Author: tonnyom[AT]gmail.com
Date: 2011-11-04
=#==#= 环境 =#==#=
OS: CentOS5.5 VPS
IPAD IOS4
Soft: lzo-2.04
openvpn-2.2.1
GuizmOVPN
=#==#= 简介 =#==#=
http://openvpn.net/
一个用于创建虚拟专用网络加密通道的软件包
http://code.google.com/p/chnroutes/
一个兲朝网络路由表
1)节约流量
2)不影响国内访问速度
3)Fuck G.F.W!!!
http://www.guizmovpn.com/
GuizmOVPN is an OpenVPN GUI for iPhone/iPad, designed to be easy to setup, configure and run.
=#==#= Base =#==#=
mv /etc/yum.repos.d/CentOS-Base.repo /etc/yum.repos.d/CentOS-Base.repo.backup
cd /etc/yum.repos.d/
wget http://mirrors.163.com/.help/CentOS5-Base-163.repo
yum makecache
yum update
yum install -y ntp openssl-devel gcc
=#==#= OpenVPN =#==#=
mkdir -p /opt/{appz,openvpn}
cd /opt/appz
wget http://www.oberhumer.com/opensource/lzo/download/lzo-2.04.tar.gz
wget http://swupdate.openvpn.org/community/releases/openvpn-2.2.1.tar.gz
tar zxf lzo-2.04.tar.gz
tar zxf openvpn-2.2.1.tar.gz
cd lzo-2.04
./configure
make && make install
cd ../openvpn-2.2.1
./configure
make && make install
=#==#= CA =#==#=
cd /opt/openvpn
cp -Rpf /opt/appz/openvpn-2.2.1/easy-rsa/* .
cd 2.0/ && vi vars #自定义里面的各个参数 不解释
初始化变量
. vars
清空Keys目录
./clean-all
创建CA证书 keys目录下生成ca.crt(根证书文件) ca.key(根证书私钥文件)
./build-ca
生成服务器端证书 keys目录下生成server.crt(证书文件) server.key(私钥文件) server.csr(证书请求文件)
./build-key-server server
生成客户端证书 keys目录下生成vpnuser1.crt(证书文件) vpnuser1.key(私钥文件) vpnuser1.csr(证书请求文件)
./build-key vpnuser1
=#==#==#==#==#==#==#==#==#==#=
FAQ:
1)生成多个客户端证书
. vars
./build-key vpnuser2
./build-key vpnuser3
在进入 Common Name (eg, your name or your server’s hostname) []: 的输入时 每个证书输入的名字必须不同.
2)注销客户端证书
./revoke-full vpnuser1
最后会在keys目录下生成crl.pem,这个文件里面包含了吊销证书的名单.
成功注销某个证书之后,可以打开keys/index.txt文件,可以看到被注销的证书前面,已标记为R.
=#==#==#==#==#==#==#==#==#==#=
生成Diffie Hellman参数
./build-dh
=#==#= OpenVPN Server配置 =#==#=
mkdir -p /opt/openvpn/2.0/conf
cd /opt/openvpn/2.0/conf
vi server.conf
=#==#==#==#==#==#==#==#==#==#=
local server-ip
port 1194
proto udp
dev tun
ca /opt/openvpn/2.0/keys/ca.crt
cert /opt/openvpn/2.0/keys/server.crt
key /opt/openvpn/2.0/keys/server.key
dh /opt/openvpn/2.0/keys/dh1024.pem
server 10.10.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.4.4"
push "dhcp-option DNS 8.8.8.8"
client-to-client
keepalive 10 120
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
log openvpn.log
verb 3
=#==#==#==#==#==#==#==#==#==#=
=#==#= NAT 配置 =#==#=
vi sysctl.conf
=#==#==#==#==#==#==#==#==#==#=
sysctl -w net.ipv4.ip_forward=1
=#==#==#==#==#==#==#==#==#==#=
iptables -t nat -A POSTROUTING -s 10.10.0.0/24 -j SNAT --to-source server-ip
/etc/init.d/iptables save
/etc/init.d/iptables restart
/usr/local/sbin/openvpn --config /opt/openvpn/2.0/conf/server.conf &
=#==#= IPAD/IPHONE =#==#=
注: IPAD/IPHONE必须越狱
一, 下载VPN客户端所需证书(ca.crt vpnuser1.csr vpnuser1.crt vpnuser1.key)
二, 下载http://chnroutes.googlecode.com/files/routes.txt
三, 编辑VPN客户端配置文件myvpn.ovpn 加入chnroutes.txt
=#==#==#==#==#==#==#==#==#==#=
max-routes 1200
client
dev tun
proto udp
remote server-ip 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert vpnuser1.crt
key vpnuser1.key
ns-cert-type server
comp-lzo
route-method exe
route-delay 2
verb 3
route 1.12.0.0 255.252.0.0 net_gateway 5
route 1.24.0.0 255.248.0.0 net_gateway 5
route 1.45.0.0 255.255.0.0 net_gateway 5
....................
....................
=#==#==#==#==#==#==#==#==#==#=
四, IPAD/IPHONE配置
1) 登陆Cydia 搜索"GuizmOVPN" 安装
2) 使用i-FunBox连接你的IPad/iPhone 进入Raw File System/User/Documents/Configurations目录 新建个myvpn目录
3) 把编辑好的VPN客户端配置文件和CA证书放入到myvpn目录中
4) 进入GuizmOVPN 选中已经添加的VPN配置文件 然后连接即可
peace of world,enjoy it,over!
帖子
