转自linuxzone http://www.linuxzone.net/server/93.html

系统：CentOS

openvpn server ip:172.16.1.2

[root@localhost ~]#yum -y install openssl-devel

[root@localhost ~]#tar xvf lzo-2.02.tar.gz

[root@localhost ~]#cd lzo-2.02

[root@localhost ~]#./configure

[root@localhost ~]#make

[root@localhost ~]#make install

[root@localhost ~]#cd /root

[root@localhost ~]#tar xvf openvpn-2.0.9.tar.gz

[root@localhost ~]#cd openvpn-2.0.9

[root@localhost ~]#./configure --prefix=/usr/local/openvpn

[root@localhost ~]#mkdir /etc/openvpn

[root@localhost ~]#cd /root/openvpn-2.0.9

[root@localhost ~]#cp sample-config-files/server.conf /etc/openvpn

[root@localhost ~]#cp -a easy-rsa/ /etc/openvpn/

[root@localhost ~]#cd /etc/openvpn/easy-rsa/2.0

[root@localhost ~]#vim vars

export KEY_COUNTRY="CN"

export KEY_PROVINCE="CA"

export KEY_CITY="SZ"

export KEY_ORG="Company"

export KEY_EMAIL="root@localhost.com"

[root@localhost ~]#. vars

[root@localhost ~]#./clean-all

[root@localhost ~]#./build-ca

[root@localhost ~]#./build-key-server server

[root@localhost ~]#./build-key test

[root@localhost ~]#./build-dh

[root@localhost ~]#vim /etc/openvpn/server.conf

[root@localhost ~]#cat /etc/openvpn/server.conf | grep -v "^#" | grep -v "^;"

local 172.16.1.2

port 1194

proto tcp

dev tun

ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt

cert /etc/openvpn/easy-rsa/2.0/keys/server.crt

key /etc/openvpn/easy-rsa/2.0/keys/server.key # This file should be kept secret

dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem

server 172.16.88.0 255.255.255.0

ifconfig-pool-persist ipp.txt

push "route 172.16.1.0 255.255.255.0" 重要有这条才能访问172.16.1.0网段

push "dhcp-option DNS 192.168.1.2"

keepalive 10 120

comp-lzo

persist-key

persist-tun

status openvpn-status.log

log /var/log/openvpn.log

verb 3

[root@localhost ~]#echo 1 >/proc/sys/net/ipv4/ip_forward

[root@localhost ~]#iptables �Ct nat �CA POSTROUTING �Cs 172.16.88.0/24 -J SNAT --to 172.16.1.2

[root@localhost ~]#/usr/local/openvpn/sbin/openvpn --config /etc/openvpn/server.conf

在windows客户端安装openvpn-2.0.9-gui

客户端配置文件：

client

remote172.16.1.21194

resolv-retry infinite

nobind

ca e://keys//ca.crt

cert e://keys//test.crt

key e://keys//test.key

完成！