虚拟专用网络介绍及配置
架构
windows主机: 客户端主机 192.168.139.1 VPN服务器: [两张网卡] 192.168.139.241[此网卡可以和window连通，在公司则需要公网IP] 172.16.2.241[此网卡可以和后端连通] web服务器: 内网主机 172.16.2.34 172.16.2.35 网关:随便
服务端部署
root@openvpn:~# apt install -y openvpn easy-rsa
#准备证书颁发相关文件
root@openvpn:~# cp -a /usr/share/easy-rsa/ /etc/openvpn/
#准备颁发证书相关变量的配置文件，
root@openvpn:~# cd /etc/openvpn/
root@openvpn:/etc/openvpn# mv easy-rsa/vars.example easy-rsa/vars
#建议修改给CA和OpenVPN服务器颁发的证书的有效期,可适当加长
root@openvpn:/etc/openvpn# grep -E 'set_var EASYRSA_CA_EXPIRE|set_var EASYRSA_CERT_EXPIRE' easy-rsa/vars
set_var EASYRSA_CA_EXPIRE 36500 #CA的证书默认有效期为10年,可以适当延长,比如:36500天
set_var EASYRSA_CERT_EXPIRE 3650 #服务器证书默为为825天,可适当加长,比如:3650天
root@openvpn:/etc/openvpn# tree /etc/openvpn/
/etc/openvpn/
├── client
├── easy-rsa
│ ├── easyrsa
│ ├── openssl-easyrsa.cnf
│ ├── vars
│ └── x509-types
│ ├── ca
│ ├── client
│ ├── code-signing
│ ├── COMMON
│ ├── email
│ ├── kdc
│ ├── server
│ └── serverClient
├── server
└── update-resolv-conf
`生成证书或秘钥文件保存目录信息`
root@openvpn:/etc/openvpn# easy-rsa/easyrsa init-pki
`创建ca证书信息`
root@openvpn:/etc/openvpn# easy-rsa/easyrsa build-ca nopass
`创建服务端秘钥对`
root@openvpn:/etc/openvpn# easy-rsa/easyrsa build-server-full stangj nopass
root@openvpn:/etc/openvpn# ll pki/issued/stangj.crt
-rw------- 1 root root 4609 Mar 23 23:37 pki/issued/stangj.crt 生成的服务端公钥文件
root@openvpn:/etc/openvpn# ll pki/private/stangj.key
-rw------- 1 root root 1704 Mar 23 23:37 pki/private/stangj.key 生成的服务端私钥文件
`生成加密算法文件`
root@openvpn:/etc/openvpn# easy-rsa/easyrsa gen-dh
root@openvpn:/etc/openvpn# ll pki/dh.pem
-rw------- 1 root root 424 Mar 23 23:39 pki/dh.pem 生成的加密文件
`生成tls-auth key，这个key主要用于防止 DoS和TLS 攻击，`
root@openvpn:/etc/openvpn# openvpn --genkey --secret stangj_tls.key
`将密钥和证书都移动到指定目录，方便管理`
root@openvpn:/etc/openvpn# cp /etc/openvpn/pki/ca.crt /etc/openvpn/server/
root@openvpn:/etc/openvpn# cp /etc/openvpn/pki/issued/stangj.crt /etc/openvpn/server/
root@openvpn:/etc/openvpn# cp /etc/openvpn/pki/private/stangj.key /etc/openvpn/server/
root@openvpn:/etc/openvpn# cp /etc/openvpn/pki/dh.pem /etc/openvpn/server/
root@openvpn:/etc/openvpn# cp /etc/openvpn/stangj_tls.key /etc/openvpn/server/
服务端编写服务配置文件
root@openvpn:/etc/openvpn# useradd openvpn
root@openvpn:/etc/openvpn# cat server.conf
port 1194
proto tcp4
dev tun
ca /etc/openvpn/server/ca.crt
cert /etc/openvpn/server/stangj.crt
key /etc/openvpn/server/stangj.key
dh /etc/openvpn/server/dh.pem
server 10.8.0.0 255.255.255.0
push "route 172.16.2.0 255.255.255.0"
keepalive 10 120
cipher AES-256-CBC
compress lz4-v2
push "compress lz4-v2"
max-clients 2048
user openvpn
group openvpn
status /var/log/openvpn/openvpn-status.log
log-append /var/log/openvpn/openvpn.log
verb 3
`修改启动的service文件`
root@openvpn:/etc/openvpn# cat /lib/systemd/system/openvpn@.service
[Unit]
Description=OpenVPN Robust And Highly Flexible Tunneling Application On %I
After=network.target
[Service]
Type=notify
PrivateTmp=true
ExecStart=/usr/sbin/openvpn --cd /etc/openvpn/ --config %i.conf
[Install]
WantedBy=multi-user.target
root@openvpn:/etc/openvpn# systemctl daemon-reload
root@openvpn:/etc/openvpn# systemctl enable --now openvpn@server.service
root@openvpn:/etc/openvpn# systemctl status openvpn@server.service
● openvpn@server.service - OpenVPN Robust And Highly Flexible Tunneling Application On server
Loaded: loaded (/lib/systemd/system/openvpn@.service; enabled; vendor preset: enabled)
Active: active (running) since Sun 2024-03-24 00:10:12 CST; 3min 4s ago # running
Main PID: 3113 (openvpn)
Status: "Initialization Sequence Completed"
Tasks: 1 (limit: 4515)
Memory: 1.8M
CPU: 10ms
CGroup: /system.slice/system-openvpn.slice/openvpn@server.service
└─3113 /usr/sbin/openvpn --cd /etc/openvpn/ --config server.conf
Mar 24 00:10:12 openvpn systemd[1]: Starting OpenVPN Robust And Highly Flexible Tunneling Application On server...
Mar 24 00:10:12 openvpn openvpn[3113]: 2024-03-24 00:10:12 WARNING: Compression for receiving enabled. Compression has been used >
Mar 24 00:10:12 openvpn systemd[1]: Started OpenVPN Robust And Highly Flexible Tunneling Application On server.
验证网卡
# 会多一张tun0 的网卡
root@openvpn:/etc/openvpn# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 00:0c:29:62:6e:6c brd ff:ff:ff:ff:ff:ff
altname enp2s1
altname ens33
inet 192.168.139.241/24 brd 192.168.139.255 scope global eth0
valid_lft forever preferred_lft forever
inet6 fe80::20c:29ff:fe62:6e6c/64 scope link
valid_lft forever preferred_lft forever
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 00:0c:29:62:6e:76 brd ff:ff:ff:ff:ff:ff
altname enp2s6
altname ens38
inet 172.16.2.241/24 brd 172.16.2.255 scope global eth1
valid_lft forever preferred_lft forever
inet6 fe80::20c:29ff:fe62:6e76/64 scope link
valid_lft forever preferred_lft forever
8: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 500
link/none
inet 10.8.0.1 peer 10.8.0.2/32 scope global tun0
valid_lft forever preferred_lft forever
inet6 fe80::679b:1261:e5c3:54c2/64 scope link stable-privacy
valid_lft forever preferred_lft forever
生成客户端证书秘钥文件信息
root@openvpn:/etc/openvpn# easy-rsa/easyrsa build-client-full tanghao nopass
root@openvpn:/etc/openvpn# mkdir /etc/openvpn/client/tanghao
root@openvpn:/etc/openvpn# cp /etc/openvpn/pki/private/tanghao.key /etc/openvpn/client/tanghao/
root@openvpn:/etc/openvpn# cp /etc/openvpn/pki/issued/tanghao.crt /etc/openvpn/client/tanghao/
root@openvpn:/etc/openvpn# cp /etc/openvpn/pki/ca.crt /etc/openvpn/client/tanghao/
root@openvpn:/etc/openvpn# vim client/tanghao/client.ovpn
client
dev tun
proto tcp
remote 192.168.139.241 1194
resolv-retry infinite
nobind
ca ca.crt
cert tanghao.crt
key tanghao.key
remote-cert-tls server
cipher AES-256-CBC
verb 3
compress lz4-v2
root@openvpn:/etc/openvpn# tree /etc/openvpn/client/tanghao/
/etc/openvpn/client/tanghao/
├── ca.crt
├── client.ovpn
├── tanghao.crt
└── tanghao.key
0 directories, 4 files
`压缩文件传输到windows端`
root@openvpn:/etc/openvpn# cd /etc/openvpn/client/tanghao/
root@openvpn:/etc/openvpn/client/tanghao# tar zcvf tanghao-vpn.tar.gz ./*
Window安装openVPN
配置openvpn的网络转换
root@openvpn:/etc/openvpn# echo 'net.ipv4.ip_forward = 1' >> /etc/sysctl.conf
root@openvpn:/etc/openvpn# sysctl -p
net.ipv4.ip_forward = 1
root@openvpn:/etc/openvpn# iptables -t nat -A POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j MASQUERADE
验证网络连通性
openvpn到此已经配置好了
虚拟专用网络OpenVPN扩展
启用安全增强功能
root@openvpn:/etc/openvpn# openvpn --genkey --secret stj_tls.key
root@openvpn:/etc/openvpn# mv stj_tls.key server/
root@openvpn:/etc/openvpn# cat server.conf
root@openvpn:/etc/openvpn# cat server.conf
port 1194
proto tcp4
dev tun
ca /etc/openvpn/server/ca.crt
cert /etc/openvpn/server/stangj.crt
key /etc/openvpn/server/stangj.key
dh /etc/openvpn/server/dh.pem
tls-auth /etc/openvpn/server/stj_tls.key 0
server 10.8.0.0 255.255.255.0
push "route 172.16.2.0 255.255.255.0"
keepalive 10 120
cipher AES-256-CBC
compress lz4-v2
push "compress lz4-v2"
max-clients 2048
user openvpn
group openvpn
status /var/log/openvpn/openvpn-status.log
log-append /var/log/openvpn/openvpn.log
verb 3
root@openvpn:/etc/openvpn/server# systemctl restart openvpn@server.service
window加入该key文件
修改配置文件
账户证书管理
证书手动注销
root@openvpn:/etc/openvpn# easy-rsa/easyrsa revoke tanghao
Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa/vars
Using SSL: openssl OpenSSL 3.0.2 15 Mar 2022 (Library: OpenSSL 3.0.2 15 Mar 2022)
Please confirm you wish to revoke the certificate with the following subject:
subject=
commonName = tanghao
Type the word 'yes' to continue, or any other input to abort.
Continue with revocation: yes # yes
Using configuration from /etc/openvpn/pki/easy-rsa-4893.ZDkax4/tmp.Yurs1W
Revoking Certificate 539115868C02011BCE0B99B361241682.
Data Base Updated
IMPORTANT!!!
Revocation was successful. You must run gen-crl and upload a CRL to your
infrastructure in order to prevent the revoked cert from being accepted.
`生成证书吊销列表`
root@openvpn:/etc/openvpn# easy-rsa/easyrsa gen-crl
root@openvpn:/etc/openvpn# cat server.conf
port 1194
proto tcp4
dev tun
ca /etc/openvpn/server/ca.crt
cert /etc/openvpn/server/stangj.crt
key /etc/openvpn/server/stangj.key
dh /etc/openvpn/server/dh.pem
server 10.8.0.0 255.255.255.0
push "route 172.16.2.0 255.255.255.0"
keepalive 10 120
cipher AES-256-CBC
compress lz4-v2
push "compress lz4-v2"
max-clients 2048
user openvpn
group openvpn
status /var/log/openvpn/openvpn-status.log
log-append /var/log/openvpn/openvpn.log
verb 3
crl-verify /etc/openvpn/pki/crl.pem # 加上这一行
`#每次吊销证书后,都需要重新启动才能生效`
root@openvpn:/etc/openvpn# systemctl restart openvpn@server.service
-
去windos上面看 已经连接不上了
实现用户密码认证
及可以共用一个密钥设置不同用户登录授权连接，就不用在新增加一个用户的时候就去生成一个密钥
修改服务端配置
官方地址：http://openvpn.se/files/other/checkpsw.sh
root@openvpn:/etc/openvpn# cat server.conf
port 1194
proto tcp4
dev tun
ca /etc/openvpn/server/ca.crt
cert /etc/openvpn/server/stangj.crt
key /etc/openvpn/server/stangj.key
dh /etc/openvpn/server/dh.pem
server 10.8.0.0 255.255.255.0
push "route 172.16.2.0 255.255.255.0"
keepalive 10 120
cipher AES-256-CBC
compress lz4-v2
push "compress lz4-v2"
max-clients 2048
user openvpn
group openvpn
status /var/log/openvpn/openvpn-status.log
log-append /var/log/openvpn/openvpn.log
verb 3
crl-verify /etc/openvpn/pki/crl.pem
# 加上下面三行
script-security 3
auth-user-pass-verify /etc/openvpn/checkpsw.sh via-env
username-as-common-name
创建自定义脚本
root@openvpn:/etc/openvpn# cat checkpsw.sh
###########################################################
# checkpsw.sh (C) 2004 Mathias Sundman <mathias@openvpn.se>
#
# This script will authenticate OpenVPN users against
# a plain text file. The passfile should simply contain
# one row per user with the username first followed by
# one or more space(s) or tab(s) and then the password.
PASSFILE="/etc/openvpn/psw-file"
LOG_FILE="/var/log/openvpn-password.log"
TIME_STAMP=`date "+%Y-%m-%d %T"`
###########################################################
if [ ! -r "${PASSFILE}" ]; then
echo "${TIME_STAMP}: Could not open password file \"${PASSFILE}\" for reading." >> ${LOG_FILE}
exit 1
fi
CORRECT_PASSWORD=`awk '!/^;/&&!/^#/&&$1=="'${username}'"{print $2;exit}' ${PASSFILE}`
if [ "${CORRECT_PASSWORD}" = "" ]; then
echo "${TIME_STAMP}: User does not exist: username=\"${username}\", password=\"${password}\"." >> ${LOG_FILE}
exit 1
fi
if [ "${password}" = "${CORRECT_PASSWORD}" ]; then
echo "${TIME_STAMP}: Successful authentication: username=\"${username}\"." >> ${LOG_FILE}
exit 0
fi
echo "${TIME_STAMP}: Incorrect password: username=\"${username}\", password=\"${password}\"." >> ${LOG_FILE}
exit 1
#增加执行权限
root@openvpn:/etc/openvpn# chmod +x /etc/openvpn/checkpsw.sh
创建用户密码文件
# 创建用户和密码认证文件,每行是一个用户和密码
root@openvpn:/etc/openvpn# cat > /etc/openvpn/psw-file <<EOF
jerry 123456
mom 654321
EOF
# 通过更改此账号密码就可以达到访问控制的效果
修改客户端window配置
client
dev tun
proto tcp
remote 192.168.139.241 1194
resolv-retry infinite
nobind
ca ca.crt
cert tom.crt
key tom.key
remote-cert-tls server
cipher AES-256-CBC
verb 3
compress lz4-v2
auth-user-pass
客户端window连接验证
文章评论