2020年新型冠状病毒肺炎，促使很多单位紧急采取临时居家远程办公，以保护人身安全。本文是我公司实际使用的方式，特分享出来，以解决大家的燃眉之急。
一、 自建VPN二大难题解决
- 而很多单位没有支持SSL安全加密的VPN设备，如果能够快速的搭建起安装的VPN系统呢？
解决方法：我们采用CentOS Linux 系统，安装开源免费的OpenVPN 软件，来搭建自己可控的、安全的VPN 系统。
2.单位宽带是动态拔号上网，无固定公网IP ，在家的员工如何让VPN 客户端，能够拔上单位里的VPN 服务器呢？
解决方法：使用国内优秀的花生壳免费动态域名解析，实现花生壳免费域名和单位宽带公网IP绑定。
自建VPN 系统的2大问题将迎刃而解。
二、 自建VPN核心内容
下面我将分为 4 大部份，分别介绍如何来部署一套安全的VPN系统：
1. VPN系统网络结构
2. 花生壳动态域名解析部署
3. 单位OpenVPN服务端部署
4.远程用户VPN客户端部署
三、VPN系统各个环境部署详解
(一）、 VPN系统网络结构图
为了便于大家更好的理解本文，我特意画了网络结构图，以便大家理解。 结构如下：
二、动态域名解析部署
1.先到花生壳官网，免费注册一个动态域名。参见网址 https://hsk.oray.com/
2.在公司的宽带路由器里，动态域名解析里，填写申请到的花生壳帐号，如我的免费域名是 nailxxx.oicp.net。如果你单位的路由器没有动态域名解析功能，可在单位内任意一台电脑，安装花生壳客户端，填写正确的用户名和密码，即可实现动态域名解析到单位的动态公网IP。如下图所示：
单位路由器 动态域名解析配置
3.端口转发配置。远程办公用户VPN客户端拔入的时候，需要在单位的路由器上，将用户的网络请求，转发给单位内的VPN服务器（本例单位VPN服务器IP 192.168.1.3）,不同厂家的路由器配置界面不一样，但原理均相同。我单位的路由器配置截图如下：
单位路由器端口转发到内网VPN服务器
三、OpenVPN 服务端部署
VPN 服务端我们以 CentOS 7.6 为系统平台，如下操作，均以 root 帐号执行。
服务器端配置核心工作内容如下：
1.Linux环境依赖包的安装
2.OpenVPN 服务端软件的安装
3.easy-rsa 证书部署
4.配置VPN服务
1.Linux环境依赖包的安装
# yum install openssl openssl-devel pam-devel lzo lzo-devel cmake
2.OpenVPN 服务端软件的安装
下载地址：http://openvpn.net/ ，该网站访问，需要翻墙，请读者根据自己的喜欢，选择一种。
（1） 解压安装包
[root@CentOS7U6 ~]# tar -zxvf openvpn-2.4.8.tar.gz
[root@CentOS7U6 ~]# cd openvpn-2.4.8/
(2) 执行编译并安装
[root@CentOS7U6 openvpn-2.4.8]# ./configure --prefix=/usr/openvpn
[root@CentOS7U6 openvpn-2.4.8]# make
[root@CentOS7U6 openvpn-2.4.8]# make install
(3) 创建工作目录
[root@CentOS7U6 openvpn-2.4.8]# cd /usr/openvpn/
[root@CentOS7U6 openvpn]# ls
include lib sbin share
[root@CentOS7U6 openvpn]# mkdir etc
[root@CentOS7U6 openvpn]# mkdir log
[root@CentOS7U6 openvpn]# ls
etc include lib log sbin share
3.easy-rsa 证书部署
下载地址：https://github.com/OpenVPN/easy-rsa
(1) 解压 easy-rsa
[root@CentOS7U6 ~]# unzip easy-rsa-3.0.6.zip
[root@CentOS7U6 ~]# cd easy-rsa-3.0.6/
(2) 复制easy-rsa到 OpenVPN安装目录
[root@CentOS7U6 easy-rsa-3.0.6]# cp -r easyrsa3/ /usr/openvpn/
[root@CentOS7U6 /]# cd /usr/openvpn/
[root@CentOS7U6 openvpn]# ls
easyrsa3 etc include lib log sbin share
(3） 重命名easy-rsa 目录名为 ca
[root@CentOS7U6 openvpn]# mv easyrsa3/ ca
(4) 准备环境参数文件 vars
[root@CentOS7U6 /]# cd /usr/openvpn/ca/
[root@CentOS7U6 ca]# ls
easyrsa openssl-easyrsa.cnf vars.example x509-types
[root@CentOS7U6 ca]# cp vars.example vars
[root@CentOS7U6 ca]# ls
easyrsa openssl-easyrsa.cnf openssl.cnf vars vars.example x509-types
(5) 最终修改后的 vars
[root@CentOS7U6 ca]# cat vars |grep -v "#"|grep -v ^$
if [ -z "$EASYRSA_CALLER" ]; then
echo "You appear to be sourcing an Easy-RSA 'vars' file." >&2
echo "This is no longer necessary and is disallowed. See the section called" >&2
echo "'How to use this file' near the top comments for more details." >&2
return 1
fi
set_var EASYRSA "$PWD"
set_var EASYRSA_PKI"$EASYRSA/pki"
set_var EASYRSA_DN "cn_only"
set_var EASYRSA_REQ_COUNTRY "CN"
set_var EASYRSA_REQ_PROVINCE"China"
set_var EASYRSA_REQ_CITY "ChongQing"
set_var EASYRSA_REQ_ORG "VPN"
set_var EASYRSA_REQ_EMAIL"[email protected]"
set_var EASYRSA_REQ_OU"VPN CA"
set_var EASYRSA_KEY_SIZE 2048
set_var EASYRSA_ALGO rsa
set_var EASYRSA_CA_EXPIRE3650
set_var EASYRSA_CERT_EXPIRE3650
set_var EASYRSA_NS_COMMENT"VPN Generated Certificate"
set_var EASYRSA_SSL_CONF "$EASYRSA/openssl-easyrsa.cnf"
set_var EASYRSA_DIGEST"sha256"
(5) 生成证书CA
重要： CA 根证书的密码一定不能遗失，否则无法生成其它证书。
[root@CentOS7U6 ca]# ./easyrsa init-pki
Note: using Easy-RSA configuration from: ./vars
init-pki complete; you may now create a CA or requests.
Your newly created PKI dir is: /usr/openvpn/ca/pki
[root@CentOS7U6 ca]#
[root@CentOS7U6 ca]# ./easyrsa build-ca
Note: using Easy-RSA configuration from: ./vars
Using SSL: openssl OpenSSL 1.0.2k-fips 26 Jan 2017
Enter New CA Key Passphrase: 123456 #CA根证书密码
Re-Enter New CA Key Passphrase: 123456 #CA根证书密码
Generating RSA private key, 2048 bit long modulus
.....................+++
..............+++
e is 65537 (0x10001)
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
Common Name (eg: your user, host, or server name) [Easy-RSA CA]:
CA creation complete and you may now import and sign cert requests.
Your new CA certificate file for publishing is at:
/usr/openvpn/ca/pki/ca.crt
[root@CentOS7U6 ca]#
(6) 生成DH PEM文件
[root@CentOS7U6 ca]# ./easyrsa gen-dh
Note: using Easy-RSA configuration from: ./vars
Using SSL: openssl OpenSSL 1.0.2k-fips 26 Jan 2017
Generating DH parameters, 2048 bit long safe prime, generator 2
This is going to take a long time
................................................................+......................................................+.........................................................................................+.....................................................................................................+............+....+..................................+..................................+.+..................................................................................................................................................+
DH parameters of size 2048 created at /usr/openvpn/ca/pki/dh.pem
[root@CentOS7U6 ca]#
(7) 生成服务端证书
重要：
服务端证书，必须使用nopass参数生成证书，否则生成的证书，在启动VPN服务时，需要手动输入密码，VPN服务端才能够启动.
[root@CentOS7U6 ca]# ./easyrsa gen-req server nopass
Note: using Easy-RSA configuration from: ./vars
Using SSL: openssl OpenSSL 1.0.2k-fips 26 Jan 2017
Generating a 2048 bit RSA private key
............+++
......+++
writing new private key to '/usr/openvpn/ca/pki/private/server.key.HBXzQozLmF'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
Common Name (eg: your user, host, or server name) [server]:
Keypair and certificate request completed. Your files are:
req: /usr/openvpn/ca/pki/reqs/server.req
key: /usr/openvpn/ca/pki/private/server.key
[root@CentOS7U6 ca]#
[root@CentOS7U6 ca]# ./easyrsa sign-req server server
Note: using Easy-RSA configuration from: ./vars
Using SSL: openssl OpenSSL 1.0.2k-fips 26 Jan 2017
You are about to sign the following certificate.
Please check over the details shown below for accuracy. Note that this request
has not been cryptographically verified. Please be sure it came from a trusted
source or that you have verified the request checksum with the sender.
Request subject, to be signed as a server certificate for 3650 days:
subject=
commonName = server
Type the word 'yes' to continue, or any other input to abort.
Confirm request details: yes #这里输入 yes 继续
Using configuration from /usr/openvpn/ca/pki/safessl-easyrsa.cnf
Enter pass phrase for /usr/openvpn/ca/pki/private/ca.key: 123456 #CA证书的密码
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName :ASN.1 12:'server'
Certificate is to be certified until Oct 2 03:37:28 2028 GMT (3650 days)
Write out database with 1 new entries
Data Base Updated
Certificate created at: /usr/openvpn/ca/pki/issued/server.crt
[root@CentOS7U6 ca]#
(8) 客户端证书
重要
./easyrsa build-client-full client1 用户登录时需要输入用户证书的密码。
./easyrsa build-client-full client20 nopass 用户登录时，不需要输入证书的密码。
[root@CentOS7U6 ca]# ./easyrsa build-client-full client1
Note: using Easy-RSA configuration from: ./vars
Using SSL: openssl OpenSSL 1.0.2k-fips 26 Jan 2017
Generating a 2048 bit RSA private key
...+++
.........................................................+++
writing new private key to '/usr/openvpn/ca/pki/private/client1.key.6yOFBpL7h0'
Enter PEM pass phrase: 666666 #自定义客户端证书的密码
Verifying - Enter PEM pass phrase: 666666 #自定义客户端证书的密码
Using configuration from /usr/openvpn/ca/pki/safessl-easyrsa.cnf
Enter pass phrase for /usr/openvpn/ca/pki/private/ca.key: 123456 #CA证书的密码
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName :ASN.1 12:'client1'
Certificate is to be certified until Oct 2 03:45:27 2028 GMT (3650 days)
Write out database with 1 new entries
Data Base Updated
[root@CentOS7U6 ca]#
生成更多的远程用户VPN 证书，只需要按上面的步骤，继续执行即可
[root@CentOS7U6 ca]# ./easyrsa build-client-full client2
[root@CentOS7U6 ca]# ./easyrsa build-client-full client3
- 部署VPN服务
(1) 复制安装程序中自带的服务端配置文件
[root@CentOS7U6 /]# cd /usr/openvpn/etc/
[root@CentOS7U6 etc]# cp /opt/setup/openvpn-2.4.8/sample/sample-config-files/server.conf .
(2) 最终修改后的服务端配置文件
[root@CentOS7U6 etc]# cat server.conf | grep -v "^#" | grep -v ";" | grep -v ^$
port 1194 #工作端口
proto tcp #工作协议
dev tun
ca /usr/openvpn/ca/pki/ca.crt #指定证书位置
cert /usr/openvpn/ca/pki/issued/server.crt
dh /usr/openvpn/ca/pki/dh.pem
server 10.8.0.0 255.255.255.0 #VPN 网段
push "route 192.168.1.0 255.255.255.0" #单位局域网段信息
ifconfig-pool-persist ipp.txt
keepalive 10 120
cipher AES-256-CBC
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3
management localhost 7505
[root@CentOS7U6 etc]#
（3）CentOS 防火墙上允许 openvpn TCP 1194 端口通信
iptables -A INPUT -p tcp --dport 1194 -j ACCEPT
（4）启用路由功能
echo “1” > /proc/sys/net/ipv4/ip_forward
（5）启动VPN 服务
/usr/openvpn/sbin/openvpn --config /usr/openvpn/etc/server.conf &
（6）VPN 服务器启用SNAT 功能
iptables -t nat -A POSTROUTING -s 10.8.0.0/16 -o eth0 -j MASQUERADE
至此 VPN 服务端配置完成
四、远程用户OpenVPN客户端部署
(1) 下载安装程序
远程办公用户，下载Windows平台的OpenVPN安装程序，下载地址：http://openvpn.net/ ，该网站访问，需要翻墙，请读者根据自己的喜欢，选择一种。
OpenVPN 2.4.8 安装程序
(2) Windows 执行OpenVPN 程序安装
双击安装程序 “openvpn-install-2.4.8-I602-Win10.exe” 根据向导，直接 Next 直到安装完成
安装 OpenVPN
(3) 准备客户端配置文件 client.ovpn
将Windows 安装目录中 C:\\Program Files\\OpenVPN\\sample-config 复制到 C:\\Program Files\\OpenVPN\\config 目录，并修改该文件内容如下
client
dev tun
proto tcp
remote nail110.oicp.net 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt # 从CentOS CA 目录下复制该文件
cert client1.crt #每个用户的证书文件，从CentOS CA 目录下复制该文件件
key client1.key #每个用户的证书文件，从CentOS CA 目录下复制该文件
remote-cert-tls server
cipher AES-256-CBC
comp-lzo
verb 3
auth-nocache
(4) 远程办公用户拔 VPN 连接
启动 Windows 开始菜单==>OpenVPN==> OpenVPN GUI ，它会在任务栏右下角出现一个电脑图标，鼠票右键==》Connect 连接
执行VPN 连接
输入客户端证书密码
VPN 客户端拔号成功
远程用户，成功和公司的网络通信
至此远程用户 VPN 客户端配置完成。
閱讀更多 服務器運維 的文章
