vpn服务搭建

最新推荐文章于 2024-12-25 10:52:14 发布

qq_28219531

最新推荐文章于 2024-12-25 10:52:14 发布

阅读量3.1k

点赞数 9

CC 4.0 BY-SA版权

文章标签： openvpn ubuntu

本文链接：https://blog.csdn.net/qq_28219531/article/details/144081125

因为需要一个服务器，所以我免费申请试用阿里云服务器
地址如下：
https://www.aliyun.com/?spm=5176.ecs-console-networkv2_.console-base_top-nav.dlogo.589c4df5gToSa0

主要做了两个改动：
更改系统和密码：
在这里插入图片描述更改安全规则：

然后用下面tcp的demo进行测试下：
server.c

#include<stdio.h>
#include<stdlib.h>
#include<string.h>
#include<errno.h>
#include<sys/types.h>
#include<sys/socket.h>
#include<netinet/in.h>
#include<unistd.h>

#define MAXLINE 4096

int main(int argc, char** argv){
    int  listenfd, connfd;
    struct sockaddr_in  servaddr;
    char  buff[4096];
    int  n;

    if( (listenfd = socket(AF_INET, SOCK_STREAM, 0)) == -1 ){
        printf("create socket error: %s(errno: %d)\n",strerror(errno),errno);
        return 0;
    }

    memset(&servaddr, 0, sizeof(servaddr));
    servaddr.sin_family = AF_INET;
    servaddr.sin_addr.s_addr = htonl(INADDR_ANY);
    servaddr.sin_port = htons(6666);

    if( bind(listenfd, (struct sockaddr*)&servaddr, sizeof(servaddr)) == -1){
        printf("bind socket error: %s(errno: %d)\n",strerror(errno),errno);
        return 0;
    }

    if( listen(listenfd, 10) == -1){
        printf("listen socket error: %s(errno: %d)\n",strerror(errno),errno);
        return 0;
    }

    printf("======waiting for client's request======\n");
    while(1){
        if( (connfd = accept(listenfd, (struct sockaddr*)NULL, NULL)) == -1){
            printf("accept socket error: %s(errno: %d)",strerror(errno),errno);
            continue;
        }
        n = recv(connfd, buff, MAXLINE, 0);
        buff[n] = '\0';
        printf("recv msg from client: %s\n", buff);
        close(connfd);
    }
    close(listenfd);
    return 0;
}

client.c

#include<stdio.h>
#include<stdlib.h>
#include<string.h>
#include<errno.h>
#include<sys/types.h>
#include<sys/socket.h>
#include<netinet/in.h>
#include<arpa/inet.h>
#include<unistd.h>
#define MAXLINE 4096

int main(int argc, char** argv){
    int   sockfd, n;
    char  recvline[4096], sendline[4096];
    struct sockaddr_in  servaddr;

    if( argc != 2){
        printf("usage: ./client <ipaddress>\n");
        return 0;
    }

    if( (sockfd = socket(AF_INET, SOCK_STREAM, 0)) < 0){
        printf("create socket error: %s(errno: %d)\n", strerror(errno),errno);
        return 0;
    }

    memset(&servaddr, 0, sizeof(servaddr));
    servaddr.sin_family = AF_INET;
    servaddr.sin_port = htons(6666);
    if( inet_pton(AF_INET, argv[1], &servaddr.sin_addr) <= 0){
        printf("inet_pton error for %s\n",argv[1]);
        return 0;
    }

    if( connect(sockfd, (struct sockaddr*)&servaddr, sizeof(servaddr)) < 0){
        printf("connect error: %s(errno: %d)\n",strerror(errno),errno);
        return 0;
    }

    printf("send msg to server: \n");
    fgets(sendline, 4096, stdin);
    if( send(sockfd, sendline, strlen(sendline), 0) < 0){
        printf("send msg error: %s(errno: %d)\n", strerror(errno), errno);
        return 0;
    }
    close(sockfd);
    return 0;
}

云服务器作为服务器，本地作为客户端进行通讯测试。

生成证书和秘钥

搭建vpn
ref：
https://ubuntu.com/server/docs/how-to-install-and-use-openvpn

安装openvpn 和easy-rsa

sudo apt update
sudo apt install openvpn easy-rsa

拷贝easy-rsa文件夹

cp /usr/share/easy-rsa/ /etc/ -R
cd /etc/easy-rsa/
cp vars.example vars

修改配置文件，（生成证书使用）
生成 pki 架构

sudo ./easyrsa init-pki

生成ca证书

sudo ./easyrsa build-ca nopass

查看ca证书如下：

root@iZ252cmxdvlnflZ:/etc/easy-rsa# ls pki/ca.crt 
pki/ca.crt

制作服务端证书（制作Server端证书（注意改命令中的server要换成前面vars文件中设置的KEY_NAME）：）

sudo ./easyrsa build-server-full server nopass

查看生成的证书如下：

root@iZ252cmxdvlnflZ:/etc/easy-rsa# ls pki/issued/
server.crt
root@iZ252cmxdvlnflZ:/etc/easy-rsa# ls pki/private/
ca.key  server.key

生成客户端证书

sudo ./easyrsa build-client-full client nopass

查看生成的证书如下：

root@iZ252cmxdvlnflZ:/etc/easy-rsa# ls pki/issued/
client.crt  server.crt
root@iZ252cmxdvlnflZ:/etc/easy-rsa# ls pki/private/
ca.key  client.key  server.key

创建迪菲·赫尔曼密钥

sudo ./easyrsa gen-dh

查看秘钥：

root@iZ252cmxdvlnflZ:/etc/easy-rsa# ls /etc/easy-rsa/pki/dh.pem
/etc/easy-rsa/pki/dh.pem

服务端配置

拷贝服务配置，证书，秘钥

root@iZ252cmxdvlnflZ:/etc/openvpn# sudo cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz /etc/openvpn/
root@iZ252cmxdvlnflZ:/etc/openvpn# cd /etc/openvpn/
root@iZ252cmxdvlnflZ:/etc/openvpn# sudo gzip -d server.conf.gz
root@iZ252cmxdvlnflZ:/etc/openvpn# cp /etc/easy-rsa/pki/issued/client.crt client/
root@iZ252cmxdvlnflZ:/etc/openvpn# cp /etc/easy-rsa/pki/private/client.key client/
root@iZ252cmxdvlnflZ:/etc/openvpn# cp /etc/easy-rsa/pki/private/server.key server
root@iZ252cmxdvlnflZ:/etc/openvpn# cp /etc/easy-rsa/pki/issued/server.crt server
root@iZ252cmxdvlnflZ:/etc/openvpn# cp /etc/easy-rsa/pki/ca.crt .
root@iZ252cmxdvlnflZ:/etc/openvpn# cp /etc/easy-rsa/pki/dh.pem .

生成ta.key

sudo openvpn --genkey --secret ta.key

修改server.conf配置文件（启动服务端vpn使用）

ca ca.crt
cert server/server.crt
key server/server.key  # This file should be kept secret
dh dh.pem

log         /var/log/openvpn/openvpn.log
log-append  /var/log/openvpn/openvpn.log

启动server

systemctl start openvpn@server.service

查看状态：

root@iZ252cmxdvlnflZ:/etc/openvpn# systemctl status openvpn@server.service
● openvpn@server.service - OpenVPN connection to server
     Loaded: loaded (/lib/systemd/system/openvpn@.service; disabled; vendor preset: enabled)
     Active: active (running) since Wed 2024-11-27 14:32:57 CST; 2min 56s ago
       Docs: man:openvpn(8)
             https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage
             https://community.openvpn.net/openvpn/wiki/HOWTO
   Main PID: 8817 (openvpn)
     Status: "Initialization Sequence Completed"
      Tasks: 1 (limit: 2173)
     Memory: 1.1M
     CGroup: /system.slice/system-openvpn.slice/openvpn@server.service
             └─8817 /usr/sbin/openvpn --daemon ovpn-server --status /run/openvpn/server.status 10 --cd /etc/open>

Nov 27 14:32:57 iZ252cmxdvlnflZ systemd[1]: Starting OpenVPN connection to server...
Nov 27 14:32:57 iZ252cmxdvlnflZ systemd[1]: Started OpenVPN connection to server.

查看网卡：

root@iZ252cmxdvlnflZ:/etc/openvpn# ifconfig 
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 172.16.18.197  netmask 255.255.240.0  broadcast 172.16.31.255
        inet6 fe80::216:3eff:fe0c:d633  prefixlen 64  scopeid 0x20<link>
        ether 00:16:3e:0c:d6:33  txqueuelen 1000  (Ethernet)
        RX packets 91345  bytes 106649779 (106.6 MB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 24260  bytes 3826096 (3.8 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 1432  bytes 124030 (124.0 KB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 1432  bytes 124030 (124.0 KB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1500
        inet 10.8.0.1  netmask 255.255.255.255  destination 10.8.0.2
        inet6 fe80::4fe3:6a1f:a65a:6ee4  prefixlen 64  scopeid 0x20<link>
        unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 100  (UNSPEC)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 6  bytes 288 (288.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

客户端配置

拷贝客户端证书到本地：

scp root@121.41.21.2:/etc/openvpn/{ca.crt,ta.key,client/*}  .

拷贝配置文件至本地

sudo cp /usr/share/doc/openvpn/examples/sample-config-files/client.conf /etc/openvpn/

修改服务器ip：

remote 121.41.23.217 1194

启动客户端服务

systemctl restart openvpn@client.service

查看服务：

ab@zsf:~$ systemctl status openvpn@client.service 
● openvpn@client.service - OpenVPN connection to client
   Loaded: loaded (/lib/systemd/system/openvpn@.service; indirect; vendor preset: enabled)
   Active: active (running) since Wed 2024-11-27 15:11:25 CST; 1min 48s ago
     Docs: man:openvpn(8)
           https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage
           https://community.openvpn.net/openvpn/wiki/HOWTO
 Main PID: 16094 (openvpn)
   Status: "Initialization Sequence Completed"
    Tasks: 1 (limit: 4915)
   CGroup: /system.slice/system-openvpn.slice/openvpn@client.service
           └─16094 /usr/sbin/openvpn --daemon ovpn-client --status /run/openvpn/client.status 10 --cd /etc/openvpn --script-security 2 --con

11月 27 15:11:27 zsf ovpn-client[16094]: Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
11月 27 15:11:27 zsf ovpn-client[16094]: ROUTE_GATEWAY 192.168.6.1/255.255.254.0 IFACE=wlp3s0 HWADDR=e0:0a:f6:66:89:77
11月 27 15:11:27 zsf ovpn-client[16094]: TUN/TAP device tun0 opened
11月 27 15:11:27 zsf ovpn-client[16094]: TUN/TAP TX queue length set to 100
11月 27 15:11:27 zsf ovpn-client[16094]: do_ifconfig, tt->did_ifconfig_ipv6_setup=0
11月 27 15:11:27 zsf ovpn-client[16094]: /sbin/ip link set dev tun0 up mtu 1500
11月 27 15:11:27 zsf ovpn-client[16094]: /sbin/ip addr add dev tun0 local 10.8.0.6 peer 10.8.0.5
11月 27 15:11:27 zsf ovpn-client[16094]: /sbin/ip route add 10.8.0.1/32 via 10.8.0.5
11月 27 15:11:27 zsf ovpn-client[16094]: WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent
11月 27 15:11:27 zsf ovpn-client[16094]: Initialization Sequence Completed

查看ip：

tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1500
        inet 10.8.0.6  netmask 255.255.255.255  destination 10.8.0.5
        inet6 fe80::acb:fd92:81e6:b85f  prefixlen 64  scopeid 0x20<link>
        unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 100  (UNSPEC)
        RX packets 1  bytes 48 (48.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 7  bytes 352 (352.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

wlp3s0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.6.175  netmask 255.255.254.0  broadcast 192.168.7.255
        inet6 fe80::ec91:2a62:1ed8:2212  prefixlen 64  scopeid 0x20<link>
        ether e0:0a:f6:66:89:77  txqueuelen 1000  (Ethernet)
        RX packets 468997  bytes 464534544 (464.5 MB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 215962  bytes 50624522 (50.6 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0