Windows下的OpenVPN服务器配置 - openvpn, windows, 证书, 服务器, ssl, vpn, cmwap, cdma, linux, freebsd

Windows下的OpenVPN服务器配置 (1716人路过)

16:04 , 引用(0) Via 本站原创

基础篇

前言

　　为了突破CMWAP的种种限制，广大网友想出了各种办法，通过移动代理连接SSL VPN服务器上网是比较方便的一种，但是由于softether系列的稳定性、兼容性较差，我们不得不重新寻找更适合的软件。OpenVPN就是一款功能强大，可跨平台(支持Win 2000/XP/2003, Linux, Mac OS X, Solaris, FreeBSD, NetBSD, 和 OpenBSD)使用的SSL VPN服务器软件（具体说明见官方主页官方主页，我就不翻译了）。经过这一段时间的测试(http://www.thinkpad.cn/forum/viewthread.php?tid=332066)，虽然还存在不少问题，但是总体说来OpenVPN的表现不错。
本文是为CMWAP和CDMA上网的用户写的，所以有些配置不适合客户端使用宽带的人。

--------------------------------------------------------------------------------

感谢 myliyifei 的支持和配合(其实我是被他拖下水的)，感谢 wyun 审稿，感谢参加测试的各位兄弟。

--------------------------------------------------------------------------------
Server端环境
OS:WINDOWS XP SP2
ADSL拨号上网

Step 1 OpenVPN安装配置
1.1 下载openvpn 并安装

下载openvpn-2.0.5-gui-1.0.3版，地址 http://openvpn.se/files/install_packages/openvpn-2.0.5-gui-1.0.3-install.exe，安装。(例如：安装到F:\OPENVPN目录下，下文举例都用此目录)
安装完成后生成一个新网卡，并在网络连接里出现本地连接[X]，把tcp/ip属性改成手动配置,192.168.10.1(根据实际情况更改) ,255.255.255.0，其余不填。

1.2 生成证书

修改F:\OpenVPN\easy-rsa\vars.bat.sample的以下部分

[Copy to clipboard] [ - ]
CODE:
set HOME=%ProgramFiles%\OpenVPN\easy-rsa
set KEY_COUNTRY=US
set KEY_PROVINCE=CA
set KEY_CITY=SanFrancisco
set KEY_ORG=FortFunston
set KEY_EMAIL=mail@host.domain

（请根据自身情况修改）改为

[Copy to clipboard] [ - ]
CODE:
set HOME=F:\OpenVPN\easy-rsa
set KEY_COUNTRY=CN
set KEY_PROVINCE=Hubei
set KEY_CITY=Wuhan
set KEY_ORG=51NB
set KEY_EMAIL=MATONG_01@163.COM
生成证书
- OpenVPN 有两种安全模式，一种基于使用 RSA 证书和密钥的 SSL/TLS，一种使用预先分享的静态密钥。本文采用SSL/TLS 模式。TLS模式的优点是安全，而且便于管理用户。默认情况下证书和用户是一对一的，多个用户使用同一证书会被踢出。
- 开始-->运行...-->键入cmd，回车，进入命令提示符-->进入F:\OpenVPN\easy-rsa目录
  
  QUOTE:
  F:\OpenVPN\easy-rsa>
- 执行如下命令
  
  [Copy to clipboard] [ - ]
  CODE:
  init-config
  
  QUOTE:
  F:\OpenVPN\easy-rsa>init-config
  
  F:\OpenVPN\easy-rsa>copy vars.bat.sample vars.bat
  已复制 1 个文件。
  
  F:\OpenVPN\easy-rsa>copy openssl.cnf.sample openssl.cnf
  已复制 1 个文件。
  
  [Copy to clipboard] [ - ]
  CODE:
  vars
  
  [Copy to clipboard] [ - ]
  CODE:
  clean-all
  
  QUOTE:
  F:\OpenVPN\easy-rsa>vars
  
  F:\OpenVPN\easy-rsa>clean-all
  系统找不到指定的文件。
  已复制 1 个文件。
  已复制 1 个文件。
  
  [Copy to clipboard] [ - ]
  CODE:
  vars
  build-ca
  build-dh
  
  QUOTE:
  F:\OpenVPN\easy-rsa>vars
  
  F:\OpenVPN\easy-rsa>build-ca #生成根证书
  Loading 'screen' into random state - done
  Generating a 1024 bit RSA private key
  .........++++++
  .......................................++++++
  writing new private key to 'keys\ca.key'
  -----
  You are about to be asked to enter information that will be incorporated
  into your certificate request.
  What you are about to enter is what is called a Distinguished Name or a DN.
  There are quite a few fields but you can leave some blank
  For some fields there will be a default value,
  If you enter '.', the field will be left blank.
  -----
  Country Name (2 letter code) [CN]:
  State or Province Name (full name) [Hubei]:
  Locality Name (eg, city) [Wuhan]:
  Organization Name (eg, company) [51NB]:
  Organizational Unit Name (eg, section) []:CMWAP
  Common Name (eg, your name or your server's hostname) []:fangzy #填自己的名字
  Email Address [mail@host.domain]:
  
  F:\OpenVPN\easy-rsa>build-dh #这个有点慢，估计要半分钟
  Loading 'screen' into random state - done
  Generating DH parameters, 1024 bit long safe prime, generator 2
  This is going to take a long time
  ....................+...........................................................
  ...............+......................+........+................................
  .....................................+..........................................
  ..........................+..+.....................+......+.....................
  .......+.+...............................................+......................
  ...........................................................+.........+..........
  ..........+.................................+.........................+.........
  ...................................................+..............+.............
  ............+...........................+...........................+....+......
  ................................................................................
  .....................+..............................+...........................
  ................................................................................
  ..........+.....................++*++*++*
  
  [Copy to clipboard] [ - ]
  CODE:
  build-key-server server
  
  QUOTE:
  F:\OpenVPN\easy-rsa>build-key-server server #生成服务器端的密钥，server为服务器名
  Loading 'screen' into random state - done
  Generating a 1024 bit RSA private key
  .........++++++
  ....................................++++++
  writing new private key to 'keys\server.key'
  -----
  You are about to be asked to enter information that will be incorporated
  into your certificate request.
  What you are about to enter is what is called a Distinguished Name or a DN.
  There are quite a few fields but you can leave some blank
  For some fields there will be a default value,
  If you enter '.', the field will be left blank.
  -----
  Country Name (2 letter code) [CN]:
  State or Province Name (full name) [Hubei]:
  Locality Name (eg, city) [Wuhan]:
  Organization Name (eg, company) [51NB]:
  Organizational Unit Name (eg, section) []:CMWAP
  Common Name (eg, your name or your server's hostname) []:server #填自己的名字
  Email Address [mail@host.domain]:
  
  Please enter the following 'extra' attributes
  to be sent with your certificate request
  A challenge password []:xxxx #输入4位以上的密码
  An optional company name []:
  Using configuration from openssl.cnf
  Loading 'screen' into random state - done
  Check that the request matches the signature
  Signature ok
  The Subject's Distinguished Name is as follows
  countryName :PRINTABLE:'CN'
  stateOrProvinceName :PRINTABLE:'Hubei'
  localityName :PRINTABLE:'Wuhan'
  organizationName :PRINTABLE:'51NB'
  organizationalUnitName:PRINTABLE:'CMWAP'
  commonName :PRINTABLE:'server'
  emailAddress :IA5STRING:'mail@host.domain'
  Certificate is to be certified until Feb 1 05:30:29 2016 GMT (3650 days)
  Sign the certificate? [y/n]:y
  
  1 out of 1 certificate requests certified, commit? [y/n]y
  Write out database with 1 new entries
  Data Base Updated
  
  [Copy to clipboard] [ - ]
  CODE:
  build-key client
  
  QUOTE:
  F:\OpenVPN\easy-rsa>build-key client #生成客户端的密钥，client为用户名
  Loading 'screen' into random state - done
  Generating a 1024 bit RSA private key
  .............++++++
  ....++++++
  writing new private key to 'keys\client.key'
  -----
  You are about to be asked to enter information that will be incorporated
  into your certificate request.
  What you are about to enter is what is called a Distinguished Name or a DN.
  There are quite a few fields but you can leave some blank
  For some fields there will be a default value,
  If you enter '.', the field will be left blank.
  -----
  Country Name (2 letter code) [CN]:
  State or Province Name (full name) [Hubei]:
  Locality Name (eg, city) [Wuhan]:
  Organization Name (eg, company) [51NB]:
  Organizational Unit Name (eg, section) []:CMWAP
  Common Name (eg, your name or your server's hostname) []:client
  Email Address [mail@host.domain]:
  
  Please enter the following 'extra' attributes
  to be sent with your certificate request
  A challenge password []:xxxx
  An optional company name []:
  Using configuration from openssl.cnf
  Loading 'screen' into random state - done
  DEBUG[load_index]: unique_subject = "yes"
  Check that the request matches the signature
  Signature ok
  The Subject's Distinguished Name is as follows
  countryName :PRINTABLE:'CN'
  stateOrProvinceName :PRINTABLE:'Hubei'
  localityName :PRINTABLE:'Wuhan'
  organizationName :PRINTABLE:'51NB'
  organizationalUnitName:PRINTABLE:'CMWAP'
  commonName :PRINTABLE:'client'
  emailAddress :IA5STRING:'mail@host.domain'
  Certificate is to be certified until Feb 1 05:31:40 2016 GMT (3650 days)
  Sign the certificate? [y/n]:y
  
  1 out of 1 certificate requests certified, commit? [y/n]y
  Write out database with 1 new entries
  Data Base Updated
- 生成多个客户端密钥，执行build-key client1 …… build-key xyz。
复制证书文件
刚才生成的证书文件在F:\OpenVPN\easy-rsa\keys下，服务器端需要的文件为ca.crt,dh1024.pem,server.crt,server.key ，客户端需要的文件为：ca.crt client.crt client.key(xxx.crt xxx.key)，配置.ovpn文件时需要用到。

1.3 配置server.ovpn文件

在\OpenVPN\config目录下创建server.ovpn文件将ca.crt,dh1024.pem,server.crt,server.key复制到F:\OpenVPN\KEY目录下
服务器端文件示例：
server.ovpn

[Copy to clipboard] [ - ]
CODE:
port 443
proto tcp-server
dev tun
server 192.168.10.0 255.255.255.0
keepalive 20 180
ca F:\\OPENVPN\\KEY\\ca.crt
cert F:\\OPENVPN\\KEY\\server.crt
key F:\\OPENVPN\\KEY\\server.key
dh F:\\OPENVPN\\KEY\\dh1024.pem
push "redirect-gateway def1"
push "dhcp-option DNS 192.168.10.1"
mode server
tls-server
status F:\\OpenVPN\\log\\openvpn-status.log
comp-lzo
verb 4

1.4 客户端安装与配置

安装OpenVPN，同1.1，但是不用更改本地连接设置。
配置OpenVPN
- 在\OpenVPN\config目录下创建client.ovpn文件，将ca.crt client.crt
  
  client.key 复制到\OpenVPN\KEY目录下，这3个文件由服务器端生成并发放。
- 客户端文件示例：
  client.ovpn
  
  [Copy to clipboard] [ - ]
  CODE:
  client
  dev tun
  proto tcp-client
  remote fangzy.3322.org 443
  resolv-retry infinite
  nobind
  http-proxy 10.0.0.172 80 #这里填入你的代理服务器地址和端口
  mute-replay-warnings
  ca F:\\OPENVPN\\KEY\\ca.crt
  cert F:\\OPENVPN\\KEY\\client.crt #这里改成每个客户端相应的证书
  key F:\\OPENVPN\\KEY\\client.key #这里改成每个客户端相应的证书
  comp-lzo
  verb 4
  status openvpn-status.log

右击openvpn-gui图标，点connect，即可连接。

至此 OpenVPN的配置结束，更详细资料请参阅http://openvpn.net/howto.html
--------------------------------------------------------------------------------
注：本文参考了《用OpenVPN构建安全VPN [OpenVPN + CA] 》 BY ELM

--------------------------------------------------------------------------------
我们已经配置好了OpenVPN，但是要使客户端上网的话，服务器端还要再安装代理服务器软件(linux下可配置iptable防火墙实现NAT)，WINDOWS下面的代理服务器软件很多，有企业级的ISA，有Kerio WinRoute Firewall，WinGate，Sygate，还有国产的ccproxy。此次测试采用的是WinGate 5.2.3。

Setp2 WinGate安装与配置
2.1 WinGate的安装

禁用Windows Firewall/Internet Connection Sharing (ICS)服务
执行安装文件，保证ENS服务被安装，重新启动电脑

2.2 WinGate的配置

先停止WinGate服务
启动OpenVPN服务，确保本地连接的状态为"已连接上"
启动WinGate服务，选择Start Engine
注：WinGate 5是在启动服务时将服务与网卡ip绑定上，换用WinGate 6就不会这么麻烦了
禁用DHCP Service，或者将192.168.10.1(VPN IP)取消绑定
禁用不必要的服务，确保Extended Network 打开
在WinGate 5的防火墙中打开443端口，或者直接将防火墙禁用。

现在大功告成，客户端可以像平时用宽带一样浏览网页，不需要设置代理服务器。

--------------------------------------------------------------------------------

　　第一次写教程，有表述不清的地方还请见谅。欢迎大家讨论OpenVPN服务器端配置方面的问题，如果有更好用的SSL VPN服务器软件也介绍一下。客户端出现问题请在这里讨论 http://www.thinkpad.cn/forum/viewthread.php?tid=332066 。

我还会陆续发布这次测试的使用心得，最后说一句：
希望有人能长期免费提供OpenVPN服务器。

by fangzy
email:matong_01[AT]163.com