE:
build-key-server server
QUOTE:
F:\OpenVPN\easy-rsa>build-key-server server #生成伺服器端的密鑰，server為伺服器名
Loading 'screen' into random state - done
Generating a 1024 bit RSA private key
writing new private key to 'keys\server.key'
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
Country Name (2 letter code) [CN]:
State or Province Name (full name) [Hubei]:
Locality Name (eg, city) [Wuhan]:
Organization Name (eg, company) [51NB]:
Organizational Unit Name (eg, section) []:CMWAP
Common Name (eg, your name or your server's hostname) []:server #填自己的名字
Email Address [[email protected]]:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:xxxx #輸入4位以上的密碼
An optional company name []:
Using configuration from openssl.cnf
Loading 'screen' into random state - done
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName :PRINTABLE:'CN'
stateOrProvinceName :PRINTABLE:'Hubei'
localityName :PRINTABLE:'Wuhan'
organizationName :PRINTABLE:'51NB'
organizationalUnitName:PRINTABLE:'CMWAP'
commonName :PRINTABLE:'server'
emailAddress :IA5STRING:'[email protected]'
Certificate is to be certified until Feb 1 05:30:29 2016 GMT (3650 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
CODE:
build-key client
QUOTE:
F:\OpenVPN\easy-rsa>build-key client #生成客戶端的密鑰，client為用戶名
Loading 'screen' into random state - done
Generating a 1024 bit RSA private key
writing new private key to 'keys\client.key'
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
Country Name (2 letter code) [CN]:
State or Province Name (full name) [Hubei]:
Locality Name (eg, city) [Wuhan]:
Organization Name (eg, company) [51NB]:
Organizational Unit Name (eg, section) []:CMWAP
Common Name (eg, your name or your server's hostname) []:client
Email Address [[email protected]]:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:xxxx
An optional company name []:
Using configuration from openssl.cnf
Loading 'screen' into random state - done
DEBUG[load_index]: unique_subject = "yes"
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName :PRINTABLE:'CN'
stateOrProvinceName :PRINTABLE:'Hubei'
localityName :PRINTABLE:'Wuhan'
organizationName :PRINTABLE:'51NB'
organizationalUnitName:PRINTABLE:'CMWAP'
commonName :PRINTABLE:'client'
emailAddress :IA5STRING:'[email protected]'
Certificate is to be certified until Feb 1 05:31:40 2016 GMT (3650 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
生成多個客戶端密鑰，執行build-key client1 …… build-key xyz。
復制證書文件
剛才生成的證書文件在F:\OpenVPN\easy-rsa\keys下，伺服器端需要的文件為ca.crt,dh1024.pem,server.crt,server.key ，客戶端需要的文件為：ca.crt client.crt client.key(xxx.crt xxx.key)，配置.ovpn文件時需要用到。
1.3 配置server.ovpn文件
· 在\OpenVPN\config目錄下創建server.ovpn文件將ca.crt,dh1024.pem,server.crt,server.key復制到F:\OpenVPN\config目錄下
· 伺服器端文件示例：
server.ovpn
CODE:
port 1198
proto tcp-server
dev tun
server 192.168.10.0 255.255.255.0
keepalive 20 180
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
push "redirect-gateway def1"
push "dhcp-option DNS 192.168.10.1"
mode server
tls-server
status openvpn-status.log
comp-lzo
verb 4
1.4 客戶端安裝與配置
o 安裝OpenVPN，同1.1，但是不用更改本地連接設置。
o 配置OpenVPN
§ 在\OpenVPN\config目錄下創建client.ovpn文件，將ca.crt client.crt client.key 復制到 \OpenVPN\config
目錄下，這3個文件由伺服器端生成並發放。
§ 客戶端文件示例：
client.ovpn
CODE:
client
dev tun
proto tcp-client
remote jacky.10dig.com 1198 #這里填入remote server add,可用IP或者域名，
#若Server是動態IP，可到http://www.wingdns.com/注冊動態域名綁定動態IP。
#如Client所連接Server使用路由上網，則需要使用NAT將地址映射到Server端。
resolv-retry infinite
nobind
http-proxy 10.0.0.172 80 #這里填入你的代理伺服器地址和埠，沒有代理則不用這行
mute-replay-warnings
ca ca.crt
cert client.crt #這里改成每個客戶端相應的證書
key client.key #這里改成每個客戶端相應的證書
comp-lzo
verb 4
status openvpn-status.log
右擊openvpn-gui圖標，點connect，即可連接。
The End
Thank you for your reading...
⑹ open-vpn參數參考
1、open-vpn路由設置
主要由 route-nopull、vpn_gateway、net_gateway 三個參數決定
route-nopull ：當客戶端加入這個參數後,openvpn 連接後不會添加路由,也就是不會有任何網路請求走 openvpn.
vpn_gateway：指定需要走vpn的路由；
net_gateway：指定不需要走vpn的路由； max-routes 參數表示可以添加路由的條數,默認只允許添加100條路由,如果少於100條路由可不加這個參數.
route-nopull
route 139.9.114.177 255.255.255.255 vpn_gateway
route 192.168.6.0 255.255.255.0 vpn_gateway
route 192.168.5.0 255.255.255.0 vpn_gateway
route 192.168.1.0 255.255.255.0 net_gateway
⑺ 使用花生殼怎樣搭建Openvpn
Openvpn是虛擬專用通道，簡單來說就是一個虛擬區域網。Openvpn部署在內網，但是Openvpn 伺服器端的網路並沒有公網ip地址，要怎樣才能在外網連接呢？沒有固定公網IP,需要藉助一些網路輔助實現VPN的搭建和訪問,類似應用有花生殼、nat123、dnspod等等。通過使用花生殼主機映射功能，達到外網連接Openvpn，詳細操作過程如下：
1.搭建Openvpn伺服器端和訪問端.
2.修改OpenVPN伺服器端的server.ovpn文件，將proto udp 更改為proto tcp；
3.在服務端安裝並設置埠映射.
應用名稱：Openvpn（可自定義）。
內網主機：填寫伺服器內網的ip地址或者計算機名稱（不支持中文）；選擇主機映射。
4.在訪問端上安裝花生殼訪問者，然後填寫域名，點擊診斷。
5.修改Openvpn 客戶端的client文件，將proto udp更改為tcp；將remote my-server-1 1194更改為remote 域名（設置埠映射的域名）1194。運行Openvpn 客戶端，出現綠色代表連接成功。
6.搭建Openvpn成功後，可以檢驗一下。就以搭建一個遠程桌面為例：
伺服器端獲取虛擬ip地址為10.0.0.1，客戶端獲取虛擬ip地址為10.0.0.6。在訪問端開啟遠程桌面，在伺服器端點擊運行——mstsc——輸入客戶端虛擬ip地址10.0.0.6 進行連接，出現如下界面代表連接成功。
⑻ OpenVPN的使用
1. 修改 C:\ProgramFiles\OpenVPN\easy-rsa\vars.bat.sample
set KEY_COUNTRY=CN #(國家)
set KEY_PROVINCE=JS #(省份)
set KEY_CITY=SuZhou #(城市)
set KEY_ORG=OpenVPN #(組織)
set [email protected] #(郵件地址)
2. DOS 下配置CA等信息
Microsoft Windows XP [版本 5.1.2600]
(C) 版權所有 1985-2001 Microsoft Corp.
C:\Documents and Settings\Administrator> cd "C:\Program Files\OpenVPN\easy-rsa"
C:\Program Files\OpenVPN\easy-rsa> init-config
C:\Program Files\OpenVPN\easy-rsa> vars.bat.sample vars.bat
已復制 1 個文件。
C:\Program Files\OpenVPN\easy-rsa> vars
C:\Program Files\OpenVPN\easy-rsa> clean-all
已復制 1 個文件。
已復制 1 個文件。
C:\Program Files\OpenVPN\easy-rsa> build-ca
Loading 'screen' into random state - done
Generating a 1024 bit RSA private key
................++++++
....++++++
writing new private key to 'keys\ca.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]:
State or Province Name (full name) [JS]:
Locality Name (eg, city) [SuZhou]:
Organization Name (eg, company) [OpenVPN]:
Organizational Unit Name (eg, section) [changeme]:
Common Name (eg, your name or your server's hostname) [changeme]: OpenVPN-CA
Name [changeme]:
Email Address [[email protected]]:
C:\Program Files\OpenVPN\easy-rsa> build-dh
Loading 'screen' into random state - done
Generating DH parameters, 1024 bit long safe prime, generator 2
This is going to take a long time
................................................................................
.............................................+................+.................
........+.......................+...............................................
........................................................+.......................
.........+....+.................................................................
.........................................................................+......
...................................+.....+....................................+.
.....................................................................+..........
........................................................+.......................
...+.............++*++*++*
C:\Program Files\OpenVPN\easy-rsa> build-key-server server
Loading 'screen' into random state - done
Generating a 1024 bit RSA private key
.++++++
....++++++
writing new private key to 'keys\server.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]:
State or Province Name (full name) [JS]:
Locality Name (eg, city) [SuZhou]:
Organization Name (eg, company) [OpenVPN]:
Organizational Unit Name (eg, section) [changeme]:
Common Name (eg, your name or your server's hostname) [changeme]: server
Name [changeme]:
Email Address [[email protected]]:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
Using configuration from openssl-1.0.0.cnf
Loading 'screen' into random state - done
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName :PRINTABLE:'CN'
stateOrProvinceName :PRINTABLE:'JS'
localityName :PRINTABLE:'SuZhou'
organizationName :PRINTABLE:'OpenVPN'
organizationalUnitName:PRINTABLE:'changeme'
commonName :PRINTABLE:'server'
name :PRINTABLE:'changeme'
emailAddress :IA5STRING:'[email protected]'
Certificate is to be certified until Oct 13 07:18:46 2025 GMT (3650 days)
Sign the certificate? [y/n]: y
1 out of 1 certificate requests certified, commit? [y/n] y
Write out database with 1 new entries
Data Base Updated
C:\Program Files\OpenVPN\easy-rsa> build-key client
Loading 'screen' into random state - done
Generating a 1024 bit RSA private key
.....++++++
............................++++++
writing new private key to 'keys\client.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]:
State or Province Name (full name) [JS]:
Locality Name (eg, city) [SuZhou]:
Organization Name (eg, company) [OpenVPN]:
Organizational Unit Name (eg, section) [changeme]:
Common Name (eg, your name or your server's hostname) [changeme]: client
Name [changeme]:
Email Address [[email protected]]:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
Using configuration from openssl-1.0.0.cnf
Loading 'screen' into random state - done
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName :PRINTABLE:'CN'
stateOrProvinceName :PRINTABLE:'JS'
localityName :PRINTABLE:'SuZhou'
organizationName :PRINTABLE:'OpenVPN'
organizationalUnitName:PRINTABLE:'changeme'
commonName :PRINTABLE:'client'
name :PRINTABLE:'changeme'
emailAddress :IA5STRING:'[email protected]'
Certificate is to be certified until Oct 13 07:20:05 2025 GMT (3650 days)
Sign the certificate? [y/n]: y
1 out of 1 certificate requests certified, commit? [y/n] y
Write out database with 1 new entries
Data Base Updated
C:\Program Files\OpenVPN\easy-rsa>
3. 拷貝文件
將 ca.crt、dh1024.pem、server.crt、server.key 復制到伺服器 C:\Program
Files\OpenVPN\config 目錄下
將 ca.crt、client.crt、client.key 復制到客戶端 C:\Program Files\OpenVPN\config 目錄下
4. C:\ProgramFiles\OpenVPN\config 目錄下創建 client.ovpn、server.ovpn
server.ovpn
local 192.168.1.101
port 1194
proto tcp
;proto udp
dev tap
;dev tun
;dev-node MyTap
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
server 172.16.1.0 255.255.255.0
ifconfig-pool-persist ipp.txt
;server-bridge 10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100
;server-bridge
push "route 0.0.0.0 0.0.0.0"
push "redirect-gateway def1 bypass-dhcp"
;push "route 192.168.20.0 255.255.255.0"
client-config-dir ccd
;route 192.168.40.128 255.255.255.248
;client-config-dir ccd
;route 10.9.0.0 255.255.255.252
;learn-address ./script
;push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 223.5.5.5"
push "dhcp-option DNS 223.6.6.6"
client-to-client
plicate-cn
keepalive 10 120
;tls-auth ta.key 0
;cipher BF-CBC
;cipher AES-128-CBC
;cipher DES-EDE3-CBC
comp-lzo
max-clients 100
;user nobody
;group nobody
persist-key
persist-tun
status openvpn-status.log
;log openvpn.log
;log-append openvpn.log
verb 3
mute 20
client.open
client
dev tap
proto tcp
remote 192.168.1.101 1194
resolv-retry infinite
nobind
persist-key
persist-tun
mute-replay-warnings
ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\client.crt"
key "C:\\Program Files\\OpenVPN\\config\\client.key"
comp-lzo
verb 3
mute 20
⑼ Windows 7上OpenVPN怎麼設置使用
從問題來看只是安裝了OpenVPN，但是沒有對其進行配置。此外OpenVPN分伺服器端和客戶端(安裝程序一樣，只是配置文件不一樣)。
OpenVPN客戶端不是安裝了就能用，需要伺服器端才能起作用。比如OpenVPN客戶端裝在Windows 7筆記本上，伺服器端用的是Windows2003 VPS。
需要進行的操作為：
(1)對伺服器端進行設置
(2)在伺服器端並生成相應的文件(包括server.ovpn, ca.crt, client.key, client.crt)，確保配置正確後啟動伺服器端。
(3)復制客戶端需要的文件(ca.crt, client.key, client.crt)到客戶端，製作client.ovpn,啟動客戶端連接伺服器端。
⑽ Windows 7上OpenVPN怎麼設置使用
將解壓出來的文件夾config內的配置文件覆蓋openvpn安裝目錄下的config內的文件。
在config文件夾下有一個文本mypass.txt，請將VPN帳號和密碼輸入：第一行VPN用戶名，第二行VPN密碼。
上面的搞定後，點擊桌面上的「OpenVPN GUI」【Vista或Win 7/8必須右鍵，以管理員身份運行】右下角會出現一個像電腦的小圖標，右鍵就可選擇VPN伺服器。