Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa/vars
init-pki complete; you may now create a CA or requests. Your newly created PKI dir is: /etc/openvpn/easy-rsa/pki
创建 CA 根证书
根据提示输入 Common Name，名字自定义。在这部分会提示 Enter New CA Key Passphrase，输入两次 PEM 密码，此密码必须记住，不然以后不能为证书签名。可以加 nopass 参数表示不用密码
$ ./easyrsa build-ca
Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa/vars Using SSL: openssl OpenSSL 1.0.2k-fips 26 Jan 2017
Enter New CA Key Passphrase: Re-Enter New CA Key Passphrase: Generating RSA private key, 2048 bit long modulus ..................................................+++ .............................................................................................+++ e is 65537 (0x10001) You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Common Name (eg: your user, host, or server name) [Easy-RSA CA]:myca
CA creation complete and you may now import and sign cert requests. Your new CA certificate file for publishing is at: /etc/openvpn/easy-rsa/pki/ca.crt
生成的 CA 证书位于 pki/ca.crt，私钥位于 pki/private/
创建 OpenVPN 服务端证书
命令中的 openvpn-server 为自定义名称，这里建议用使用 nopass 参数，否则以后启动服务时需要输入密码。创建过程中需要输入之前的 CA 根证书的 PEM 密码。
Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa/vars Using SSL: openssl OpenSSL 1.0.2k-fips 26 Jan 2017 Generating a 2048 bit RSA private key ........................................................+++ ................+++ writing new private key to '/etc/openvpn/easy-rsa/pki/easy-rsa-4754.a78E4M/tmp.ubswzT' ----- Using configuration from /etc/openvpn/easy-rsa/pki/easy-rsa-4754.a78E4M/tmp.zSlCOO Enter pass phrase for /etc/openvpn/easy-rsa/pki/private/ca.key: Check that the request matches the signature Signature ok The Subject's Distinguished Name is as follows commonName :ASN.1 12:'openvpn-server' Certificate is to be certified until May 21 09:13:22 2025 GMT (825 days)
Write out database with 1 new entries Data Base Updated
生成的 OpenVPN 服务端证书位于 pki/issued/，私钥位于 pki/private/
$ ls pki/issued/ openvpn-server.crt $ ls pki/private/ ca.key openvpn-server.key
local 192.168.88.88 port 1194 proto udp dev tun ca server_certs/ca.crt cert server_certs/openvpn-server.crt key server_certs/openvpn-server.key dh dh.pem server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt push "redirect-gateway def1 bypass-dhcp" push "dhcp-option DNS 8.8.8.8" client-to-client keepalive 10 120 comp-lzo user nobody group nobody persist-key persist-tun status openvpn-status.log log openvpn.log verb 3
开启系统 IPv4 转发功能
修改内核配置文件 /etc/sysctl.conf，增加以下配置，开启内核 IPv4 转发功能
/etc/sysctl.conf
net.ipv4.ip_forward = 1
执行命令使配置生效
sysctl -p
添加 iptables 防火墙规则
配置 iptables 防火墙规则，允许 OpenVPN 分配的网段 NAT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j MASQUERADE