#注意:以下操作由服务端操作即可
#PS:为什么我找不到var文件??
============安装===============
wget -O /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo
yum install openvpn -y //提供vpn主功能
yum install easy-rsa -y //用于生成证书
cmhclient=caya //自定义用户的名字
cmhserver=cmhserver //自定义服务器的名字
vpnpath='/etc/openvpn/server.conf //自定义需要启动的VPN服务端文件

##########实际上,我们需要以下文件########
------------------服务端-------------------
server.conf //启动服务端的配置文件,Windows下为.ovpn格式
ca.crt //以下证书位置由server配置文件指定路径
$cmhserver.key
$cmhserver.crt
dh.pem
------------------客户端-------------------
client.conf //客户端配置文件,Windows下为.ovpn格式
ca.crt //以下证书位置由client配置文件指定
$cmhclient.crt
$cmhclient.key
------------------签约证书-----------------
$cmhclient.req

==============配置服务端证书================
cp -rf /usr/share/easy-rsa/3.0.3/* /etc/openvpn/server
mv /etc/openvpn/server/openssl-1.0.cnf /etc/openvpn/server/openssl.cnf
-----------------------以下内容分步输入---------------------
./easyrsa init-pki //初始化PKI
./easyrsa build-ca nopass //生成ca
./easyrsa gen-req $cmhserver nopass //提示输入服务器名[cmserver],回车即可
./easyrsa sign server $cmhserver //提示需要确认,输入yes回车
./easyrsa gen-dh

=============生成客户端使用的证书============
cp -rf /usr/share/easy-rsa/3.0.3/* /etc/openvpn/client
cd /etc/openvpn/client
-----------------------以下内容分步输入---------------------
./easyrsa init-pki
./easyrsa gen-req $cmhclient nopass //自定义用户名[cmhclient]
================给客户签约===============
cd ../easy-rsa/
./easyrsa import-req /etc/openvpn/client/pki/reqs/$cmhclient.req $cmhclient //导入注册文件
./easyrsa sign client $cmhclient //有要求密码则设密码,没要求不用管

=================修改服务端配置文件===============
mkdir /etc/openvpn/server/config
cp /etc/openvpn/easy-rsa/pki/ca.crt /etc/openvpn/server/config
cp /etc/openvpn/easy-rsa/pki/private/$cmhserver.key /etc/openvpn/server/config
cp /etc/openvpn/easy-rsa/pki/issued/$cmhserver.crt /etc/openvpn/server/config
cp /etc/openvpn/easy-rsa/pki/dh.pem /etc/openvpn/server/config
cp /usr/share/doc/openvpn-2.4.6/sample/sample-config-files/server.conf /etc/openvpn/
vi /etc/openvpn/server/config/server.conf
-------------------------------------------------
local 192.168.31.1  //此处应该写内网IP
port 1194
proto udp
dev tun
ca
/etc/openvpn/keys/
ca.crt
cert
/etc/openvpn/keys/
server.crt
key
/etc/openvpn/keys/server.key
# This file should be kept secret
dh
/etc/openvpn/keys/
dh.pem
server 10.8.0.0 255.255.255.0　　　　//curl members.3322.org/dyndns/getip    通过这指令查看自己外网IP
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"

comp-lzo
max-clients 100
keepalive 10 120
persist-key
persist-tun
status openvpn-status.log
verb 3
------------------------------------------------

=================修改客户端配置文件===============
mkdir /etc/openvpn/client/conifg/
cp /etc/openvpn/easy-rsa/pki/ca.crt /etc/openvpn/client/conifg/
cp /etc/openvpn/easy-rsa/pki/issued/$cmhclient.crt /etc/openvpn/client/conifg/
cp /etc/openvpn/client/pki/private/$cmhclient.key /etc/openvpn/client/conifg/
cp /usr/share/doc/openvpn-2.4.6/sample/sample-config-files/client.conf /etc/openvpn/client/config/
vi /etc/openvpn/client/config/client.conf
-----------------------------------------
client
dev tun
proto udp
# OpenVPN服务器的外网IP和端口
remote 173.29.34.22 1194                  //此处应该写公网IP 
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert orangleliu.crt # client1的证书
key orangleliu.key # client1的密钥
ns-cert-type server

comp-lzo
verb 3
--------------------------------------------