信息来源：邪恶八进制信息安全团队（
www.eviloctal.com）
原始出处：
http://www.51nb.com/forum/viewth ... p;highlight=OPENVPN
文章作者：fangzy
基础篇
基础篇
前言
为了突破CMWAP的种种限制，广大网友想出了各种办法，通过移动代理连接SSL VPN服务器上网是比较方便的一种，但是由于softether系列的稳定性、兼容性较差，我们不得不重新寻找更适合的软件。OpenVPN就是一款功能强大，可跨平台(支持Win 2000/XP/2003, Linux, Mac OS X, Solaris, FreeBSD, NetBSD, 和 OpenBSD)使用的SSL VPN服务器软件（具体说明见官方主页官方主页，我就不翻译了）。经过这一段时间的测试(
http://www.thinkpad.cn/forum/viewthread.php?tid=332066)，虽然还存在不少问题，但是总体说来OpenVPN的表现不错。
本文是为CMWAP和CDMA上网的用户写的，所以有些配置不适合客户端使用宽带的人。
--------------------------------------------------------------------------------
感谢 myliyifei 的支持和配合(其实我是被他拖下水的)，感谢 wyun 审稿，感谢参加测试的各位兄弟。
--------------------------------------------------------------------------------
Server端环境
OS:WINDOWS XP SP2
ADSL拨号上网
Step 1 OpenVPN安装配置
1.1 下载openvpn 并安装
下载openvpn-2.0.5-gui-1.0.3版，地址
http://openvpn.se/files/install_ ... i-1.0.3-install.exe，安装。(例如：安装到F:\OPENVPN目录下，下文举例都用此目录)
安装完成后生成一个新网卡，并在网络连接里出现本地连接[X]，把tcp/ip属性改成手动配置,192.168.10.1(根据实际情况更改) ,255.255.255.0，其余不填。
1.2 生成证书
修改F:\OpenVPN\easy-rsa\vars.bat.sample的以下部分
复制内容到剪贴板
代码:
set HOME=%ProgramFiles%\OpenVPN\easy-rsa
set KEY_COUNTRY=US
set KEY_PROVINCE=CA
set KEY_CITY=SanFrancisco
set KEY_ORG=FortFunston
set KEY_EMAIL=mail@host.domain（请根据自身情况修改）改为
复制内容到剪贴板
代码:
set HOME=F:\OpenVPN\easy-rsa
set KEY_COUNTRY=CN
set KEY_PROVINCE=Hubei
set KEY_CITY=Wuhan
set KEY_ORG=51NB
set KEY_EMAIL=MATONG_01@163.COM生成证书
OpenVPN 有两种安全模式，一种基于使用 RSA 证书和密钥的 SSL/TLS，一种使用预先分享的静态密钥。本文采用SSL/TLS 模式。TLS模式的优点是安全，而且便于管理用户。默认情况下证书和用户是一对一的，多个用户使用同一证书会被踢出。
开始-->运行...-->键入cmd，回车，进入命令提示符-->进入F:\OpenVPN\easy-rsa目录
复制内容到剪贴板
代码:
F:\OpenVPN\easy-rsa>执行如下命令
复制内容到剪贴板
代码:
init-config复制内容到剪贴板
代码:
F:\OpenVPN\easy-rsa>init-config
F:\OpenVPN\easy-rsa>copy vars.bat.sample vars.bat
已复制 1 个文件。
F:\OpenVPN\easy-rsa>copy openssl.cnf.sample openssl.cnf
已复制 1 个文件。复制内容到剪贴板
代码:
vars复制内容到剪贴板
代码:
clean-all复制内容到剪贴板
代码:
F:\OpenVPN\easy-rsa>vars
F:\OpenVPN\easy-rsa>clean-all
系统找不到指定的文件。
已复制 1 个文件。
已复制 1 个文件。复制内容到剪贴板
代码:
vars
build-ca
build-dh复制内容到剪贴板
代码:
F:\OpenVPN\easy-rsa>vars
F:\OpenVPN\easy-rsa>build-ca #生成根证书
Loading 'screen' into random state - done
Generating a 1024 bit RSA private key
.........++++++
.......................................++++++
writing new private key to 'keys\ca.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]:
State or Province Name (full name) [Hubei]:
Locality Name (eg, city) [Wuhan]:
Organization Name (eg, company) [51NB]:
Organizational Unit Name (eg, section) []:CMWAP
Common Name (eg, your name or your server's hostname) []:fangzy #填自己的名字
Email Address [[email]mail@host.doma[/email]in]:
F:\OpenVPN\easy-rsa>build-dh #这个有点慢，估计要半分钟
Loading 'screen' into random state - done
Generating DH parameters, 1024 bit long safe prime, generator 2
This is going to take a long time
....................+...........................................................
...............+......................+........+................................
.....................................+..........................................
..........................+..+.....................+......+.....................
.......+.+...............................................+......................
...........................................................+.........+..........
..........+.................................+.........................+.........
...................................................+..............+.............
............+...........................+...........................+....+......
................................................................................
.....................+..............................+...........................
................................................................................
..........+.....................++*++*++*复制内容到剪贴板
代码:
build-key-server server复制内容到剪贴板
代码:
F:\OpenVPN\easy-rsa>build-key-server server #生成服务器端的密钥，server为服务器名
Loading 'screen' into random state - done
Generating a 1024 bit RSA private key
.........++++++
....................................++++++
writing new private key to 'keys\server.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]:
State or Province Name (full name) [Hubei]:
Locality Name (eg, city) [Wuhan]:
Organization Name (eg, company) [51NB]:
Organizational Unit Name (eg, section) []:CMWAP
Common Name (eg, your name or your server's hostname) []:server #填自己的名字
Email Address [[email]mail@host.doma[/email]in]:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:xxxx #输入4位以上的密码
An optional company name []:
Using configuration from openssl.cnf
Loading 'screen' into random state - done
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName :PRINTABLE:'CN'
stateOrProvinceName :PRINTABLE:'Hubei'
localityName :PRINTABLE:'Wuhan'
organizationName :PRINTABLE:'51NB'
organizationalUnitName:PRINTABLE:'CMWAP'
commonName :PRINTABLE:'server'
emailAddress :IA5STRING:'[email]mail@host.doma[/email]in'
Certificate is to be certified until Feb 1 05:30:29 2016 GMT (3650 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated复制内容到剪贴板
代码:
build-key client复制内容到剪贴板
代码:
F:\OpenVPN\easy-rsa>build-key client #生成客户端的密钥，client为用户名
Loading 'screen' into random state - done
Generating a 1024 bit RSA private key
.............++++++
....++++++
writing new private key to 'keys\client.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]:
State or Province Name (full name) [Hubei]:
Locality Name (eg, city) [Wuhan]:
Organization Name (eg, company) [51NB]:
Organizational Unit Name (eg, section) []:CMWAP
Common Name (eg, your name or your server's hostname) []:client
Email Address [[email]mail@host.doma[/email]in]:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:xxxx
An optional company name []:
Using configuration from openssl.cnf
Loading 'screen' into random state - done
DEBUG[load_index]: unique_subject = "yes"
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName :PRINTABLE:'CN'
stateOrProvinceName :PRINTABLE:'Hubei'
localityName :PRINTABLE:'Wuhan'
organizationName :PRINTABLE:'51NB'
organizationalUnitName:PRINTABLE:'CMWAP'
commonName :PRINTABLE:'client'
emailAddress :IA5STRING:'[email]mail@host.doma[/email]in'
Certificate is to be certified until Feb 1 05:31:40 2016 GMT (3650 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated生成多个客户端密钥，执行build-key client1 …… build-key xyz。
复制证书文件
刚才生成的证书文件在F:\OpenVPN\easy-rsa\keys下，服务器端需要的文件为ca.crt,dh1024.pem,server.crt,server.key ，客户端需要的文件为：ca.crt client.crt client.key(xxx.crt xxx.key)，配置.ovpn文件时需要用到。
1.3 配置server.ovpn文件
在\OpenVPN\config目录下创建server.ovpn文件将ca.crt,dh1024.pem,server.crt,server.key复制到F:\OpenVPN\KEY目录下
服务器端文件示例：
server.ovpn
复制内容到剪贴板
代码:
port 443
proto tcp-server
dev tun
server 192.168.10.0 255.255.255.0
keepalive 20 180
ca F:\\OPENVPN\\KEY\\ca.crt
cert F:\\OPENVPN\\KEY\\server.crt
key F:\\OPENVPN\\KEY\\server.key
dh F:\\OPENVPN\\KEY\\dh1024.pem
push "redirect-gateway def1"
push "dhcp-option DNS 192.168.10.1"
mode server
tls-server
status F:\\OpenVPN\\log\\openvpn-status.log
comp-lzo
verb 41.4 客户端安装与配置
安装OpenVPN，同1.1，但是不用更改本地连接设置。
配置OpenVPN
在\OpenVPN\config目录下创建client.ovpn文件，将ca.crt client.crt
client.key 复制到\OpenVPN\KEY目录下，这3个文件由服务器端生成并发放。
客户端文件示例：
client.ovpn
复制内容到剪贴板
代码:
client
dev tun
proto tcp-client
remote fangzy.3322.org 443
resolv-retry infinite
nobind
http-proxy 10.0.0.172 80 #这里填入你的代理服务器地址和端口
mute-replay-warnings
ca F:\\OPENVPN\\KEY\\ca.crt
cert F:\\OPENVPN\\KEY\\client.crt #这里改成每个客户端相应的证书
key F:\\OPENVPN\\KEY\\client.key #这里改成每个客户端相应的证书
comp-lzo
verb 4
status openvpn-status.log右击openvpn-gui图标，点connect，即可连接。
至此 OpenVPN的配置结束，更详细资料请参阅
http://openvpn.net/howto.html
--------------------------------------------------------------------------------
注：本文参考了《用OpenVPN构建安全VPN [OpenVPN + CA] 》 BY ELM
--------------------------------------------------------------------------------
我们已经配置好了OpenVPN，但是要使客户端上网的话，服务器端还要再安装代理服务器软件(linux下可配置iptable防火墙实现NAT)，WINDOWS下面的代理服务器软件很多，有企业级的ISA，有Kerio WinRoute Firewall，WinGate，Sygate，还有国产的ccproxy。此次测试采用的是WinGate 5.2.3。
Setp2 WinGate安装与配置
2.1 WinGate的安装
禁用Windows Firewall/Internet Connection Sharing (ICS)服务
执行安装文件，保证ENS服务被安装，重新启动电脑
2.2 WinGate的配置
先停止WinGate服务
启动OpenVPN服务，确保本地连接的状态为"已连接上"
启动WinGate服务，选择Start Engine
注：WinGate 5是在启动服务时将服务与网卡ip绑定上，换用WinGate 6就不会这么麻烦了
禁用DHCP Service，或者将192.168.10.1(VPN IP)取消绑定
禁用不必要的服务，确保Extended Network 打开
在WinGate 5的防火墙中打开443端口，或者直接将防火墙禁用。
现在大功告成，客户端可以像平时用宽带一样浏览网页，不需要设置代理服务器。
--------------------------------------------------------------------------------
第一次写教程，有表述不清的地方还请见谅。欢迎大家讨论OpenVPN服务器端配置方面的问题，如果有更好用的SSL VPN服务器软件也介绍一下。客户端出现问题请在这里讨论
http://www.thinkpad.cn/forum/viewthread.php?tid=332066 。
我还会陆续发布这次测试的使用心得，最后说一句：
希望有人能长期免费提供OpenVPN服务器。
by fangzy
email:matong_01[AT]163.com
