OpenVPN虚拟网安装及部署文档格式.docx
- 文档编号:21695418
- 上传时间:2023-01-31
- 格式:DOCX
- 页数:21
- 大小:76.92KB
OpenVPN虚拟网安装及部署文档格式.docx
《OpenVPN虚拟网安装及部署文档格式.docx》由会员分享,可在线阅读,更多相关《OpenVPN虚拟网安装及部署文档格式.docx(21页珍藏版)》请在冰豆网上搜索。
setKEY_EMAIL=sunzhouyicdtsm.
(二)把easy-rsa下的openssl.f.sample改成openssl.f。
然后翻开命令行〔开场-运行-输入cmd〕
C:
\DocumentsandSettings\ThinkPad>
cd"
\ProgramFiles\OpenVPN\easy-rsa"
\ProgramFiles\OpenVPN\easy-rsa>
vars
clean-all
系统找不到指定的文件。
已复制1个文件。
3.生成根CA:
(一)C:
build-ca
Loading'
screen'
intorandomstate-done
Generatinga1024bitRSAprivatekey
...............................++++++
.......++++++
writingnewprivatekeyto'
keys\ca.Key'
-----
Youareabouttobeaskedtoenterinformationthatwillbeincorporated
intoyourcertificaterequest.
WhatyouareabouttoenteriswhatiscalledaDistinguishedNameoraDN.
Therearequiteafewfieldsbutyoucanleavesomeblank
Forsomefieldstherewillbeadefaultvalue,
Ifyouenter'
.'
thefieldwillbeleftblank.
CountryName(2lettercode)[US]:
StateorProvinceName(fullname)[CA]:
BJ
LocalityName(eg,city)[SanFrancisco]:
BeiJing
OrganizationName(eg,pany)[OpenVPN]:
cdtsm
OrganizationalUnitName(eg,section)[]:
monName(eg,yournameoryourserver'
shostname)[]:
EmailAddress[mailhost.domain]:
sunzhouyicdtsm.
4.生成dh1024.pem文件,server使用TLS必须使用的一个文件。
〔一〕C:
build-dh
GeneratingDHparameters,1024bitlongsafeprime,generator2
Thisisgoingtotakealongtime
.....................................................................+..........
............................................+...............................+...
................+.....+.................+.......................+...............
...........+.............................................+......................
....................+...........................................+...............
...........................+....................................................
.+...................................++*++*++*
5.下面生成效劳器端证书、客户端证书和TA证书:
首先生成server使用的证书:
〔一〕C:
build-key-serverCdtsmServer
............++++++
keys\CdtsmServer.key'
Pleaseenterthefollowing'
e*tra'
attributes
tobesentwithyourcertificaterequest
Achallengepassword[]:
123456
Anoptionalpanyname[]:
Usingconfigurationfromopenssl.f
Checkthattherequestmatchesthesignature
Signatureok
TheSubject'
sDistinguishedNameisasfollows
countryName:
PRINTABLE:
'
stateOrProvinceName:
BJ'
localityName:
BeiJing'
organizationName:
cdtsm'
organizationalUnitName:
monName:
emailAddress:
IA5STRING:
sunzhouyicdtsm.'
CertificateistobecertifieduntilJul2504:
11:
082020GMT(3650days)
Signthecertificate?
[y/n]:
y
1outof1certificaterequestscertified,mit?
[y/n]y
Writeoutdatabasewith1newentries
DataBaseUpdated
到此server端使用的证书生成完毕。
(二)生成可是为客户端生成client证书。
接下来生成客户端证书:
C:
build-keyCdtsmClient
Loading'
Generatinga1024bitRSAprivatekey
......++++++
.............................++++++
keys\CdtsmClient.key'
CdtsmClient
CdtsmClient'
13:
172020GMT(3650days)
到此客户端使用的client证书生成完毕。
(三)下面生成ta.key文件
最后生成ta.Key文件
openvpn--genkey--secretkeys/ta.Key
到此为止根ca、客户端、效劳器端所需要的证书和密钥文件就已经全部准备就绪,接下来要做的是配置效劳器端文件和客户端文件。
6.效劳端和客户端的配置:
〔一〕效劳器端的配置文件在C:
\ProgramFiles\OpenVPN\sample-config文件夹下:
server.ovpn内容例如如下:
*WhichlocalIPaddressshouldOpenVPN
*listenon?
(optional)
*WhichTCP/UDPportshouldOpenVPNlistenon?
*IfyouwanttorunmultipleOpenVPNinstances
*onthesamemachine,useadifferentport
*numberforeachone.Youwillneedto
*openupthisportonyourfirewall.
*申明使用的端口,默认1194
port1194
*TCPorUDPserver?
*申明使用的协议,默认使用UDP,如果使用pro*y,必须使用TCP协议
;
prototcp
protoudp
*"
devtun"
willcreatearoutedIPtunnel,
devtap"
willcreateanethernettunnel.
*Use"
devtap0"
ifyouareethernetbridging
*andhaveprecreatedatap0virtualinterface
*andbridgeditwithyourethernetinterface.
*Ifyouwanttocontrolaccesspolicies
*overtheVPN,youmustcreatefirewall
*rulesforthetheTUN/TAPinterface.
*Onnon-Windowssystems,youcangive
*ane*plicitunitnumber,suchastun0.
*OnWindows,use"
dev-node"
forthis.
*Onmostsystems,theVPNwillnotfunction
*unlessyoupartiallyorfullydisable
*thefirewallfortheTUN/TAPinterface.
*申明使用的设备可选tap和tun,tap是二层设备,支持链路层协议。
*tun是ip层的点对点协议,限制稍微多一些,本人习惯使用TAP设备
devtap
devtun
*WindowsneedstheTAP-Win32adaptername
*fromtheNetworkConnectionspanelifyou
*havemorethanone.On*PSP2orhigher,
*youmayneedtoselectivelydisablethe
*WindowsfirewallfortheTAPadapter.
*Non-Windowssystemsusuallydon'
tneedthis.
dev-nodeMyTap
*SSL/TLSrootcertificate(ca),certificate
*(cert),andprivatekey(key).Eachclient
*andtheservermusthavetheirowncertand
*keyfile.Theserverandallclientswill
*usethesamecafile.
*
*Seethe"
easy-rsa"
directoryforaseries
*ofscriptsforgeneratingRSAcertificates
*andprivatekeys.Remembertouse
*auniquemonNamefortheserver
*andeachoftheclientcertificates.
*Any*509keymanagementsystemcanbeused.
*OpenVPNcanalsouseaPKCS*12formattedkeyfile
*(see"
pkcs12"
directiveinmanpage).
*OpenVPN使用的ROOTCA,使用build-ca生成的,用于验证客户是证书是否合法
caca.Crt
*Server使用的证书文件
certCdtsmServer.Crt
*Server使用的证书对应的key,注意文件的权限,防止被盗
keyCdtsmServer.key*Thisfileshouldbekeptsecret
*Diffiehellmanparameters.
*Generateyourownwith:
*openssldhparam-outdh1024.pem1024
*Substitute2048for1024ifyouareusing
*2048bitkeys.
dhdh1024.pem
*ConfigureservermodeandsupplyaVPNsubnet
*forOpenVPNtodrawclientaddressesfrom.
*Theserverwilltake10.8.0.1foritself,
*therestwillbemadeavailabletoclients.
*Eachclientwillbeabletoreachtheserver
*on10.8.0.1.mentthislineoutifyouare
*ethernetbridging.Seethemanpageformoreinfo.
*Maintainarecordofclient<
->
virtualIPaddress
*associationsinthisfile.IfOpenVPNgoesdownor
*isrestarted,reconnectingclientscanbeassigned
*thesamevirtualIPaddressfromthepoolthatwas
*previouslyassigned.
ifconfig-pool-persistipp.t*t
*Configureservermodeforethernetbridging.
*YoumustfirstuseyourOS'
sbridgingcapability
*tobridgetheTAPinterfacewiththeethernet
*NICinterface.Thenyoum
- 配套讲稿:
如PPT文件的首页显示word图标,表示该PPT已包含配套word讲稿。双击word图标可打开word文档。
- 特殊限制:
部分文档作品中含有的国旗、国徽等图片,仅作为作品整体效果示例展示,禁止商用。设计者仅对作品中独创性部分享有著作权。
- 关 键 词:
- OpenVPN 虚拟 安装 部署
![提示](https://static.bdocx.com/images/bang_tan.gif)