只需 OpenVPN 客戶端即可連接到 OpenVPN 服務器並獲得對內網本地資源的訪問權限。在本指南中，您將學習如何在 RockyLinux8 上安裝和配置 OpenVPN 客戶端。 請注意，OpenVPN 軟件可以配置為服務器或客戶端。
按照鏈接了解如何在 RockyLinux8 上安裝和配置 OpenVPN 服務器。
在 Rocky Linux 8 上設置 OpenVPN 服務器
在 RockyLinux8 上安裝和配置 OpenVPN 客戶端
在 RockyLinux8 上安裝 OpenVPN 客戶端
運行以下命令在 RockyLinux8 上安裝 OpenVPN 客戶端。
dnf epel-release -y
dnf info openvpn
Available Packages
Name : openvpn
Version : 2.4.11
Release : 1.el8
Architecture : x86_64
Size : 543 k
Source : openvpn-2.4.11-1.el8.src.rpm
Repository : epel
Summary : A full-featured SSL VPN solution
URL : https://community.openvpn.net/
License : GPLv2
Description : OpenVPN is a robust and highly flexible tunneling application that uses all
: of the encryption, authentication, and certification features of the
: OpenSSL library to securely tunnel IP networks over a single UDP or TCP
: port. It can use the Marcus Franz Xaver Johannes Oberhumers LZO library
: for compression
然後，您可以運行該命令來安裝 OpenVPN 客戶端。
dnf install openvpn
在 Rocky Linux 8 上配置 OpenVPN 客戶端
為了能夠連接到 OpenVPN 服務器，您需要創建一個包含 CA 證書、客戶端-服務器證書和密鑰的客戶端配置。
如果您按照指南在 Rocky Linux 8 上設置 OpenVPN 服務器，您已經了解瞭如何生成客戶端證書文件和密鑰。
生成密鑰後，將它們複製到客戶端並記下它們的存儲路徑。
您還需要將 HMAC 密鑰和 CA 證書複製到客戶端。
然後，您可以創建 OpenVPN 客戶端配置。
例如，為客戶端創建 OpenVPN 配置文件 gentoo證書和密鑰 gentoo.crt 什麼時候 gentoo.key;
vim gentoo.ovpn
client tls-client pull dev tun proto udp4 remote 192.168.60.19 1194 resolv-retry infinite nobind #user nobody #group nogroup persist-key persist-tun key-direction 1 remote-cert-tls server auth-nocache comp-lzo verb 3 auth SHA512 tls-auth ta.key 1 ca ca.crt cert gentoo.crt key gentoo.key
請注意，在此設置中，客戶端證書、密鑰、CA 證書和 HMAC 密鑰與 OpenVPN 客戶端配置本身位於同一路徑 gentoo.ovpn 中。
ls -1 .
ca.crt
gentoo.crt
gentoo.key
gentoo.ovpn
ta.key您可以將它們嵌入到配置文件中以避免證書和密鑰路徑問題。
client
tls-client
pull
dev tun
proto udp4
remote 192.168.60.19 1194
resolv-retry infinite
nobind
#user nobody
#group nogroup
persist-key
persist-tun
key-direction 1
remote-cert-tls server
auth-nocache
comp-lzo
verb 3
auth SHA512
<tls-auth>
-----BEGIN OpenVPN Static key V1-----
feb1af5407baa247d4e772c76aed6c75
...
-----END OpenVPN Static key V1-----
</tls-auth>
<ca>
-----BEGIN CERTIFICATE-----
MIIDTjCCAjagAwIBAgIUX0VQrHTgLDabUUIOAf7tD9cGp4YwDQYJKoZIhvcNAQEL
...
WA9BBk2shVWfR849Lmkep+GPyqHpU47dZAz37ARB2Gfu3w==
-----END CERTIFICATE-----
</ca>
<cert>
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
...
/7FvJaeLqmUHnvSs5eBlRZSgtOL19SCFkG0HXdnw3LtBaoHQXxgzOkDPW1+5
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC+DI7kg6MsRoCs
...
6WdLcNtWKAcU294xJEZoOA8/
-----END PRIVATE KEY-----
</key>
對需要連接到 VPN 的所有用戶的所有客戶端服務器執行相同操作。
如果您知道，我已對以下行進行了評論以避免錯誤。 錯誤：Linux 路由添加命令失敗：外部程序以錯誤狀態退出：2 在重新連接時再次添加之前更新創建的路由。
#user nobody #group nogroup
現在 OpenVPN 客戶端配置文件已準備就緒。
使用 RockyLinux8 連接到 OpenVPN 服務器
然後，您可以按需連接到 OpenVPN 服務器或配置服務器以在系統重新啟動時建立 VPN 配置文件。
使用 openvpn 命令在命令行上連接到 OpenVPN
按需連接 openvpn 命令是；
sudo openvpn client-config.ovpn
還
sudo openvpn --config client-config.ovpn
其中client-config是客戶端的openvpn配置文件，比如上面的gentoo.ovpn文件。
如果連接到 OpenVPN 服務器成功，您將看到以下內容： Initialization Sequence Completed..
Wed Jun 30 15:27:16 2021 OpenVPN 2.4.11 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Apr 21 2021 Wed Jun 30 15:27:16 2021 library versions: OpenSSL 1.1.1g FIPS 21 Apr 2020, LZO 2.08 Wed Jun 30 15:27:16 2021 Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication Wed Jun 30 15:27:16 2021 Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication Wed Jun 30 15:27:16 2021 TCP/UDP: Preserving recently used remote address: [AF_INET]192.168.60.19:1194 Wed Jun 30 15:27:16 2021 Socket Buffers: R=[212992->212992] S=[212992->212992] Wed Jun 30 15:27:16 2021 UDPv4 link local: (not bound) Wed Jun 30 15:27:16 2021 UDPv4 link remote: [AF_INET]192.168.60.19:1194 Wed Jun 30 15:27:16 2021 TLS: Initial packet from [AF_INET]192.168.60.19:1194, sid=7ec70642 fdcdad40 Wed Jun 30 15:27:16 2021 VERIFY OK: depth=1, CN=Kifarunix-demo CA Wed Jun 30 15:27:16 2021 VERIFY KU OK Wed Jun 30 15:27:16 2021 Validating certificate extended key usage Wed Jun 30 15:27:16 2021 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication Wed Jun 30 15:27:16 2021 VERIFY EKU OK Wed Jun 30 15:27:16 2021 VERIFY OK: depth=0, CN=server Wed Jun 30 15:27:16 2021 WARNING: 'link-mtu' is used inconsistently, local="link-mtu 1586", remote="link-mtu 1602" Wed Jun 30 15:27:16 2021 WARNING: 'cipher' is used inconsistently, local="cipher BF-CBC", remote="cipher AES-256-CBC" Wed Jun 30 15:27:16 2021 WARNING: 'keysize' is used inconsistently, local="keysize 128", remote="keysize 256" Wed Jun 30 15:27:16 2021 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA Wed Jun 30 15:27:16 2021 [server] Peer Connection Initiated with [AF_INET]192.168.60.19:1194 Wed Jun 30 15:27:17 2021 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1) Wed Jun 30 15:27:17 2021 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 208.67.222.222,dhcp-option DNS 192.168.10.3,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.2 255.255.255.0,peer-id 0,cipher AES-256-GCM' Wed Jun 30 15:27:17 2021 OPTIONS IMPORT: timers and/or timeouts modified Wed Jun 30 15:27:17 2021 OPTIONS IMPORT: --ifconfig/up options modified Wed Jun 30 15:27:17 2021 OPTIONS IMPORT: route options modified Wed Jun 30 15:27:17 2021 OPTIONS IMPORT: route-related options modified Wed Jun 30 15:27:17 2021 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified Wed Jun 30 15:27:17 2021 OPTIONS IMPORT: peer-id set Wed Jun 30 15:27:17 2021 OPTIONS IMPORT: adjusting link_mtu to 1625 Wed Jun 30 15:27:17 2021 OPTIONS IMPORT: data channel crypto options modified Wed Jun 30 15:27:17 2021 Data Channel: using negotiated cipher 'AES-256-GCM' Wed Jun 30 15:27:17 2021 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key Wed Jun 30 15:27:17 2021 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key Wed Jun 30 15:27:17 2021 ROUTE_GATEWAY 10.0.2.2/255.255.255.0 IFACE=enp0s3 HWADDR=08:00:27:98:30:73 Wed Jun 30 15:27:17 2021 TUN/TAP device tun0 opened Wed Jun 30 15:27:17 2021 TUN/TAP TX queue length set to 100 Wed Jun 30 15:27:17 2021 /sbin/ip link set dev tun0 up mtu 1500 Wed Jun 30 15:27:17 2021 /sbin/ip addr add dev tun0 10.8.0.2/24 broadcast 10.8.0.255 Wed Jun 30 15:27:17 2021 /sbin/ip route add 192.168.60.19/32 via 10.0.2.2 Wed Jun 30 15:27:17 2021 /sbin/ip route add 0.0.0.0/1 via 10.8.0.1 Wed Jun 30 15:27:17 2021 /sbin/ip route add 128.0.0.0/1 via 10.8.0.1 Wed Jun 30 15:27:17 2021 Initialization Sequence Completed
檢查 IP 地址。
ip add show tun0
9: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 100
link/none
inet 10.8.0.2/24 brd 10.8.0.255 scope global tun0
valid_lft forever preferred_lft forever
inet6 fe80::697:ce38:b852:540c/64 scope link stable-privacy
valid_lft forever preferred_lft forever測試與 VPN 服務器的連接。
ping 10.8.0.1 -c 3
PING 10.8.0.1 (10.8.0.1) 56(84) bytes of data.
64 bytes from 10.8.0.1: icmp_seq=1 ttl=64 time=2.71 ms
64 bytes from 10.8.0.1: icmp_seq=2 ttl=64 time=2.42 ms
64 bytes from 10.8.0.1: icmp_seq=3 ttl=64 time=1.95 ms
--- 10.8.0.1 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 46ms
rtt min/avg/max/mdev = 1.952/2.362/2.713/0.316 ms根據您服務器的路由設置，您還應該能夠訪問 Internet。
將 OpenVPN 客戶端作為服務運行
您可以啟用 OpenVPN 客戶端 systemd 服務以在服務器重新啟動時自動建立連接。
在此之前，請更改 VPN 配置文件的擴展名。 .ovpn 到達 .conf..相應地替換文件名。
cp gentoo.{ovpn,conf}複製 .conf 文件到 OpenVPN 客戶端設置目錄， /etc/openvpn/client..
mv gentoo.conf /etc/openvpn/client然後禁用 SELinux（但不建議這樣做，-:)）；
setenforce 0 && sed -i 's/=enforcing/=permissive/' /etc/selinux/config
啟動 OpenVPN 客戶端 systemd 服務。改名 gentoo 使用 .conf 配置文件的名稱。
systemctl start [email protected]
檢查狀態。
systemctl status [email protected]
● [email protected] - OpenVPN tunnel for gentoo
Loaded: loaded (/usr/lib/systemd/system/[email protected]; disabled; vendor preset: disabled)
Active: active (running) since Wed 2021-06-30 15:48:47 EDT; 12s ago
Docs: man:openvpn(8)
https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage
https://community.openvpn.net/openvpn/wiki/HOWTO
Main PID: 39782 (openvpn)
Status: "Initialization Sequence Completed"
Tasks: 1 (limit: 11272)
Memory: 1.6M
CGroup: /system.slice/system-openvpnx2dclient.slice/[email protected]
└─39782 /usr/sbin/openvpn --suppress-timestamps --nobind --config gentoo.conf
Jun 30 15:48:48 localhost.localdomain openvpn[39782]: Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Jun 30 15:48:48 localhost.localdomain openvpn[39782]: ROUTE_GATEWAY 10.0.2.2/255.255.255.0 IFACE=enp0s3 HWADDR=08:00:27:98:30:73
Jun 30 15:48:48 localhost.localdomain openvpn[39782]: TUN/TAP device tun0 opened
Jun 30 15:48:48 localhost.localdomain openvpn[39782]: TUN/TAP TX queue length set to 100
Jun 30 15:48:48 localhost.localdomain openvpn[39782]: /sbin/ip link set dev tun0 up mtu 1500
Jun 30 15:48:48 localhost.localdomain openvpn[39782]: /sbin/ip addr add dev tun0 10.8.0.2/24 broadcast 10.8.0.255
Jun 30 15:48:48 localhost.localdomain openvpn[39782]: /sbin/ip route add 192.168.60.19/32 via 10.0.2.2
Jun 30 15:48:48 localhost.localdomain openvpn[39782]: /sbin/ip route add 0.0.0.0/1 via 10.8.0.1
Jun 30 15:48:48 localhost.localdomain openvpn[39782]: /sbin/ip route add 128.0.0.0/1 via 10.8.0.1
Jun 30 15:48:48 localhost.localdomain openvpn[39782]: Initialization Sequence Completed
允許它在系統啟動時運行。
systemctl enable [email protected]
OpenVPN 客戶端 RockyLinux8 現在已成功安裝和設置。
關於如何在 RockyLinux8 上安裝和配置 OpenVPN 客戶端的教程到此結束。
為 OpenVPN 客戶端分配靜態 IP 地址
配置基於 OpenVPN LDAP 的身份驗證
