通过docker快速实现OpenVPN搭建
文章目录
-
- 拉取镜像
- 创建配置文件
- 生成密钥文件
- 生成客户端证书
-
- 生成无密码的客户端
- 生成有密码的客户端
- 导出证书
- 启动VPN
- 配置哪些流量走VPN
- 客户端下载地址
- 参考
通过docker快速实现OpenVPN搭建
拉取镜像
docker pull kylemanna/open:2.4
创建配置文件
docker run -v /opt/open:/etc/open --rm kylemanna/open:2.4 o_genconfig -u tcp://ip[:port]
ip:port 设置的地址为你连接VPN访问的ip和端口，一般为公网IP和端口
运行结果
[root@bigdata-101 ~]# docker run -v /opt/open:/etc/open --rm kylemanna/open:2.4 o_genconfig -u udp://x.x.x.x:port
Processing PUSH Config: 'block-outside-dns'
Processing Route Config: '192.168.254.0/24'
Processing PUSH Config: 'dhcp-option DNS 8.8.8.8'
Processing PUSH Config: 'dhcp-option DNS 8.8.4.4'
Processing PUSH Config: 'comp-lzo no'
Successfully generated config
Cleaning up before Exit ...
生成密钥文件
docker run -v /opt/open:/etc/open --rm -it kylemanna/open:2.4 o_initpki
# 设置密码
Enter New CA Key Passphrase:
Re-Enter New CA Key Passphrase:
# 默认回车
Common Name (eg: your user, host, or server name) [Easy-RSA CA]:
# 输入刚刚设置的密码
Enter pass phrase for /etc/open/pki/private/ca.key:
Enter pass phrase for /etc/open/pki/private/ca.key:
完整执行步骤日志
[root@bigdata-101 ~]# docker run -v /opt/open:/etc/open --rm -it kylemanna/open:2.4 o_initpki
init-pki complete; you may now create a CA or requests.
Your newly created PKI dir is: /etc/open/pki
Using SSL: openssl OpenSSL 1.1.1g 21 Apr 2020
Enter New CA Key Passphrase:
Re-Enter New CA Key Passphrase:
Generating RSA private key, 2048 bit long modulus (2 primes)
.............................................................................................................................................................................+++++
.................................+++++
e is 65537 (0x010001)
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Common Name (eg: your user, host, or server name) [Easy-RSA CA]:
CA creation complete and you may now import and sign cert requests.
Your new CA certificate file for publishing is at:
/etc/open/pki/ca.crt
Using SSL: openssl OpenSSL 1.1.1g 21 Apr 2020
Generating DH parameters, 2048 bit long safe prime, generator 2
This is going to take a long time
.................................................................+....+....................+.........................................................................................................+....+.......................................................................................................................................................................+.....................................+...................+.......................+.....................................................................................................................................................................................................................................+............................................................................+...................................................................................................................+.....+.......................................................................................................................................................................................................................................+..................................................................................................................................................................................................+........+.............................................................................................................................+..............................+....................................................+..............................................................................................................................................................................+......................................................................................................+....................................................................................+.......................++*++*++*++*
DH parameters of size 2048 created at /etc/open/pki/dh.pem
Using SSL: openssl OpenSSL 1.1.1g 21 Apr 2020
Generating a RSA private key
.............................................+++++
.....................+++++
writing new private key to '/etc/open/pki/easy-rsa-73.bBJIMn/tmp.PBbHDh'
-----
Using configuration from /etc/open/pki/easy-rsa-73.bBJIMn/tmp.lDdIgp
Enter pass phrase for /etc/open/pki/private/ca.key:
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName :ASN.1 12:'公网IP'
Certificate is to be certified until Apr 2 07:03:45 2026 GMT (825 days)
Write out database with 1 new entries
Data Base Updated
Using SSL: openssl OpenSSL 1.1.1g 21 Apr 2020
Using configuration from /etc/open/pki/easy-rsa-148.JkjcgL/tmp.Ahiido
Enter pass phrase for /etc/open/pki/private/ca.key:
An updated CRL has been created.
CRL file: /etc/open/pki/crl.pem
生成客户端证书
生成无密码的客户端
docker run -v /opt/open:/etc/open --rm -it kylemanna/open:2.4 easyrsa build-client-full jast nopass
jast 为客户端用户
[root@bigdata-101 ~]# docker run -v /opt/open:/etc/open --rm -it kylemanna/open:2.4 easyrsa build-client-full jast nopass
Using SSL: openssl OpenSSL 1.1.1g 21 Apr 2020
Generating a RSA private key
.+++++
...................+++++
writing new private key to '/etc/open/pki/easy-rsa-1.npkoBm/tmp.GjbIiO'
-----
Using configuration from /etc/open/pki/easy-rsa-1.npkoBm/tmp.GAAMkb
Enter pass phrase for /etc/open/pki/private/ca.key: # 输入刚刚创建的密码
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName :ASN.1 12:'jast'
Certificate is to be certified until Apr 2 07:06:25 2026 GMT (825 days)
Write out database with 1 new entries
Data Base Updated
生成有密码的客户端
Using SSL: openssl OpenSSL 1.1.1g 21 Apr 2020
Generating a RSA private key
.........................................+++++
...............................................+++++
writing new private key to '/etc/open/pki/easy-rsa-1.MEMpOp/tmp.gLiNaP'
Enter PEM pass phrase: # 输入要设置的客户端的密码
Verifying - Enter PEM pass phrase:
-----
Using configuration from /etc/open/pki/easy-rsa-1.MEMpOp/tmp.gCiMLA
Enter pass phrase for /etc/open/pki/private/ca.key: # 输入之前设置的证书密码
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName :ASN.1 12:'jast3'
Certificate is to be certified until Apr 2 07:24:36 2026 GMT (825 days)
Write out database with 1 new entries
Data Base Updated
导出证书
导出客户端认证文件到本地
jast 为客户端名称
docker run -v /opt/open:/etc/open --rm kylemanna/open:2.4 o_getclient jast > /opt/jast.o
启动VPN
docker run --name ov --restart=always --privileged=true -v /opt/open:/etc/open -d -p 1194:1194/tcp --cap-add=NET_ADMIN kylemanna/open:2.4
如果公网访问VPN，公网的IP地址和端口要映射到当前容器所在服务器的1194端口
配置哪些流量走VPN
修改客户端文件jast.o，在配置文件中添加
# 表示不接受服务器对于修改路由表的推送，而可以按照我们之后指定的规则去修改
route-nopull
# 这个参数设置了路由的度量值（metric），用于确定路由的优先级。路由的度量值越小，优先级越高。在有多个路由规则匹配的情况下，系统会选择度量值最小的路由。
route-metric 150
# 远程主机（remote_host）的流量通过本地网关（net_gateway）发送
route remote_host 255.255.255.255 net_gateway
# 172.19.0.0/16网段的流量通过本地网关发送
route 172.19.0.0 255.255.0.0 net_gateway
# 192.168.1.0/16网段的流量通过VPN网关（_gateway）发送
route 192.168.1.0 255.255.0.0 _gateway
注释掉这一行
redirect-gateway def1作用是将默认网关重定向到 VPN 服务器上，所以要注释掉。
# edirect-gateway def1
客户端下载地址
Mac:https://tunnelblick.net/
Win7:https://swupdate.open.org/community/releases/open-install-2.4.8-I602-Win7.exe
Win10:https://swupdate.open.org/community/releases/open-install-2.4.8-I602-Win10.exe
参考
https://kui.li/675.html
https://kyo86.com/2022/10/08/open/
https://blog.csdn.net/weizhen330/article/details/132244496
https://blog.csdn.net/qq_42761569/article/details/106538056