OPenVPN
PARTIE SERVER
- yum -y install epel-repository
- yum -y install openvpn easy-rsa iptables-services
- cp -r /usr/share/easy-rsa/ /etc/openvpn/
- cd /etc/openvpn/easy-rsa/2.*/
vim vars => KEY_SIZE=4096 - source ./vars
- ./clean-all
- ./build-ca
- ./build-key-server server
- ./build-dh (ULTRA LONG)
- ./build-key client1
- ./build-key client2
- etc
- cd /etc/openvpn/easy-rsa/2.0/
- cp -r keys/ /etc/openvpn/
- cd /etc/openvpn/
- vim server.conf
port 1194 proto udp proto udp6 dev tun ca /etc/openvpn/keys/ca.crt cert /etc/openvpn/keys/server.crt key /etc/openvpn/keys/server.key dh /etc/openvpn/keys/dh4096.pem ;tls-auth /etc/openvpn/certs/ta.key 0 server 192.168.45.0 255.255.255.0 server-ipv6 2001:db8:0:123::/64 ifconfig-pool-persist ipp.txt push "redirect-gateway def1 bypass-dhcp" push "dhcp-option DNS 192.168.45.1" push "dhcp-option DNS 8.8.4.4" keepalive 1800 4000 cipher DES-EDE3-CBC # Triple-DES comp-lzo max-clients 10 duplicate-cn user nobody group nobody persist-key persist-tun ;log-append openvpn.log status openvpn-status.log verb 5 mute 20
Ajouter une règle iptable pour laisser passer le traffic VPN:
iptables -A POSTROUTING -s 192.168.45.0/24 -o eth0 -j MASQUERADE iptables-save > /etc/sysconfig/iptables
Démarrer le vpn
systemctl start openvpn@server
PARTIE CLIENT
Installer le client openvpn Créer un fichier openvpn.ovpnclient dev tun proto udp remote 192.168.1.104 1194 resolv-retry infinite nobind persist-key persist-tun mute-replay-warnings ca ca.crt cert client.crt key client.key ns-cert-type server comp-lzo <ca>___COPIER_COLLER_LE_FICHIER CA.CRT___</ca> <key>___COPIER_COLLER_LE_FICHIER CLIENT.CRT___</key> <cert>___COPIER_COLLER_LE_FICHIER CLIENT.CRT___</cert>Double cliquer sur le fichier ovpn.