OpenVPN

| | Comments (0)

OpenVPN 可以使用任何單一 Port 來建立 VPN Tunnel
Linux Kernel 需要有 TUN/TAP 支援
Network device support > Universal TUN/TAP device driver support

準備檔案
wget http://openvpn.net/release/openvpn-2.0.8.tar.gz

安裝
tar zxf openvpn-2.0.8.tar.gz
cd openvpn-2.0.8
./configure && make install
cd easy-rsa/2.0
編輯 vars 指定變數
. vars (載入 vars)
./build-ca (產生 CA cert, keys/ca.*)
./build-key-server server (產生 Server Key, keys/server.*)
./build-dh (產生 DH parameters, keys/dh1024.pem)
./build-key client1 (產生 Client1 Key, keys/client1.*)
openvpn --genkey --secret keys/ta.key (產生 tls-auth Key)
mkdir /usr/local/etc/openvpn
cp -a keys /usr/local/etc/openvpn

Server 端設定
編輯 /usr/local/etc/openvpn/server.conf

dev tun
port 443
proto tcp # use tcp, could pass by proxy server
server 192.168.2.0 255.255.255.0
push "redirect-gateway" ; 自動將 Client 的 default gateway 設成經由 VPN Server 出去
push "dhcp-option DNS 168.95.192.1"
push "dhcp-option DNS 168.95.192.2"
client-to-client
ifconfig-pool-persist ipp.txt ; 此檔 Server 會自動產生
keepalive 10 120
tls-server
ca /usr/local/etc/openvpn/keys/ca.crt
cert /usr/local/etc/openvpn/keys/server.crt
key /usr/local/etc/openvpn/keys/server.key
dh /usr/local/etc/openvpn/keys/dh1024.pem
comp-lzo
persist-tun
persist-key
status openvpn-status.log
verb 3

Client 端設定
Config 檔存成 client1.ovpn
client
dev tun
dev-node OpenVPN ; 此名稱需和 TAP-Win32 virtual ethernet adapter 連線名稱一致, 預設應是「區域連線n」, 按 F2 改名為 OpenVPN
proto tcp
remote 218.187.1.1 443 ; 218.187.1.1 為 Server IP
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client1.crt
key client1.key
comp-lzo
verb 3

Client 端可以使用 OpenVPN GUI for Windows
將 client1.* (Config, Key等) 放到 X:\Program File\OpenVPN\config
在 OpenVPN Tray Icon 按兩下就可以開始連線
ref.
OpenVPN - Richliu's wiki
MacBlog3:使用 OpenVPN
OpenVPN - DebianWiki
Gentoo Forums - OpenVPN 2.0 TAP mini-HOWTO

Leave a comment

March 2009

Sun Mon Tue Wed Thu Fri Sat
1 2 3 4 5 6 7
8 9 10 11 12 13 14
15 16 17 18 19 20 21
22 23 24 25 26 27 28
29 30 31        

About this Entry

This page contains a single entry by Pank published on September 20, 2006 2:13 AM.

MSN can not login. Error code: 81000314 or 80072745 was the previous entry in this blog.

PPPoE Server + FreeRADIUS + MySQL is the next entry in this blog.

Find recent content on the main index or look in the archives to find all content.