OPENVPN ubuntu 12.04 安裝

參考

• http://openvpn.net/index.php/open-source/documentation/howto.html#redirect
• http://ubuntuforums.org/archive/index.php/t-1375001.html
• http://www.gaggl.com/2013/04/openvpn-forward-all-client-traffic-through-tunnel-using-ufw/
• http://wiki.ubuntu.org.cn/index.php?title=UFW%E9%98%B2%E7%81%AB%E5%A2%99%E7%AE%80%E5%8D%95%E8%AE%BE%E7%BD%AE&variant=zh-hant
• http://stephen.rees-carter.net/2012/09/how-to-enable-ip-forwarding-with-ufw/

1. sudo apt-get install openvpn
2. sudo mkdir /etc/openvpn/easy-rsa/
   sudo cp -R /usr/share/doc/openvpn/examples/easy-rsa/2.0/* /etc/openvpn/easy-rsa/
   sudo chown -R $USER /etc/openvpn/easy-rsa/
3. sudo vi /etc/openvpn/easy-rsa/vars
4. cd /etc/openvpn/easy-rsa/
5. sudo chown -R root:root .
6. sudo chmod g+w .
7. source vars
8. ./clean-all
9. sudo vi /etc/openvpn/easy-rsa/vars
   1. export KEY_CONFIG=$EASY_RSA/openssl-1.0.0.cnf
10. ./build-ca
11. Note that in the above sequence, most queried parameters were defaulted to the values set in the vars or vars.bat files. The only parameter which must be explicitly entered is the Common Name. In the example above, I used "OpenVPN-CA".
12. ./build-key-server server
13. ./build-dh
14. cd keys
15. sudo cp server.crt server.key ca.crt dh2048.pem ../../
16. sudo cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz /etc/openvpn/
17. sudo gzip -d /etc/openvpn/server.conf.gz
18. vi  /etc/openvpn/server.conf
19. sudo /etc/init.d/openvpn restart
20. Generate Client keys
    1. ./build-key client1
    2. ./build-key client2
    3. ./build-key client3
21. Download keys
    1. sudo apt-get install apache2
    2. cd /etc/openvpn/easy-rsa/
    3. tar -zpcv -f test.tar.gz keys
    4. mv test.tar.gz /var/www/
    5. Download keys
    6. rm /var/www/test.tar.gz
22. Firewall set
    1. sysctl -w net.ipv4.conf.all.forwarding=1
    2. sysctl -w net.ipv4.ip_forward=1
    3. iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
    4. iptables-save
23. Change to UFW(這裡有點問題, 重開機後不行用, 要用上面的iptables才可出去)
1. sudo vim /etc/default/ufw

2. DEFAULT_FORWARD_POLICY="ACCEPT"

3. sudo vim /etc/ufw/sysctl.conf
4. # Uncomment this to allow this host to route packets between interfaces
   1. net/ipv4/ip_forward=1
   2. net/ipv6/conf/default/forwarding=1
   3. net/ipv6/conf/all/forwarding=1
5. ufw disable
6. ufw enable

IPV6設定參考

http://tomsalmon.eu/2013/04/openvpn-ipv6-with-tun-device/