326 lines
7.6 KiB
Markdown
326 lines
7.6 KiB
Markdown
# OpenVPN 完整部署流程与 Systemd 管理指南
|
||
|
||
本指南旨为从零开始部署 OpenVPN 客户端，并使用 Systemd 进行管理的完整流程。
|
||
|
||
## 一、准备工作与依赖安装
|
||
|
||
### 1.1 更新系统
|
||
```bash
|
||
sudo dnf update -y
|
||
```
|
||
|
||
### 1.2 安装编译依赖
|
||
安装所有编译 OpenVPN 可能需要的开发包：
|
||
```bash
|
||
sudo dnf install -y gcc make openssl-devel lzo-devel lz4-devel pam-devel systemd-devel libcap-ng-devel pkg-config
|
||
```
|
||
|
||
## 二、编译安装 OpenVPN 2.6.10
|
||
|
||
### 2.1 下载源码
|
||
```bash
|
||
cd /tmp
|
||
wget https://github.com/OpenVPN/openvpn/releases/download/v2.6.10/openvpn-2.6.10.tar.gz
|
||
tar -xf openvpn-2.6.10.tar.gz
|
||
cd openvpn-2.6.10
|
||
```
|
||
|
||
### 2.2 配置编译选项
|
||
```bash
|
||
# 标准配置（启用所有功能）
|
||
./configure --prefix=/usr
|
||
|
||
# 如果遇到 libcap-ng 问题，可禁用 DCO：
|
||
# ./configure --prefix=/usr --disable-dco
|
||
```
|
||
|
||
### 2.3 编译并安装
|
||
```bash
|
||
make
|
||
sudo make install
|
||
```
|
||
|
||
### 2.4 验证安装
|
||
```bash
|
||
openvpn --version
|
||
# 应显示：OpenVPN 2.6.10 x86_64-pc-linux-gnu
|
||
```
|
||
|
||
## 三、配置文件准备
|
||
|
||
### 3.1 创建配置目录
|
||
```bash
|
||
sudo mkdir -p /etc/openvpn/client
|
||
```
|
||
|
||
### 3.2 放置配置文件
|
||
将你的 OpenVPN 客户端配置文件重命名为 `client.ovpn` 并放置：
|
||
```bash
|
||
sudo cp /path/to/your/config.ovpn /etc/openvpn/client.ovpn
|
||
```
|
||
|
||
### 3.3 配置认证文件
|
||
创建认证文件（包含用户名和密码）：
|
||
```bash
|
||
sudo bash -c "cat > /etc/openvpn/client/auth.txt << 'EOF'
|
||
qdvpn4
|
||
Qdtd@9683556
|
||
EOF"
|
||
|
||
# 设置严格的权限
|
||
sudo chmod 600 /etc/openvpn/client/auth.txt
|
||
sudo chown root:root /etc/openvpn/client/auth.txt
|
||
```
|
||
|
||
### 3.4 验证文件结构
|
||
```bash
|
||
tree /etc/openvpn
|
||
# 应该看到：
|
||
# /etc/openvpn/
|
||
# ├── client.ovpn
|
||
# └── client
|
||
# └── auth.txt
|
||
```
|
||
|
||
## 四、Systemd 服务配置
|
||
|
||
### 4.1 创建服务文件
|
||
使用经过验证的配置：
|
||
```bash
|
||
sudo tee /etc/systemd/system/openvpn-client.service > /dev/null << 'EOF'
|
||
[Unit]
|
||
Description=OpenVPN Client Connection
|
||
After=network.target
|
||
Wants=network-online.target
|
||
Documentation=man:openvpn(8)
|
||
|
||
[Service]
|
||
Type=simple
|
||
WorkingDirectory=/etc/openvpn
|
||
ExecStart=/usr/sbin/openvpn --config client.ovpn --auth-user-pass /etc/openvpn/client/auth.txt --log /var/log/openvpn-client.log
|
||
ExecReload=/bin/kill -HUP $MAINPID
|
||
Restart=on-failure
|
||
RestartSec=5s
|
||
|
||
# 安全加固
|
||
PrivateTmp=true
|
||
NoNewPrivileges=true
|
||
ProtectSystem=strict
|
||
ReadWritePaths=/etc/openvpn /var/log
|
||
ProtectHome=true
|
||
|
||
[Install]
|
||
WantedBy=multi-user.target
|
||
EOF
|
||
```
|
||
|
||
### 4.2 创建日志文件并设置权限
|
||
```bash
|
||
sudo touch /var/log/openvpn-client.log
|
||
sudo chmod 644 /var/log/openvpn-client.log
|
||
```
|
||
|
||
### 4.3 配置日志轮转
|
||
```bash
|
||
sudo tee /etc/logrotate.d/openvpn-client > /dev/null << 'EOF'
|
||
/var/log/openvpn-client.log {
|
||
weekly
|
||
rotate 4
|
||
compress
|
||
delaycompress
|
||
missingok
|
||
notifempty
|
||
create 644 root root
|
||
postrotate
|
||
systemctl kill -s HUP openvpn-client 2>/dev/null || true
|
||
endscript
|
||
}
|
||
EOF
|
||
```
|
||
|
||
## 五、服务管理与测试
|
||
|
||
### 5.1 启动并启用服务
|
||
```bash
|
||
# 重新加载 systemd 配置
|
||
sudo systemctl daemon-reload
|
||
|
||
# 启动 OpenVPN 客户端服务
|
||
sudo systemctl start openvpn-client
|
||
|
||
# 设置开机自启
|
||
sudo systemctl enable openvpn-client
|
||
|
||
# 检查服务状态
|
||
sudo systemctl status openvpn-client
|
||
```
|
||
|
||
### 5.2 服务管理命令速查
|
||
|
||
| 操作 | 命令 | 说明 |
|
||
|------|------|------|
|
||
| **启动服务** | `sudo systemctl start openvpn-client` | 启动 VPN 连接 |
|
||
| **停止服务** | `sudo systemctl stop openvpn-client` | 停止 VPN 连接 |
|
||
| **重启服务** | `sudo systemctl restart openvpn-client` | 重启 VPN 连接 |
|
||
| **查看状态** | `sudo systemctl status openvpn-client` | 查看运行状态 |
|
||
| **启用自启** | `sudo systemctl enable openvpn-client` | 设置开机自启 |
|
||
| **禁用自启** | `sudo systemctl disable openvpn-client` | 取消开机自启 |
|
||
| **查看日志** | `sudo journalctl -u openvpn-client -f` | 实时查看日志 |
|
||
| **查看文件日志** | `sudo tail -f /var/log/openvpn-client.log` | 查看原生日志 |
|
||
| **重新加载配置** | `sudo systemctl reload openvpn-client` | 重载配置文件 |
|
||
|
||
### 5.3 连接验证
|
||
```bash
|
||
# 检查虚拟网络接口
|
||
ip addr show tun0
|
||
|
||
# 检查 VPN 路由
|
||
ip route | grep tun0
|
||
|
||
# 测试 VPN 内网连通性
|
||
ping -c 4 192.168.1.5
|
||
|
||
# 测试 SSH 隧道（如配置了端口转发）
|
||
ssh -p 10005 admin@localhost
|
||
```
|
||
|
||
## 六、故障排查指南
|
||
|
||
### 6.1 服务启动失败
|
||
```bash
|
||
# 查看详细错误信息
|
||
sudo journalctl -u openvpn-client -xe
|
||
|
||
# 手动测试配置文件
|
||
cd /etc/openvpn
|
||
sudo openvpn --config client.ovpn --auth-user-pass client/auth.txt
|
||
```
|
||
|
||
### 6.2 常见问题解决
|
||
|
||
#### 问题 1：权限错误
|
||
```bash
|
||
# 检查认证文件权限
|
||
ls -la /etc/openvpn/client/auth.txt
|
||
# 应为：-rw------- 1 root root
|
||
|
||
# 修复权限
|
||
sudo chmod 600 /etc/openvpn/client/auth.txt
|
||
```
|
||
|
||
#### 问题 2：配置文件路径错误
|
||
```bash
|
||
# 验证所有必要文件存在
|
||
ls -la /etc/openvpn/client.ovpn
|
||
ls -la /etc/openvpn/client/auth.txt
|
||
```
|
||
|
||
#### 问题 3：依赖库缺失
|
||
```bash
|
||
# 检查 openvpn 链接的库
|
||
ldd $(which openvpn)
|
||
|
||
# 重新安装依赖
|
||
sudo dnf reinstall openssl-devel lzo-devel lz4-devel
|
||
```
|
||
|
||
#### 问题 4：日志文件问题
|
||
```bash
|
||
# 确保日志目录存在且有权限
|
||
sudo mkdir -p /var/log
|
||
sudo touch /var/log/openvpn-client.log
|
||
sudo chmod 644 /var/log/openvpn-client.log
|
||
```
|
||
|
||
### 6.3 快速诊断命令
|
||
```bash
|
||
# 综合检查
|
||
./vpn-check.sh
|
||
```
|
||
|
||
## 七、部署检查清单
|
||
|
||
- 系统已更新：`sudo dnf update -y`
|
||
- 所有依赖包已安装
|
||
- OpenVPN 2.6.10 编译安装成功
|
||
- 配置文件 `/etc/openvpn/client.ovpn` 存在
|
||
- 认证文件 `/etc/openvpn/client/auth.txt` 存在且权限为 600
|
||
- Systemd 服务文件已正确配置
|
||
- 日志文件可写：`/var/log/openvpn-client.log`
|
||
- 服务能正常启动：`systemctl status` 显示 active (running)
|
||
- VPN 接口 tun0 已创建
|
||
- VPN 内网路由已添加
|
||
- 能 ping 通 VPN 内网地址
|
||
|
||
## 八、一键部署脚本
|
||
|
||
```bash
|
||
#!/bin/bash
|
||
# openvpn-quick-deploy.sh
|
||
|
||
set -e
|
||
|
||
echo "=== OpenVPN 客户端一键部署脚本 ==="
|
||
|
||
# 变量配置
|
||
VPN_USER="qdvpn4"
|
||
VPN_PASS="Qdtd@9683556"
|
||
OVPN_CONFIG_PATH="/path/to/your/config.ovpn"
|
||
|
||
# 1. 安装依赖
|
||
echo "步骤 1/6: 安装依赖包..."
|
||
sudo dnf install -y gcc make openssl-devel lzo-devel lz4-devel pam-devel systemd-devel libcap-ng-devel pkg-config
|
||
|
||
# 2. 编译安装 OpenVPN
|
||
echo "步骤 2/6: 编译安装 OpenVPN 2.6.10..."
|
||
cd /tmp
|
||
wget -q https://github.com/OpenVPN/openvpn/releases/download/v2.6.10/openvpn-2.6.10.tar.gz
|
||
tar -xf openvpn-2.6.10.tar.gz
|
||
cd openvpn-2.6.10
|
||
./configure --prefix=/usr
|
||
make -j$(nproc)
|
||
sudo make install
|
||
|
||
# 3. 准备配置文件
|
||
echo "步骤 3/6: 准备配置文件..."
|
||
sudo mkdir -p /etc/openvpn/client
|
||
sudo cp "$OVPN_CONFIG_PATH" /etc/openvpn/client.ovpn
|
||
|
||
# 4. 创建认证文件
|
||
echo "步骤 4/6: 创建认证文件..."
|
||
sudo bash -c "cat > /etc/openvpn/client/auth.txt << EOF
|
||
$VPN_USER
|
||
$VPN_PASS
|
||
EOF"
|
||
sudo chmod 600 /etc/openvpn/client/auth.txt
|
||
|
||
# 5. 配置 Systemd 服务
|
||
echo "步骤 5/6: 配置 Systemd 服务..."
|
||
sudo tee /etc/systemd/system/openvpn-client.service > /dev/null << EOF
|
||
[Unit]
|
||
Description=OpenVPN Client Connection
|
||
After=network.target
|
||
Wants=network-online.target
|
||
|
||
[Service]
|
||
Type=simple
|
||
WorkingDirectory=/etc/openvpn
|
||
ExecStart=/usr/sbin/openvpn --config client.ovpn --auth-user-pass /etc/openvpn/client/auth.txt --log /var/log/openvpn-client.log
|
||
Restart=on-failure
|
||
RestartSec=5s
|
||
|
||
[Install]
|
||
WantedBy=multi-user.target
|
||
EOF
|
||
|
||
# 6. 启动服务
|
||
echo "步骤 6/6: 启动服务..."
|
||
sudo systemctl daemon-reload
|
||
sudo systemctl start openvpn-client
|
||
sudo systemctl enable openvpn-client
|
||
|
||
echo "=== 部署完成 ==="
|
||
echo "服务状态: sudo systemctl status openvpn-client"
|
||
echo "查看日志: sudo journalctl -u openvpn-client -f"
|
||
```
|