1. 准备一台 vps 服务器
2. https://github.com/Nyr/openvpn-install 按提示install
3. http://www.canadiancontent.net/tech/download/OpenVPN_GUI.html下载client端
3.1. 将ca.crt client.crt client.key ta.key 复制 到client.config 下
4. server.conf:
local X.X.X.X //内网ip
port 1194
proto udp
dev tap
ca /etc/openvpn/server/ca.crt
cert /etc/openvpn/server/server.crt
key /etc/openvpn/server/server.key
dh /etc/openvpn/server/dh.pem
mode server
tls-server
tls-auth /etc/openvpn/server/ta.key 0
ifconfig-pool-persist /etc/openvpn/server/ipp.txt
cipher AES-256-CBC
auth SHA256
comp-lzo yes
topology subnet
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 10 120
cipher AES-256-CBC
user nobody
group nobody
persist-key
persist-tun
status /var/log/openvpn-status.log
log /var/log/openvpn.log
log-append /var/log/openvpn.log
verb 3
crl-verify /etc/openvpn/server/crl.pem
explicit-exit-notify
5. client.ovpn
client
remote X.X.X.X 1194 //vps ip
proto udp
dev tap
ca ca.crt
cert client.crt
key client.key
cipher AES-128-CBC
auth SHA256
tls-client
tls-auth ta.key 1
ifconfig 10.8.0.0 255.255.255.0 //server.conf中的server网段
persist-tun
persist-key
resolv-retry infinite
local 192.168.0.187 //本地static ip
comp-lzo yes
verb 4
6. echo 1 > /proc/sys/net/ipv4/ip_forward
7. vim /etc/sysconfig/iptables
*filter
:INPUT ACCEPT [564445:43894172]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [585640:76506641]
-A INPUT -p udp -m udp --dport 1194 -j ACCEPT
COMMIT
*nat
:PREROUTING ACCEPT [8:384]
:INPUT ACCEPT [8:384]
:OUTPUT ACCEPT [24:1491]
:POSTROUTING ACCEPT [24:1491]
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
COMMIT
8. OK!
