此类的文章应该很多了。

实际搭建过程中费了点劲,记录一下,以备下次再次搭建:

一、黑色星期五的时候抢购了Chicagovps的6美刀一年的VPS,首先跑到控制台去,查看确认一下TUN/TAP是Enable的:

二、下载lzo,编译安装:

wget http://www.rendoumi.com/soft/lzo-1.08.tar.gz

tar zxvf lzo-1.08.tar.gz  
cd lzo-1.08  
./configure --prefix=/usr/local/lzo
make  
make install

vi /etc/ld/so.conf  
/usr/local/lzo/lib

ldconfig -v  

三、下载openvpn,编译安装:

wget http://www.rendoumi.com/soft/openvpn-2.3.8.tar.gz

tar zxvf openvpn-2.3.8.tar.gz  
cd openvpn-2.3.8  
LZO_CFLAGS="-I/usr/local/lzo/include" LZO_LIBS="-L/usr/local/lzo/lib -llzo" ./configure --prefix=/export/servers/openvpn --disable-plugin-auth-pam  
make  
make install  

四、配置openvpn的证书:

wget http://www.rendoumi.com/soft/easy-rsa.tar.gz

tar zxvf easy-rsa.tar.gz  
mv easy-rsa /etc/openvpn  
cd /etc/openvpn

vi vars  
export KEY_COUNTRY=CN  
export KEY_PROVINCE=NA  
export KEY_CITY=BEIJING  
export KEY_ORG="CHICAGO-VPS"  
export KEY_EMAIL="zhangranrui@gmail.com"

source ./vars  
mkdir keys

./build-ca
./build-key-server  Atlanta-198-23-231-173
./build-key zrr-ipone6s
./build-dh

五、编辑openvpn的server.conf:

# vi /etc/openvpn/server.conf
------
local 198.23.231.173  
port 1194  
proto tcp  
dev tun  
tun-mtu 1500  
tun-mtu-extra 32  
mssfix 1450  
ca /etc/openvpn/keys/ca.crt  
cert /etc/openvpn/keys/Atlanta-198-23-231-173.crt  
key /etc/openvpn/keys/Atlanta-198-23-231-173.key  
dh /etc/openvpn/keys/dh1024.pem  
server 10.10.0.0 255.255.255.0  
ifconfig-pool-persist /root/ipp.txt  
client-config-dir /etc/openvpn/ccd  
push "redirect-gateway autolocal"  
push "dhcp-option DNS 8.8.8.8"  
push "dhcp-option DNS 223.5.5.5"  
client-to-client  
keepalive 10 120  
comp-lzo  
user nobody  
group nobody  
persist-key  
persist-tun  
status /var/log/openvpn-status.log  
log         /var/log/openvpn.log  
log-append  /var/log/openvpn.log  
verb 6  
------

六、生成iphone6s的ovpn配置,注意,这个配置文件不太一样的地方是所有东西都在一个文件里,把ca.crt还有签发的证书和key文件内容直接贴进一个文件里了:

vi chicagovps.ovpn  
client  
dev tun  
proto tcp  
remote 198.23.231.173 1194  
resolv-retry infinite  
nobind  
persist-key  
persist-tun  
verb 4  
comp-lzo  
<ca>  
-----BEGIN CERTIFICATE-----
MIIDYDCCAsmgAwIBAgIJAKPVWwxBhFcaMA0GCSqGSIb3DQEBBQUAMH4xCzAJBgNV  
......
Gz4AeQ==  
-----END CERTIFICATE-----
</ca>  
<cert>  
-----BEGIN CERTIFICATE-----
MIIDcDCCAtmgAwIBAgIBAjANBgkqhkiG9w0BAQQFADB+MQswCQYDVQQGEwJDTjEL  
......
p6C6kSSEqBRwhTyZ6c1N1RDLgs4=  
-----END CERTIFICATE-----
</cert>  
<key>  
-----BEGIN PRIVATE KEY-----
MIICeAIBADANBgkqhkiG9w0BAQEFAASCAmIwggJeAgEAAoGBAOyYv447FyVBvH/H  
......
b8emqkuHUMRwpY4D  
-----END PRIVATE KEY-----
</key>  

七、把chicagovps.ovpn当成附件发给自己的icloud.com的邮箱,然后在iphone6s装上openvpn-connect,在邮件附件里选择用openvpn打开并导入,就可以了。注意,要想下载openvpn-connect,必须在iphone6s上该区,改到美国,中国区是没有这个软件的,被屏蔽了!

八、在服务器上设置iptable:

# vi /etc/sysctl.conf
net.ipv4.ip_forward = 1

# sysctl -p

# iptables -t nat -A POSTROUTING -s 10.10.0.0/24 -j SNAT --to 198.23.231.173

九、在server上运行openvpn守护进程:

 /export/servers/openvpn/sbin/openvpn --config /etc/openvpn/server.conf --daemon

十、这样就可以用iphone6s连接ovpn翻墙出去了。

最新更新:openvpn是有特征识别码的,最近用openvpn直翻也越来越困难。不过不要紧,终极大法中,这是其中一环,八戒会陆续写出自己的方法。

comments powered by Disqus