sudoaptinstallopenＶＰＮeasy-rsa@H_403_11@
拷贝 easy-rsa 目录
cp-r/usr/share/easy-rsa//etc/openＶＰＮ/@H_403_11@
查看 openssl 版本
opensslversion@H_403_11@
生成 ca 证书（ca.crt）和私钥(ca.key)
cd/etc/openＶＰＮ/easy-rsa/ cpopenssl-1.0.0.cnfopenssl.cnf ../vars#source./vars ./clean-all#只是增加客户端证书和私钥的时候不要执行这一句 ./build-ca#注意CommonName@H_403_11@
生成服务端的证书和私钥（server.crt/server.key）
./build-key-serverserver@H_403_11@
生成客户端的证书和私钥
./build-keyclient1 ./build-keyclient2 ./build-keyclient3@H_403_11@
./build-dh@H_403_11@
让服务端文件就位
cp/etc/openＶＰＮ/easy-rsa/keys/ca.crt/etc/open***/ cp/etc/openＶＰＮ/easy-rsa/keys/server.crt/etc/open***/server/ cp/etc/openＶＰＮ/easy-rsa/keys/server.key/etc/open***/server/ cp/etc/openＶＰＮ/easy-rsa/keys/dh2048.pem/etc/open***/server/@H_403_11@
创建 ccd 目录，里面存放推送信息（如固定 ip）到客户端的文件
mkdir/etc/open***/server/ccd cd/etc/open***/server/ccd vimclient#文件名对应CommonName #client内容示例（推送固定ip） ifconfig-push192.168.77.46255.255.255.0@H_403_11@
创建 server.conf，并按照样例写入配置
cd/etc/openＶＰＮ/server/ /etc/openＶＰＮ/server#vimserver.con@H_403_11@
启动服务端
nohupopenＶＰＮ/etc/openＶＰＮ/server/server.conf&@H_403_11@
服务端配置文件示例
local192.168.0.110 port10101 prototcp devtap float ca/etc/openＶＰＮ/server/ca.crt cert/etc/openＶＰＮ/server/server.crt key/etc/openＶＰＮ/server/server.key dh/etc/openＶＰＮ/server/dh2048.pem server192.168.77.0255.255.255.0 client-config-dir/etc/open***/server/ccd/ client-to-client keepalive10120 comp-lzo persist-key statusopenＶＰＮ-status.log log/var/log/openＶＰＮ.log verb4 mute20@H_403_11@
客户端配置文件示例
client devtap0 remote123.456.789.154 port10101 prototcp float ca./ca.crt cert./client1.crt key./client1.key comp-lzo verb6 mute20@H_403_11@
【FAQ】
Q：客户端连不上服务端，报错：WARNING: No server certificate verification method has been enabled.
A：检查私钥和公钥当中是否有 0B 的文件。
Q：客户端连不上服务端，报错：TCP: connect to [AF_INET]223.18.95.157:7872 Failed: Unknown error
A：检查客户端外围防火墙。
*** walker ***
