1. openvpn server安装（10.3.0.100）
wget https://git.io/vpn -O openvpn-install.sh && bash openvpn-install.sh
备用地址：wget http://d.guohao.space/vpn/openvpn-install.sh -O openvpn-install.sh && bash openvpn-install.sh
I need to ask you a few questions before starting the setup.
You can leave the default options and just press enter if you are ok with them.
First, provide the IPv4 address of the network interface you want OpenVPN
listening to.
IP address: x.x.x.x
Which protocol do you want for OpenVPN connections?
1) UDP (recommended)
2) TCP
Protocol [1-2]: 2
What port do you want OpenVPN listening to?
Port: 31194
Which DNS do you want to use with the VPN?
1) Current system resolvers
2) 1.1.1.1
3) Google
4) OpenDNS
5) Verisign
DNS [1-5]: 1
Finally, tell me your name for the client certificate.
Please, use one word only, no special characters.
Client name: client
Okay, that was all I needed. We are ready to set up your OpenVPN server now.
Press any key to continue...
# 这回车后会安装相关的包，生成客户端配置文件，并启动vpn服务
...
...
Finished!
Your client configuration is available at: /root/client.ovpn
2. vpn server端配置
# cat /etc/openvpn/server.conf
port 31194
proto tcp
dev tun
sndbuf 0
rcvbuf 0
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-auth ta.key 0
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
# push "redirect-gateway def1 bypass-dhcp" 改为
push "route 10.3.0.0 255.255.255.0"
# push "dhcp-option DNS 114.114.114.114"
keepalive 10 120
cipher AES-256-CBC
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
verb 3
crl-verify crl.pem
配置说明：
-
server
vpn网络网段，这个可自定义，用默认的也可以
-
push “redirect-gateway def1 bypass-dhcp”
vpn server向客户端推送路由信息，默认的配置会使客户端所有流量都经过vpn，这不是我们想要的，只有到内网的才路由到vpn
-
push “dhcp-option DNS 114.114.114.114”
直接去掉，如果有内部dns服务器的话要改成内部的dns
修改完记得重启vpn服务
systemctl restart openvpn@server
