openvpn

ماذا يفعل

طريقة الكتابة

openvpn --config FILE
systemctl start openvpn-server@NAME | openvpn-client@NAME

الأجزاء الرئيسية

Server config keys

port / proto / dev

1194, udp|tcp, tun.

ca / cert / key / dh

PKI files.

tls-crypt FILE

Encrypt and protect the control channel.

server 10.8.0.0 255.255.255.0

VPN address pool.

push "route …"

Routes for clients.

data-ciphers AES-256-GCM:CHACHA20-POLY1305

Allowed ciphers.

user nobody / group nobody

Drop root after start.

crl-verify FILE

Revoked clients list.

الأكثر استخدامًا

لا يوجد شيء يطابق هذا الفلتر.

$ مستخدم عادي# بصلاحية root (أو مع sudo)

1. 1Install (EPEL) and make a PKI with easy-rsa

   #dnf install -y epel-release && dnf install -y openvpn easy-rsa
   #cp -r /usr/share/easy-rsa/3 /etc/openvpn/easy-rsa && cd /etc/openvpn/easy-rsa
   #./easyrsa init-pki
   #./easyrsa build-ca
   #./easyrsa build-server-full vpn1 nopass
   #./easyrsa build-client-full laptop-hosam

2. 2Make the tls-crypt key

   #openvpn --genkey tls-crypt /etc/openvpn/server/tc.key

3. 3A small server config

   #cat /etc/openvpn/server/vpn.conf
   port 1194
   proto udp
   dev tun
   ca ca.crt
   cert vpn1.crt
   key vpn1.key
   dh none
   tls-crypt tc.key
   server 10.8.0.0 255.255.255.0
   push "route 192.168.122.0 255.255.255.0"
   data-ciphers AES-256-GCM:CHACHA20-POLY1305
   user nobody
   group nobody
   persist-key
   persist-tun
   crl-verify crl.pem

4. 4Open the firewall and start

   #firewall-cmd --permanent --add-service=openvpn --add-masquerade && firewall-cmd --reload
   #systemctl enable --now openvpn-server@vpn

5. 5Check connected clients

   #cat /run/openvpn-server/status-vpn.log
   #journalctl -u openvpn-server@vpn -n 30

6. 6Client file (inline certs)

   $head -8 laptop-hosam.ovpn
   client
   dev tun
   proto udp
   remote vpn.example.com 1194
   remote-cert-tls server
   <ca>
   -----BEGIN CERTIFICATE-----

7. 7Connect from Linux

   #openvpn --config laptop-hosam.ovpn
   #nmcli connection import type openvpn file laptop-hosam.ovpn

8. 8Remove a lost laptop (revoke)

   #cd /etc/openvpn/easy-rsa && ./easyrsa revoke laptop-hosam && ./easyrsa gen-crl
   #cp pki/crl.pem /etc/openvpn/server/crl.pem
   #systemctl restart openvpn-server@vpn

9. 9Check certificate expiry

   #openssl x509 -in /etc/openvpn/server/vpn1.crt -noout -enddate

10. 10Make a new client for a colleague

    #cd /etc/openvpn/easy-rsa && ./easyrsa build-client-full laptop-sara
    #ls pki/issued/laptop-sara.crt pki/private/laptop-sara.key

لا يوجد شيء يطابق هذا الفلتر.

الملفات

/etc/openvpn/server/

Server configs and keys.

/etc/openvpn/easy-rsa/pki/

The PKI (CA key!).

رموز الخروج