一、Ope***简介：
Open×××是一个用于创建虚拟专用网络(Virtual Private Network)加密通道的免费开源软件。使用Open×××可以方便地在家庭、办公场所、住宿酒店等不同网络访问场所之间搭建类似于局域网的专用网络通道。Open×××使用方便，运行性能优秀，支持Solaris、Linux 2.2+(Linux 2.2+表示Linux 2.2及以上版本，下同)、OpenBSD 3.0+、FreeBSD、NetBSD、Mac OS X、Android和Windows 2000+的操作系统，并且采用了高强度的数据加密，再加上其开源免费的特性，使得Open×××成为中小型企业及个人的×××首选产品。
使用Open×××配合特定的代理服务器，可用于访问Youtube、FaceBook、Twitter等受限网站，也可用于突破公司的网络限制。由于Open×××支持UDP协议，还可以配合HTTP代理(HTTP Proxy)使用，使得只要是能够打开网站或上QQ的地方，就可以访问外部的任何网站或其他网络资源。
二、Open***搭建：
1、环境介绍：
| 主机名称 | 功能 | ip |
| node4 | Open*** Server端 | 172.16.2.15 |
| node5 | Open*** Clientd端 | 172.16.2.16 |
2、Open*** Server端配置：
1）环境准备：
开启数据转发： [root@node4 ~]# vim /etc/sysctl.conf net.ipv4.ip_forward = 1 [root@node4 ~]# sysctl -p
关闭SELINUX [root@node4 ~]# setenforce 0 [root@node4 ~]# getenforce Permissive
2）准备epel源
[root@node4 ~]# cat /etc/yum.repos.d/epel.repo [aliyun] name=epel baseurl=http://mirrors.aliyun.com/epel/6Server/x86_64/ enabled=1 gpgcheck=0
3)安装open*** 软件以及依赖包
[root@node4 ~]# yum install open*** easy-rsa -y
4)查看安装open***生成的文件
[root@node4 ~]# rpm -ql open*** [root@node4 ~]# rpm -ql easy-rsa
5)复制安装easy-rsa生成的文件到安装open***生成的/etc/open***目录中
[root@node4 ~]# cp -r /usr/share/easy-rsa/ /etc/open***/
6)生成证书文件
[root@node4 ~]# cd /etc/open***/easy-rsa/2.0/ [root@node4 2.0]# vim vars export KEY_COUNTRY="CN" \\修改成你所在国家的简称 export KEY_PROVINCE="BJ" \\修改成你所在的省份 export KEY_CITY="BEIJING" \\修改成你所在的城市 export KEY_ORG="test" \\填写你所在的组织 export KEY_EMAIL="[email protected]" \\填写你的管理邮箱 export KEY_OU="Test" \\填写你的单位名称 [root@node4 2.0]# source ./vars \\重新载入vars配置 NOTE: If you run ./clean-all, I will be doing a rm -rf on /etc/open***/easy-rsa/2.0/keys [root@node4 2.0]# ./clean-all \\清理key [root@node4 2.0]# ls keys/ \\查看keys目录中只有以下两个文件 index.txt serial
生成CA证书和秘钥(由于上面已经修改配置文件，一路回车即可) [root@node4 2.0]# ./build-ca Generating a 2048 bit RSA private key ...............................................+++ ..............+++ writing new private key to 'ca.key' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [CN]: State or Province Name (full name) [BJ]: Locality Name (eg, city) [BEIJING]: Organization Name (eg, company) [test]: Organizational Unit Name (eg, section) [TEST]: Common Name (eg, your name or your server's hostname) [test CA]: Name [EasyRSA]: Email Address [[email protected]]:
创建迪菲霍尔曼秘钥交换参数: [root@node4 2.0]# ./build-dh Generating DH parameters, 2048 bit long safe prime, generator 2 This is going to take a long time ................................................................................................................................+...................................................................+........................................................................................+.................................................................................................................................................................................................................................................................................................................................................................................+....................................+..............................................................................................................................................................................................................................................................................................+...................+.........................................................................+.............+........................................................................................................................................................................................................................................+..........................................................+.........................................................................+...........................................................................+.........................................................................+........+.........................................................................................................................................................................................................+......................................+..........................+......................+............+..........................................................................................................................................................................................................................+...................+.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................+..........................................................................+.................................................................................................................................................................................+.........................................................................................+.......................................................................................................................+...................................................................................+...............+............................................................................+.+..............................................................................................+.......+.......+......................................................................................................................................................................................................................................................+............................................+..............................................................................................................+.....................................+....+..........................................................................................................................+..................................................................................................+.................................................................................................................................................................................................................................................................................................+..........+................+....................................................................................................+..+.....................................................+.................++*++*
生成Server端的证书和秘钥 [root@node4 2.0]# ./build-key-server open***-server（证书名称） Generating a 2048 bit RSA private key .......+++ ..+++ writing new private key to 'open***-server.key' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [CN]: State or Province Name (full name) [BJ]: Locality Name (eg, city) [BEIJING]: Organization Name (eg, company) [test]: Organizational Unit Name (eg, section) [TEST]: Common Name (eg, your name or your server's hostname) [open***-server]: Name [EasyRSA]: Email Address [[email protected]]: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: Using configuration from /etc/open***/easy-rsa/2.0/openssl-1.0.0.cnf Check that the request matches the signature Signature ok The Subject's Distinguished Name is as follows countryName :PRINTABLE:'CN' stateOrProvinceName :PRINTABLE:'BJ' localityName :PRINTABLE:'BEIJING' organizationName :PRINTABLE:'test' organizationalUnitName:PRINTABLE:'TEST' commonName :PRINTABLE:'open***-server' name :PRINTABLE:'EasyRSA' emailAddress :IA5STRING:'[email protected]' Certificate is to be certified until Jul 28 20:01:24 2025 GMT (3650 days) Sign the certificate? [y/n]:y 1 out of 1 certificate requests certified, commit? [y/n]y Write out database with 1 new entries Data Base Updated
再次查看keys目录的下文件，已经生成许多文件： [root@node4 2.0]# ls keys/ 01.pem ca.key index.txt index.txt.old open***-server.csr serial ca.crt dh2048.pem index.txt.attr open***-server.crt open***-server.key serial.old
复制keys目录下的相关证书秘钥文件到/etc/open***目录
[root@node4 2.0]# cp keys/{dh2048.pem,open***-server.crt,open***-server.key,ca.crt} /etc/open***
7)修改server.conf配置文件
复制server的配置文件到/etc/open***目录 [root@node4 2.0]# cp /usr/share/doc/open***-2.3.10/sample/sample-config-files/server.conf /etc/open***/ 修改server.conf配置文件，内容如下： port 1194 \\监听端口 proto tcp \\使用tcp协议监听，可以使用proto udp，使用udp协议监听 dev tun \\使用路由设备控制 ca /etc/open***/ca.crt \\ca证书位置 cert /etc/open***/open***-server.crt \\server端的证书位置 key /etc/open***/open***-server.key \\server端的秘钥位置 dh dh2048.pem \\指定秘钥交换参数 server 192.168.100.0 255.255.255.0 \\定义分配给客户端的ip网段，建议不要和本地网段相同 ifconfig-pool-persist ipp.txt \\记录ip分配信息 push "route 0.0.0.0 0.0.0.0 " \\推送默认路由给客户端 push "redirect-gateway def1 bypass-dhcp" \\推送给客户端默认网关 push "dhcp-option DNS 8.8.8.8" \\推送给客户端dns地址，如果在vps上搭建的话就推送这几个地址 push "dhcp-option DNS 8.8.4.4" client-to-client \\启动open*** client之间可以通信 duplicate-cn \\同一个客户端可以再多个地方登录 keepalive 10 120 \\***保持监测时间 comp-lzo \\启用压缩功能 persist-key persist-tun log open***.log \\日志文件 verb 5 \\日志级别，刚刚开始搭建的时候可以开启debug模式，成功后可以调成其他模式
8)rpm安装的open***启动脚本有问题，需要进行修改
修改启动脚本： [root@node4 open***]# vim /etc/init.d/open*** \\大约在173行处修改 $open*** --daemon --writepid $piddir/$bn.pid --cd $work --config server.conf $c $script_security
启动0pen*** [root@node4 open***]# /etc/init.d/open*** start \\启动open*** Starting open***: [ OK ] [root@node4 open***]# netstat -tpln | grep 1194 \\查看监听状态 tcp 0 0 0.0.0.0:1194 0.0.0.0:* LISTEN 7408/open***
9)如果启用了防火墙，还要配置防火墙，如果没有启用防火墙此操作可省略：
iptables -t nat -A POSTROUTING -s 192.168.100.0/24 -j MASQUERADE iptables -A INPUT -m state --state NEW -m udp -p udp --dport 1194 -j ACCEPT iptables -A FORWARD -s 10.8.0.0/24 -p udp --dport 1194 -j ACCEPT service iptables save service iptables restart
3、配置client
1)安装open***
[root@node5 ~]# yum install open***
2)在Server端生成client证书秘钥
[root@node4 2.0]# pwd /etc/open***/easy-rsa/2. [root@node4 2.0]# ./build-key client Generating a 2048 bit RSA private key .....................................+++ ..............+++ writing new private key to 'client.key' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [CN]: State or Province Name (full name) [BJ]: Locality Name (eg, city) [BEIJING]: Organization Name (eg, company) [test]: Organizational Unit Name (eg, section) [TEST]: Common Name (eg, your name or your server's hostname) [client]: Name [EasyRSA]: Email Address [[email protected]]: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: Using configuration from /etc/open***/easy-rsa/2.0/openssl-1.0.0.cnf Check that the request matches the signature Signature ok The Subject's Distinguished Name is as follows countryName :PRINTABLE:'CN' stateOrProvinceName :PRINTABLE:'BJ' localityName :PRINTABLE:'BEIJING' organizationName :PRINTABLE:'test' organizationalUnitName:PRINTABLE:'TEST' commonName :PRINTABLE:'client' name :PRINTABLE:'EasyRSA' emailAddress :IA5STRING:'[email protected]' Certificate is to be certified until Jul 28 20:30:00 2025 GMT (3650 days) Sign the certificate? [y/n]:y 1 out of 1 certificate requests certified, commit? [y/n]y Write out database with 1 new entries Data Base Updated
3)复制生成的client证书和秘钥到客户端
[root@node4 2.0]# scp keys/{ca.crt,client.crt,client.key} node5:/etc/open***/
ca.crt 100% 1667 1.6KB/s 00:00
client.crt 100% 5263 5.1KB/s 00:00
client.key 100% 1704 1.7KB/s 00:00
4)复制client.conf配置文件到/etc/open***
[root@node5 ~]# cp /usr/share/doc/open***-2.3.10/sample/sample-config-files/client.conf /etc/open***/
5)修改配置文件
[root@node5 ~]# vim /etc/open***/client.conf client \\指明为客户端模式 dev tun \\使用路由模式控制网络 proto tcp \\使用tcp协议 remote 172.16.2.15 1194 \\server的地址及监听端口 resolv-retry infinite \\重新连接 nobind \\客户端不需要启动服务 persist-key persist-tun ca /etc/open***/ca.crt \\ca证书 cert /etc/open***/client.crt \\客户端证书 key /etc/open***/client.key \\客户秘钥 remote-cert-tls server \\使用证书加密 comp-lzo \\启用压缩功能 verb 5 \\设置日志级别
6)在client端连接server端，本人使用的是linux客户端，使用screen工具在新终端连接sever
[root@node5 ~]# yum install screen -y [root@node5 ~]# screen \\会生成一个新控制台 [root@node5 ~]# vim /etc/open***/client.conf \\在screen生成的控制台运行此命令
7)查看client的连接状态
[root@node5 ~]# ifconfig eth0 Link encap:Ethernet HWaddr 00:0C:29:D1:41:59 inet addr:172.16.2.16 Bcast:172.16.2.255 Mask:255.255.255.0 inet6 addr: fe80::20c:29ff:fed1:4159/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:171104 errors:0 dropped:0 overruns:0 frame:0 TX packets:104422 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:152056244 (145.0 MiB) TX bytes:19865764 (18.9 MiB) lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:65536 Metric:1 RX packets:25463 errors:0 dropped:0 overruns:0 frame:0 TX packets:25463 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:3306366 (3.1 MiB) TX bytes:3306366 (3.1 MiB) 生成一个tun0接口，获取server端分配的ip地址 tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 inet addr:192.168.100.6 P-t-P:192.168.100.5 Mask:255.255.255.255 UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)
4、抓包分析server端与client端连接
[root@node4 open***]# tcpdump -n -vv -i eth0 tcp port 1194 tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes 04:53:07.960478 IP (tos 0x0, ttl 64, id 4987, offset 0, flags [DF], proto TCP (6), length 107) 172.16.2.16.44839 > 172.16.2.15.open***: Flags [P.], cksum 0x66d5 (correct), seq 1711534989:1711535044, ack 2333043868, win 210, options [nop,nop,TS val 76440339 ecr 19611899], length 55 04:53:07.960519 IP (tos 0x0, ttl 64, id 40007, offset 0, flags [DF], proto TCP (6), length 52) 172.16.2.15.open*** > 172.16.2.16.44839: Flags [.], cksum 0x474b (correct), seq 1, ack 55, win 190, options [nop,nop,TS val 19620962 ecr 76440339], length 0
5、windows客户使用open***
1)下载安装windows的客户端
2)把在server端生成证书文件复制到客户端安装目录的conf目录
3）修改client.conf为client.o***
4）配置修改于linux的client模式意义
5)双击运行，便可以连接上，此时客户端图标显示绿色，代表连接成功
到此，Open***已经搭建完成，可以轻松去你想去的网站了O(∩_∩)O哈哈