CentOS Linux 配置 VPN服务器

# 安装 EPEL 源
sudo yum install epel-release -y

# 安装 OpenVPN、PAM 认证插件和证书生成工具
sudo yum install openvpn openvpn-auth-pam easy-rsa -y

# 复制 easy-rsa 工具到 OpenVPN 目录
sudo cp -r /usr/share/easy-rsa/3/ /etc/openvpn/EasyRSA
cd /etc/openvpn/EasyRSA
# 生成 CA 根证书（需要设置密码）
sudo ./easyrsa build-ca nopass

# 生成服务器证书和密钥
sudo ./easyrsa build-server-full server nopass

# 生成 Diffie-Hellman 参数
sudo ./easyrsa gen-dh

# 生成 TLS 加密密钥
sudo openvpn --genkey --secret pki/tls-auth.key

# 复制证书到 OpenVPN 主目录
sudo cp pki/ca.crt pki/issued/server.crt pki/private/server.key pki/dh.pem /etc/openvpn/

sudo vi /etc/openvpn/server.conf

port 1194
proto udp
dev tun

ca ca.crt
cert server.crt
key server.key  # 服务器私钥
dh dh.pem
tls-auth tls-auth.key 0  # 服务器端为0

server 10.8.0.0 255.255.255.0  # VPN子网
ifconfig-pool-persist ipp.txt

# push "route 192.168.1.0 255.255.255.0"  # 推送内网路由（按需修改）
push "redirect-gateway def1 bypass-dhcp" #推送所有网络走VPN
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"

keepalive 10 120
tls-version-min 1.2
cipher AES-256-CBC
tls-cipher TLS-DHE-RSA-WITH-AES-256-CBC-SHA256:TLS-DHE-RSA-WITH-AES-128-CBC-SHA256
auth SHA512
auth-nocache
verify-client-cert none # 不要求客户端证书
#auth-user-pass-verify /etc/openvpn/checkpsw.sh via-env # 密码验证脚本
#script-security 3
plugin /usr/lib64/openvpn/plugins/openvpn-plugin-auth-pam.so login
username-as-common-name
status openvpn-status.log
log-append openvpn.log
verb 3

开启 IP 转发

# 临时生效
sudo sysctl -w net.ipv4.ip_forward=1

# 永久生效（重启后保留）
sudo echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
sudo sysctl -p  # 刷新配置

创建TUN设备持久化配置

# 创建TUN设备持久化配置
sudo mkdir -p /etc/systemd/system/openvpn@server.service.d/
sudo vi /etc/systemd/system/openvpn@server.service.d/tun.conf

[Service]
ExecStartPre=/sbin/modprobe tun

sudo systemctl daemon-reload
sudo systemctl start openvpn@server
sudo systemctl enable openvpn@server

client.ovpn

client
dev tun
proto udp
remote 156.239.53.101 1194

resolv-retry infinite
nobind
persist-key
persist-tun

remote-cert-tls server
tls-version-min 1.2
cipher AES-256-CBC
tls-cipher TLS-DHE-RSA-WITH-AES-256-CBC-SHA256:TLS-DHE-RSA-WITH-AES-128-CBC-SHA256
auth SHA512
auth-nocache

verb 3
auth-user-pass
key-direction 1

<ca>

</ca>
<tls-auth>

</tls-auth>