作者：张华 发表于：2016-07-29
版权声明：可以任意转载，转载时请务必以超链接形式标明文章原始出处和作者信息及本版权声明
http://blog.csdn.net/quqi99 )
安装Server
#!/usr/bin/env bash
set -o xtrace
sudo apt-get -y install easy-rsa openssl
#Using easy-rsa to generate KEY and certificate
sudo cp -r /usr/share/easy-rsa/ /etc/openvpn
cd /etc/openvpn/easy-rsa
sudo chown -R `whoami`:root /etc/openvpn
mkdir -p /etc/openvpn/easy-rsa/keys
if [ ! -f "/etc/openvpn/easy-rsa/keys/ca.key" ]; then
source ./vars
export KEY_COUNTRY=CN
export KEY_PROVINCE=BJ
export KEY_CITY=BJ
export KEY_ORG=sts
export KEY_OU=sts
export KEY_NAME=sts
export KEY_EMAIL=root@sts
export KEY_NAME="server"
./clean-all
./build-ca
./build-key-server server
fi
cp /etc/openvpn/easy-rsa/keys/{server.crt,server.key,ca.crt} /etc/openvpn
openssl dhparam -out /etc/openvpn/dh2048.pem 2048
#Generate server configuration
#gunzip -c /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz > /etc/openvpn/server.conf
sudo bash -c 'cat > /etc/openvpn/server.conf' <<EOF
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
;push "route 192.168.10.0 255.255.255.0"
push "redirect-gateway def1 bypass-dhcp"
;push "dhcp-option DNS 8.8.8.8"
;push "dhcp-option DNS 8.8.4.4"
keepalive 10 120
reneg-sec 0
;openssl dhparam -out /etc/openvpn/dh2048.pem 2048
dh dh2048.pem
;sudo openvpn --genkey --secret ta.key
tls-auth ta.key 0 # This file is secret
;Static Key
;secret /etc/openvpn/ta.key
;cipher BF-CBC # Blowfish (default)
;cipher AES-128-CBC # AES
;cipher DES-EDE3-CBC # Triple-DES
comp-lzo
max-clients 100
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
;log openvpn.log
;log-append openvpn.log
verb 3
EOF
#Network Set up
sudo ufw diable
sudo iptables -A INPUT -p tcp -m state --state NEW --dport 1194 -j ACCEPT
sudo iptables -A INPUT -p udp -m state --state NEW --dport 1194 -j ACCEPT
sudo iptables -A FORWARD -j ACCEPT
sudo iptables -t nat -A POSTROUTING -j MASQUERADE
sudo sed -i '/net.ipv4.ip_forward/ s/.∗=.*/\11/' /etc/sysctl.conf
sudo sysctl -p
sudo sysctl -w net.ipv4.ip_forward=1
#Start VPN Server
sudo /etc/init.d/openvpn restart
#sudo openvpn --config /etc/openvpn/server.conf
重要参数
1, tls-timeout=4 , 因为默认的默认的UDP超时时间是30秒，但是实际测试中发现无论在server配置tls-timeout为任何值均极易引发错误”TLS Error: TLS key negotiation failed to occur within 60 seconds“， 所以没敢tls-timeout值。但是修改了： sudo sysctl -w net.netfilter.nf_conntrack_udp_timeout=60
The tls-timeout specifies how many seconds elapse between retransmission of
packets if no response is recieved from the server. The default timeout is 2
seconds. You can change this timeout to some other value, but the client will
continue to attempt connections for 1 minute regardless of how the tls-timeout
interval is set.
2, "keepalive 10 120", 它相当于“ping 10,ping-restart 120", openvpn构建在udp之上，每隔120秒的时间窗服务端收不到客户端的数据将触发Timer重传。原来默认的60秒可能由于网络环境丢包频繁超时重发降低性能（10/60=16.7%的丢包率）。
3, ta.key是一个公钥，能对tls数据进行摘要，当验证发现被篡改后能及时丢弃及时重传
#VPN Server端
;sudo openvpn --genkey --secret ta.key
tls-auth ta.key 0 # This file is secret
#VPN Client端
tls-auth ta.key 1
4, 用下列规则发现被篡改后的tls包及时丢弃及时重传(未测试）
sudo iptables iptables -I FORWARD -p tcp -s <vpn-ip> --sport 1194 --tcp-flags RST RST -m state --state RELATED,ESTABLISHED -j DROP
客户端设置
#VPN Client
#It's ideal for each client connecting to the VPN to have its own unique certificate and key.
#This is preferable to generating one general certificate and key to use among all client devices.
cd /etc/openvpn/easy-rsa && ./build-key client1
#cp /usr/share/doc/openvpn/examples/sample-config-files/client.conf /etc/openvpn/easy-rsa/keys/client.ovpn
#scp ubuntu@<server>:/etc/openvpn/easy-rsa/keys/client1.crt /etc/openvpn/
#scp ubuntu@<server>:/etc/openvpn/easy-rsa/keys/client1.key /etc/openvpn/
#scp ubuntu@<server>:/etc/openvpn/easy-rsa/keys/client.ovpn /etc/openvpn/
#scp ubuntu@<server>:/etc/openvpn/easy-rsa/keys/ca.crt /etc/openvpn/
#scp ubuntu@<server>:/etc/openvpn/ta.key /etc/openvpn/
#Generate client configuration
sudo bash -c 'cat > /etc/openvpn/client.ovpn' <<EOF
client
dev tun
proto udp
remote <vpn-server> 1194
;remote my-server-2 1194
;remote-random
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
ca ca.crt
cert client1.crt
key client1.key
ns-cert-type server
tls-auth ta.key 1
comp-lzo
verb 3
redirect-gateway def1
tun-mtu 1500
mssfix 1420
;Static Key
;secret /etc/openvpn/ta.key
EOF
#Start VPN Client
sudo openvpn --config /etc/openvpn/client.ovpn