本文介绍了如何在基于RPM和DEB的系统中安装和配置OpenVPN服务器。我们在本文中将使用一个名为openvpn-install的脚本，它使整个OpenVPN服务器的安装和配置过程实现了自动化。该脚本可帮助你在几分钟内搭建好自己的VPN服务器，哪怕你之前没有用过OpenVPN。
在Linux中安装和配置OpenVPN Server
出于本文的需要，我将使用两个运行CentOS 7 64位版本的系统。一个充当OpenVPN服务器，另一个充当OpenVPN客户机。下面是测试系统的详细信息。
OpenVPN服务器：
操作系统：CentOS 7 64位极简版
IP地址：192.168.43.150/24
主机名称：vpnserver.ostechnix.local
OpenVPN客户机：
操作系统：CentOS 7 64位极简版
IP地址：192.168.43.199/24
我们先来看看服务器端配置。
OpenVPN Server的安装和配置
从GitHub页面下载openvpn-install脚本。
wget https://git.io/vpn -O openvpn-install.sh
然后，使用下列命令，以root用户的身份运行该脚本：
bash openvpn-install.sh
系统会要求你回答一系列问题。回答相应的问题。
确保VPN服务器的IP地址正确。如果你使用多个IP地址，输入想让OpenVPN侦听的那个网络接口的IP地址。
Welcome to this quick OpenVPN "road warrior" installer
I need to ask you a few questions before starting the setup
You can leave the default options and just press enter if you are ok with them
First I need to know the IPv4 address of the network interface you want OpenVPN
listening to.
IP address: 192.168.43.150
选择你想使用哪种协议。我想要使用tcp端口，因此选择了数字2。
Which protocol do you want for OpenVPN connections?
1) UDP (recommended)
2) TCP
Protocol [1-2]: 2
输入端口号。
What port do you want OpenVPN listening to?
Port: 1194
输入你想与VPN结合使用的DNS服务器细节。我想使用谷歌DNS解析器，于是选择了选项2。
Which DNS do you want to use with the VPN?
1) Current system resolvers
2) Google
3) OpenDNS
4) NTT
5) Hurricane Electric
6) Verisign
DNS [1-6]: 2
我们已到了最后一步。输入你的客户机证书名称。这个名称应该是一个单词，不该含有任何特殊字符。
Finally, tell me your name for the client certificate
Please, use one word only, no special characters
Client name: client
按回车键，开始OpenVPN服务器的安装。
Okay, that was all I needed. We are ready to setup your OpenVPN server now
Press any key to continue...
没有任何问题，该脚本会开始装上安装OpenVPN服务器需要的所有必要依赖项。另外，它还会创建所有必要的密钥和证书，以便通过VPN客户机的验证。这个过程需要几分钟。
最后，脚本会问你有没有任何外部IP地址。如果没有外部IP地址，就让它空着，不用管，按回车键。
If your server is NATed (e.g. LowEndSpirit), I need to know the external IP
If that's not the case, just ignore this and leave the next field blank
External IP:
Finished!
Your client configuration is available at /root/client.ovpn
If you want to add more clients, you simply need to run this script again!
OpenVPN服务器的安装和配置已完成。你从最后的输出中可以看出，客户机配置细节保存在文件/root/client.ovpn中。需要将该文件拷贝到你的所有VPN客户机系统。
我将client.ovpn文件拷贝到了我的VPN客户机。
scp client.ovpn root@192.168.43.199:/etc/openvpn/
接下来，我们需要配置OpenVPN客户机。
OpenVPN客户机的配置
确保你从VPN服务器系统拷贝过来了client.ovpn文件。我已经将这个文件拷贝到VPN客户机系统的/etc/openvpn/目录。
使用发行版软件包管理器安装OpenVPN软件包。
yum install openvpn
接下来，运行下列命令，与VPN服务器之间建立一条安全连接。
openvpn --config /etc/openvpn/client.ovpn
示例输出：
Wed Apr 5 18:50:44 2017 Unrecognized option or missing parameter(s) in /etc/openvpn/client.ovpn:14: block-outside-dns (2.3.14)
Wed Apr 5 18:50:44 2017 OpenVPN 2.3.14 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Dec 7 2016
Wed Apr 5 18:50:44 2017 library versions: OpenSSL 1.0.1e-fips 11 Feb 2013, LZO 2.06
Wed Apr 5 18:50:44 2017 Control Channel Authentication: tls-auth using INLINE static key file
Wed Apr 5 18:50:44 2017 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Apr 5 18:50:44 2017 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Apr 5 18:50:44 2017 Socket Buffers: R=[87380->87380] S=[16384->16384]
Wed Apr 5 18:50:44 2017 Attempting to establish TCP connection with [AF_INET]192.168.43.150:1194 [nonblock]
Wed Apr 5 18:50:45 2017 TCP connection established with [AF_INET]192.168.43.150:1194
Wed Apr 5 18:50:45 2017 TCPv4_CLIENT link local: [undef]
Wed Apr 5 18:50:45 2017 TCPv4_CLIENT link remote: [AF_INET]192.168.43.150:1194
Wed Apr 5 18:50:45 2017 TLS: Initial packet from [AF_INET]192.168.43.150:1194, sid=c6fb554e 362eb192
Wed Apr 5 18:50:45 2017 VERIFY OK: depth=1, CN=ChangeMe
Wed Apr 5 18:50:45 2017 Validating certificate key usage
Wed Apr 5 18:50:45 2017 ++ Certificate has key usage 00a0, expects 00a0
Wed Apr 5 18:50:45 2017 VERIFY KU OK
Wed Apr 5 18:50:45 2017 Validating certificate extended key usage
Wed Apr 5 18:50:45 2017 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Wed Apr 5 18:50:45 2017 VERIFY EKU OK
Wed Apr 5 18:50:45 2017 VERIFY OK: depth=0, CN=server
Wed Apr 5 18:50:45 2017 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Wed Apr 5 18:50:45 2017 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Apr 5 18:50:45 2017 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Wed Apr 5 18:50:45 2017 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Apr 5 18:50:45 2017 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Wed Apr 5 18:50:45 2017 [server] Peer Connection Initiated with [AF_INET]192.168.43.150:1194
Wed Apr 5 18:50:48 2017 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Wed Apr 5 18:50:48 2017 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.2 255.255.255.0'
Wed Apr 5 18:50:48 2017 OPTIONS IMPORT: timers and/or timeouts modified
Wed Apr 5 18:50:48 2017 OPTIONS IMPORT: --ifconfig/up options modified
Wed Apr 5 18:50:48 2017 OPTIONS IMPORT: route options modified
Wed Apr 5 18:50:48 2017 OPTIONS IMPORT: route-related options modified
Wed Apr 5 18:50:48 2017 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Wed Apr 5 18:50:48 2017 ROUTE_GATEWAY 192.168.43.1/255.255.255.0 IFACE=enp0s3 HWADDR=08:00:27:28:98:6b
Wed Apr 5 18:50:48 2017 TUN/TAP device tun0 opened
Wed Apr 5 18:50:48 2017 TUN/TAP TX queue length set to 100
Wed Apr 5 18:50:48 2017 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Apr 5 18:50:48 2017 /usr/sbin/ip link set dev tun0 up mtu 1500
Wed Apr 5 18:50:48 2017 /usr/sbin/ip addr add dev tun0 10.8.0.2/24 broadcast 10.8.0.255
Wed Apr 5 18:50:48 2017 /usr/sbin/ip route add 192.168.43.150/32 dev enp0s3
Wed Apr 5 18:50:48 2017 /usr/sbin/ip route add 0.0.0.0/1 via 10.8.0.1
Wed Apr 5 18:50:48 2017 /usr/sbin/ip route add 128.0.0.0/1 via 10.8.0.1
Wed Apr 5 18:50:48 2017 Initialization Sequence Completed
现在，检查一下tun0(VPN接口)是否已创建，并使用‘ip addr’命令，检查VPN接口的IP地址。
ip addr
示例输出：
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: enp0s3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether 08:00:27:28:98:6b brd ff:ff:ff:ff:ff:ff
inet 192.168.43.199/24 brd 192.168.43.255 scope global dynamic enp0s3
valid_lft 42359sec preferred_lft 42359sec
inet6 fe80::a00:27ff:fe28:986b/64 scope link
valid_lft forever preferred_lft forever
3: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 100
link/none
inet 10.8.0.2/24 brd 10.8.0.255 scope global tun0
valid_lft forever preferred_lft forever
你可以从上述输出中看出，我们的VPN服务器自动将IP地址10.8.0.2分配给了VPN客户机。
现在试着从VPN客户机系统ping该VPN服务器：
ping -c3 10.8.0.1
示例输出：
PING 10.8.0.1 (10.8.0.1) 56(84) bytes of data.
64 bytes from 10.8.0.1: icmp_seq=1 ttl=64 time=1.05 ms
64 bytes from 10.8.0.1: icmp_seq=2 ttl=64 time=1.94 ms
64 bytes from 10.8.0.1: icmp_seq=3 ttl=64 time=2.49 ms
--- 10.8.0.1 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2001ms
rtt min/avg/max/mdev = 1.057/1.832/2.495/0.594 ms
恭喜!我们现在已在CentOS中成功地安装和配置了OpenVPN服务器和客户机。这个方法对基于DEB的系统(比如Ubuntu和Linux Mint)来说一样。不像手动安装，该脚本让OpenVPN的安装和配置容易了许多。