{"id":837,"date":"2021-02-16T14:57:16","date_gmt":"2021-02-16T06:57:16","guid":{"rendered":"https:\/\/blog.vvvtimes.com\/?p=837"},"modified":"2023-03-07T11:40:02","modified_gmt":"2023-03-07T03:40:02","slug":"centos7-install-openvpn-true-password-auth-bridge-mode","status":"publish","type":"post","link":"https:\/\/blog.vvvtimes.com\/index.php\/2021\/02\/16\/centos7-install-openvpn-true-password-auth-bridge-mode\/","title":{"rendered":"CentOS7\u5b89\u88c5\u90e8\u7f72OpenVPN\u7eaf\u5bc6\u7801\u8ba4\u8bc1\u6865\u63a5\u6a21\u5f0f"},"content":{"rendered":"

\n\t\u672c\u6587\u53c2\u8003
\n<\/h1>\n

1.https:\/\/www.emaculation.com\/doku.php\/bridged_openvpn_server_setup<\/a><\/p>\n

\n\t2.https:\/\/serverfault.com\/questions\/622657\/configure-firewalld-for-openvpn-server-bridge-in-fedora-20<\/a>\n<\/p>\n

\n\t3.https:\/\/www.linux.org.ru\/forum\/admin\/10631949<\/a>\n<\/p>\n

\n\t\n<\/p>\n

\n\t\u6ce8\u610f\uff1a\u5b89\u5353\u548cIOS\u5ba2\u6237\u7aef\u5bf9TAP\u7f51\u5361\u7684\u652f\u6301\u6709\u7f3a\u9677\uff0c\u6240\u4ee5\u5b89\u5353\u548cIOS\u7406\u8bba\u4e0a\u4e0d\u652f\u6301OpenVPN\u6865\u63a5\u3002\n<\/p>\n

\n\t\u5b89\u5353\u7684\u4e0d\u5b8c\u5168\u652f\u6301 VPN Client Pro\uff08\u6536\u8d39\uff0c\u65e0\u9700root\uff09\uff0cOpenVPN Installer \/ OpenVPN Settings\uff08\u514d\u8d39\uff0c\u9700\u8981root\uff09\n<\/p>\n

\n\t\u5b89\u5353\u548cIOS\u53ef\u80fd\u7684\u65b9\u6848\u662fVAP\uff1a\u53c2\u8003\u8fd9\u4e2a\u94fe\u63a5<\/a>\n<\/p>\n

\n\t\n<\/p>\n

\n\t1. \u8f6f\u4ef6\u7248\u672c
\n<\/h1>\n

CentOS \u2013 7.9.2009
\neasy-rsa \u2013 3.0.8
\nOpenVPN \u2013 2.4.10<\/p>\n

\n\t\n<\/p>\n

\n\tbridge-utils\n<\/p>\n

\n\t\n<\/p>\n

\n\t2.\u5b89\u88c5
\n<\/h1>\n

\n\t\u6839\u636e\u524d\u9762NAT\u6a21\u5f0f\u7684\u5b89\u88c5\u6559\u7a0b<\/a>\uff0c\u5927\u90e8\u5206\u6b65\u9aa4\u80fd\u590d\u7528\uff0c\u8fd9\u91cc\u53ea\u8bf4\u533a\u522b\n<\/p>\n

\n\t2.1\u914d\u7f6e\u6865\u63a5
\n<\/h2>\n

\n\t\u5b89\u88c5bridge-utils\n<\/p>\n

\n\t\n<\/p>\n

yum install bridge-utils<\/pre>\n
ip addr \u67e5\u770b\u672c\u673aip<\/p>\n
\n\t\n<\/p>\n
\n\t\n<\/p>\n
[root@localhost ~]# ip addr\r\n1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000\r\n    link\/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00\r\n    inet 127.0.0.1\/8 scope host lo\r\n       valid_lft forever preferred_lft forever\r\n    inet6 ::1\/128 scope host \r\n       valid_lft forever preferred_lft forever\r\n2: ens32: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000\r\n    link\/ether 00:50:56:8f:c0:dd brd ff:ff:ff:ff:ff:ff\r\n    inet 10.24.11.243\/24 brd 10.24.11.255 scope global noprefixroute ens32\r\n       valid_lft forever preferred_lft forever\r\n    inet6 fe80::f4f5:b7e6:943d:fd26\/64 scope link noprefixroute \r\n       valid_lft forever preferred_lft forever\r\n3: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 100\r\n    link\/none \r\n    inet 10.8.0.1 peer 10.8.0.2\/32 scope global tun0\r\n       valid_lft forever preferred_lft forever\r\n    inet6 fe80::80e4:f8c5:e4fe:cf1\/64 scope link flags 800 \r\n       valid_lft forever preferred_lft forever<\/pre>\n
\u53ef\u4ee5\u83b7\u53d6\u5982\u4e0b\u4fe1\u606f<\/p>\n
\n\t\n<\/p>\n
\n\t\n<\/p>\n
IP\u5730\u5740\uff1a10.24.11.243\r\n\u5b50\u7f51\u63a9\u7801\uff1a255.255.255.0\uff08\/24 CIDR\u8868\u793a\u6cd5\uff09\r\n\u5e7f\u64ad\u5730\u5740\uff1a10.24.11.255\r\n\u8def\u7531IP\u5730\u5740\uff1a10.24.11.254<\/pre>\n
\u914d\u7f6e\u6865\u63a5\u811a\u672c<\/p>\n
\n\t\n<\/p>\n
\n\t\n<\/p>\n
nano \/etc\/openvpn\/openvpn-bridge<\/pre>\n
\u5185\u5bb9\u5982\u4e0b<\/p>\n
\n\t\n<\/p>\n
\n\t\n<\/p>\n
#!\/bin\/sh\r\n\r\n# Define Bridge Interface\r\nbr=\"br0\"\r\n\r\n# Define list of TAP interfaces to be bridged,\r\n# for example tap=\"tap0 tap1 tap2\".\r\ntap=\"tap0\"\r\n\r\n# Define physical ethernet interface to be bridged\r\n# with TAP interface(s) above. \u6839\u636e\u5b9e\u9645\u5185\u5bb9\u4fee\u6539\u4e0b\u9762\u56db\u9879\r\neth=\"ens32\"\r\neth_ip_netmask=\"10.24.11.243\/24\"\r\neth_broadcast=\"10.24.11.255\"\r\neth_gateway=\"10.24.11.254\"\r\n\r\ncase \"$1\" in\r\nstart)\r\n    for t in $tap; do\r\n        openvpn --mktun --dev $t\r\n    done\r\n\r\n    brctl addbr $br\r\n    brctl addif $br $eth\r\n\r\n    for t in $tap; do\r\n        brctl addif $br $t\r\n    done\r\n\r\n    for t in $tap; do\r\n        ip addr flush dev $t\r\n        ip link set $t promisc on up\r\n    done\r\n\r\n    ip addr flush dev $eth\r\n    ip link set $eth promisc on up\r\n\r\n    ip addr add $eth_ip_netmask broadcast $eth_broadcast dev $br\r\n    ip link set $br up\r\n\r\n    ip route add default via $eth_gateway\r\n    ;;\r\nstop)\r\n    ip link set $br down\r\n    brctl delbr $br\r\n\r\n    for t in $tap; do\r\n        openvpn --rmtun --dev $t\r\n    done\r\n\r\n    ip link set $eth promisc off up\r\n    ip addr add $eth_ip_netmask broadcast $eth_broadcast dev $eth\r\n\r\n    ip route add default via $eth_gateway\r\n    ;;\r\n*)\r\n    echo \"Usage:  openvpn-bridge {start|stop}\"\r\n    exit 1\r\n    ;;\r\nesac\r\nexit 0<\/pre>\n
\n\t\u8d4b\u6743\u9650\n<\/p>\n
\n\t\n<\/p>\n
chmod 700 \/etc\/openvpn\/openvpn-bridge\r\nchown openvpn:openvpn \/etc\/openvpn\/openvpn-bridge<\/pre>\n
\n\t\n<\/p>\n
\n\t\n<\/p>\n
\n\t2.2\u7f16\u8f91\u670d\u52a1\u7aef\u914d\u7f6e
\n<\/h2>\n
\n\tdev tun\u6ce8\u91ca\u6389\uff0c\u6539\u6210 dev tap0\n<\/p>\n
\n\tserver\u884c\u6ce8\u91ca\u6389\uff0c\u6539\u6210server-bridge\uff0cserver-bridge\u8bed\u6cd5\u5982\u4e0b\n<\/p>\n
\n\t\n<\/p>\n
server-bridge [gw] [mask] [start-IP] [end-IP]<\/pre>\n
\u6ce8\u610f\uff0c\u8fd9\u91cc\u7684[gw] \u6709\u7684\u6559\u7a0b\u662f\u672c\u673aip\uff0c\u6709\u7684\u6559\u7a0b\u662f\u5b9e\u9645\u7f51\u5173\uff0c\u4e24\u4e2a\u90fd\u8bd5\u9a8c\u540e\uff0c\u586b\u672c\u673a\u7f51\u5173\u7684\u53ea\u80fd\u8bbf\u95ee\u672c\u7f51\u6bb5\u7684\uff0c\u5982\u679c\u5b58\u5728\u591a\u4e2avlan\uff0c\u90a3\u5c31\u65e0\u6cd5\u8bbf\u95ee
\n\u6240\u4ee5\u6b63\u786e\u7684\u586b\u53d1\u5e94\u8be5\u662f\u586b\u5b9e\u9645\u7f51\u5173\u3002
\n\u7f16\u8f91<\/p>\n
\n\t\n<\/p>\n
\n\t\n<\/p>\n
nano \/etc\/openvpn\/server\/server.conf<\/pre>\n
\u5185\u5bb9\u5982\u4e0b<\/p>\n
\n\t\n<\/p>\n
\n\t\n<\/p>\n
port 1194\r\nproto tcp\r\n#dev tun\r\ndev tap0\r\n#dev-node tap-bridge\r\nuser openvpn\r\ngroup openvpn\r\n\r\n#\u914d\u7f6e\u8bc1\u4e66\u4fe1\u606f\r\nca \/etc\/openvpn\/server\/easy-rsa\/pki\/ca.crt\r\ncert \/etc\/openvpn\/server\/easy-rsa\/pki\/issued\/server.crt\r\nkey \/etc\/openvpn\/server\/easy-rsa\/pki\/private\/server.key\r\ndh \/etc\/openvpn\/server\/easy-rsa\/pki\/dh.pem\r\ntls-auth \/etc\/openvpn\/server\/easy-rsa\/ta.key 0\r\n\r\n#\u914d\u7f6e\u8d26\u53f7\u5bc6\u7801\u7684\u8ba4\u8bc1\u65b9\u5f0f\r\nscript-security 3\r\nauth-user-pass-verify \"\/etc\/openvpn\/server\/user\/checkpsw.sh\" via-env\r\nverify-client-cert none\r\nusername-as-common-name\r\nclient-to-client\r\nduplicate-cn\r\n\r\n#\u914d\u7f6e\u7f51\u7edc\u4fe1\u606f\r\n#server 10.8.0.0 255.255.255.0\r\nserver-bridge 10.24.11.254 255.255.255.0 10.24.11.10 10.24.11.190\r\nclient-to-client\r\npush \"dhcp-option DNS 10.24.11.250\"\r\npush \"dhcp-option DNS 114.114.114.114\"\r\npush \"route 10.24.11.0 255.255.255.0\"\r\npush \"route 10.24.0.0 255.255.0.0\"\r\npush \"route 172.20.0.0 255.255.0.0\"\r\npush \"route 10.244.0.0 255.255.0.0\"\r\n\r\ncompress lzo\r\ncipher AES-256-CBC\r\nkeepalive 10 120\r\npersist-key\r\npersist-tun\r\nverb 3\r\n\r\nlog \/var\/log\/openvpn\/server.log\r\nlog-append \/var\/log\/openvpn\/server.log\r\nstatus \/var\/log\/openvpn\/status.log<\/pre>\n
\n\t2.3\u7f16\u8f91\u542f\u52a8\u811a\u672c
\n<\/h2>\n
\n\t\u7f16\u8f91openvpn-server@.service\n<\/p>\n
\n\t\n<\/p>\n
nano \/usr\/lib\/systemd\/system\/openvpn-server@.service<\/pre>\n
\u5728Service\u5185\u5bb9\u540e\u6dfb\u52a0\u4e24\u884c<\/p>\n
\n\t\n<\/p>\n
\n\t\n<\/p>\n
[Service]\r\nExecStartPre=\/etc\/openvpn\/openvpn-bridge start\r\nExecStopPost=\/etc\/openvpn\/openvpn-bridge stop<\/pre>\n
\u91cd\u8f7dservice<\/p>\n
\n\t\n<\/p>\n
\n\t\n<\/p>\n
systemctl daemon-reload<\/pre>\n
\n\t\u91cd\u542f\u670d\u52a1\u7aef\n<\/p>\n
\n\t\n<\/p>\n
systemctl restart openvpn-server@.service.service<\/pre>\n
\n\t\n<\/p>\n
\n\t\n<\/p>\n
\n\t2.4 \u914d\u7f6e\u9632\u706b\u5899
\n<\/h2>\n
\n\t\u5b98\u7f51\u53ea\u7ed9\u4e86iptables\u7248\u672c\u7684\uff0ciptable\u5982\u4e0b\n<\/p>\n
\n\t\n<\/p>\n
iptables -A INPUT -i tap0 -j ACCEPT\r\niptables -A INPUT -i br0 -j ACCEPT\r\niptables -A FORWARD -i br0 -j ACCEPT<\/pre>\n
\u6267\u884c\u540e\u9700\u8981\u4fdd\u5b58<\/p>\n
\n\t\n<\/p>\n
\n\t\n<\/p>\n
service iptables save<\/pre>\n
\n\t\u5bf9\u5e94\u7684firewall\u7248\u672c\u5982\u4e0b\n<\/p>\n
\n\t\n<\/p>\n
firewall-cmd --permanent --direct --passthrough ipv4 -A INPUT -i tap0 -j ACCEPT\r\nfirewall-cmd --permanent --direct --passthrough ipv4 -A INPUT -i br0 -j ACCEPT\r\nfirewall-cmd --permanent --direct --passthrough ipv4 -A FORWARD -i br0 -j ACCEPT<\/pre>\n
\n\t\u6267\u884c\u540e\u9700\u6267\u884c\u91cd\u8f7d\u751f\u6548\n<\/p>\n
\n\t\n<\/p>\n
firewall-cmd --reload<\/pre>\n
\n\t\n<\/p>\n
\n\t\n<\/p>\n
\n\t2.5\u914d\u7f6e\u5ba2\u6237\u7aef
\n<\/h2>\n
\n\tdev tun\u6539\u6210dev tap0\n<\/p>\n
\n\t\u7f16\u8f91C:\\Program Files\\OpenVPN\\config\\client.ovpn\u5982\u4e0b\n<\/p>\n
\n\t\n<\/p>\n
client\r\nproto tcp\r\ndev tap0\r\nauth-user-pass\r\nremote 10.24.11.243 1194\r\nca ca.crt\r\ntls-auth ta.key 1\r\n\r\nremote-cert-tls server\r\ncipher AES-256-CBC\r\nauth-nocache\r\npersist-tun\r\npersist-key\r\ncomp-lzo\r\nverb 3\r\nmute 10<\/pre>\n
\n\t\n<\/p>\n
\n\t\n<\/p>\n
\n\t3.\u5e38\u89c1\u95ee\u9898
\n<\/h1>\n
\n\t1.\u80fd\u5206\u914d\u540c\u7f51\u6bb5ip\uff0c\u80fdping\u901a\u5176\u4ed6\u7f51\u6bb5\u548c\u670d\u52a1\u5668IP,\u4f46\u65e0\u6cd5ping\u901a\u540c\u7f51\u6bb5\u5176\u4ed6ip\n<\/p>\n
\n\t\u5982\u679c\u670d\u52a1\u5668\u5728\u865a\u62df\u673a\uff08\u5982ESXI\uff0chyper-V)\u4e0a\uff0c\u5148\u68c0\u67e5\u662f\u5426\u5f00\u542f”\u5141\u8bb8MAC\u5730\u5740\u6b3a\u9a97”\u529f\u80fd\n<\/p>\n
\n\tEXSI\u5bf9\u5e94\u914d\u7f6e\u5982\u4e0b\n<\/p>\n
\n\t\"\"\n<\/p>\n
\n\t\u5f00\u542f\u4e4b\u540e\uff0c\u68c0\u67e5\u9632\u706b\u5899\u662f\u5426\u5f00\u542fNAT\u914d\u7f6e\uff0c\u53d6\u6d88\u6389\u3002\n<\/p>\n
\n\t\n<\/p>\n
\n\t\n<\/p>\n
\n\t<\/p>\n","protected":false},"excerpt":{"rendered":"
\u672c\u6587\u53c2\u8003 1.https:\/\/www.emaculation.com\/doku.php\/bridged_ope … <\/p>\n
\u7ee7\u7eed\u9605\u8bfb\u201cCentOS7\u5b89\u88c5\u90e8\u7f72OpenVPN\u7eaf\u5bc6\u7801\u8ba4\u8bc1\u6865\u63a5\u6a21\u5f0f\u201d<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-837","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/blog.vvvtimes.com\/index.php\/wp-json\/wp\/v2\/posts\/837","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.vvvtimes.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.vvvtimes.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.vvvtimes.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.vvvtimes.com\/index.php\/wp-json\/wp\/v2\/comments?post=837"}],"version-history":[{"count":17,"href":"https:\/\/blog.vvvtimes.com\/index.php\/wp-json\/wp\/v2\/posts\/837\/revisions"}],"predecessor-version":[{"id":1045,"href":"https:\/\/blog.vvvtimes.com\/index.php\/wp-json\/wp\/v2\/posts\/837\/revisions\/1045"}],"wp:attachment":[{"href":"https:\/\/blog.vvvtimes.com\/index.php\/wp-json\/wp\/v2\/media?parent=837"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.vvvtimes.com\/index.php\/wp-json\/wp\/v2\/categories?post=837"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.vvvtimes.com\/index.php\/wp-json\/wp\/v2\/tags?post=837"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}