tun (IP 层面的信道) 和 tap (Ethernet 层面的信道) 接口。实务上，常用的是 tun 接口，除非 VPN 客户端难以经由 Ethernet 桥接器集成入服务器的局域网路。
openssl 命令的脚本内。
$make-cadir pki-falcot$cd pki-falcot
vars file, which can be uncommented and edited:
$vim vars$grep EASYRSA varsexport KEY_CONFIG=`$EASY_RSA/whichopensslcnf $EASY_RSA` export KEY_DIR="$EASY_RSA/keys" echo NOTE: If you run ./clean-all, I will be doing a rm -rf on $KEY_DIR export KEY_SIZE=2048 export KEY_EXPIRE=3650 export KEY_COUNTRY="FR" export KEY_PROVINCE="Loire" export KEY_CITY="Saint-Étienne" export KEY_ORG="Falcot Corp" export KEY_EMAIL="admin@falcot.com" export KEY_OU="Certificate authority" export KEY_NAME="Certificate authority for Falcot Corp" # If you'd like to sign all keys with the same Common Name, uncomment the KEY_CN export below # export KEY_CN="CommonName" $
keys/ca.crt 和 keys/ca.key)：
pki/ca.crt and pki/private/ca.key during this step). We can add the option nopass to avoid entering a password each time the private key is used:
$./easyrsa build-ca nopassNote: using Easy-RSA configuration from: ./vars Using SSL: openssl OpenSSL 1.1.1b 26 Feb 2019 Generating RSA private key, 2048 bit long modulus (2 primes) ......................................................................................+++++ ......................+++++ e is 65537 (0x010001) You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Common Name (eg: your user, host, or server name) [Easy-RSA CA]: CA creation complete and you may now import and sign cert requests. Your new CA certificate file for publishing is at: /home/roland/pki-falcot/pki/ca.crt
vpn.falcot.com 识别；此名称再次使用于添加钥匙文件 (keys/vpn.falcot.com.crt 供公钥，keys/vpn.falcot.com.key 供私钥)：
$./easyrsa gen-req vpn.falcot.com nopassNote: using Easy-RSA configuration from: ./vars Using SSL: openssl OpenSSL 1.1.1b 26 Feb 2019 Generating a RSA private key .................................................................................+++++ ........+++++ writing new private key to '/home/roland/pki-falcot/pki/private/vpn.falcot.com.key.E5c3RGJBUd' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Common Name (eg: your user, host, or server name) [vpn.falcot.com]: Keypair and certificate request completed. Your files are: req: /home/roland/pki-falcot/pki/reqs/vpn.falcot.com.req key: /home/roland/pki-falcot/pki/private/vpn.falcot.com.key $./easyrsa sign-req server vpn.falcot.comNote: using Easy-RSA configuration from: ./vars Using SSL: openssl OpenSSL 1.1.1b 26 Feb 2019 You are about to sign the following certificate. Please check over the details shown below for accuracy. Note that this request has not been cryptographically verified. Please be sure it came from a trusted source or that you have verified the request checksum with the sender. Request subject, to be signed as a server certificate for 1080 days: subject= commonName = vpn.falcot.com Type the word 'yes' to continue, or any other input to abort. Confirm request details:yesUsing configuration from /home/roland/pki-falcot/pki/safessl-easyrsa.cnf Check that the request matches the signature Signature ok The Subject's Distinguished Name is as follows commonName :ASN.1 12:'vpn.falcot.com' Certificate is to be certified until Jun 14 10:44:44 2022 GMT (1080 days) Write out database with 1 new entries Data Base Updated Certificate created at: /home/roland/pki-falcot/pki/issued/vpn.falcot.com.crt $./easyrsa gen-dhNote: using Easy-RSA configuration from: ./vars Using SSL: openssl OpenSSL 1.1.1b 26 Feb 2019 Generating DH parameters, 2048 bit long safe prime, generator 2 This is going to take a long time […] DH parameters of size 2048 created at /home/roland/pki-falcot/pki/dh.pem
$./build-key JoeSmithNote: using Easy-RSA configuration from: ./vars Using SSL: openssl OpenSSL 1.1.1b 26 Feb 2019 Generating a RSA private key ....+++++ ..............................+++++ writing new private key to '/home/roland/pki-falcot/pki/private/JoeSmith.key.mY21iP8ysv' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Common Name (eg: your user, host, or server name) [JoeSmith]: Keypair and certificate request completed. Your files are: req: /home/roland/pki-falcot/pki/reqs/JoeSmith.req key: /home/roland/pki-falcot/pki/private/JoeSmith.key
pki/ca.crt) will be stored on all machines (both server and clients) as /etc/ssl/certs/Falcot_CA.crt. The server's certificate is installed only on the server (pki/issued/vpn.falcot.com.crt goes to /etc/ssl/vpn.falcot.com.crt, and pki/private/vpn.falcot.com.key goes to /etc/ssl/private/vpn.falcot.com.key with restricted permissions so that only the administrator can read it), with the corresponding Diffie-Hellman parameters (pki/dh.pem) installed to /etc/openvpn/dh.pem. Client certificates are installed on the corresponding VPN client in a similar fashion.
/etc/openvpn/*.conf. Setting up a VPN server is therefore a matter of storing a corresponding configuration file in this directory. A good starting point is /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz, which leads to a rather standard server. Of course, some parameters need to be adapted: ca, cert, key and dh need to describe the selected locations (respectively, /etc/ssl/certs/Falcot_CA.crt, /etc/ssl/vpn.falcot.com.crt, /etc/ssl/private/vpn.falcot.com.key and /etc/openvpn/dh.pem). The server 10.8.0.0 255.255.255.0 directive defines the subnet to be used by the VPN; the server uses the first IP address in that range (10.8.0.1) and the rest of the addresses are allocated to clients.
tun0 之名，添加 OpenVPN 的虚拟网络接口。然而，有时在启动 OpenVPN 前，把防火墙配置成真实的网络接口。最好固定添加的虚拟网络接口，OpenVPN 使用预存的接口。进一步选择接口的名称。到了这个阶段，openvpn --mktun --dev vpn --dev-type tun 添加一个虚拟网络接口名称为 vpn 型态为 tun；这个命令可以集成入防火墙配置脚本，或 up 指向 /etc/network/interfaces 文件。OpenVPN 配置档必须跟着更新，直接使用 dev vpn 和 dev-type tun。
10.8.0.1 地址近用 VPN 服务器。为了授权客户近用本地网络 (192.168.0.0/24)，需在 OpenVPN 配置中加入 推送路径 192.168.0.0 255.255.255.0，让 VPN 客户端自动取得网络路由，使其明了经由 VPN 可以进入该网络。此外，本地网络的机器也需被告知，经由 VPN 服务器 (在闸道安装 VPN 服务器即自动启用) 进入VPN。另外，VPN 服务器可以配置后运行伪装 IP 的工作，让来自 VPN 客户端的消息显示成来自 VPN 服务器 (见 第 10.1 节 “网关”)。
/etc/openvpn/ 内的文件才能设置 OpenVPN 客户端。标准的配置方法可从使用 /usr/share/doc/openvpn/examples/sample-config-files/client.conf 这个文件开始。remote vpn.falcot.com 1194 介绍 OpenVPN 服务器的地址及端口号；描述密钥文档地址时，需参考 ca、cert 和 key。
AUTOSTART directive to none in the /etc/default/openvpn file. Starting or stopping a given VPN connection is always possible with the commands systemctl start openvpn@name and systemctl stop openvpn@name (where the connection name matches the one defined in /etc/openvpn/name.conf).
tun*) 于 SSH 链接的两端，且可以精准地配置这些虚拟接口，就像在实体接口环境下。必须先设置 PermitTunnel 为 “yes” 于 SSH 服务器配置档 (/etc/ssh/sshd_config)，才能启用此隧道系统。启用 SSH 链接后，添加的隧道必须以 -w any:any 选项 (any 可以用期望的 tun 设备名称取代) 请求链接。两端的用户需有管理者权限，才能添加网络设备 (换句话说，必须以超级用户的身份才能创建链接)。
/etc/ipsec-tools.conf 包括给 IPsec tunnels (或 Security Associations，以 IPsec 术语来说) 使用的参数，让主机连进来；/etc/init.d/setkey 脚本提供启用与停止信道的方法 (每个信道是安全链接至另个主机虚拟私有网络)。可以参考 setkey(8) 手册提供的文档，以人工方式创建此文件。然而，撰写供所有主机使用的参数，并不轻松反而极为烦琐，因为信道的数量急剧增加。安装 IKE 调度 (如 IPsec Key Exchange) 就像 racoon 或 strongswan 把管理带入中央的点，就可简化此进程，而且定期更换密钥，显得更安全。
/etc/ppp/options.pptp、/etc/ppp/peers/falcot、/etc/ppp/ip-up.d/falcot、与 /etc/ppp/ip-down.d/falcot。
例 10.2. /etc/ppp/options.pptp 文件
# PPP options used for a PPTP connection lock noauth nobsdcomp nodeflate
例 10.3. /etc/ppp/peers/falcot 文件
# vpn.falcot.com is the PPTP server pty "pptp vpn.falcot.com --nolaunchpppd" # the connection will identify as the "vpn" user user vpn remotename pptp # encryption is needed require-mppe-128 file /etc/ppp/options.pptp ipparam falcot
pptpd 是 Linux 的 PPTP 服务器。它的主要配置档是，/etc/pptpd.conf，应做若干改变：localip (内网 IP 地址) 与 remoteip (外网 IP 地址)。在下例中，PPTP 服务器总是使用 192.168.0.199 地址，以及从 192.168.0.200 至 192.168.0.250 之间接收 PPTP 客户端的 IP 地址。
例 10.6. /etc/pptpd.conf 文件
# TAG: speed # # Specifies the speed for the PPP daemon to talk at. # speed 115200 # TAG: option # # Specifies the location of the PPP options file. # By default PPP looks in '/etc/ppp/options' # option /etc/ppp/pptpd-options # TAG: debug # # Turns on (more) debugging to syslog # # debug # TAG: localip # TAG: remoteip # # Specifies the local and remote IP address ranges. # # You can specify single IP addresses separated by commas or you can # specify ranges, or both. For example: # # 192.168.0.234,192.168.0.245-249,192.168.0.254 # # IMPORTANT RESTRICTIONS: # # 1. No spaces are permitted between commas or within addresses. # # 2. If you give more IP addresses than MAX_CONNECTIONS, it will # start at the beginning of the list and go until it gets # MAX_CONNECTIONS IPs. Others will be ignored. # # 3. No shortcuts in ranges! ie. 234-8 does not mean 234 to 238, # you must type 234-238 if you mean this. # # 4. If you give a single localIP, that's ok - all local IPs will # be set to the given one. You MUST still give at least one remote # IP for each simultaneous client. # #localip 192.168.0.234-238,192.168.0.245 #remoteip 192.168.1.234-238,192.168.1.245 #localip 10.0.1.1 #remoteip 10.0.1.2-100 localip 192.168.0.199 remoteip 192.168.0.200-250
/etc/ppp/pptpd-options 做若干改变。 重要的参数有服务器名称 (pptp)、网域名称 (falcot.com)、以及 DNS 与 WINS 服务器的 IP 地址。
例 10.7. /etc/ppp/pptpd-options 文件
## turn pppd syslog debugging on #debug ## change 'servername' to whatever you specify as your server name in chap-secrets name pptp ## change the domainname to your local domain domain falcot.com ## these are reasonable defaults for WinXXXX clients ## for the security related settings # The Debian pppd package now supports both MSCHAP and MPPE, so enable them # here. Please note that the kernel support for MPPE must also be present! auth require-chap require-mschap require-mschap-v2 require-mppe-128 ## Fill in your addresses ms-dns 192.168.0.1 ms-wins 192.168.0.1 ## Fill in your netmask netmask 255.255.255.0 ## some defaults nodefaultroute proxyarp lock
vpn 用户 (及其密码) 于 /etc/ppp/chap-secrets 文件的最后一个步骤。其他的作为里，星号 (*) 是有作用的，在此的服务器名称必须明示出来。而且，Windows PPTP 客户端以 DOMAIN\\USER 形式辨识，不是以用户名区别。这就说明了在 FALCOT\\vpn 用户必须提及的文件。也可以指定用户使用特定的 IP 地址；此字段内的星号用于指定动态的地址。