1.系统环境：centos6.4
双网卡：一个公网，一个私有IP 这里对外IP 是1.1.1.202 内网为192.168.0.10 （server），把10 作为内网的IP 的网关，让server可以转发数据。
2.基础包的安装
yum install openssl openssl-devel gcc -y 或者编译安装这里我采用编译安装的方式部署
# yum install pam-devel gcc -y
#wget http://www.openssl.org/source/openssl-1.0.1e.tar.gz
# tar zxvf openssl-1.0.1e.tar.gz
# cd openssl-1.0.1e
# ./config --prefix=/usr/local/openssl
#make && make installs
3.安装lzo 软件包，用于压缩隧道通信数据以加快传输的速度
#cd /usr/src
#wget http://www.oberhumer.com/opensource/lzo/download/lzo-2.06.tar.gz
#tar zxvflzo-2.06.tar.gz
#cd lzo-2.06
#./configure--prefix=/usr /local/lzo
#make && make install
4.open*** 服务器端的安装配置
安装open*** 在http://open***.net/release/open***-2.3.2.tar.gz
open*** 提供*** server 由于众所周知的原因官网无法打开，建议在国内网站下载低版本
#tar zxvf open***-2.2.2.tar.gz
#cd open***-2.2.2
#./configure --prefix=/usr/local/open*** --with-lzo-headers=/usr/local/lzo/include --with-lzo-lib=/usr/local/lzo/lib --with-ssl-headers=/usr/local/openssl/include/ --with-ssl-lib=/usr/local/openssl/lib/
注意：configure: error: libpam required but missing
yum install pam-devel 需要安装
# make && make install
5.配置
#mkdir /etc/open***
#cp -aR /usr/src/open***-2.2.2/easy-rsa/ /etc/open***
#cd /etc/open***/easy-rsa/2.0/
这下面的文件做简单介绍：
vars 脚本，是用来创建环境变量，设置所需要的变量的脚本
clean-all 脚本，是创建生成CA证书及密钥文件所需要的文件和目录
build-ca 脚本，生成CA证书(交互)
build-dh 脚本，生成Diffie-Hellman文件(交互)
build-key-server 脚本，生成服务器端密钥(交互)
build-key 脚本，生成客户端密钥(交互)
pkitool 脚本，直接使用vars的环境变量设置直接生成证书(非交互)
调整vars文件
vim /etc/open***/easy-rsa/2.0/vars
export KEY_COUNTRY="CN"
export KEY_PROVINCE="BJ"
export KEY_CITY="BeiJing"
export KEY_ORG="geeboo"
export KEY_EMAIL="459812529@qq.com"
export KEY_CN=geeboo
export KEY_NAME=geeboo
export KEY_OU="geeboo.com"
export PKCS11_MODULE_PATH=geeboo
export PKCS11_PIN=123456
：wq
#source vars
#./clean-all
#cp openssl-1.0.0.cnf openssl.cnf
#./build-ca 一路回车即可
。。。。。。
Country Name (2 letter code) [CN]:
State or Province Name (full name) [BJ]:
Locality Name (eg, city) [beijing]:
.........
#cd keys
在keys目录下就可以看到ca.crt ca.key文件
生成Diffie-Hellman文件
#cd ..
#./build-dh
ls keys
ca.crt ca.key dh1024.pem
#./build-key-server server
challenge password []:123456 #定义密码,建议设置复杂的密码
An optional company name []:geeboo
一路回车,Sign the certificate? [y/n]:y 选择y
Certificate is to be certified until Jan 31 02:46:02 2022 GMT (3650days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
创建客户端证书
#./build-key dean #用户名
Generating a 1024 bit RSA private key
..........++++++
................++++++
writing new private key to 'dean.key'
-----
You are about to be asked to enter information that will beincorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or aDN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]:
State or Province Name (full name) [BJ]:
Locality Name (eg, city) [BJ]:
Organization Name (eg, company) [geeboo]:
Organizational Unit Name (eg, section) []:geeboo
Common Name (eg, your name or your server's hostname) [dean]:dean
Name []:
Email Address zhangsan@pongo.cn]:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:dean123456
An optional company name []:
这个步骤主要设定用户的名字和密码
一次可以创建其他的用户和密码
6.配置主配置文件
#cp /usr/src/open***-2.2.2/sample-config-files/server.conf /etc/open***
#vim server.conf
local 1.1.1.202 (*** server 的对外ip)
port 1194
proto tcp
dev tun
ca /etc/open***/easy-rsa/2.0/keys/ca.crt
cert /etc/open***/easy-rsa/2.0/keys/server.crt
key /etc/open***/easy-rsa/2.0/keys/server.key
dh /etc/open***/easy-rsa/2.0/keys/dh1024.pem
server 20.0.0.0 255.255.255.0 #是*** 通道自己划归的ip
ifconfig-pool-persist ipp.txt
push "route 192.168.0.0 255.255.255.0" #和服务器同网段的内网网段
client-to-client
duplicate-cn
keepalive 10 120
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status /etc/open***/easy-rsa/2.0/keys/open***-status.log
verb 5
7.客户端的安装配置
在客户端上个运行open***-2.1.3-install-amcoding.exert
下一步到安装完成
在config 文件夹把 server 端的ca.crt dean.keydean.crt copy 到这个文件夹下
用文本编辑器编辑client.o***
##############################################
# Sample client-side Open××× 2.0 config file #
# for connecting to multi-client server. #
# #
# This configuration can be used by multiple #
# clients, however each client should have #
# its own cert and key files. #
# #
# On Windows, you might want to rename this #
# file so it has a .o*** extension #
##############################################
# Specify that we are a client and that we
# will be pulling certain config file directives
# from the server.
client
# Use the same setting as you are using on
# the server.
# On most systems, the ××× will not function
# unless you partially or fully disable
# the firewall for the TUN/TAP interface.
;dev tap
dev tun
# Windows needs the TAP-Win32 adapter name
# from the Network Connections panel
# if you have more than one. OnXP SP2,
# you may need to disable the firewall
# for the TAP adapter.
;dev-node MyTap
# Are we connecting to a TCP or
# UDP server? Use the samesetting as
# on the server.
;proto tcp
proto tcp
hand-window 45
# The hostname/IP and port of the server.
# You can have multiple remote entries
# to load balance between the servers.
remote 1.1.1.202 1194
push "route 192.168.0.0 255.255.255.0"
# Choose a random host from the remote
# list for load-balancing. Otherwise
# try hosts in the order specified.
;remote-random
# Keep trying indefinitely to resolve the
# host name of the Open××× server. Very useful
# on machines which are not permanently connected
# to the internet such as laptops.
resolv-retry infinite
# Most clients don't need to bind to
# a specific local port number.
nobind
# Downgrade privileges after initialization (non-Windows only)
;user nobody
;group nobody
# Try to preserve some state across restarts.
persist-key
persist-tun
# If you are connecting through an
# HTTP proxy to reach the actual Open×××
# server, put the proxy server/IP and
# port number here. See the manpage
# if your proxy server requires
# authentication.
;http-proxy-retry # retry on connection failures
;http-proxy [proxy server] [proxy port #]
# Wireless networks often produce a lot
# of duplicate packets. Set thisflag
# to silence duplicate packet warnings.
;mute-replay-warnings
# SSL/TLS parms.
# See the server config file for more
# description. It's best to use
# a separate .crt/.key file pair
# for each client. A single ca
# file can be used for all clients.
ca ca.crt
cert dean.crt
key dean.key
# Verify server certificate by checking
# that the certicate has the nsCertType
# field set to "server". This is an
# important precaution to protect against
# a potential attack discussed here:
# http://open***.net/howto.html#mitm
#
# To use this feature, you will need to generate
# your server certificates with the nsCertType
# field set to "server". The build-key-server
# script in the easy-rsa folder will do this.
ns-cert-type server
# If a tls-auth key is used on the server
# then every client must also have the key.
#tls-auth dean.key 1
# Select a cryptographic cipher.
# If the cipher option is used on the server
# then you must also specify it here.
;cipher x
# Enable compression on the ××× link.
# Don't enable this unless it is also
# enabled in the server config file.
comp-lzo
# Set log file verbosity.
verb 4
# Silence repeating messages
;mute 20
reneg-sec 0
#route-method exe
route-delay 2
auth-user-pass
#auth-user-pass mypasswd.txt
route-method exe
route-delay 2
route add 0.0.0.0 mask 0.0.0.0
8.启动*** 服务
#/usr/local/open***/sbin/open***--config /etc/open***/server.conf &
并把该命令写入
vim /etc/rc.d/rc.local
/usr/local/open***/sbin/open***--config /etc/open***/server.conf >/dev/null 2>&1 &
#lsof -i:1194
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
open*** 20790 root 5u IPv4 136403 0t0 TCP 1.1.1.202:open*** (LISTEN)
open*** 20790 root 8u IPv4 142078 0t0 TCP 1.1.1.202:open***->1.1.1.24:59860 (ESTABLISHED)
#ifconfig
tun0 Link encap:UNSPEC HWaddr00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:20.0.0.1 P-t-P:20.0.0.2 Mask:255.255.255.255
UP POINTOPOINT RUNNINGNOARP MULTICAST MTU:1500 Metric:1
RX packets:144226 errors:0dropped:0 overruns:0 frame:0
TX packets:76902errors:0 dropped:0 overruns:0 carrier:0
collisions:0txqueuelen:100
在客户端运行open***
右击图标连接，并输入dean 和密码
ping 192.168.0.144 内网段的一个服务器的IP
转载于:https://blog.51cto.com/eagleheart/1300984
