19:I[15621,["/_next/static/immutable/chunks/3gm-8e62xn1qd.js","/_next/static/immutable/chunks/0n2yq6f-f75k2.js"],"ArticleReader"] 1a:Ta0c,

1.安装软件包
```
1sudo apt-get install openvpn
```

2.生成证书

 1# cp -R /usr/share/doc/openvpn/examples/easy-rsa/ /etc/openvpn/
 2# cd /etc/openvpn/easy-rsa/2.0/
 3# ./clean-all
 4# ./build-ca  ;按提示填写信息，创建根证书
 5# ./build-key-server server ;按提示填写信息，创建服务端key
 6# ./build-key shanghai ;创建客户端key，上海用
 7# ./build-key shenzhen ;创建客户端key，深圳用
 8# ./build-key other ;创建客户端key，备用
 9创建不同key的用途是区别连接地区，分配固定IP。需要注意的是，Common Name(eg,your name or your server’s hostname)这项每个客户端之间不能重名，和server key的设置也不能重名，否则会生成失败。
10# ./build-dh ;生成DH
11# openvpn --genkey --secret ta.key ;生成tls-aut证书
12# cp server.crt server.key dh2048.pem ca.crt ta.key /etc/openvpn/

3.服务配置

 1# vi /etc/openvpn/server.conf ;创建配置文件
 2port 1195
 3proto udp
 4dev tap
 5ca ca.crt
 6cert server.crt
 7key server.key # This file should be kept secret
 8dh dh2048.pem
 9server 10.10.101.0 255.255.255.248
10ifconfig-pool-persist ipp.txt
11push "route 192.168.1.0 255.255.255.0"
12client-config-dir ccd
13keepalive 10 120
14tls-auth ta.key 0
15comp-lzo
16user nobody
17group nobody
18persist-key
19persist-tun
20status openvpn-status.log
21verb 3
22# vi /etc/openvpn/ipp.txt ;分配客户端IP
23shanghai,10.10.101.2
24shenzhen,10.10.101.3
25other,10.10.101.4

4.网关配置，启动服务端时，同时开启IP转发，把本机设置成到办公网的网关

1# vi /etc/openvpn/startserver.sh ;创建启动脚本
2#!/bin/bash
3/usr/sbin/openvpn --daemon --config /etc/openvpn/server.conf
4sleep 5
5echo 1 > /proc/sys/net/ipv4/ip_forward
6ip ro add 10.10.0.0/16 via 10.10.101.2 dev tap0 src 192.168.1.213
7ip ro add 192.168.20.0/24 via 10.10.101.3 dev tap0 src 192.168.1.213
8(设置src很重要，否则IDC中其他机器可以ping通OA，但在网关机上却ping不通)

5.启动服务
```
1/etc/openvpn/startserver.sh
```

6.开机启动服务

1echo "/etc/openvpn/startserver.sh" >> /etc/rc.local

7.所有IDC服务器配置静态路由，办公网IP段指向我们创建的网关

1# /sbin/ip ro add 10.10.0.0/16 via 192.168.1.213
2# /sbin/ip ro add 192.168.20.0/24 via 192.168.1.213

1b:T8d0,1.安装软件包1sudo apt-get install openvpn 2.生成证书 1# cp -R /usr/share/doc/openvpn/examples/easy-rsa/ /etc/openvpn/ 2# cd /etc/openvpn/easy-rsa/2.0/ 3# ./clean-all 4# ./build-ca ;按提示填写信息，创建根证书 5# ./build-key-server server ;按提示填写信息，创建服务端key 6# ./build-key shanghai ;创建客户端key，上海用 7# ./build-key shenzhen ;创建客户端key，深圳用 8# ./build-key other ;创建客户端key，备用 9创建不同key的用途是区别连接地区，分配固定IP。需要注意的是，Common Name(eg,your name or your server’s hostname)这项每个客户端之间不能重名，和server key的设置也不能重名，否则会生成失败。 10# ./build-dh ;生成DH 11# openvpn --genkey --secret ta.key ;生成tls-aut证书 12# cp server.crt server.key dh2048.pem ca.crt ta.key /etc/openvpn/ 3.服务配置 1# vi /etc/openvpn/server.conf ;创建配置文件 2port 1195 3proto udp 4dev tap 5ca ca.crt 6cert server.crt 7key server.key # This file should be kept secret 8dh dh2048.pem 9server 10.10.101.0 255.255.255.248 10ifconfig-pool-persist ipp.txt 11push "route 192.168.1.0 255.255.255.0" 12client-config-dir ccd 13keepalive 10 120 14tls-auth ta.key 0 15comp-lzo 16user nobody 17group nobody 18persist-key 19persist-tun 20status openvpn-status.log 21verb 3 22# vi /etc/openvpn/ipp.txt ;分配客户端IP 23shanghai,10.10.101.2 24shenzhen,10.10.101.3 25other,10.10.101.4 4.网关配置，启动服务端时，同时开启IP转发，把本机设置成到办公网的网关1# vi /etc/openvpn/startserver.sh ;创建启动脚本 2#!/bin/bash 3/usr/sbin/openvpn --daemon --config /etc/openvpn/server.conf 4sleep 5 5echo 1 > /proc/sys/net/ipv4/ip_forward 6ip ro add 10.10.0.0/16 via 10.10.101.2 dev tap0 src 192.168.1.213 7ip ro add 192.168.20.0/24 via 10.10.101.3 dev tap0 src 192.168.1.213 8(设置src很重要，否则IDC中其他机器可以ping通OA，但在网关机上却ping不通) 5.启动服务1/etc/openvpn/startserver.sh 6.开机启动服务1echo "/etc/openvpn/startserver.sh" >> /etc/rc.local 7.所有IDC服务器配置静态路由，办公网IP段指向我们创建的网关1# /sbin/ip ro add 10.10.0.0/16 via 192.168.1.213 2# /sbin/ip ro add 192.168.20.0/24 via 192.168.1.2131c:T677,

1.安装软件包
```
1apt-get install openvpn
```
2.把服务端上生成的客户端key（ca.crt,shanghai.crt,shanghai.key,ta.key），上传到客户端的/etc/openvpn/conf/目录

3.创建客户端配置文件

 1/etc/openvpn/conf/client.ovpn
 2client
 3remote 183.57.37.213 1194
 4dev tap
 5proto udp
 6resolv-retry infinite
 7nobind
 8persist-key
 9persist-tun
10ca /etc/openvpn/conf/ca.crt
11cert /etc/openvpn/conf/shanghai.crt
12key /etc/openvpn/conf/shanghai.key
13ns-cert-type server
14comp-lzo
15verb 3
16tls-auth /etc/openvpn/conf/ta.key 1

4.启动客户端

1/usr/sbin/openvpn /etc/openvpn/conf/client.ovpn &
2查看输出是否正常连接到服务端并获取IP，也可以ifconfig查看是否有tap设备。

5.网关设置

1IDC中有网关转发包到OA，办公网同样需要网关转发包到IDC。
2如成功连接，此时这台客户端机器已可以连接到IDC的设备，我们还需要把他设置成网关服务器，让办公网其他设备可以通过它连接到IDC。
3echo 1 > /proc/sys/net/ipv4/ip_forward
4ip ro add 192.168.1.0/24 via 10.10.101.1 dev tap0
5在办公网路由器上配置静态路由，把IDC内网段的包指向10.10.1.1。
6
7测试，已经可以互通了。

6.创建启动脚本

1/etc/openvpn/conf/startclient.sh
2#!/bin/bash
3/usr/sbin/openvpn /etc/openvpn/conf/client.ovpn &
4sleep 5
5echo 1 > /proc/sys/net/ipv4/ip_forward
6ip ro add 192.168.1.0/24 via 10.10.101.1 dev tap0

11:["$","main",null,{"className":"reader-page","children":[["$","div",null,{"className":"reader-kicker","children":[["$","$L10",null,{"href":"/sources/0fdcf1f2b5c68a0f","children":[["$","svg",null,{"ref":"$undefined","xmlns":"http://www.w3.org/2000/svg","width":16,"height":16,"viewBox":"0 0 24 24","fill":"none","stroke":"currentColor","strokeWidth":2,"strokeLinecap":"round","strokeLinejoin":"round","className":"lucide lucide-arrow-left","children":[["$","path","1l729n",{"d":"m12 19-7-7 7-7"}],["$","path","x3x0zl",{"d":"M19 12H5"}],"$undefined"]}]," 返回 ","mephisto.cc"]}],["$","span",null,{"children":"工程"}]]}],["$","header",null,{"className":"article-meta","children":[["$","span",null,{"children":["FROM · ","mephisto.cc"]}],["$","div",null,{"children":[["$","svg",null,{"ref":"$undefined","xmlns":"http://www.w3.org/2000/svg","width":15,"height":15,"viewBox":"0 0 24 24","fill":"none","stroke":"currentColor","strokeWidth":2,"strokeLinecap":"round","strokeLinejoin":"round","className":"lucide lucide-calendar-days","children":[["$","path","1cmpym",{"d":"M8 2v4"}],["$","path","4m81vk",{"d":"M16 2v4"}],["$","rect","1hopcy",{"width":"18","height":"18","x":"3","y":"4","rx":"2"}],["$","path","8toen8",{"d":"M3 10h18"}],["$","path","6423bh",{"d":"M8 14h.01"}],["$","path","1etili",{"d":"M12 14h.01"}],["$","path","1gbofw",{"d":"M16 14h.01"}],["$","path","lrp35t",{"d":"M8 18h.01"}],["$","path","mhygvu",{"d":"M12 18h.01"}],["$","path","kzsmim",{"d":"M16 18h.01"}],"$undefined"]}]," ","2024年4月12日",null]}]]}],["$","$L19",null,{"article":{"title":"Openvpn示例","byline":null,"publishedAt":"2024-04-12T00:00:00.000Z","language":"en","blocks":[{"id":"b0","type":"paragraph","html":"

openvpn 示例文档

","text":"openvpn 示例文档"},{"id":"b1","type":"heading","html":"

一、服务端部署

","text":"一、服务端部署"},{"id":"b2","type":"list","html":"$1a","text":"$1b"},{"id":"b3","type":"heading","html":"

二、客户端部署

","text":"二、客户端部署"},{"id":"b4","type":"list","html":"$1c","text":"1.安装软件包1apt-get install openvpn 2.把服务端上生成的客户端key（ca.crt,shanghai.crt,shanghai.key,ta.key），上传到客户端的/etc/openvpn/conf/目录3.创建客户端配置文件 1/etc/openvpn/conf/client.ovpn 2client 3remote 183.57.37.213 1194 4dev tap 5proto udp 6resolv-retry infinite 7nobind 8persist-key 9persist-tun 10ca /etc/openvpn/conf/ca.crt 11cert /etc/openvpn/conf/shanghai.crt 12key /etc/openvpn/conf/shanghai.key 13ns-cert-type server 14comp-lzo 15verb 3 16tls-auth /etc/openvpn/conf/ta.key 1 4.启动客户端1/usr/sbin/openvpn /etc/openvpn/conf/client.ovpn & 2查看输出是否正常连接到服务端并获取IP，也可以ifconfig查看是否有tap设备。 5.网关设置1IDC中有网关转发包到OA，办公网同样需要网关转发包到IDC。 2如成功连接，此时这台客户端机器已可以连接到IDC的设备，我们还需要把他设置成网关服务器，让办公网其他设备可以通过它连接到IDC。 3echo 1 > /proc/sys/net/ipv4/ip_forward 4ip ro add 192.168.1.0/24 via 10.10.101.1 dev tap0 5在办公网路由器上配置静态路由，把IDC内网段的包指向10.10.1.1。 6 7测试，已经可以互通了。 6.创建启动脚本1/etc/openvpn/conf/startclient.sh 2#!/bin/bash 3/usr/sbin/openvpn /etc/openvpn/conf/client.ovpn & 4sleep 5 5echo 1 > /proc/sys/net/ipv4/ip_forward 6ip ro add 192.168.1.0/24 via 10.10.101.1 dev tap0"}],"source":"$0:f:0:1:0:props:children:props:children:1:props:children:props:children:props:children:0:props:sources:346","originalUrl":"https://mephisto.cc/tech/openvpn/","excerpt":"openvpn 多地示例"},"shouldTranslate":true}],"$L1d"]}]