{"id":202,"date":"2010-03-26T17:20:12","date_gmt":"2010-03-26T09:20:12","guid":{"rendered":"http:\/\/blog.nuface.tw\/?p=202"},"modified":"2010-04-13T08:12:44","modified_gmt":"2010-04-13T00:12:44","slug":"openvpn-%e5%bb%ba%e7%bd%ae%e7%ad%86%e8%a8%98%e7%ac%ac1%e9%9b%86","status":"publish","type":"post","link":"https:\/\/blog.nuface.tw\/?p=202","title":{"rendered":"OpenVPN \u5efa\u7f6e\u7b46\u8a18(\u7b2c1\u96c6)"},"content":{"rendered":"

\u8edf\u9ad4\u7c21\u4ecb<\/em><\/strong><\/p>\n

\u8edf\u9ad4\u958b\u767c\u8005\u70ba James Yonan \uff0c\u4ee5 GPL \u65b9\u5f0f\u767c\u4f48\u3002\u662f\u4e00\u5957\u5f88\u6709\u540d\u7684\u958b\u6e90\u8edf\u9ad4\u3002\u8edf\u9ad4\u529f\u80fd\u53ef\u4ee5\u5728\uff0cRouted \u6216 Bridged \u7684\u74b0\u5883\u53ca\u9060\u7aef\u5b58\u53d6\u8a2d\u5099\u4e0a\uff0c\u5efa\u7acb P to P \u6216\u8457 Site to Site \u7684\uff0c\u52a0\u5bc6\u5b89\u5168\u9023\u7dda\u3002\u8edf\u9ad4\u4f7f\u7528 SSL\/TLS \u65b9\u5f0f\u9032\u884c\u52a0\u5bc6\uff0c\u53ef\u7a7f\u8d8a NAT \u53ca\u6709Firewalls \u7684\u74b0\u5883\u3002
\n
\n\"OpenVPN
\nLogo Ref Open VPN Project <\/a><\/p>\n

OpenVPN \u5141\u8a31\u5728 P-to-P \u9032\u884c\u8eab\u4efd\u8a8d\u8b49\u6642\uff0c\u4f7f\u7528\u9810\u8a2d\u7684\u5171\u4eab\u5bc6\u9470\uff0c\u8b49\u66f8\u6216\u4f7f\u7528\u8005\u5e33\u865f\/\u5bc6\u78bc\u3002<\/p>\n

\u7576\u4f7f\u7528VPN Server \u7ba1\u7406\u591a\u500b\u767b\u5165\u4f7f\u7528\u8005\u6642\uff0cOpenVPN \u5141\u8a31 Server \u5c0d\u6bcf\u4e00\u500b\u4e0d\u540c\u7684\u4f7f\u7528\u8005\uff0c\u7c3d\u767c\u6191\u8b49\u4ee5\u9032\u884c\u8a8d\u8b49\u4f5c\u696d\u3002<\/p>\n

OpenVPN \u4f7f\u7528OpenSSL \u52a0\u5bc6\u5eab\u53ca SSLv3\/TLSv1 \u901a\u8a0a\u9032\u884c\u52a0\u5bc6\uff0c\u540c\u6642\u5305\u542b\u4e86\u8a31\u591a\u5b89\u5168\u6027\u53ca\u63a7\u5236\u529f\u80fd\u3002<\/p>\n

\u76ee\u524d\u8edf\u9ad4\u53ef\u5728Solaris, Linux, OpenBSD, FreeBSD, NetBSD, QNX, Mac OS X, Windows 2000\/XP\/Vista \u4e0a\u57f7\u884c\u3002<\/p>\n

\u5728 Windows Mobile, Android, iPhone\u7b49\u884c\u52d5\u88dd\u7f6e\uff0c\u96d6\u7136\u6709\u652f\u63f4\u591a\u7a2eVPN\u4f5c\u696d,\u4f46\u4e26\u4e0d\u5305\u542bOpenVPN\u3002<\/p>\n

\u8edf\u9ad4\u5fc5\u9808\u9032\u884c\u5b89\u88dd\u7a0b\u5e8f\u53ca\u900f\u904e\u624b\u52d5\u8a2d\u5b9a\u7d44\u614b\u6a94\u6848\uff0c\u7121\u6cd5\u4f7f\u7528\u4e00\u822c\u7684\u5716\u5f62\u5b89\u88dd\u65b9\u5f0f\uff0c\u7576\u4f3a\u670d\u5668\u53ca\u4f7f\u7528\u8005\u7aef\u5728\u9023\u63a5\u6642\uff0c\u6703\u4f9d\u6240\u4f7f\u7528\u7684\u8a8d\u8b49\u65b9\u5f0f\uff0c\u9078\u64c7\u6027\u7684\u4f7f\u7528\u4e0d\u540c\u7684\u7d44\u614b\u6a94\uff0c\u53ca\u4f7f\u75281\u500b\u6216\u591a\u500b\u7684\u5bc6\u9470\u505a\u8a8d\u8b49\u3002<\/p>\n

\u6709\u4e9b\u96fb\u8166\u73a9\u5bb6,\u6703\u7531\u7db2\u969b\u7db2\u8def\uff0c\u5229\u7528OpenVPN\uff0c\u9023\u5165\u5340\u57df\u7db2\u8def\uff0c\u4ee5\u4f7f\u7528\u5728\u5340\u57df\u7db2\u8def\u5167\u624d\u53ef\u9032\u884c\u7684\u5340\u7db2\u904a\u6232\u3002<\/p>\n

\"openvpn<\/p>\n

\u4ee5\u4e0a\u662fOpenVPN \u7684\u7c21\u55ae\u4ecb\u7d39\uff0c\u63a5\u8457\u8981\u4f86\u9032\u884c\u5efa\u7f6e\u4f5c\u696d\u3002<\/p>\n

OpenVPN Server<\/em><\/strong><\/p>\n

\u4e00\u6a23\u662f\u505a\u5728Xen \u865b\u6a5f\u4e0a\uff0cOS \u4f7f\u7528 CentOS 5.4\u3000\uff0c\u9023\u63a53\u500b\u7db2\u6bb5 192.168.2.0\/24 \u53ca 10.8.0.0\/24 \uff0c10.8.10.0\/24\uff0c\u5e0c\u671b\u5b8c\u6210\u4e0b\u9762\u7684\u6e2c\u8a66\u89d2\u672c\u3002<\/p>\n

\"OpenVPN\u6e2c\u8a66\u89d2\u672c\"<\/p>\n

\u5e95\u5c64\u4e3b\u6a5f\u4f7f\u7528FC8\uff0c\u5728\u4e0a\u9762\u5efa\u7acb\u5169\u53f0\u865b\u6a5f\u505a\u6e2c\u8a66\u3002\u7b2c1\u53f0\u70baVPN Server \uff0c\u7b2c2\u53f0\u70ba\u5c0f\u745e\u7684\u8890\u5bc6\u82b1\u5712\uff0c\u53ea\u6709\u9023\u4e0a\u7b2c1\u53f0\u7684VPN Server \uff0c\u5efa\u7acb\u4e86\u52a0\u5bc6\u901a\u9053\uff0c\u624d\u53ef\u4ee5\u9023\u81f3\u90a3\u53f0 Private Garden\u3002\u8981\u5efa\u7acbVPN \u9023\u7dda\uff0c\u9084\u6703\u901a\u904e\u4e00\u500bNAT \uff0c\u8aaa\u660e\u4e86\u672c\u7bc7\u7b2c1\u6bb5\u6240\u8aaa\u7684 “\u8edf\u9ad4\u4f7f\u7528 SSL\/TLS \u65b9\u5f0f\u9032\u884c\u52a0\u5bc6\uff0c\u53ef\u7a7f\u8d8a NAT \u53ca\u6709Firewalls \u7684\u74b0\u5883” \u3002<\/p>\n

\u5148\u7528Xen \u505a\u4e00\u500bCentOS 5.4<\/em><\/strong> <\/p>\n

\u5148\u5728\u5e95\u5c64Host OS \u4e0b\uff0c\u5efa\u7acb\u4e00\u500b\u65b0\u4f5c\u696d\u7cfb\u7d71\u8981\u7528\u7684Logical volume\uff0cvps05LV00 20G<\/p>\n


\n[root@rico ~]# lvcreate -n vps05LV00 -L 20G \/dev\/VolGroup00
\n Logical volume \"vps05LV00\" created
\n[root@rico ~]#
\n<\/code><\/p><\/blockquote>\n

\u63a5\u8457\uff0c\u4e4b\u524d\u5df2\u7d93\u6709\u505a\u904e\u4e86\u4e00\u500bCentOS 5.4 x86_64 \u7684\u4f5c\u696d\u7cfb\u7d71\uff0c\u76f4\u63a5\u8907\u88fd\u4e00\u4efd\u3002<\/p>\n


\n[root@rico ~]# dd if=\/dev\/VolGroup00\/centos5x64 of=\/dev\/VolGroup00\/vps05LV00
\n41943040+0 records in
\n41943040+0 records out
\n21474836480 bytes (21 GB) copied, 1788.66 s, 12.0 MB\/s
\n<\/code><\/p><\/blockquote>\n

\u5148\u628a\u5e95\u5c64\u90a3\u53f0\u7684VNC server \u555f\u52d5\u4e00\u4e0b\uff0c\u4ee5\u65b9\u4fbf\uff0c\u7b49\u7b49\u9023\u9032\u53bb\u67e5\u770b\uff0c\u865b\u6a5f\u555f\u52d5\u72c0\u6cc1\u3002<\/p>\n


\n[root@rico ~]#vncserver :10
\n<\/code><\/p><\/blockquote>\n

\u7de8\u5beb\u4e00\u4e0b\uff0c\u958b\u555f\u865b\u6a5f\u7684Script\u3002\u8a2d\u5b9a\u6a94\u540dopenvpn.xen \uff0c \u534a\u865b\u64ec\u5316\uff0c1\u9846CPU\uff0c512MB RAM\uff0c2\u5f35\u7db2\u5361\uff0c20G\u7684HDD(\u524d\u9762\u5df1\u9810\u5148\u88dd\u597d\u7684CentOS5.4\u4f5c\u696d\u7cfb\u7d71\u3002<\/p>\n


\n[root@rico ~]#vi openvpn.xen
\n# ip 192.168.2.198 \/ 192.168.100.1
\n# host: openvpn.nuface.tw
\n# vps05LV00 : 20G
\nname = \"openvpn\"
\nmemory = \"512\"
\nvcpus = 1
\nvif = [ 'type=bridge, bridge=eth0','type=bridge, bridge=virbr0' ]
\ndisk = [ 'phy:\/dev\/VolGroup00\/vps05LV00,xvda,w']
\nroot = \"\/dev\/xvda1 ro\"
\n# Sets runlevel 4.
\nextra = \"4\"
\non_poweroff = 'destroy'
\non_reboot = 'restart'
\non_crash = 'restart'
\nbootloader = \"\/usr\/bin\/pygrub\"
\nvfb = [ 'type=vnc,vncunused=1']
\n<\/code><\/p><\/blockquote>\n

\u555f\u52d5\u9019\u53f0\u865b\u6a5f\u3002<\/p>\n


\n[root@rico ~]#xm create openvpn.xen
\n<\/code><\/p><\/blockquote>\n

\u9023\u5165VNC \u53bb\u67e5\u770b\u555f\u52d5\u72c0\u6cc1\u3002
\n\"VPN
\n\"VPN<\/p>\n

\u6210\u529f\u555f\u52d5\uff0c\u767b\u5165\u4f5c\u696d\u7cfb\u7d71\uff0c\u4fee\u6539\u7db2\u5361\u8a2d\u5b9a\u503c \u3002<\/p>\n


\n[root@rico ~]#vi \/etc\/sysconfig\/network-scripts\/ifcfg-eth0
\n# Xen Virtual Ethernet
\nDEVICE=eth0
\nBOOTPROTO=static
\nIPADDR=192.168.2.198
\nNETMASK=255.255.255.0
\nONBOOT=yes<\/p>\n

[root@rico ~]#vi \/etc\/sysconfig\/network-scripts\/ifcfg-eth1
\n# Xen Virtual Ethernet
\nDEVICE=eth1
\nBOOTPROTO=static
\nIPADDR=192.168.100.1
\nNETMASK=255.255.255.0
\nONBOOT=yes
\n<\/code><\/p><\/blockquote>\n

Note\uff0c\u628aHWADDR=XX:XX:XX:XX:XX:XX Mark \u6389\uff0c\u4e0d\u8981\u6307\u5b9aHWADDR\uff0c\u7531\u5916\u5c64\u7684Host OS \u6307\u5b9a\u5373\u53ef\uff0c\u5982\u679c\u5728\u5167\u5c64\u4e5f\u6307\u5b9a\u7684\u8a71\uff0c\u5167\u5916\u5982\u679cMAC \u4e0d\u540c\uff0c\u6703\u555f\u52d5\u53e6\u4e00\u500bifconfig \u7684\u8a2d\u5b9a\uff0cIP \u5c31\u6703\u8dd1\u6389\u3002<\/p>\n

\u641e\u5b9a\u5f8c\uff0c\u91cd\u555fnetwork \u3002<\/p>\n


\n[root@rico ~]#\/etc\/init.d\/network restart
\n<\/code><\/p><\/blockquote>\n

\u7db2\u8def\u8a2d\u5b9a\u597d\u5f8c\uff0c\u9023\u5165\u505a\u8a2d\u5b9aVPN \u4f5c\u696d\u3002<\/p>\n

\u6b32\u77e5\u5f8c\u4e8b\uff0c\u7b2c2\u96c6\uff0c\u5f85\u7e8c!<\/p>\n

OpenVPN \u5efa\u7f6e\u7b46\u8a18(\u7b2c2\u96c6)<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

\u8edf\u9ad4\u7c21\u4ecb \u8edf\u9ad4\u958b\u767c\u8005\u70ba James Yonan \uff0c\u4ee5 GPL \u65b9\u5f0f\u767c\u4f48\u3002\u662f\u4e00\u5957\u5f88\u6709\u540d\u7684\u958b\u6e90\u8edf\u9ad4\u3002\u8edf\u9ad4\u529f\u80fd\u53ef\u4ee5\u5728 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[23,24],"tags":[92,72,123,150,54],"class_list":["post-202","post","type-post","status-publish","format-standard","hentry","category-mistech","category-mistech-net","tag-centos-5-4","tag-open-vpn","tag-openvpn","tag-site-to-site","tag-xen"],"_links":{"self":[{"href":"https:\/\/blog.nuface.tw\/index.php?rest_route=\/wp\/v2\/posts\/202","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.nuface.tw\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.nuface.tw\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.nuface.tw\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.nuface.tw\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=202"}],"version-history":[{"count":60,"href":"https:\/\/blog.nuface.tw\/index.php?rest_route=\/wp\/v2\/posts\/202\/revisions"}],"predecessor-version":[{"id":1193,"href":"https:\/\/blog.nuface.tw\/index.php?rest_route=\/wp\/v2\/posts\/202\/revisions\/1193"}],"wp:attachment":[{"href":"https:\/\/blog.nuface.tw\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=202"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.nuface.tw\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=202"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.nuface.tw\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=202"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}