Linux OpenVPN Server 架設

下載安裝腳本

wget https://git.io/vpn -O openvpn-install.sh

openvpn-install.sh

bash ./openvpn-install.sh

依照選項建立vpn server

建立好後client端檔案的位置 (/root/pve.ovpn)

Finished!

The client configuration is available in: /root/pve.ovpn
New clients can be added by running this script again.

Tap橋接模式設定

apt-get install -y bridge-utils

將本身網卡註解，並加入bridge(br0)，編輯/etc/network/interfaces

auto lo
iface lo inet loopback
#auto eth0
#iface eth0 inet dhcp
auto br0
iface br0 inet static
address 192.168.x.x
netmask 255.255.255.0
gateway 192.168.x.x
network 192.168.x.0
broadcast 192.168.x.255
bridge_ports eth0
#auto eth0
#iface eth0 inet static
#        address 192.168.x.x/24
#        gateway 192.168.x.x

service networking restart

伺服器設定檔修改

編輯/etc/openvpn/server/server.conf

local 192.168.x.x
port 1195
proto tcp
dev tap0
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-crypt tc.key
server-bridge
push "route 192.168.x.0 255.255.255.0"
route-gateway 192.168.x.x
keepalive 10 120
user nobody
group nogroup
cipher AES-256-CBC
persist-key
persist-tun
verb 3
explicit-exit-notify 1
script-security 2
up "openvpn_up br0"
down "openvpn_down br0"
cipher AES-256-CBC
comp-lzo
status /var/log/openvpn/status.log
duplicate-cn  <<<允許多個連線，共享證書和金鑰

service openvpn-server@server restart

編輯/etc/openvpn/server/openvpn_up

#!/bin/sh
BR=$1
DEV=$2
MTU=$3
/sbin/ifconfig $DEV mtu $MTU promisc up
/sbin/brctl addif $BR $DEV
/sbin/ifconfig tap0 up

編輯/etc/openvpn/server/openvpn_down

#!/bin/sh
BR=$1
DEV=$2
/sbin/brctl delif $BR $DEV
/sbin/ifconfig $DEV down

客戶端設定檔修改

加入comp-lzo壓縮參數

Tun橋接模式設定

local 10.0.0.5
push "route 10.0.0.0 255.255.255.0" (推送路由)
push "route 10.8.0.0 255.255.255.0" (推送路由)
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-crypt tc.key
server 10.8.0.0 255.255.255.0 (配發網段)
keepalive 10 120
user nobody
group nogroup
persist-key
persist-tun
verb 3
crl-verify crl.pem
explicit-exit-notify
comp-lzo (壓縮參數)
log-append /var/log/openvpn/op_server.log (寫入log)
status /var/log/openvpn/status.log (寫入狀態)
duplicate-cn  <<<允許多個連線，共享證書和金鑰

service openvpn-server@server restart

告警訊息修正參數

DEPRECATED OPTION: --cipher set to 'AES-256-CBC' but missing in --data-ciphers (AES-256-GCM:AES-128-GCM). Future OpenVPN version will ignore --cipher for cipher negotiations. Add 'AES-256-CBC' to --data-ciphers or change --cipher 'AES-256-CBC' to --data-ciphers-fallback 'AES-256-CBC' to silence this warning.
WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1602', remote='link-mtu 1586'
WARNING: 'keysize' is used inconsistently, local='keysize 256', remote='keysize 128'
WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this

Server設定檔新增

cipher AES-256-CBC

Client設定檔修改

cipher AES-256-CBC
修改
data-ciphers-fallback AES-256-CBC

auth-nocache