设为首页收藏本站

 找回密码
 注册论坛

QQ登录

只需一步,快速开始

用百度帐号登录

只需两步,快速登录

新浪微博账号登陆

只需一步,快速开始

搜索
查看: 6680|回复: 2

Openwrt CC版固件搭建OpenVPN服务器实现移动设备免流量上网

[复制链接]

签到天数: 121 天

[LV.7]常住居民III

发表于 2016/8/13 18:14 | 显示全部楼层 |阅读模式 |Google Chrome 54.0.2788.0|Windows 7
天涯海角搜一下: 百度 谷歌 360 搜狗 有道 雅虎 必应 即刻
本帖最后由 krv 于 2016/8/13 18:22 编辑

刷固件等用串口操作时请出主意 串口调试时usb转串口模块波特率应设为115200 终端波特率应设为117500 否则乱码!!!


  1. ###############################################
  2. ####           安装openvpn                 ####
  3. ###############################################

  4. opkg update ; opkg install openvpn-openssl openvpn-easy-rsa luci-i18n-openvpn-zh-cn

  5. ###############################################
  6. ####           配置vars参数                ####
  7. ###############################################

  8. echo > /etc/easy-rsa/vars ; vi /etc/easy-rsa/vars

  9. ###添加以下参
  10. export EASY_RSA="/etc/easy-rsa"
  11. export OPENSSL="openssl"
  12. export PKCS11TOOL="pkcs11-tool"
  13. export GREP="grep"
  14. export KEY_CONFIG=`/usr/sbin/whichopensslcnf $EASY_RSA`
  15. export KEY_DIR="$EASY_RSA/keys"
  16. echo NOTE: If you run ./clean-all, I will be doing a rm -rf on $KEY_DIR
  17. export PKCS11_MODULE_PATH="dummy"
  18. export PKCS11_PIN="dummy"
  19. export KEY_SIZE=1024
  20. export CA_EXPIRE=3650
  21. export KEY_EXPIRE=3650
  22. export KEY_COUNTRY="CN"
  23. export KEY_PROVINCE="ZJ"
  24. export KEY_CITY="ZJ"
  25. export KEY_ORG="ZJ"
  26. export KEY_EMAIL="ZJ@ZJ.com"
  27. export KEY_OU="ZJ"
  28. export KEY_NAME="EasyRSA"

  29. ###############################################
  30. ####             创建密钥                  ####
  31. ###############################################

  32. # 创建密约的时候要求输入密码不懂得话全部留空 问要不要创建就输入y然后回车
  33. build-ca
  34. build-dh
  35. build-key-server server
  36. build-key-pkcs12 client1

  37. cp /etc/easy-rsa/keys/ca.crt /etc/openvpn/
  38. cp /etc/easy-rsa/keys/server.crt /etc/openvpn/
  39. cp /etc/easy-rsa/keys/server.key /etc/openvpn/
  40. cp /etc/easy-rsa/keys/dh1024.pem /etc/openvpn/
  41. cp /etc/easy-rsa/keys/client1.crt /etc/openvpn/
  42. cp /etc/easy-rsa/keys/client1.key /etc/openvpn/

  43. ###############################################
  44. ####          配置网络及防火墙             ####
  45. ###############################################

  46. vi /tmp/setupfirewall.sh

  47. ###添加以下代码:
  48. ###设置VPN接口
  49. uci set network.vpn0="interface"
  50. uci set network.vpn0.ifname="tun0"
  51. uci set network.vpn0.proto="none"
  52. uci set network.vpn0.auto="1"
  53. uci commit network

  54. uci add firewall rule
  55. uci set firewall.@rule[-1].name="Allow-OpenVPN-Inbound"
  56. uci set firewall.@rule[-1].target="ACCEPT"
  57. uci set firewall.@rule[-1].src="wan"
  58. uci set firewall.@rule[-1].proto="tcp"
  59. uci set firewall.@rule[-1].dest_port="3389"  #开放外网端口
  60. uci add firewall zone
  61. uci set firewall.@zone[-1].name="vpn"
  62. uci set firewall.@zone[-1].input="ACCEPT"
  63. uci set firewall.@zone[-1].forward="ACCEPT"
  64. uci set firewall.@zone[-1].output="ACCEPT"
  65. uci set firewall.@zone[-1].masq="1"
  66. uci set firewall.@zone[-1].network="vpn0"
  67. uci add firewall forwarding
  68. uci set firewall.@forwarding[-1].src="vpn"
  69. uci set firewall.@forwarding[-1].dest="wan"
  70. uci add firewall forwarding
  71. uci set firewall.@forwarding[-1].src="vpn"
  72. uci set firewall.@forwarding[-1].dest="lan"
  73. uci commit firewall

  74. /etc/init.d/network reload;
  75. /etc/init.d/firewall reload;

  76. 然后执行:
  77. sh /tmp/setupfirewall.sh

  78. ###############################################
  79. ####          创建openvpn服务器            ####
  80. ###############################################

  81. vi /tmp/setupopenvpn.sh

  82. ###添加以下代码:
  83. touch /etc/config/openvpn
  84. uci delete openvpn.sample_server
  85. uci delete openvpn.sample_client
  86. uci delete openvpn.custom_config

  87. uci set openvpn.myvpn='openvpn'
  88. uci set openvpn.myvpn.enabled='1'
  89. uci set openvpn.myvpn.proto='tcp-server'
  90. uci set openvpn.myvpn.port='3389'  #OpenVPN端口
  91. uci set openvpn.myvpn.dev='tun'
  92. uci set openvpn.myvpn.topology='subnet'
  93. uci set openvpn.myvpn.server='10.8.0.0 255.255.255.0'
  94. uci set openvpn.myvpn.comp_lzo='adaptive'
  95. uci set openvpn.myvpn.ca='/etc/openvpn/ca.crt'
  96. uci set openvpn.myvpn.dh='/etc/openvpn/dh1024.pem'
  97. uci set openvpn.myvpn.cert='/etc/openvpn/server.crt'
  98. uci set openvpn.myvpn.key='/etc/openvpn/server.key'
  99. uci set openvpn.myvpn.persist_key='1'
  100. uci set openvpn.myvpn.persist_tun='1'
  101. uci set openvpn.myvpn.user='nobody'
  102. uci set openvpn.myvpn.group='nogroup'
  103. uci set openvpn.myvpn.max_clients='10'
  104. uci set openvpn.myvpn.keepalive='10 120'
  105. uci set openvpn.myvpn.verb='3'
  106. uci set openvpn.myvpn.status='/var/log/openvpn_status.log'
  107. uci set openvpn.myvpn.log='/tmp/openvpn.log'
  108. uci add_list openvpn.myvpn.push='route 192.168.10.0 255.255.255.0' ###推送本地路由表,我这里是192.168.10.0, 你们自己看着改成自己的
  109. uci add_list openvpn.myvpn.push='comp-lzo adaptive'
  110. uci add_list openvpn.myvpn.push='redirect-gateway def1 bypass-dhcp' ###推送全部流量走VPN
  111. uci add_list openvpn.myvpn.push='dhcp-option DNS 192.168.10.1' ###推送网关,我这里是192.168.10.1, 你们自己看着改成自己的
  112. uci commit openvpn
  113. /etc/init.d/openvpn start; /etc/init.d/openvpn enable ; sleep 2 ; cat /tmp/openvpn.log
  114. ###代码结束:

  115. 然后执行:
  116. sh /tmp/setupopenvpn.sh

  117. 没问题的话就会显示openvpn成功 最后如下:
  118. Initialization Sequence Completed

  119. ###############################################
  120. ####           客户端配置文件              ####
  121. ###############################################

  122. client
  123. dev tun
  124. proto tcp-client
  125. remote 动态域名或IP 3389
  126. resolv-retry infinite
  127. nobind
  128. persist-key
  129. persist-tun
  130. verb 3
  131. <ca>
  132. ###复制ca.crt内容到这里###
  133. </ca>
  134. <cert>
  135. ###复制client1.crt内容到这里###
  136. </cert>
  137. <key>
  138. ###复制client1.key内容到这里###
  139. </key>
  140. ######################################################
  141. http-proxy      10.0.0.172 80
  142. 免流代码添这里
  143. ######################################################
复制代码
欢迎光临IT技术交流论坛:http://bbs.itzmx.com/
回复

使用道具 举报

签到天数: 2213 天

[LV.Master]伴坛终老

 成长值: 20805
发表于 2016/8/13 20:37 | 显示全部楼层 |Google Chrome 52.0.2743.116|Windows 8.1
大佬好厉害
欢迎光临IT技术交流论坛:http://bbs.itzmx.com/
回复 支持 1 反对 0

使用道具 举报

签到天数: 121 天

[LV.7]常住居民III

 楼主| 发表于 2016/8/14 14:58 | 显示全部楼层 |Safari 9.0|iPhone iOS 9.2

你比我更专业>_<
欢迎光临IT技术交流论坛:http://bbs.itzmx.com/
回复 支持 反对

使用道具 举报

您需要登录后才可以回帖 登录 | 注册论坛 用百度帐号登录新浪微博账号登陆

本版积分规则

手机版|Archiver|Mail me|网站地图|IT技术交流论坛 ( 闽ICP备13013206号-7 )

GMT+8, 2018/1/24 13:35 , Processed in 0.263716 second(s), 33 queries , Gzip On, Apc On.

Powered by itzmx!

© 2011-2018 sakura

快速回复 返回顶部 返回列表