CentOS下编译安装OpenVPN2.1.4 安装依赖yum install openssl openssl-devel gcc wget -y下载OpenVPN2.1.4源码包和LZO2.05wget http://downloads.openwrt.org.cn/sources/openvpn-2.1.4.tar.gzwget http://downloads.openwrt.org.cn/sources/lzo-2.05.tar.gztar -zxvf openvpn-2.1.4.tar.gz && tar -zxvf lzo-2.05.tar.gzcd lzo-2.05.tar.gz/先编译安装lzo2.05./configuremake && make install 编译安装openvpn2.1.4cd openvpn-2.1.4/./configuremake && make install 使用easyrsa2.0生成证书cd easyrsa2.0/vi vars填写末尾六行eg：export KEY_SIZE=2048 export KEY_COUNTRY="US"export KEY_PROVINCE="CA"export KEY_CITY="LosAngeles"export KEY_ORG="Lonelyboy Networks"export KEY_EMAIL="lonelyboyzavier@gmail.com"保存后chmod +x varssource ./vars清空keys中的内容./clean-all生成2048位RSA服务器CA证书./build-ca生成服务器证书./build-key-server openvpnserver生成客户端证书./build-key clientname(自定义名)生成dh2048.pem文件./build-dh 一个客户端连接需要三个文件ca.crt ,client.crt,client.key拷贝至客户端即可mkdir /etc/openvpn && cd /etc/openvpntouch server.confmkdir cert (将ca.crt ，dh2048.pem，openvpnserver.crt，openvpnserver.key拷贝到cert文件夹)服务器端配置server.conf参考自定义协议）proto #端口号定义port XXXVPS使用tun需要母鸡支持dev tuntopology subnetserver 10.8.0.0 255.255.255.0自定义需要走VPN的IP路由push "route 172.31.9.0 255.255.255.0"auth SHA256cipher AES-256-CBCcomp-lzo adaptivepush "comp-lzo adaptive"通过服务端转发所有流量，默认不启用push "redirect-gateway def1 bypass-dhcp"向客户端通告DNS，可自定义push "dhcp-option DNS 114.114.114.114"push "dhcp-option DNS 8.8.8.8"配置证书文件路径ca /etc/openvpn/cert/ca.crtdh /etc/openvpn/cert/dh2048.pemcert /etc/openvpn/cert/openvpnserver.crtkey /etc/openvpn/cert/openvpnserver.keypersist-keypersist-tunuser nobody生成openvpn日志，verb为日志等级，默认为3log /var/log/openvpn.log log-append /var/log/openvpn.logmax-clients 10client-to-clientkeepalive 10 60nice 3verb 4mute 10iptables配置转发iptables -t nat -A POSTROUTING -s 10.8.0.0/255.255.255.0 -o eth0 -j MASQUERADEvi /etc/sysctl.conf net.ipv4.ip_forward=1 openvpn启动命令openvpn --config /etc/openvpn/server.conf

使用openssl为服务器配置自签名SSL证书 SSH登录服务器后首先创建存放证书的文件夹mkdir /etc/https安装opensslCentOS:yum install -y openssl openssl-devel或者 Ubuntu: apt-get install openssl openssl-developenssl genrsa -des3 -out server.key 2048 //生成2048位RSA私钥openssl req -new -key server.key -out server.csr //生成csr证书申请文件openssl x509 -req -days 3650 -in server.csr -signkey server.key -out server.crt //生成自签名证书openssl rsa -in server.key -out server.key.nopass //将带密码的私钥转化为不带密码私钥Country Name (2 letter code) []: //国家名State or Province Name (full name) []: //州/省名字Locality Name (eg, city) []: //地/市名Organization Name (eg, company) []: //组织/公司名字Organizational Unit Name (eg, section) []: //单位名Common Name (eg, your name or your server's hostname) []: //服务器名或个人名Email Address []: //邮箱地址可不填Please enter the following 'extra' attributes to be sent with your certificate requestA challenge password []: //可不填An optional company name []: //可不填

CentOS搭建Cisco Anyconnect服务器-----Ocserv编译过程整理 AnyConnect是思科公司的企业安全远程接入解决方案，受许多中小企业青睐。其手机客户端可从安卓市场或者苹果商店下载。编译环境 CentOS 6.9 X86安装编译依赖环境yum install gcc libtasn1-devel zlib zlib-devel trousers trousers-devel gmp-devel gmp xz texinfo libnl-devel tcp_wrappers-libs tcp_wrappers-devel tcp_wrappers dbus dbus-devel ncurses-devel pam-devel readline-devel bison bison-devel flex gcc wget编译安装autoconf和automakecd /usrwget ftp://ftp.gnu.org/gnu/autoconf/autoconf-latest.tar.gztar -zxvf autoconf-2.69.tar.gzcd autoconf-2.69/./configure --prefix=/usr/local/autoconfmake && make installcp /usr/local/autoconf/bin/autoconf /usr/bin/autoconfcd /usrwget ftp://ftp.gnu.org/gnu/automake/automake-1.14.1.tar.gzcd automake-1.14.1./configure --prefix=/usr/local/automakemake && make installcp /usr/local/automake/bin/automake /usr/bin/automake安装nettlewget ftp://ftp.gnu.org/gnu/nettle/nettle-2.7.1.tar.gztar zxvf nettle-2.7.1.tar.gzcd nettle-2.7.1/./configure --prefix=/usr/local/nettlemake && make installecho '/usr/local/nettle/lib/' > /etc/ld.so.conf.d/nettle.confLdconfig安装gnutlswget ftp://ftp.gnutls.org/gcrypt/gnutls/v3.3/gnutls-3.3.9.tar.gztar xvf gnutls-3.3.9.tar.xzcd gnutls-3.3.9/export NETTLE_CFLAGS="-I/usr/local/nettle/include/"export NETTLE_LIBS="-L/usr/local/nettle/lib/ -lnettle"export HOGWEED_LIBS="-L/usr/local/nettle/lib/ -lhogweed"export HOGWEED_CFLAGS="-I/usr/local/nettle/include"./configure --prefix=/usr/local/gnutlsmake && make installln -s /usr/local/gnutls/bin/certtool /usr/bin/certtoolecho '/usr/local/gnutls/lib/' > /etc/ld.so.conf.d/gnutls.confLdconfig安装libnlyum install bison flex(可选)wget http://www.infradead.org/~tgr/libnl/files/libnl-3.2.24.tar.gztar -zxvf libnl-3.2.24.tar.gzcd libnl-3.2.24./configure --prefix=/usr/local/libnlmake && make installecho '/usr/local/libnl/lib/' > /etc/ld.so.conf.d/libnl.confLdconfig安装ocservcd /usrexport LIBNL3_CFLAGS="-I/usr/local/libnl/include/libnl3"export LIBNL3_LIBS="-L//usr/local/libnl/lib/ -lnl-3 -lnl-route-3"export LIBGNUTLS_LIBS="-L/usr/local/gnutls/lib/ -lgnutls"export LIBGNUTLS_CFLAGS="-I/usr/local/gnutls/include/"wget ftp://ftp.infradead.org/pub/ocserv/ocserv-0.9.0.1.tar.xztar xvf ocserv-0.9.0.1.tar.xzcd ocserv-0.9.0./configure --prefix=/usr/local/ocservmake && make installecho 'export PATH=$PATH://usr/local/ocserv/sbin/:/usr/local/ocserv/bin/' >> $HOME/.bashrcsource $HOME/.bashrc配置NATiptables -t nat -A POSTROUTING -s 192.168.12.0/255.255.255.0 -o eth0 -j MASQUERADEvi /etc/sysctl.conf net.ipv4.ip_forward=1 // 配置ip转发iptables -t nat -L // 查看防火墙NAT规则出错则编译安装protobuf及三个文件cd /usryum install glibc-headers gcc-c++wget no-check-certificatehttps://github.com/google/protobuf/releases/download/v2.6.1/protobuf-2.6.1.tar.gztar -zxvf protobuf-2.6.1.tar.gzcd protobuf-2.6.1./configuremake && make install用户名登录cp /usr/ocserv-0.9.0/src/ocpasswd /usr/bin/ocpasswdocpasswd -c /etc/ocserv/passwd (username) //username为用户名，可自定义配置文件auth = "plain[/etc/ocserv/passwd]"证书认证 //默认采用用户名密码认证，证书认证在文末auth = "certificate"ca-cert /etc/ocserv/ca-cert.pemmax-clients = 16max-same-clients = 2tcp-port = 10443 //端口号可自定义，不与常用端口冲突udp-port = 10443 //自定义端口号，自行选择协议，若选择TCP则注释掉UDP这行keepalive = 32400try-mtu-discovery = truecisco-client-compat = trueserver-cert = /etc/ocserv/server-cert.pemserver-key = /etc/ocserv/server-key.pemauth-timeout = 40pid-file = /var/run/ocserv.pidsocket-file = /var/run/ocserv-socketrun-as-user = nobodyrun-as-group = daemondevice = vpnsipv4-network = 192.168.12.0 //网段可自定义ipv4-netmask = 255.255.255.0route = 192.168.12.0/255.255.255.0 //若未配置国内外分流务必注释掉这行启动ocserv ocserv -c /etc/ocserv.conf //加-f则为调试模式 不加则后台运行 服务器证书 生成SSL证书mkdir /etc/ocserv/cd /etc/ocservCA私钥：certtool --generate-privkey --outfile ca-key.pemCA模板：cat << EOF > ca.tmplcn = "www.lonelyboy.org" //名称可自定义organization = "www.lonelyboy.org" //名称可自定义serial = 1expiration_days = 3650casigning_keycert_signing_keycrl_signing_keyEOFCA证书：certtool --generate-self-signed --load-privkey ca-key.pem --template ca.tmpl --outfile ca-cert.pemServer私钥：certtool --generate-privkey --outfile server-key.pemServer证书模板：cat << EOF > server.tmplcn = "www.lonelyboy.org" //名称可自定义o = "www.lonelyboy.org" //名称可自定义expiration_days = 3650signing_keyencryption_keytls_www_serverEOFServer证书：certtool --generate-certificate --load-privkey server-key.pem --load-ca-certificate ca-cert.pem --load-ca-privkey ca-key.pem --template server.tmpl --outfile server-cert.pem证书登录 //默认用户名密码认证，可自行选择是否使用证书认证用户私钥certtool --generate-privkey --outfile user-key.pem用户模板 //自定义cat << EOF > user.tmplcn = "XXX" //随机名可自定义unit = "XXX" //随机名可自定义expiration_days = 365signing_keytls_www_clientEOFuser证书certtool --generate-certificate --load-privkey user-key.pem --load-ca-certificate ca-cert.pem --load-ca-privkey ca-key.pem --template user.tmpl --outfile user-cert.pem