检查系统环境
[[email protected] ~]# cat /etc/redhat-release CentOS Linux release 7.0.1406 (Core) [[email protected] ~]# df -hP Filesystem Size Used Avail Use% Mounted on /dev/ploop12288p1 30G 484M 28G 2% / devtmpfs 256M 0 256M 0% /dev tmpfs 256M 0 256M 0% /dev/shm tmpfs 256M 88K 256M 1% /run tmpfs 256M 0 256M 0% /sys/fs/cgroup [[email protected] ~]# cat /dev/net/tun cat: /dev/net/tun: File descriptor in bad state [[email protected] ~]# grep IPADDR /etc/sysconfig/network-scripts/ifcfg-venet0:0 | awk -F= '{print $2}' 104.223.122.202 [[email protected] ~]#
系统初始化下
[[email protected] ~]# curl -Lks onekey.sh/centos_init|bash [[email protected] ~]# reboot
更新源
[[email protected] ~]# yum clean all && yum makecache && yum install epel-release -y && yum update -y
将CentOS 7的FrieWall换成iptables
bash -c "$(curl -Ls onekey.sh/friewall2iptables)"
yum安装openvpn
[[email protected] ~]# yum install openvpn easy-rsa net-tools -y 配置openvpn Server端 [[email protected] ~]# cp /usr/share/doc/openvpn-2.3.11/sample/sample-config-files/server.conf /etc/openvpn/ [[email protected] ~]# mkdir /etc/openvpn/easy-rsa [[email protected] ~]# /bin/cp -rf /usr/share/easy-rsa/2.0/* /etc/openvpn/easy-rsa [[email protected] ~]# cd /etc/openvpn/easy-rsa [[email protected] /etc/openvpn/easy-rsa]# vi vars #参考下面的图做修改
[[email protected] /etc/openvpn/easy-rsa]# source ./vars NOTE: If you run ./clean-all, I will be doing a rm -rf on /etc/openvpn/easy-rsa/keys
使用build-ca脚本构建CA证书，证书将创建在/etc/openvpn/easy-rsa/。按Enter键接受默认值：
[[email protected] /etc/openvpn/easy-rsa]# ./build-ca Generating a 2048 bit RSA private key .....................................................................+++ ..........................................+++ writing new private key to 'ca.key' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [CN]: State or Province Name (full name) [ShangHai]: Locality Name (eg, city) [PuDong]: Organization Name (eg, company) [Prime Research Asia]: Organizational Unit Name (eg, section) [Social Media]: Common Name (eg, your name or your server's hostname) [Prime Research Asia CA]: Name [EasyRSA]: Email Address [[email protected]]: [[email protected] /etc/openvpn/easy-rsa]#
下一步，我们将创建密钥和服务器本身的证书。和以前一样，接受默认值，然后按Y确认证书的签字：
[[email protected] /etc/openvpn/easy-rsa]# ./build-key-server server Generating a 2048 bit RSA private key ............................+++ ...................+++ writing new private key to 'server.key' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [CN]: State or Province Name (full name) [ShangHai]: Locality Name (eg, city) [PuDong]: Organization Name (eg, company) [Prime Research Asia]: Organizational Unit Name (eg, section) [Social Media]: Common Name (eg, your name or your server's hostname) [server]: Name [EasyRSA]: Email Address [[email protected]]: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: Using configuration from /etc/openvpn/easy-rsa/openssl-1.0.0.cnf Check that the request matches the signature Signature ok The Subject's Distinguished Name is as follows countryName :PRINTABLE:'CN' stateOrProvinceName :PRINTABLE:'ShangHai' localityName :PRINTABLE:'PuDong' organizationName :PRINTABLE:'Prime Research Asia' organizationalUnitName:PRINTABLE:'Social Media' commonName :PRINTABLE:'server' name :PRINTABLE:'EasyRSA' emailAddress :IA5STRING:'[email protected]' Certificate is to be certified until Jun 11 18:27:02 2026 GMT (3650 days) Sign the certificate? [y/n]:y 1 out of 1 certificate requests certified, commit? [y/n]y Write out database with 1 new entries Data Base Updated [[email protected] /etc/openvpn/easy-rsa]#
接下来，生成用于信息交流，以补充对RSA的Diffie-Hellman文件（这将需要相当长的一段时间）。这将创建一个名为dh2048.pem内的/ etc / OpenVPN的/ RSA /密钥文件中：
[[email protected] /etc/openvpn/easy-rsa]# ./build-dh Generating DH parameters, 2048 bit long safe prime, generator 2 This is going to take a long time ..................+.................
最后，为每个使用VPN服务器的客户端创建单独的证书文件：
[[email protected] /etc/openvpn/easy-rsa]# ./build-key 104.233.122.202-lookback Generating a 2048 bit RSA private key ...+++ ...........................................................+++ writing new private key to '104.233.122.202-lookback.key' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [CN]: State or Province Name (full name) [ShangHai]: Locality Name (eg, city) [PuDong]: Organization Name (eg, company) [Prime Research Asia]: Organizational Unit Name (eg, section) [Social Media]: Common Name (eg, your name or your server's hostname) [104.233.122.202-lookback]: Name [EasyRSA]: Email Address [[email protected]]: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: Using configuration from /etc/openvpn/easy-rsa/openssl-1.0.0.cnf Check that the request matches the signature Signature ok The Subject's Distinguished Name is as follows countryName :PRINTABLE:'CN' stateOrProvinceName :PRINTABLE:'ShangHai' localityName :PRINTABLE:'PuDong' organizationName :PRINTABLE:'Prime Research Asia' organizationalUnitName:PRINTABLE:'Social Media' commonName :PRINTABLE:'104.233.122.202-lookback' name :PRINTABLE:'EasyRSA' emailAddress :IA5STRING:'[email protected]' Certificate is to be certified until Jun 11 18:35:47 2026 GMT (3650 days) Sign the certificate? [y/n]:y 1 out of 1 certificate requests certified, commit? [y/n]y Write out database with 1 new entries Data Base Updated [[email protected] /etc/openvpn/easy-rsa]#
防止VPN被DDOS攻击，生成ta.key
[[email protected] /etc/openvpn/easy-rsa]# openvpn --genkey --secret ../ta.key
接下来开始修改server端的配置文件
[[email protected] /etc/openvpn/easy-rsa]# cp keys/{ca.crt,dh2048.pem,server.crt,server.key} /etc/openvpn/ [[email protected] /etc/openvpn/easy-rsa]# cd .. [[email protected] /etc/openvpn]# vi server.conf
###下面是我的配置文件可以参考 [[email protected] /etc/openvpn]# grep -Ev '^($|#)' server.conf ;local a.b.c.d #指定监听的本机IP(因为有些计算机具备多个IP地址)，该命令是可选的，默认监听所有IP地址。 port 22033 #服务端端口号，根据需要自行修改 proto tcp #通过tcp协议来连接，也可以通过udp，看实际的需求 ;proto udp ;dev tap dev tun #路由模式，注意windows下必须使用dev tap ;dev-node MyTap #非Windows系统通常不需要设置这个 ca ca.crt #ca证书存放位置，这边是放在默认路径下的不需要修改，如果放在其他路径下，后面要加上绝对路径，根据实际情况更改 cert server.crt #服务器证书存放位置，这边是放在默认路径下的不需要修改，如果放在其他路径下，后面要加上绝对路径，根据实际情况更改 key server.key #服务器密钥存放位置，这边是放在默认路径下的不需要修改，如果放在其他路径下，后面要加上绝对路径，根据实际情况更改 dh dh2048.pem #dh2048.pem存放位置，这边是放在默认路径下的不需要修改，如果放在其他路径下，后面要加上绝对路径，根据实际情况更改 ;topology subnet server 10.188.0.0 255.255.0.0 #虚拟局域网网段设置，请根据需要自行修改 ifconfig-pool-persist ipp.txt #在openvpn重启时,再次连接的客户端将依然被分配和以前一样的IP地址 ;server-bridge 10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100 ;server-bridge ;push "route 192.168.10.0 255.255.255.0" ;push "route 192.168.20.0 255.255.255.0" push "route 0.0.0.0 0.0.0.0" #全网走openvpn ;client-config-dir ccd ;route 192.168.40.128 255.255.255.248 ;client-config-dir ccd ;route 10.9.0.0 255.255.255.252 ;learn-address ./script push "redirect-gateway def1 bypass-dhcp" #客户端所有网络通信通过vpn，这个可以选择的，如果注释掉的话那就是本地的数据包还是从本地出去，不强制走VPN push "dhcp-option DNS 8.8.8.8" #指定客户端使用的主DNS push "dhcp-option DNS 8.8.4.4" #指定客户端使用的备DNS client-to-client #开启客户端互访 duplicate-cn #支持一个证书多个客户端登录使用，建议不启用 keepalive 5 30 #服务端5面监测一次，如果30秒没响应就认定客户端down了 tls-auth ta.key 0 #防DDOS攻击，服务器端0,客户端1 ;cipher BF-CBC # Blowfish (default) #这是默认的加密算法 ;cipher AES-128-CBC # AES ;cipher DES-EDE3-CBC # Triple-DES comp-lzo #允许数据压缩，如果启用了客户端配置文件也需要有这项 max-clients 100 #最大客户端并发连接数量 user nobody #定义运行openvpn的用户 group nobody #定义运行openvpn的用户组 persist-key #通过keepalive检测超时后，重新启动VPN，不重新读取keys，保留第一次使用的keys persist-tun #通过keepalive检测超时后，重新启动VPN，一直保持tun或者tap设备是linkup的，否则网络连接会先linkdown然后linkup status /tmp/openvpn-status.log #定期把openvpn的一些状态信息写到文件中，以便自己写程序计费或者进行其他操作 ;log openvpn.log #记录日志，每次重新启动openvpn后删除原有的log信息 log-append /tmp/openvpn.log #记录日志，每次重新启动openvpn后追加原有的log信息 verb 3 #设置日志要记录的级别，可选0-9，0 只记录错误信息，4 能记录普通的信息，5 和 6 在连接出现问题时能帮助调试，9 是极端的，所有信息都会显示，甚至连包头等信息都显示（像tcpdump） mute 20 #相同信息的数量，如果连续出现 20 条相同的信息，将不记录到日志中。 [[email protected] /etc/openvpn]#
[[email protected] /etc/openvpn]# echo -e "###OpenVPN ADD\nnet.ipv4.conf.default.accept_source_route = 1\nnet.ipv4.conf.default.rp_filter = 0\nnet.ipv4.ip_forward = 1" >> /etc/sysctl.conf [[email protected] /etc/openvpn]# sysctl -p net.ipv4.conf.default.accept_source_route = 1 net.ipv4.conf.default.rp_filter = 0 net.ipv4.ip_forward = 1 [[email protected] /etc/openvpn]#
[[email protected] /etc/openvpn]# systemctl -f enable [email protected] Created symlink from /etc/systemd/system/multi-user.target.wants/[email protected] to /usr/lib/systemd/system/[email protected]. [[email protected] /etc/openvpn]# systemctl start [email protected] [[email protected] /etc/openvpn]# systemctl -l status [email protected] ● [email protected] - OpenVPN Robust And Highly Flexible Tunneling Application On server Loaded: loaded (/usr/lib/systemd/system/[email protected]; enabled; vendor preset: disabled) Active: active (running) since 一 2016-06-13 16:08:20 EDT; 10s ago Process: 6464 ExecStart=/usr/sbin/openvpn --daemon --writepid /var/run/openvpn/%i.pid --cd /etc/openvpn/ --config %i.conf (code=exited, status=0/SUCCESS) Main PID: 6465 (openvpn) CGroup: /system.slice/system-openvpn.slice/[email protected] └─6465 /usr/sbin/openvpn --daemon --writepid /var/run/openvpn/server.pid --cd /etc/openvpn/ --config server.conf 6月 13 16:08:20 ss-usa-odo01.90r.org systemd[1]: Starting OpenVPN Robust And Highly Flexible Tunneling Application On server... 6月 13 16:08:20 ss-usa-odo01.90r.org systemd[1]: Started OpenVPN Robust And Highly Flexible Tunneling Application On server. [[email protected] /etc/openvpn]# cat /tmp/openvpn.log Mon Jun 13 16:07:47 2016 us=2075 Current Parameter Settings: Mon Jun 13 16:07:47 2016 us=2135 config = 'server.conf' Mon Jun 13 16:07:47 2016 us=2144 mode = 1 Mon Jun 13 16:07:47 2016 us=2150 persist_config = DISABLED Mon Jun 13 16:07:47 2016 us=2156 persist_mode = 1 Mon Jun 13 16:07:47 2016 us=2162 show_ciphers = DISABLED Mon Jun 13 16:07:47 2016 us=2168 show_digests = DISABLED Mon Jun 13 16:07:47 2016 us=2174 show_engines = DISABLED Mon Jun 13 16:07:47 2016 us=2180 genkey = DISABLED Mon Jun 13 16:07:47 2016 us=2185 key_pass_file = '[UNDEF]' Mon Jun 13 16:07:47 2016 us=2192 show_tls_ciphers = DISABLED Mon Jun 13 16:07:47 2016 us=2199 Connection profiles [default]: Mon Jun 13 16:07:47 2016 us=2206 proto = tcp-server Mon Jun 13 16:07:47 2016 us=2214 local = '[UNDEF]' Mon Jun 13 16:07:47 2016 us=2219 local_port = 22033 Mon Jun 13 16:07:47 2016 us=2224 remote = '[UNDEF]' Mon Jun 13 16:07:47 2016 us=2229 remote_port = 22033 Mon Jun 13 16:07:47 2016 us=2234 remote_float = DISABLED Mon Jun 13 16:07:47 2016 us=2240 bind_defined = DISABLED Mon Jun 13 16:07:47 2016 us=2246 bind_local = ENABLED Mon Jun 13 16:07:47 2016 us=2252 connect_retry_seconds = 5 Mon Jun 13 16:07:47 2016 us=2258 connect_timeout = 10 Mon Jun 13 16:07:47 2016 us=2264 connect_retry_max = 0 Mon Jun 13 16:07:47 2016 us=2271 socks_proxy_server = '[UNDEF]' Mon Jun 13 16:07:47 2016 us=2277 socks_proxy_port = 0 Mon Jun 13 16:07:47 2016 us=2283 socks_proxy_retry = DISABLED Mon Jun 13 16:07:47 2016 us=2289 tun_mtu = 1500 Mon Jun 13 16:07:47 2016 us=2305 tun_mtu_defined = ENABLED Mon Jun 13 16:07:47 2016 us=2311 link_mtu = 1500 Mon Jun 13 16:07:47 2016 us=2316 link_mtu_defined = DISABLED Mon Jun 13 16:07:47 2016 us=2322 tun_mtu_extra = 0 Mon Jun 13 16:07:47 2016 us=2327 tun_mtu_extra_defined = DISABLED Mon Jun 13 16:07:47 2016 us=2333 mtu_discover_type = -1 Mon Jun 13 16:07:47 2016 us=2338 fragment = 0 Mon Jun 13 16:07:47 2016 us=2344 mssfix = 1450 Mon Jun 13 16:07:47 2016 us=2350 explicit_exit_notification = 0 Mon Jun 13 16:07:47 2016 us=2357 Connection profiles END Mon Jun 13 16:07:47 2016 us=2363 remote_random = DISABLED Mon Jun 13 16:07:47 2016 us=2368 ipchange = '[UNDEF]' Mon Jun 13 16:07:47 2016 us=2373 dev = 'tun' Mon Jun 13 16:07:47 2016 us=2378 dev_type = '[UNDEF]' Mon Jun 13 16:07:47 2016 us=2382 dev_node = '[UNDEF]' Mon Jun 13 16:07:47 2016 us=2388 lladdr = '[UNDEF]' Mon Jun 13 16:07:47 2016 us=2394 topology = 1 Mon Jun 13 16:07:47 2016 us=2400 tun_ipv6 = DISABLED Mon Jun 13 16:07:47 2016 us=2405 ifconfig_local = '10.188.0.1' Mon Jun 13 16:07:47 2016 us=2411 ifconfig_remote_netmask = '10.188.0.2' Mon Jun 13 16:07:47 2016 us=2416 ifconfig_noexec = DISABLED Mon Jun 13 16:07:47 2016 us=2422 ifconfig_nowarn = DISABLED Mon Jun 13 16:07:47 2016 us=2437 ifconfig_ipv6_local = '[UNDEF]' Mon Jun 13 16:07:47 2016 us=2442 ifconfig_ipv6_netbits = 0 Mon Jun 13 16:07:47 2016 us=2487 ifconfig_ipv6_remote = '[UNDEF]' Mon Jun 13 16:07:47 2016 us=2494 shaper = 0 Mon Jun 13 16:07:47 2016 us=2500 mtu_test = 0 Mon Jun 13 16:07:47 2016 us=2506 mlock = DISABLED Mon Jun 13 16:07:47 2016 us=2512 keepalive_ping = 5 Mon Jun 13 16:07:47 2016 us=2518 keepalive_timeout = 30 Mon Jun 13 16:07:47 2016 us=2523 inactivity_timeout = 0 Mon Jun 13 16:07:47 2016 us=2537 ping_send_timeout = 5 Mon Jun 13 16:07:47 2016 us=2542 ping_rec_timeout = 60 Mon Jun 13 16:07:47 2016 us=2547 ping_rec_timeout_action = 2 Mon Jun 13 16:07:47 2016 us=2554 ping_timer_remote = DISABLED Mon Jun 13 16:07:47 2016 us=2559 remap_sigusr1 = 0 Mon Jun 13 16:07:47 2016 us=2564 persist_tun = ENABLED Mon Jun 13 16:07:47 2016 us=2569 persist_local_ip = DISABLED Mon Jun 13 16:07:47 2016 us=2574 persist_remote_ip = DISABLED Mon Jun 13 16:07:47 2016 us=2579 persist_key = ENABLED Mon Jun 13 16:07:47 2016 us=2585 passtos = DISABLED Mon Jun 13 16:07:47 2016 us=2590 resolve_retry_seconds = 1000000000 Mon Jun 13 16:07:47 2016 us=2596 username = 'nobody' Mon Jun 13 16:07:47 2016 us=2601 groupname = 'nobody' Mon Jun 13 16:07:47 2016 us=2617 chroot_dir = '[UNDEF]' Mon Jun 13 16:07:47 2016 us=2622 cd_dir = '[UNDEF]' Mon Jun 13 16:07:47 2016 us=2627 writepid = '[UNDEF]' Mon Jun 13 16:07:47 2016 us=2645 up_script = '[UNDEF]' Mon Jun 13 16:07:47 2016 us=2650 down_script = '[UNDEF]' Mon Jun 13 16:07:47 2016 us=2655 down_pre = DISABLED Mon Jun 13 16:07:47 2016 us=2660 up_restart = DISABLED Mon Jun 13 16:07:47 2016 us=2668 up_delay = DISABLED Mon Jun 13 16:07:47 2016 us=2675 daemon = DISABLED Mon Jun 13 16:07:47 2016 us=2681 inetd = 0 Mon Jun 13 16:07:47 2016 us=2686 log = ENABLED Mon Jun 13 16:07:47 2016 us=2692 suppress_timestamps = DISABLED Mon Jun 13 16:07:47 2016 us=2696 nice = 0 Mon Jun 13 16:07:47 2016 us=2701 verbosity = 6 Mon Jun 13 16:07:47 2016 us=2706 mute = 0 Mon Jun 13 16:07:47 2016 us=2711 gremlin = 0 Mon Jun 13 16:07:47 2016 us=2716 status_file = '/tmp/openvpn-status.log' Mon Jun 13 16:07:47 2016 us=2721 status_file_version = 1 Mon Jun 13 16:07:47 2016 us=2727 status_file_update_freq = 60 Mon Jun 13 16:07:47 2016 us=2732 occ = ENABLED Mon Jun 13 16:07:47 2016 us=2738 rcvbuf = 0 Mon Jun 13 16:07:47 2016 us=2743 sndbuf = 0 Mon Jun 13 16:07:47 2016 us=2749 mark = 0 Mon Jun 13 16:07:47 2016 us=2754 sockflags = 0 Mon Jun 13 16:07:47 2016 us=2759 fast_io = DISABLED Mon Jun 13 16:07:47 2016 us=2765 lzo = 7 Mon Jun 13 16:07:47 2016 us=2773 route_script = '[UNDEF]' Mon Jun 13 16:07:47 2016 us=2779 route_default_gateway = '[UNDEF]' Mon Jun 13 16:07:47 2016 us=2784 route_default_metric = 0 Mon Jun 13 16:07:47 2016 us=2791 route_noexec = DISABLED Mon Jun 13 16:07:47 2016 us=2797 route_delay = 0 Mon Jun 13 16:07:47 2016 us=2803 route_delay_window = 30 Mon Jun 13 16:07:47 2016 us=2809 route_delay_defined = DISABLED Mon Jun 13 16:07:47 2016 us=2815 route_nopull = DISABLED Mon Jun 13 16:07:47 2016 us=2820 route_gateway_via_dhcp = DISABLED Mon Jun 13 16:07:47 2016 us=2826 max_routes = 100 Mon Jun 13 16:07:47 2016 us=2831 allow_pull_fqdn = DISABLED Mon Jun 13 16:07:47 2016 us=2838 route 10.188.0.0/255.255.0.0/nil/nil Mon Jun 13 16:07:47 2016 us=2843 management_addr = '[UNDEF]' Mon Jun 13 16:07:47 2016 us=2850 management_port = 0 Mon Jun 13 16:07:47 2016 us=2856 management_user_pass = '[UNDEF]' Mon Jun 13 16:07:47 2016 us=2862 management_log_history_cache = 250 Mon Jun 13 16:07:47 2016 us=2877 management_echo_buffer_size = 100 Mon Jun 13 16:07:47 2016 us=2883 management_write_peer_info_file = '[UNDEF]' Mon Jun 13 16:07:47 2016 us=2889 management_client_user = '[UNDEF]' Mon Jun 13 16:07:47 2016 us=2895 management_client_group = '[UNDEF]' Mon Jun 13 16:07:47 2016 us=2901 management_flags = 0 Mon Jun 13 16:07:47 2016 us=2912 shared_secret_file = '[UNDEF]' Mon Jun 13 16:07:47 2016 us=2918 key_direction = 1 Mon Jun 13 16:07:47 2016 us=2924 ciphername_defined = ENABLED Mon Jun 13 16:07:47 2016 us=2940 ciphername = 'BF-CBC' Mon Jun 13 16:07:47 2016 us=2946 authname_defined = ENABLED Mon Jun 13 16:07:47 2016 us=2951 authname = 'SHA1' Mon Jun 13 16:07:47 2016 us=2957 prng_hash = 'SHA1' Mon Jun 13 16:07:47 2016 us=2963 prng_nonce_secret_len = 16 Mon Jun 13 16:07:47 2016 us=2968 keysize = 0 Mon Jun 13 16:07:47 2016 us=2974 engine = DISABLED Mon Jun 13 16:07:47 2016 us=2979 replay = ENABLED Mon Jun 13 16:07:47 2016 us=2989 mute_replay_warnings = DISABLED Mon Jun 13 16:07:47 2016 us=2994 replay_window = 64 Mon Jun 13 16:07:47 2016 us=2999 replay_time = 15 Mon Jun 13 16:07:47 2016 us=3004 packet_id_file = '[UNDEF]' Mon Jun 13 16:07:47 2016 us=3010 use_iv = ENABLED Mon Jun 13 16:07:47 2016 us=3015 test_crypto = DISABLED Mon Jun 13 16:07:47 2016 us=3020 tls_server = ENABLED Mon Jun 13 16:07:47 2016 us=3026 tls_client = DISABLED Mon Jun 13 16:07:47 2016 us=3031 key_method = 2 Mon Jun 13 16:07:47 2016 us=3047 ca_file = 'ca.crt' Mon Jun 13 16:07:47 2016 us=3053 ca_path = '[UNDEF]' Mon Jun 13 16:07:47 2016 us=3069 dh_file = 'dh2048.pem' Mon Jun 13 16:07:47 2016 us=3074 cert_file = 'server.crt' Mon Jun 13 16:07:47 2016 us=3080 extra_certs_file = '[UNDEF]' Mon Jun 13 16:07:47 2016 us=3096 priv_key_file = 'server.key' Mon Jun 13 16:07:47 2016 us=3102 pkcs12_file = '[UNDEF]' Mon Jun 13 16:07:47 2016 us=3107 cipher_list = '[UNDEF]' Mon Jun 13 16:07:47 2016 us=3112 tls_verify = '[UNDEF]' Mon Jun 13 16:07:47 2016 us=3118 tls_export_cert = '[UNDEF]' Mon Jun 13 16:07:47 2016 us=3123 verify_x509_type = 0 Mon Jun 13 16:07:47 2016 us=3129 verify_x509_name = '[UNDEF]' Mon Jun 13 16:07:47 2016 us=3135 crl_file = '[UNDEF]' Mon Jun 13 16:07:47 2016 us=3140 ns_cert_type = 0 Mon Jun 13 16:07:47 2016 us=3146 remote_cert_ku[i] = 0 Mon Jun 13 16:07:47 2016 us=3152 remote_cert_ku[i] = 0 Mon Jun 13 16:07:47 2016 us=3157 remote_cert_ku[i] = 0 Mon Jun 13 16:07:47 2016 us=3163 remote_cert_ku[i] = 0 Mon Jun 13 16:07:47 2016 us=3169 remote_cert_ku[i] = 0 Mon Jun 13 16:07:47 2016 us=3174 remote_cert_ku[i] = 0 Mon Jun 13 16:07:47 2016 us=3179 remote_cert_ku[i] = 0 Mon Jun 13 16:07:47 2016 us=3184 remote_cert_ku[i] = 0 Mon Jun 13 16:07:47 2016 us=3189 remote_cert_ku[i] = 0 Mon Jun 13 16:07:47 2016 us=3194 remote_cert_ku[i] = 0 Mon Jun 13 16:07:47 2016 us=3199 remote_cert_ku[i] = 0 Mon Jun 13 16:07:47 2016 us=3204 remote_cert_ku[i] = 0 Mon Jun 13 16:07:47 2016 us=3209 remote_cert_ku[i] = 0 Mon Jun 13 16:07:47 2016 us=3214 remote_cert_ku[i] = 0 Mon Jun 13 16:07:47 2016 us=3220 remote_cert_ku[i] = 0 Mon Jun 13 16:07:47 2016 us=3234 remote_cert_ku[i] = 0 Mon Jun 13 16:07:47 2016 us=3241 remote_cert_eku = '[UNDEF]' Mon Jun 13 16:07:47 2016 us=3246 ssl_flags = 0 Mon Jun 13 16:07:47 2016 us=3252 tls_timeout = 2 Mon Jun 13 16:07:47 2016 us=3258 renegotiate_bytes = 0 Mon Jun 13 16:07:47 2016 us=3263 renegotiate_packets = 0 Mon Jun 13 16:07:47 2016 us=3268 renegotiate_seconds = 3600 Mon Jun 13 16:07:47 2016 us=3274 handshake_window = 60 Mon Jun 13 16:07:47 2016 us=3278 transition_window = 3600 Mon Jun 13 16:07:47 2016 us=3293 single_session = DISABLED Mon Jun 13 16:07:47 2016 us=3298 push_peer_info = DISABLED Mon Jun 13 16:07:47 2016 us=3303 tls_exit = DISABLED Mon Jun 13 16:07:47 2016 us=3309 tls_auth_file = 'ta.key' Mon Jun 13 16:07:47 2016 us=3315 pkcs11_protected_authentication = DISABLED Mon Jun 13 16:07:47 2016 us=3321 pkcs11_protected_authentication = DISABLED Mon Jun 13 16:07:47 2016 us=3327 pkcs11_protected_authentication = DISABLED Mon Jun 13 16:07:47 2016 us=3332 pkcs11_protected_authentication = DISABLED Mon Jun 13 16:07:47 2016 us=3338 pkcs11_protected_authentication = DISABLED Mon Jun 13 16:07:47 2016 us=3344 pkcs11_protected_authentication = DISABLED Mon Jun 13 16:07:47 2016 us=3350 pkcs11_protected_authentication = DISABLED Mon Jun 13 16:07:47 2016 us=3356 pkcs11_protected_authentication = DISABLED Mon Jun 13 16:07:47 2016 us=3361 pkcs11_protected_authentication = DISABLED Mon Jun 13 16:07:47 2016 us=3367 pkcs11_protected_authentication = DISABLED Mon Jun 13 16:07:47 2016 us=3372 pkcs11_protected_authentication = DISABLED Mon Jun 13 16:07:47 2016 us=3377 pkcs11_protected_authentication = DISABLED Mon Jun 13 16:07:47 2016 us=3382 pkcs11_protected_authentication = DISABLED Mon Jun 13 16:07:47 2016 us=3389 pkcs11_protected_authentication = DISABLED Mon Jun 13 16:07:47 2016 us=3395 pkcs11_protected_authentication = DISABLED Mon Jun 13 16:07:47 2016 us=3403 pkcs11_protected_authentication = DISABLED Mon Jun 13 16:07:47 2016 us=3410 pkcs11_private_mode = 00000000 Mon Jun 13 16:07:47 2016 us=3415 pkcs11_private_mode = 00000000 Mon Jun 13 16:07:47 2016 us=3421 pkcs11_private_mode = 00000000 Mon Jun 13 16:07:47 2016 us=3426 pkcs11_private_mode = 00000000 Mon Jun 13 16:07:47 2016 us=3432 pkcs11_private_mode = 00000000 Mon Jun 13 16:07:47 2016 us=3437 pkcs11_private_mode = 00000000 Mon Jun 13 16:07:47 2016 us=3443 pkcs11_private_mode = 00000000 Mon Jun 13 16:07:47 2016 us=3448 pkcs11_private_mode = 00000000 Mon Jun 13 16:07:47 2016 us=3454 pkcs11_private_mode = 00000000 Mon Jun 13 16:07:47 2016 us=3459 pkcs11_private_mode = 00000000 Mon Jun 13 16:07:47 2016 us=3465 pkcs11_private_mode = 00000000 Mon Jun 13 16:07:47 2016 us=3481 pkcs11_private_mode = 00000000 Mon Jun 13 16:07:47 2016 us=3486 pkcs11_private_mode = 00000000 Mon Jun 13 16:07:47 2016 us=3503 pkcs11_private_mode = 00000000 Mon Jun 13 16:07:47 2016 us=3509 pkcs11_private_mode = 00000000 Mon Jun 13 16:07:47 2016 us=3514 pkcs11_private_mode = 00000000 Mon Jun 13 16:07:47 2016 us=3530 pkcs11_cert_private = DISABLED Mon Jun 13 16:07:47 2016 us=3535 pkcs11_cert_private = DISABLED Mon Jun 13 16:07:47 2016 us=3540 pkcs11_cert_private = DISABLED Mon Jun 13 16:07:47 2016 us=3545 pkcs11_cert_private = DISABLED Mon Jun 13 16:07:47 2016 us=3550 pkcs11_cert_private = DISABLED Mon Jun 13 16:07:47 2016 us=3557 pkcs11_cert_private = DISABLED Mon Jun 13 16:07:47 2016 us=3563 pkcs11_cert_private = DISABLED Mon Jun 13 16:07:47 2016 us=3568 pkcs11_cert_private = DISABLED Mon Jun 13 16:07:47 2016 us=3573 pkcs11_cert_private = DISABLED Mon Jun 13 16:07:47 2016 us=3579 pkcs11_cert_private = DISABLED Mon Jun 13 16:07:47 2016 us=3585 pkcs11_cert_private = DISABLED Mon Jun 13 16:07:47 2016 us=3590 pkcs11_cert_private = DISABLED Mon Jun 13 16:07:47 2016 us=3595 pkcs11_cert_private = DISABLED Mon Jun 13 16:07:47 2016 us=3601 pkcs11_cert_private = DISABLED Mon Jun 13 16:07:47 2016 us=3606 pkcs11_cert_private = DISABLED Mon Jun 13 16:07:47 2016 us=3613 pkcs11_cert_private = DISABLED Mon Jun 13 16:07:47 2016 us=3619 pkcs11_pin_cache_period = -1 Mon Jun 13 16:07:47 2016 us=3624 pkcs11_id = '[UNDEF]' Mon Jun 13 16:07:47 2016 us=3630 pkcs11_id_management = DISABLED Mon Jun 13 16:07:47 2016 us=3637 server_network = 10.188.0.0 Mon Jun 13 16:07:47 2016 us=3643 server_netmask = 255.255.0.0 Mon Jun 13 16:07:47 2016 us=3654 server_network_ipv6 = :: Mon Jun 13 16:07:47 2016 us=3660 server_netbits_ipv6 = 0 Mon Jun 13 16:07:47 2016 us=3666 server_bridge_ip = 0.0.0.0 Mon Jun 13 16:07:47 2016 us=3672 server_bridge_netmask = 0.0.0.0 Mon Jun 13 16:07:47 2016 us=3678 server_bridge_pool_start = 0.0.0.0 Mon Jun 13 16:07:47 2016 us=3685 server_bridge_pool_end = 0.0.0.0 Mon Jun 13 16:07:47 2016 us=3690 push_entry = 'route 0.0.0.0 0.0.0.0' Mon Jun 13 16:07:47 2016 us=3708 push_entry = 'redirect-gateway def1 bypass-dhcp' Mon Jun 13 16:07:47 2016 us=3724 push_entry = 'dhcp-option DNS 8.8.8.8' Mon Jun 13 16:07:47 2016 us=3729 push_entry = 'dhcp-option DNS 8.8.4.4' Mon Jun 13 16:07:47 2016 us=3734 push_entry = 'route 10.188.0.0 255.255.0.0' Mon Jun 13 16:07:47 2016 us=3740 push_entry = 'topology net30' Mon Jun 13 16:07:47 2016 us=3747 push_entry = 'ping 5' Mon Jun 13 16:07:47 2016 us=3751 push_entry = 'ping-restart 30' Mon Jun 13 16:07:47 2016 us=3754 ifconfig_pool_defined = ENABLED Mon Jun 13 16:07:47 2016 us=3758 ifconfig_pool_start = 10.188.0.4 Mon Jun 13 16:07:47 2016 us=3762 ifconfig_pool_end = 10.188.255.251 Mon Jun 13 16:07:47 2016 us=3766 ifconfig_pool_netmask = 0.0.0.0 Mon Jun 13 16:07:47 2016 us=3769 ifconfig_pool_persist_filename = 'ipp.txt' Mon Jun 13 16:07:47 2016 us=3773 ifconfig_pool_persist_refresh_freq = 600 Mon Jun 13 16:07:47 2016 us=3776 ifconfig_ipv6_pool_defined = DISABLED Mon Jun 13 16:07:47 2016 us=3780 ifconfig_ipv6_pool_base = :: Mon Jun 13 16:07:47 2016 us=3783 ifconfig_ipv6_pool_netbits = 0 Mon Jun 13 16:07:47 2016 us=3790 n_bcast_buf = 256 Mon Jun 13 16:07:47 2016 us=3793 tcp_queue_limit = 64 Mon Jun 13 16:07:47 2016 us=3796 real_hash_size = 256 Mon Jun 13 16:07:47 2016 us=3800 virtual_hash_size = 256 Mon Jun 13 16:07:47 2016 us=3803 client_connect_script = '[UNDEF]' Mon Jun 13 16:07:47 2016 us=3807 learn_address_script = '[UNDEF]' Mon Jun 13 16:07:47 2016 us=3810 client_disconnect_script = '[UNDEF]' Mon Jun 13 16:07:47 2016 us=3814 client_config_dir = '[UNDEF]' Mon Jun 13 16:07:47 2016 us=3817 ccd_exclusive = DISABLED Mon Jun 13 16:07:47 2016 us=3820 tmp_dir = '/tmp' Mon Jun 13 16:07:47 2016 us=3824 push_ifconfig_defined = DISABLED Mon Jun 13 16:07:47 2016 us=3828 push_ifconfig_local = 0.0.0.0 Mon Jun 13 16:07:47 2016 us=3831 push_ifconfig_remote_netmask = 0.0.0.0 Mon Jun 13 16:07:47 2016 us=3835 push_ifconfig_ipv6_defined = DISABLED Mon Jun 13 16:07:47 2016 us=3841 push_ifconfig_ipv6_local = ::/0 Mon Jun 13 16:07:47 2016 us=3845 push_ifconfig_ipv6_remote = :: Mon Jun 13 16:07:47 2016 us=3849 enable_c2c = ENABLED Mon Jun 13 16:07:47 2016 us=3853 duplicate_cn = ENABLED Mon Jun 13 16:07:47 2016 us=3858 cf_max = 0 Mon Jun 13 16:07:47 2016 us=3862 cf_per = 0 Mon Jun 13 16:07:47 2016 us=3865 max_clients = 100 Mon Jun 13 16:07:47 2016 us=3869 max_routes_per_client = 256 Mon Jun 13 16:07:47 2016 us=3882 auth_user_pass_verify_script = '[UNDEF]' Mon Jun 13 16:07:47 2016 us=3886 auth_user_pass_verify_script_via_file = DISABLED Mon Jun 13 16:07:47 2016 us=3889 port_share_host = '[UNDEF]' Mon Jun 13 16:07:47 2016 us=3893 port_share_port = 0 Mon Jun 13 16:07:47 2016 us=3896 client = DISABLED Mon Jun 13 16:07:47 2016 us=3900 pull = DISABLED Mon Jun 13 16:07:47 2016 us=3906 auth_user_pass_file = '[UNDEF]' Mon Jun 13 16:07:47 2016 us=3911 OpenVPN 2.3.11 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on May 10 2016 Mon Jun 13 16:07:47 2016 us=3919 library versions: OpenSSL 1.0.1e-fips 11 Feb 2013, LZO 2.06 Mon Jun 13 16:07:47 2016 us=4002 WARNING: --ifconfig-pool-persist will not work with --duplicate-cn Mon Jun 13 16:07:47 2016 us=59407 Diffie-Hellman initialized with 2048 bit key Mon Jun 13 16:07:47 2016 us=59920 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file Mon Jun 13 16:07:47 2016 us=59938 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication Mon Jun 13 16:07:47 2016 us=59946 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication Mon Jun 13 16:07:47 2016 us=59958 TLS-Auth MTU parms [ L:1544 D:1182 EF:68 EB:0 ET:0 EL:3 ] Mon Jun 13 16:07:47 2016 us=59975 Socket Buffers: R=[87380->87380] S=[16384->16384] Mon Jun 13 16:07:47 2016 us=60070 ROUTE_GATEWAY ON_LINK IFACE=venet0 HWADDR=00:00:00:00:00:00 Mon Jun 13 16:07:47 2016 us=60296 TUN/TAP device tun0 opened Mon Jun 13 16:07:47 2016 us=60311 TUN/TAP TX queue length set to 100 Mon Jun 13 16:07:47 2016 us=60323 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0 Mon Jun 13 16:07:47 2016 us=60341 /usr/sbin/ip link set dev tun0 up mtu 1500 Mon Jun 13 16:07:47 2016 us=72043 /usr/sbin/ip addr add dev tun0 local 10.188.0.1 peer 10.188.0.2 Mon Jun 13 16:07:47 2016 us=89355 /usr/sbin/ip route add 10.188.0.0/16 via 10.188.0.2 Mon Jun 13 16:07:47 2016 us=90077 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:143 ET:0 EL:3 AF:3/1 ] Mon Jun 13 16:07:47 2016 us=90257 GID set to nobody Mon Jun 13 16:07:47 2016 us=90268 UID set to nobody Mon Jun 13 16:07:47 2016 us=90275 Listening for incoming TCP connection on [undef] Mon Jun 13 16:07:47 2016 us=90283 TCPv4_SERVER link local (bound): [undef] Mon Jun 13 16:07:47 2016 us=90287 TCPv4_SERVER link remote: [undef] Mon Jun 13 16:07:47 2016 us=90295 MULTI: multi_init called, r=256 v=256 Mon Jun 13 16:07:47 2016 us=90441 IFCONFIG POOL: base=10.188.0.4 size=16382, ipv6=0 Mon Jun 13 16:07:47 2016 us=90453 IFCONFIG POOL LIST Mon Jun 13 16:07:47 2016 us=90480 MULTI: TCP INIT maxclients=100 maxevents=104 Mon Jun 13 16:07:47 2016 us=90495 Initialization Sequence Completed Mon Jun 13 16:08:07 2016 us=790588 TCP/UDP: Closing socket Mon Jun 13 16:08:07 2016 us=790658 /usr/sbin/ip route del 10.188.0.0/16 RTNETLINK answers: Operation not permitted Mon Jun 13 16:08:07 2016 us=791611 ERROR: Linux route delete command failed: external program exited with error status: 2 Mon Jun 13 16:08:07 2016 us=791637 Closing TUN/TAP interface Mon Jun 13 16:08:07 2016 us=791657 /usr/sbin/ip addr del dev tun0 local 10.188.0.1 peer 10.188.0.2 RTNETLINK answers: Operation not permitted Mon Jun 13 16:08:07 2016 us=792360 Linux ip addr del failed: external program exited with error status: 2 Mon Jun 13 16:08:07 2016 us=830989 SIGINT[hard,] received, process exiting [[email protected] /etc/openvpn]#
[[email protected] /etc/openvpn]# iptables -nvxL --lin Chain INPUT (policy ACCEPT 0 packets, 0 bytes) num pkts bytes target prot opt in out source destination 1 127988 174103095 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 2 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 3 0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0 4 228 14272 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22 5 651 33525 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) num pkts bytes target prot opt in out source destination 1 0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited Chain OUTPUT (policy ACCEPT 77183 packets, 5938860 bytes) num pkts bytes target prot opt in out source destination [[email protected] /etc/openvpn]# iptables -I INPUT 4 -p tcp -m state --state NEW -m tcp --dport 22033 -j ACCEPT [[email protected] /etc/openvpn]# iptables -nvxL --lin Chain INPUT (policy ACCEPT 0 packets, 0 bytes) num pkts bytes target prot opt in out source destination 1 127988 174103095 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 2 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 3 0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0 4 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22033 5 228 14272 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22 6 651 33525 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) num pkts bytes target prot opt in out source destination 1 0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited Chain OUTPUT (policy ACCEPT 77183 packets, 5938860 bytes) num pkts bytes target prot opt in out source destination [[email protected] /etc/openvpn]# iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT [[email protected] /etc/openvpn]# iptables -I FORWARD 2 -s 10.0.0.0/8 -j ACCEPT [[email protected] /etc/openvpn]# iptables -nvxL --lin Chain INPUT (policy ACCEPT 0 packets, 0 bytes) num pkts bytes target prot opt in out source destination 1 128015 174104967 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 2 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 3 0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0 4 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22033 5 228 14272 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22 6 651 33525 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) num pkts bytes target prot opt in out source destination 1 0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 2 0 0 ACCEPT all -- * * 10.0.0.0/8 0.0.0.0/0 3 0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited Chain OUTPUT (policy ACCEPT 3 packets, 436 bytes) num pkts bytes target prot opt in out source destination [[email protected] /etc/openvpn]# iptables -t nat -A POSTROUTING -s 10.0.0.0/8 -j SNAT --to-source 104.223.122.202 [[email protected] /etc/openvpn]# iptables -t nat -nvxL --lin Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes) num pkts bytes target prot opt in out source destination Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes) num pkts bytes target prot opt in out source destination 1 0 0 SNAT all -- * * 10.0.0.0/8 0.0.0.0/0 to:104.223.122.202 Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) num pkts bytes target prot opt in out source destination [[email protected] /etc/openvpn]# iptables-save >/etc/sysconfig/iptables [[email protected] /etc/openvpn]# cat /etc/sysconfig/iptables # Generated by iptables-save v1.4.21 on Mon Jun 13 16:14:40 2016 *raw :PREROUTING ACCEPT [366072:522504090] :OUTPUT ACCEPT [204986:14628967] COMMIT # Completed on Mon Jun 13 16:14:40 2016 # Generated by iptables-save v1.4.21 on Mon Jun 13 16:14:40 2016 *nat :PREROUTING ACCEPT [0:0] :POSTROUTING ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -A POSTROUTING -s 10.0.0.0/8 -j SNAT --to-source 104.223.122.202 COMMIT # Completed on Mon Jun 13 16:14:40 2016 # Generated by iptables-save v1.4.21 on Mon Jun 13 16:14:40 2016 *mangle :PREROUTING ACCEPT [366072:522504090] :INPUT ACCEPT [366072:522504090] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [204986:14628967] :POSTROUTING ACCEPT [204986:14628967] COMMIT # Completed on Mon Jun 13 16:14:40 2016 # Generated by iptables-save v1.4.21 on Mon Jun 13 16:14:40 2016 *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [98:11832] -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -p icmp -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 22033 -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT -A INPUT -j REJECT --reject-with icmp-host-prohibited -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT -A FORWARD -s 10.0.0.0/8 -j ACCEPT -A FORWARD -j REJECT --reject-with icmp-host-prohibited COMMIT # Completed on Mon Jun 13 16:14:40 2016 [[email protected] /etc/openvpn]#
iptables -nvxL --lin iptables -I INPUT 4 -p tcp -m state --state NEW -m tcp --dport 22033 -j ACCEPT iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -I FORWARD 2 -s 10.0.0.0/8 -j ACCEPT iptables -t nat -A POSTROUTING -s 10.0.0.0/8 -j SNAT --to-source 104.223.122.202 iptables-save >/etc/sysconfig/iptables ###由于OpenVPN本事不支持多端口，因此我们可以借助iptables来实现多端口使用 iptables -t nat -A PREROUTING -p tcp -d 104.223.122.202 -m multiport --dports 22034:22044 -j REDIRECT --to-port 22033 这样就把所有发往104.223.122.202这个Ip的22034-22044端口的数据包都转发到了22033上了 104.223.122.202是你的OpenVPN的监听IP
客户端配置文件参考
client dev tun proto tcp resolv-retry infinite nobind persist-key persist-tun comp-lzo verb 3 remote 104.223.122.202 22033 ca 104.223.122.202-ca.crt cert 104.223.122.202-lookback.crt key 104.223.122.202-lookback.key tls-auth 104.223.122.202-ta.key 1
您可以选择一种方式赞助本站
支付宝扫一扫赞助
微信钱包扫描赞助
赏