RockyLinux OpenVPN

sudo dnf install epel-release -y
sudo dnf makecache
## 如果不需部署OpenVPN服务端，可以不安装easy-rsa
sudo dnf install openvpn easy-rsa -y

mkdir /etc/openvpn/easy-rsa

ln -s /usr/share/easy-rsa/3/* /etc/openvpn/easy-rsa/

cd /etc/openvpn/easy-rsa
sudo ./easyrsa init-pki

sudo ./easyrsa build-ca nopass

sudo ./easyrsa gen-req server nopass
sudo ./easyrsa sign-req server server

sudo ./easyrsa gen-dh

sudo openvpn --genkey secret pki/ta.key

sudo mkdir -p /etc/openvpn/server
cd /etc/openvpn/easy-rsa
sudo cp pki/ca.crt pki/issued/server.crt /etc/openvpn/server/
sudo cp pki/private/server.key /etc/openvpn/server/
sudo cp pki/dh.pem /etc/openvpn/server/
sudo cp pki/.a.key /etc/openvpn/server/

sudo cp /usr/share/doc/openvpn/sample/sample-config-files/server.conf /etc/openvpn/server/

local 0.0.0.0
port 1194
proto udp
dev tun

ca /etc/openvpn/server/ca.crt
cert /etc/openvpn/server/server.crt
key /etc/openvpn/server/server.key  # This file should be kept secret
dh /etc/openvpn/server/dh.pem

server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt

# 推送路由：告诉客户端，192.168.10.0/24网段可以通过本VPN服务器到达
push "route 192.168.10.0 255.255.255.0"

# 不强制客户端全局代理
;push "redirect-gateway def1 bypass-dhcp"

keepalive 10 120

# 如果不试用自定义解析，个人觉得就没必要设置DNS，设置不当的话还会影响客户端上网
;push "dhcp-option DNS 208.67.222.222"
;push "dhcp-option DNS 208.67.220.220"

# 这里试用tls-auth会报错，试用tls-crypt就没问题，不知道原因，反正就这么设置把
# tls-auth /etc/openvpn/server/ta.key 0 # This file is secret
tls-crypt /etc/openvpn/server/ta.key

cipher AES-256-CBC

# 如果报错就把这里注释掉试试
user nobody
group nobody

persist-key
persist-tun

status /var/log/openvpn-status.log

verb 3

explicit-exit-notify 1

# 指定用于验证用户名和密码的脚本路径
auth-user-pass-verify /etc/openvpn/server/checkpsw.sh via-env 
# 告诉服务器使用用户名而不是证书的 CN。
username-as-common-name
# 允许调用外部脚本并传递密码等敏感信息。
script-security 3
verify-client-cert none

#!/bin/sh
###########################################################
# checkpsw.sh (C) 2004 Mathias Sundman <mathias@openvpn.se>
#
# This script will authenticate OpenVPN users against
# a plain text file. The passfile should simply contain
# one row per user with the username first followed by
# one or more space(s) or tab(s) and then the password.

PASSFILE="/etc/openvpn/server/psw-file"
LOG_FILE="/var/log/openvpn-password.log"
TIME_STAMP=`date "+%Y-%m-%d %T"`

###########################################################

if [ ! -r "${PASSFILE}" ]; then
  echo "${TIME_STAMP}: Could not open password file \"${PASSFILE}\" for reading." >> ${LOG_FILE}
  exit 1
fi

CORRECT_PASSWORD=`awk '!/^;/&&!/^#/&&$1=="'${username}'"{print $2;exit}' ${PASSFILE}`

if [ "${CORRECT_PASSWORD}" = "" ]; then 
  echo "${TIME_STAMP}: User does not exist: username=\"${username}\", password=\"${password}\"." >> ${LOG_FILE}
  exit 1
fi

if [ "${password}" = "${CORRECT_PASSWORD}" ]; then 
  echo "${TIME_STAMP}: Successful authentication: username=\"${username}\"." >> ${LOG_FILE}
  exit 0
fi

echo "${TIME_STAMP}: Incorrect password: username=\"${username}\", password=\"${password}\"." >> ${LOG_FILE}
exit 1

sudo chmod +x /etc/openvpn/server/checkpsw.sh

sudo vi /etc/openvpn/server/psw-file

myvpnuser mysecurepassword123

sudo chmod 600 /etc/openvpn/server/psw-file
sudo chown root:root /etc/openvpn/server/psw-file

echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

sudo firewall-cmd --permanent --add-port=1194/udp
sudo firewall-cmd --permanent --add-masquerade
# 如果你的VPN服务器在公有网络上，请明确指定接口，例如 --zone=public
sudo firewall-cmd --reload

# 替换 'eth0' 为你的服务器连接内网的实际网卡名（通过 ip addr 命令查看）
sudo iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

sudo iptables -L FORWARD

sudo iptables -P FORWARD ACCEPT

# 安装iptables服务（如果尚未安装）
sudo dnf install iptables-services

# 保存当前规则到配置文件
sudo service iptables save
# 或者
sudo /sbin/iptables-save > /etc/sysconfig/iptables

# 启用并启动iptables服务（注意：这只是为了保存规则，并非开启防火墙）
sudo systemctl enable iptables
sudo systemctl start iptables

# 安装iptables-persistent包
sudo apt-get install iptables-persistent

# 在安装过程中，它会询问是否保存当前规则，选择“是”
# 或者之后手动保存
sudo netfilter-persistent save

sudo semanage port -a -t openvpn_port_t -p udp 21194

semanage port -l | grep openvpn

sudo systemctl enable --now openvpn-server@server
sudo systemctl status openvpn-server@server

sudo journalctl -u openvpn-server@server -f

sudo openvpn --config /etc/openvpn/server/server.conf

client
dev tun
proto udp
remote 192.168.10.251 21194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
auth SHA256
cipher AES-256-CBC
data-ciphers AES-256-GCM:AES-128-GCM:AES-256-CBC:AES-128-CBC
key-direction 1
verb 3
auth-user-pass
# tls-auth ta.key 1 
tls-crypt ta.key
ca ca.crt