一、安装准备

yum -y install openssl-devel openssl
yum -y install gcc gcc-c++

二、OpenVPN服务端安装过程

1.lzo下载与安装

cd /apps  #安装目录
wget ftp://www.wudonghang.com/soft/openvpn-2.1_rc15.tar.gz #下载lzo
tar zxvf lzo-2.04.tar.gz  #解压
cd lzo-2.04
./configure ; make ; make install  #编译与安装 

2.openvpn下载与安装

cd /apps
wget http://openvpn.net/release/openvpn-2.1_rc15.tar.gz
tar zxvf openvpn-2.1_rc15.tar.gz
cd openvpn-2.1_rc15
./configure ; make ; make install

3.服务器端设置

cp -r /apps/openvpn-2.1_rc15/ /etc/openvpn #用easy-rsa生成服务器证书客户端证书 

4.初始化参数

将解压目录的easy-rsa目录复制到 /etc/openvpn下

cd /etc/openvpn/easy-rsa/2.0
./vars
source vars 

5.生成CA证书

./clean-all
./build-ca 

6.建立server key(一直回车）

./build-key-server server

7.生成diffie hellman参数

./build-dh 

8.复制ca证书，服务端证书到OpenVPN配置目录

复制代码 代码如下:
cp keys/{ca.crt,ca.key,server.crt,server.key,dh1024.pem} /etc/openvpn/

9.生成client key

./build-key client1 #与server key 设置一致

如要生成多个vpn账户，则与client1一样生成其他客户端证书如

./build-key client2
./build-key client3

10.生成客户端配置文件client1.ovpn

vi /etc/openvpn/easy-rsa/2.0/keys/client1.ovpn

client
remote 192.168.80.129 1194
dev tun #说明连接方式是点对点的连接，如要以以太网的方式则可以将tun修改为tap
proto tcp
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client1.crt
key client1.key
ns-cert-type server
comp-lzo
route-delay 2
route-method exe
verb 3

11.打包客户端配置文件证书等

tar czf keys.tgz ca.crt ca.key client1.crt client1.csr client1.key client1.ovpn
mv keys.tgz /root 

12.创建并编辑服务器端配置文件server.conf

port 1194
proto tcp
dev tun #说明连接方式是点对点的连接，如要以以太网的方式则可以将tun修改为tap
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway"
push "route 172.18.2.0 255.255.255.0" #路由转发到内网网段
push "dhcp-option DNS 172.18.2.1"
push "dhcp-option DNS 8.8.8.8"
keepalive 10 120
comp-lzo
persist-key
persist-tun
client-to-client #如果不加则各个客户端之间将无法连接 

13.对防火墙的相关设置

echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o venet0 -j MASQUERADE
iptables-save > /etc/sysconfig/iptables
sed -i 's/eth0/venet0/g' /etc/sysconfig/iptables # dirty vz fix for iptables-save
echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf