1. OpenVPN is based on OpenSSL, so you must install OpenSSL first:
[root@Zabbix-Server ~]# yum install openssl openssl-devel gcc
2. Install the lzo software to compress tunnel communication data and accelerate transmission speed (version lzo-2.06):
[root@Zabbix-Server lzo-2.06]# ./configure --prefix=/usr/local/lzo [root@Zabbix-Server lzo-2.06]# make [root@Zabbix-Server lzo-2.06]# make install
3. Install OpenVPN (version openvpn-2.2.2):
[root@Zabbix-Server openvpn-2.2.2]# ./configure --prefix=/usr/local/openvpn --with-lzo-lib=/usr/local/lzo/ [root@Zabbix-Server openvpn-2.2.2]# make [root@Zabbix-Server openvpn-2.2.2]# make install
4. Configure OpenVPN
1) Set up CA details. Navigate to the source code directory and edit the vars file to set relevant variables.
[root@Zabbix-Server ~]# cd /root/src/openvpn-2.2.2/easy-rsa/2.0 [root@Zabbix-Server 2.0]# vim vars ###vim vars items to modify### export KEY_COUNTRY="CN" # Define country export KEY_PROVINCE="SH" # Define province export KEY_CITY="Chengdu" # Define city export KEY_ORG="yunwei123.com" # Define organization export KEY_EMAIL="zeus911@foxmail.com" # Define email address ###vim vars### [root@Zabbix-Server 2.0]# source vars NOTE: If you run ./clean-all, I will be doing a rm -rf on /root/src/openvpn-2.0.9/easy-rsa/2.0/keys # Initialize the keys directory [root@Zabbix-Server 2.0]# ./clean-all
Generate the root CA certificate ca.key and ca.crt, which are used to sign server and client certificates. Since preset values were defined, you can simply press Enter through the creation process.
[root@Zabbix-Server 2.0]# ./build-ca
Generate the Diffie-Hellman file for the server:
[root@Zabbix-Server 2.0]# ./build-dh
2) Generate certificates and keys for the OpenVPN server. Generally, you only need to input values for “A challenge password []” and “An optional company name []”. For other prompts, use defaults or enter “y”. If you do not want to use the default preset values, fill in your desired ones.
[root@Zabbix-Server 2.0]# ./build-key-server server
3) Generate certificate files for the OpenVPN client. Using yunwei123 as an example, the steps are the same as for the server. If you do not change the default preset values, just press Enter or “y” throughout. Note that each client’s certificate file must be generated this way (if using RADIUS authentication, this step is unnecessary; this will be covered in a future article). Each client requires an independently generated certificate file.
[root@Zabbix-Server 2.0]# ./build-key yunwei123
4) Modify relevant configuration files
For convenience, copy the entire keys folder to the OpenVPN installation directory /usr/local/openvpn/:
[root@Zabbix-Server 2.0]# cp -rp keys/ /usr/local/openvpn/
Copy the OpenVPN configuration file /root/src/openvpn-2.2.2/sample-config-files/server.conf to the OpenVPN installation directory:
[root@Zabbix-Server 2.0]# mkdir /usr/local/openvpn/etc [root@Zabbix-Server 2.0]# cd ../../sample-config-files/ [root@Zabbix-Server sample-config-files]# cp server.conf /usr/local/openvpn/etc/
Edit the configuration file /usr/local/openvpn/etc/server.conf:
[root@Zabbix-Server sample-config-files]# cd /usr/local/openvpn/etc/ [root@Zabbix-Server etc]# vim server.conf ####vim server.conf new additions or modifications#### proto tcp # Use TCP protocol for communication ca /usr/local/openvpn/keys/ca.crt cert /usr/local/openvpn/keys/server.crt key /usr/local/openvpn/keys/server.key server 10.8.0.0 255.255.255.0 # Network segment allocated by OpenVPN service for VPN network push "dhcp-option DNS 202.96.209.5" push "route 10.10.10.0 255.255.255.0" # Internal network # Specify log file; default logs are sent to syslog and recorded in /var/log/message log /var/log/openvpn.log ####vim server.conf####
# Enable system IP forwarding to allow packets to flow between different network segments:
[root@Zabbix-Server etc]# echo "1" > /proc/sys/net/ipv4/ip_forward The above command temporarily enables IP forwarding, but it will take effect again after the next reboot. To make it permanent, modify the file /etc/sysctl.conf. [root@Zabbix-Server etc]# vim /etc/sysctl.conf ####vim parameters to change#### net.ipv4.ip_forward = 1 # Use sysctl -p to apply parameters immediately [root@Zabbix-Server etc]# sysctl -p
5) Start the OpenVPN server:
[root@Zabbix-Server openvpn]# /usr/local/openvpn/sbin/openvpn --config /usr/local/openvpn/etc/server.conf # To run in the background: [root@Zabbix-Server openvpn]# nohup /usr/local/openvpn/sbin/openvpn --config /usr/local/openvpn/etc/server.conf &
You can also use the script provided with the source package /root/src/openvpn-2.2.2/sample-scripts/openvpn.init with minor modifications to suit the current environment.
[root@Zabbix-Server sample-scripts]# cp openvpn.init /etc/init.d/openvpn [root@Zabbix-Server sample-scripts]# vim /etc/init.d/openvpn ####vim openvpn items to change#### # Add custom installation directory for openvpn executable /usr/local/openvpn/sbin/openvpn openvpn_locations="/usr/sbin/openvpn /usr/local/sbin/openvpn /usr/local/openvpn/sbin/openvpn" # Change configuration file directory to /usr/local/openvpn/etc work=/usr/local/openvpn/etc ####vim openvpn#### # Start openvpn and add to startup items [root@Zabbix-Server sample-scripts]# /etc/init.d/openvpn start Starting openvpn: [ OK ] [root@Zabbix-Server sample-scripts]# chkconfig openvpn on [root@Zabbix-Server sample-scripts]#
6) First, install the OpenVPN client (my Win7 64-bit). The installer is also available in the cloud drive. Then, place the three related certificate files from the keys folder (ca.crt, yunwei123.crt, yunwei123.key) into the client’s C:Program FilesOpenVPNconfig folder.
Next, create the client configuration file using the server-provided client.conf (/root/src/openvpn-2.0.9/sample-config-files/client.conf) as a template. On Windows, change the extension to .ovpn.
The only four items that need to be changed are: remote, ca, cert, and key. My configuration yunwei123.ovpn is as follows:
client dev tun proto tcp remote 192.168.5.168 1194 resolv-retry infinite nobind persist-key persist-tun ca ca.crt cert yunwei123.crt key yunwei123.key comp-lzo verb 3
After configuration, double-click the OpenVPN icon to start the client program, then right-click the small icon in the system tray and select “Connect” to establish the connection.