Open Ｖｐｎ Windows 平台安装部署教程

init-config     # init-config 会把 vars.bat.sample 复制为 var.bat
vars            # vars.bat 用来设置一些变量，主要就是配置文件中修改的那部分
clean-all      # 会清掉 C: \Program File\OpenVPN\easy-rsa\keys 目录，再把 index.txt 和 serial 文件放进来。
build-ca       # 生成根证书
build-dh.bat   # 生成 dh1024.pem 文件，Server 使用 TLS(OpenSSL) 必须要有的文件
build-key-server server # 生成服务端密钥和证书
# 这一步像 build-dh.bat 一样有些东西要填写，之后就是该回答 y 的 y 一下，关键就一个：
# Common Name 必须填，且不能与执行 build-dh 时相同，否则会报：
# failed to update database
# TXT_DB error number 2
# 找不到 C:\Program Files\OpenVPN\easy-rsa\keys\*.old
# 三个文件 server01.key、server01.csr 和 server01.crt 也会生成，但文件 server01.crt 的大小是 0 字节无效的，就要重新再来，看到 Data Base Updated 才行。
# 要生成多个服务端的密钥和证书则继续 build-key-server server02 ......

build-key client   #客户端生成密钥和证书
# build-ca和build-key-server一样要输入一堆东西，这里注意的是 Common Name 不能与执行 build-key-server 时输入的一样，与 build-ca 的 Common Name 一样我试过没什么关系，否则也是报：
# failed to update database
# TXT_DB error number 2
# 找不到 C:\Program Files\OpenVPN\easy-rsa\keys\*.old
# 要生成其他的客户端密钥和证书，可以继续 build-key client02 ......

..\bin\openvpn --genkey --secret keys\ta.key
# 生成 ta.key 文件 这一步是可选操作，生成的ta.key主要用于防御DoS、UDP淹没等恶意攻击。命令中的第3个参数keys/ta.key表示生成的文件路径(含文件名)。

set KEY_COUNTRY=CN
set KEY_PROVINCE=FuJian
set KEY_CITY=FuZhou
set KEY_ORG=FYLUO
set KEY_EMAIL=eagle@fyluo.com
set KEY_CN=Eagle
set KEY_NAME=Eagle
set KEY_OU=Eagle
set PKCS11_MODULE_PATH=Eagle
set PKCS11_PIN=1234

C:\Program Files\OpenVPN\easy-rsa>vars.bat
C:\Program Files\OpenVPN\easy-rsa>clean-all.bat
系统找不到指定的文件。
已复制         1 个文件。
已复制         1 个文件。

C:\Program Files\OpenVPN\easy-rsa>build-ca.bat　　#创建根证书
Loading 'screen' into random state - done
Generating a 1024 bit RSA private key
.....................++++++
...........++++++
writing new private key to 'keys\ca.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]:
State or Province Name (full name) [FuJian]:
Locality Name (eg, city) [FuZhou]:
Organization Name (eg, company) [FYLUO]:
Organizational Unit Name (eg, section) [Eagle]:
Common Name (eg, your name or your server's hostname) [Eagle]:
Name [Eagle]:
Email Address [eagle@fyluo.com]:


C:\Program Files\OpenVPN\easy-rsa>build-dh.bat
Loading 'screen' into random state - done
Generating DH parameters, 1024 bit long safe prime, generator 2
This is going to take a long time
.......+.....+.................................................................+
................................................................................
.........................+................................+.....................
................................................................................
.............................................................+..................
................................................................................
.................+.................................................++*++*++*


C:\Program Files\OpenVPN\easy-rsa>build-key-server.bat server　　#创建server端证书和私钥文件

Loading 'screen' into random state - done
Generating a 1024 bit RSA private key
....++++++
..................................................++++++
writing new private key to 'keys\server.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]:
State or Province Name (full name) [FuJian]:
Locality Name (eg, city) [FuZhou]:
Organization Name (eg, company) [FYLUO]:
Organizational Unit Name (eg, section) [Eagle]:
Common Name (eg, your name or your server's hostname) [Eagle]:server　　#这里和上面的名称要一样
Name [Eagle]:
Email Address [eagle@fyluo.com]:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:123456  设置密码
An optional company name []:
Using configuration from openssl-1.0.0.cnf
Loading 'screen' into random state - done
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName           :PRINTABLE:'CN'
stateOrProvinceName   :PRINTABLE:'FuJian'
localityName          :PRINTABLE:'FuZhou'
organizationName      :PRINTABLE:'FYLUO'
organizationalUnitName:PRINTABLE:'Eagle'
commonName            :PRINTABLE:'server'
name                  :PRINTABLE:'Eagle'
emailAddress          :IA5STRING:'eagle@fyluo.com'
Certificate is to be certified until Jun  2 12:35:53 2028 GMT (3650 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated


C:\Program Files\OpenVPN\easy-rsa>build-key.bat client　　#创建客户端证书与私钥文件，多个客户端重复运行此命令 client1..client2
Loading 'screen' into random state - done
Generating a 1024 bit RSA private key
................++++++
..............................................++++++
writing new private key to 'keys\client.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]:
State or Province Name (full name) [FuJian]:
Locality Name (eg, city) [FuZhou]:
Organization Name (eg, company) [FYLUO]:
Organizational Unit Name (eg, section) [Eagle]:
Common Name (eg, your name or your server's hostname) [Eagle]:
Name [Eagle]:
Email Address [eagle@fyluo.com]:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:123456 设置密码
An optional company name []:
Using configuration from openssl-1.0.0.cnf
Loading 'screen' into random state - done
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName           :PRINTABLE:'CN'
stateOrProvinceName   :PRINTABLE:'FuJian'
localityName          :PRINTABLE:'FuZhou'
organizationName      :PRINTABLE:'FYLUO'
organizationalUnitName:PRINTABLE:'Eagle'
commonName            :PRINTABLE:'cli'
name                  :PRINTABLE:'Eagle'
emailAddress          :IA5STRING:'eagle@fyluo.com'
Certificate is to be certified until Jun  2 12:36:27 2028 GMT (3650 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
C:\Program Files\OpenVPN\easy-rsa>

port 8080   #访问端口
proto tcp   #协议类型，也可用UDP
dev tun

ca ca.crt         这个文件名需要和生成的服务端文件一致
cert server.crt   这个文件名需要和生成的服务端文件一致
key server.key    这个文件名需要和生成的服务端文件一致

;crl-verify vpncrl.pem
dh dh1024.pem  这个文件名需要和生成的服务端文件一致
server 192.168.89.0 255.255.255.0    #虚拟局域网网段设置，请根据需要自行修改
ifconfig-pool-persist ipp.txt　　　　#在openvpn重启时,再次连接的客户端将依然被分配和以前一样的IP地址
push "redirect-gateway def1 bypass-dhcp" 　　#客户端所有网络通信通过vpn，这个可以选择的，如果注释掉的话那就是本地的数据包还是从本地出去，不强制走VPN
push "dhcp-option DNS 218.85.157.99" 　　　　#指定客户端使用的主DNS
push "dhcp-option DNS 223.5.5.5" 　　　　　　 #指定客户端使用的备DNS
push "route 192.168.88.0 255.255.255.0"
client-to-client　　　　#开启客户端互访
keepalive 5 30        服务端5秒监测一次，如果30秒没响应就认定客户端down了

;duplicate-cn
tls-auth ta.key 0   #防DDOS攻击，服务器端0,客户端1
comp-lzo　　#vpn2.4中被弃用，在配置中具有此选项可能导致客户端无法连接到服务器
;max-clients 100
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
verb 4