OpenVPN  - 通过多平台VPN连接保护服务器管理

OpenVPN是一个全功能的SSL VPN，通过使用行业标准SSL / TLS协议实现OSI第2层或第3层安全网络扩展。 它支持基于证书，智能卡和/或用户名/密码凭据的灵活的客户端认证方法，并允许使用应用于VPN虚拟接口的防火墙规则的用户或组专用访问控制策略。 OpenVPN不是Web应用程序代理，不通过Web浏览器进行操作。

服务器准备

对于本教程，我们将使用Debian或Ubuntu服务器。 您可以使用任何已经在生产中的服务器。

OpenVPN安装

所有已知的Linux和UNIX服务器在其存储库中都有OpenVPN。 安装就像运行一样简单：

apt-get install openvpn

防火墙配置

OpenVPN的默认监听端口是1194.可以安全地使用默认端口。 OpenVPN默认使用UDP协议。 这有一个简单的原因：

OpenVPN使用第2层和第3层

• 第2层是数据链路层，通过物理层提供数据帧的无差错传输，这意味着它使用自己的TUN / TAP网络设备。
• 第3层是提供路由的网络层。

这意味着第4层（传输层确保数据包传送）由操作系统和应用程序本身管理。 简单地说，任何控制流量和数据包传输的控制都是由操作系统进行的，因此OpenVPN本身不需要再做两次。 当然，可以选择使用TCP for OpenVPN，这意味着您会浪费更多的资源，但是在某些特殊环境的情况下，可能会很方便。

总结一下，打开UDP端口1194就足以允许VPN连接。 不需要进行过滤，因为OpenVPN有自己的验证和控制（见后面的部分）。 将以下语句添加到防火墙配置中。

-A INPUT -p udp -m udp --dport 1194 -j ACCEPT

服务器配置

OpenVPN安装成功后，您可以在/ etc / openvpn文件夹中找到所有OpenVPN配置文件。 让我们在编辑器中打开server.conf文件并对其进行编辑。

nano /etc/openvpn/server.conf

检查并编辑以下部分：

# SSL/TLS root certificate (ca), certificate
# (cert), and private key (key).

ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key # This file should be kept secret

# Diffie hellman parameters.
dh /etc/openvpn/easy-rsa/keys/dh2048.pem

# Configure server mode and supply a VPN subnet
server 10.9.8.0 255.255.255.0

# Push routes to the client
push "route 10.9.8.0 255.255.255.0"
 
# For extra security beyond that provided
# by SSL/TLS, create an "HMAC firewall"
# to help block DoS attacks and UDP port flooding.
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0 # This file is secret
 
# Select a cryptographic cipher.
cipher AES-128-CBC # AES
 
# Enable compression on the VPN link.
comp-lzo
 
# It's a good idea to reduce the OpenVPN
# daemon's privileges after initialization.
user vpn
group vpn

当我们选择10.9.8.0/24子网作为内部子网时，您的客户端将在连接后从该子网中获取IP地址。 默认情况下，10.9.8.1保留给服务器本身。

生成证书

首先，我们必须编辑vars文件。 填写KEY_COUNTRY，KEY_PROVINCE，KEY_CITY，KEY_ORG和KEY_EMAIL参数。 每次生成新证书时，都会使用这些值。

要加载vars文件，请运行：

./vars

加载完成后，我们可以创建证书颁发机构：

./clean-all

./build-ca

生成CA时，继续生成服务器证书：

./build-key-server server

还有一个客户证书：

./build-key client

毕竟，我们必须生成DH参数：

./build-dh

更安全

为了确保我们已经获得了OpenVPN服务器，我们将使用tls-auth。 这确保我们不会将我们的证书发送到受感染的服务器。

openvpn –genkey –secret ta.key

此ta.key文件必须现在包含在每个客户端的证书包中。

客户端配置

 ##############################################
# Sample client-side OpenVPN 2.0 config file #
# for connecting to multi-client server. #
# #
# This configuration can be used by multiple #
# clients, however each client should have #
# its own cert and key files. #
# #
# On Windows, you might want to rename this #
# file so it has a .ovpn extension #
##############################################
 
# Specify that we are a client and that we
# will be pulling certain config file directives
# from the server.
client
 
# Use the same setting as you are using on
# the server.
# On most systems, the VPN will not function
# unless you partially or fully disable
# the firewall for the TUN/TAP interface.
;dev tap
dev tun
 
# Windows needs the TAP-Windows adapter name
# from the Network Connections panel
# if you have more than one. On XP SP2,
# you may need to disable the firewall
# for the TAP adapter.
;dev-node MyTap
 
# Are we connecting to a TCP or
# UDP server? Use the same setting as
# on the server.
;proto tcp
proto udp
 
# The hostname/IP and port of the server.
# You can have multiple remote entries
# to load balance between the servers.
remote <your-server-ip> 1194
;remote my-server-2 1194
 
# Choose a random host from the remote
# list for load-balancing. Otherwise
# try hosts in the order specified.
;remote-random
 
# Keep trying indefinitely to resolve the
# host name of the OpenVPN server. Very useful
# on machines which are not permanently connected
# to the internet such as laptops.
resolv-retry infinite
 
# Most clients don't need to bind to
# a specific local port number.
nobind
 
# Downgrade privileges after initialization (non-Windows only)
;user nobody
;group nobody
 
# Try to preserve some state across restarts.
persist-key
persist-tun
 
# If you are connecting through an
# HTTP proxy to reach the actual OpenVPN
# server, put the proxy server/IP and
# port number here. See the man page
# if your proxy server requires
# authentication.
;http-proxy-retry # retry on connection failures
;http-proxy [proxy server] [proxy port #]
 
# Wireless networks often produce a lot
# of duplicate packets. Set this flag
# to silence duplicate packet warnings.
;mute-replay-warnings
 
# SSL/TLS parms.
# See the server config file for more
# description. It's best to use
# a separate .crt/.key file pair
# for each client. A single ca
# file can be used for all clients.
ca ca.crt
cert client.crt
key client.key
 
# Verify server certificate by checking
# that the certicate has the nsCertType
# field set to "server". This is an
# important precaution to protect against
# a potential attack discussed here:
# http://openvpn.net/howto.html#mitm
#
# To use this feature, you will need to generate
# your server certificates with the nsCertType
# field set to "server". The build-key-server
# script in the easy-rsa folder will do this.
;ns-cert-type server
 
# If a tls-auth key is used on the server
# then every client must also have the key.
tls-auth ta.key 1
 
# Select a cryptographic cipher.
# If the cipher option is used on the server
# then you must also specify it here.
cipher AES-128-CBC
 
# Enable compression on the VPN link.
# Don't enable this unless it is also
# enabled in the server config file.
comp-lzo
 
# Set log file verbosity.
verb 3
 
# Silence repeating messages
mute 20 

将其另存为client.ovpn文件，并将ta.key，ca.crt，client.crt，client.key添加到一个文件夹。

将openvpn客户端安装到计算机并运行client.ovpn配置文件后，您应该可以连接到VPN服务器。 之后，您可以从10.9.8.0/24范围获取IP地址，私人地设置和配置您的服务器。