В данной лабораторной работе мы развернем собственный центр сертификатов (CA) и настроим OpenVPN на машине gwX. OpenVPN-клиентом будет выступать находящаяся "снаружи" машина clientX.
1.Подключитесь к gwX и установите необходимые пакеты:
apt install openvpn easy-rsa
mkdir /etc/openvpn/easy-rsa
cp -r /usr/share/easy-rsa /etc/openvpn/
cd /etc/openvpn/easy-rsa/
./easyrsa init-pki
./easyrsa build-ca
./easyrsa gen-dh
./easyrsa gen-crl
./easyrsa build-server-full server nopass
cp ./pki/ca.crt /etc/openvpn/ca.crt
cp ./pki/dh.pem /etc/openvpn/dh.pem
cp ./pki/crl.pem /etc/openvpn/crl.pem
cp ./pki/issued/server.crt /etc/openvpn/server.crt
cp ./pki/private/server.key /etc/openvpn/server.key
cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf /etc/openvpn
nano /etc/openvpn/server.conf
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key
dh /etc/openvpn/dh.pem
push "route 172.16.0.0 255.255.255.0"
push "route 10.20.30.0 255.255.255.0"
push "dhcp-option DNS 172.16.0.1"
#tls-auth ta.key 0
chmod -R 700 pki/revoked/*
cp -a openssl-easyrsa.cnf /etc/openvpn/pki
cp /usr/share/doc/openvpn/examples/sample-config-files/client.conf /etc/openvpn/client/mycompany.conf
nano /etc/openvpn/client/mycompany.conf
remote 10.5.Y.X+100 1194
#tls-auth ta.key 1
auth-nocache
./easyrsa build-client-full <логин> nopass
mkdir /etc/openvpn/client/<логин>
cd /etc/openvpn/client/<логин>
cp /etc/openvpn/easy-rsa/pki/ca.crt .
cp /etc/openvpn/easy-rsa/pki/issued/<логин>.crt ./client.crt
cp /etc/openvpn/easy-rsa/pki/private/<логин>.key ./client.key
systemctl edit openvpn
[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/sbin/openvpn --config /etc/openvpn/server.conf --ncp-ciphers AES-256-GCM
WorkingDirectory=/etc/openvpn
systemctl daemon-reload
init 6
cd /etc/openvpn/easy-rsa
./easyrsa revoke strelnikov
./easyrsa gen-crl
systemctl restart openvpn