CentOS 7 安装openvpn的步骤详解
检查系统环境
[root@ss-usa-odo01 ~]# cat /etc/redhat-release
CentOS Linux release 7.0.1406 (Core)
[root@ss-usa-odo01 ~]# df -hP
Filesystem Size Used Avail Use% Mounted on
/dev/ploop12288p1 30G 484M 28G 2% /
devtmpfs 256M 0 256M 0% /dev
tmpfs 256M 0 256M 0% /dev/shm
tmpfs 256M 88K 256M 1% /run
tmpfs 256M 0 256M 0% /sys/fs/cgroup
[root@ss-usa-odo01 ~]# cat /dev/net/tun
cat: /dev/net/tun: File descriptor in bad state
[root@ss-usa-odo01 ~]# grep IPADDR /etc/sysconfig/network-scripts/ifcfg-venet0:0 | awk -F= '{print $2}'
104.223.122.202
[root@ss-usa-odo01 ~]#
系统初始化下
[root@ss-usa-odo01 ~]# curl -Lks onekey.sh/centos_init|bash
[root@ss-usa-odo01 ~]# reboot
更新源
[root@ss-usa-odo01 ~]# yum clean all && yum makecache && yum install epel-release -y && yum update -y
将CentOS 7的FrieWall换成iptables
bash -c "$(curl -Ls onekey.sh/friewall2iptables)"
yum安装openvpn
[root@ss-usa-odo01 ~]# yum install openvpn easy-rsa net-tools -y
配置openvpn Server端
[root@ss-usa-odo01 ~]# cp /usr/share/doc/openvpn-2.3.11/sample/sample-config-files/server.conf /etc/openvpn/
[root@ss-usa-odo01 ~]# mkdir /etc/openvpn/easy-rsa
[root@ss-usa-odo01 ~]# /bin/cp -rf /usr/share/easy-rsa/2.0/* /etc/openvpn/easy-rsa
[root@ss-usa-odo01 ~]# cd /etc/openvpn/easy-rsa
[root@ss-usa-odo01 /etc/openvpn/easy-rsa]# vi vars #参考下面的图做修改
[root@ss-usa-odo01 /etc/openvpn/easy-rsa]# source ./vars
NOTE: If you run ./clean-all, I will be doing a rm -rf on /etc/openvpn/easy-rsa/keys
使用build-ca脚本构建CA证书，证书将创建在/etc/openvpn/easy-rsa/。按Enter键接受默认值：
[root@ss-usa-odo01 /etc/openvpn/easy-rsa]# ./build-ca
Generating a 2048 bit RSA private key
.....................................................................+++
..........................................+++
writing new private key to 'ca.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]:
State or Province Name (full name) [ShangHai]:
Locality Name (eg, city) [PuDong]:
Organization Name (eg, company) [Prime Research Asia]:
Organizational Unit Name (eg, section) [Social Media]:
Common Name (eg, your name or your server's hostname) [Prime Research Asia CA]:
Name [EasyRSA]:
Email Address [admin@dwhd.org]:
[root@ss-usa-odo01 /etc/openvpn/easy-rsa]#
下一步，我们将创建密钥和服务器本身的证书。和以前一样，接受默认值，然后按Y确认证书的签字：
[root@ss-usa-odo01 /etc/openvpn/easy-rsa]# ./build-key-server server
Generating a 2048 bit RSA private key
............................+++
...................+++
writing new private key to 'server.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]:
State or Province Name (full name) [ShangHai]:
Locality Name (eg, city) [PuDong]:
Organization Name (eg, company) [Prime Research Asia]:
Organizational Unit Name (eg, section) [Social Media]:
Common Name (eg, your name or your server's hostname) [server]:
Name [EasyRSA]:
Email Address [admin@dwhd.org]:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
Using configuration from /etc/openvpn/easy-rsa/openssl-1.0.0.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName :PRINTABLE:'CN'
stateOrProvinceName :PRINTABLE:'ShangHai'
localityName :PRINTABLE:'PuDong'
organizationName :PRINTABLE:'Prime Research Asia'
organizationalUnitName:PRINTABLE:'Social Media'
commonName :PRINTABLE:'server'
name :PRINTABLE:'EasyRSA'
emailAddress :IA5STRING:'admin@dwhd.org'
Certificate is to be certified until Jun 11 18:27:02 2026 GMT (3650 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
[root@ss-usa-odo01 /etc/openvpn/easy-rsa]#
Linux之CentOS 7 安装openvpn
接下来，生成用于信息交流，以补充对RSA的Diffie-Hellman文件（这将需要相当长的一段时间）。这将创建一个名为dh2048.pem内的/ etc / OpenVPN的/ RSA /密钥文件中：
[root@ss-usa-odo01 /etc/openvpn/easy-rsa]# ./build-dh
Generating DH parameters, 2048 bit long safe prime, generator 2
This is going to take a long time
..................+.................
最后，为每个使用VPN服务器的客户端创建单独的证书文件：
[root@ss-usa-odo01 /etc/openvpn/easy-rsa]# ./build-key 104.233.122.202-lookback
Generating a 2048 bit RSA private key
...+++
...........................................................+++
writing new private key to '104.233.122.202-lookback.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]:
State or Province Name (full name) [ShangHai]:
Locality Name (eg, city) [PuDong]:
Organization Name (eg, company) [Prime Research Asia]:
Organizational Unit Name (eg, section) [Social Media]:
Common Name (eg, your name or your server's hostname) [104.233.122.202-lookback]:
Name [EasyRSA]:
Email Address [admin@dwhd.org]:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
Using configuration from /etc/openvpn/easy-rsa/openssl-1.0.0.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName :PRINTABLE:'CN'
stateOrProvinceName :PRINTABLE:'ShangHai'
localityName :PRINTABLE:'PuDong'
organizationName :PRINTABLE:'Prime Research Asia'
organizationalUnitName:PRINTABLE:'Social Media'
commonName :PRINTABLE:'104.233.122.202-lookback'
name :PRINTABLE:'EasyRSA'
emailAddress :IA5STRING:'admin@dwhd.org'
Certificate is to be certified until Jun 11 18:35:47 2026 GMT (3650 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
[root@ss-usa-odo01 /etc/openvpn/easy-rsa]#
Linux之CentOS 7 安装openvpn
防止VPN被DDOS攻击，生成ta.key
[root@ss-usa-odo01 /etc/openvpn/easy-rsa]# openvpn --genkey --secret ../ta.key
接下来开始修改server端的配置文件
[root@ss-usa-odo01 /etc/openvpn/easy-rsa]# cp keys/{ca.crt,dh2048.pem,server.crt,server.key} /etc/openvpn/
[root@ss-usa-odo01 /etc/openvpn/easy-rsa]# cd ..
[root@ss-usa-odo01 /etc/openvpn]# vi server.conf
###下面是我的配置文件可以参考
[root@ss-usa-odo01 /etc/openvpn]# grep -Ev '^($|#)' server.conf
;local a.b.c.d #指定监听的本机IP(因为有些计算机具备多个IP地址)，该命令是可选的，默认监听所有IP地址。
port 22033 #服务端端口号，根据需要自行修改
proto tcp #通过tcp协议来连接，也可以通过udp，看实际的需求
;proto udp
;dev tap
dev tun #路由模式，注意windows下必须使用dev tap
;dev-node MyTap #非Windows系统通常不需要设置这个
ca ca.crt #ca证书存放位置，这边是放在默认路径下的不需要修改，如果放在其他路径下，后面要加上绝对路径，根据实际情况更改
cert server.crt #服务器证书存放位置，这边是放在默认路径下的不需要修改，如果放在其他路径下，后面要加上绝对路径，根据实际情况更改
key server.key #服务器密钥存放位置，这边是放在默认路径下的不需要修改，如果放在其他路径下，后面要加上绝对路径，根据实际情况更改
dh dh2048.pem #dh2048.pem存放位置，这边是放在默认路径下的不需要修改，如果放在其他路径下，后面要加上绝对路径，根据实际情况更改
;topology subnet
server 10.188.0.0 255.255.0.0 #虚拟局域网网段设置，请根据需要自行修改
ifconfig-pool-persist ipp.txt #在openvpn重启时,再次连接的客户端将依然被分配和以前一样的IP地址
;server-bridge 10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100
;server-bridge
;push "route 192.168.10.0 255.255.255.0"
;push "route 192.168.20.0 255.255.255.0"
push "route 0.0.0.0 0.0.0.0" #全网走openvpn
;client-config-dir ccd
;route 192.168.40.128 255.255.255.248
;client-config-dir ccd
;route 10.9.0.0 255.255.255.252
;learn-address ./script
push "redirect-gateway def1 bypass-dhcp" #客户端所有网络通信通过vpn，这个可以选择的，如果注释掉的话那就是本地的数据包还是从本地出去，不强制走VPN
push "dhcp-option DNS 8.8.8.8" #指定客户端使用的主DNS
push "dhcp-option DNS 8.8.4.4" #指定客户端使用的备DNS
client-to-client #开启客户端互访
duplicate-cn #支持一个证书多个客户端登录使用，建议不启用
keepalive 5 30 #服务端5面监测一次，如果30秒没响应就认定客户端down了
tls-auth ta.key 0 #防DDOS攻击，服务器端0,客户端1
;cipher BF-CBC # Blowfish (default) #这是默认的加密算法
;cipher AES-128-CBC # AES
;cipher DES-EDE3-CBC # Triple-DES
comp-lzo #允许数据压缩，如果启用了客户端配置文件也需要有这项
max-clients 100 #最大客户端并发连接数量
user nobody #定义运行openvpn的用户
group nobody #定义运行openvpn的用户组
persist-key #通过keepalive检测超时后，重新启动VPN，不重新读取keys，保留第一次使用的keys
persist-tun #通过keepalive检测超时后，重新启动VPN，一直保持tun或者tap设备是linkup的，否则网络连接会先linkdown然后linkup
status /tmp/openvpn-status.log #定期把openvpn的一些状态信息写到文件中，以便自己写程序计费或者进行其他操作
;log openvpn.log #记录日志，每次重新启动openvpn后删除原有的log信息
log-append /tmp/openvpn.log #记录日志，每次重新启动openvpn后追加原有的log信息
verb 3 #设置日志要记录的级别，可选0-9，0 只记录错误信息，4 能记录普通的信息，5 和 6 在连接出现问题时能帮助调试，9 是极端的，所有信息都会显示，甚至连包头等信息都显示（像tcpdump）
mute 20
#相同信息的数量，如果连续出现 20 条相同的信息，将不记录到日志中。
[root@ss-usa-odo01 /etc/openvpn]#
[root@ss-usa-odo01 /etc/openvpn]# echo -e "###OpenVPN ADD\nnet.ipv4.conf.default.accept_source_route = 1\nnet.ipv4.conf.default.rp_filter = 0\nnet.ipv4.ip_forward = 1" >> /etc/sysctl.conf
[root@ss-usa-odo01 /etc/openvpn]# sysctl -p
net.ipv4.conf.default.accept_source_route = 1
net.ipv4.conf.default.rp_filter = 0
net.ipv4.ip_forward = 1
[root@ss-usa-odo01 /etc/openvpn]#
[root@ss-usa-odo01 /etc/openvpn]# systemctl -f enable openvpn@server
Created symlink from /etc/systemd/system/multi-user.target.wants/openvpn@server.service to /usr/lib/systemd/system/openvpn@.service.
[root@ss-usa-odo01 /etc/openvpn]# systemctl start openvpn@server
[root@ss-usa-odo01 /etc/openvpn]# systemctl -l status openvpn@server
● openvpn@server.service - OpenVPN Robust And Highly Flexible Tunneling Application On server
Loaded: loaded (/usr/lib/systemd/system/openvpn@.service; enabled; vendor preset: disabled)
Active: active (running) since 一 2016-06-13 16:08:20 EDT; 10s ago
Process: 6464 ExecStart=/usr/sbin/openvpn --daemon --writepid /var/run/openvpn/%i.pid --cd /etc/openvpn/ --config %i.conf (code=exited, status=0/SUCCESS)
Main PID: 6465 (openvpn)
CGroup: /system.slice/system-openvpn.slice/openvpn@server.service
└─6465 /usr/sbin/openvpn --daemon --writepid /var/run/openvpn/server.pid --cd /etc/openvpn/ --config server.conf
6月 13 16:08:20 ss-usa-odo01.90r.org systemd[1]: Starting OpenVPN Robust And Highly Flexible Tunneling Application On server...
6月 13 16:08:20 ss-usa-odo01.90r.org systemd[1]: Started OpenVPN Robust And Highly Flexible Tunneling Application On server.
[root@ss-usa-odo01 /etc/openvpn]# cat /tmp/openvpn.log
Mon Jun 13 16:07:47 2016 us=2075 Current Parameter Settings:
Mon Jun 13 16:07:47 2016 us=2135 config = 'server.conf'
Mon Jun 13 16:07:47 2016 us=2144 mode = 1
Mon Jun 13 16:07:47 2016 us=2150 persist_config = DISABLED
Mon Jun 13 16:07:47 2016 us=2156 persist_mode = 1
Mon Jun 13 16:07:47 2016 us=2162 show_ciphers = DISABLED
Mon Jun 13 16:07:47 2016 us=2168 show_digests = DISABLED
Mon Jun 13 16:07:47 2016 us=2174 show_engines = DISABLED
Mon Jun 13 16:07:47 2016 us=2180 genkey = DISABLED
Mon Jun 13 16:07:47 2016 us=2185 key_pass_file = '[UNDEF]'
Mon Jun 13 16:07:47 2016 us=2192 show_tls_ciphers = DISABLED
Mon Jun 13 16:07:47 2016 us=2199 Connection profiles [default]:
Mon Jun 13 16:07:47 2016 us=2206 proto = tcp-server
Mon Jun 13 16:07:47 2016 us=2214 local = '[UNDEF]'
Mon Jun 13 16:07:47 2016 us=2219 local_port = 22033
Mon Jun 13 16:07:47 2016 us=2224 remote = '[UNDEF]'
Mon Jun 13 16:07:47 2016 us=2229 remote_port = 22033
Mon Jun 13 16:07:47 2016 us=2234 remote_float = DISABLED
Mon Jun 13 16:07:47 2016 us=2240 bind_defined = DISABLED
Mon Jun 13 16:07:47 2016 us=2246 bind_local = ENABLED
Mon Jun 13 16:07:47 2016 us=2252 connect_retry_seconds = 5
Mon Jun 13 16:07:47 2016 us=2258 connect_timeout = 10
Mon Jun 13 16:07:47 2016 us=2264 connect_retry_max = 0
Mon Jun 13 16:07:47 2016 us=2271 socks_proxy_server = '[UNDEF]'
Mon Jun 13 16:07:47 2016 us=2277 socks_proxy_port = 0
Mon Jun 13 16:07:47 2016 us=2283 socks_proxy_retry = DISABLED
Mon Jun 13 16:07:47 2016 us=2289 tun_mtu = 1500
Mon Jun 13 16:07:47 2016 us=2305 tun_mtu_defined = ENABLED
Mon Jun 13 16:07:47 2016 us=2311 link_mtu = 1500
Mon Jun 13 16:07:47 2016 us=2316 link_mtu_defined = DISABLED
Mon Jun 13 16:07:47 2016 us=2322 tun_mtu_extra = 0
Mon Jun 13 16:07:47 2016 us=2327 tun_mtu_extra_defined = DISABLED
Mon Jun 13 16:07:47 2016 us=2333 mtu_discover_type = -1
Mon Jun 13 16:07:47 2016 us=2338 fragment = 0
Mon Jun 13 16:07:47 2016 us=2344 mssfix = 1450
Mon Jun 13 16:07:47 2016 us=2350 explicit_exit_notification = 0
Mon Jun 13 16:07:47 2016 us=2357 Connection profiles END
Mon Jun 13 16:07:47 2016 us=2363 remote_random = DISABLED
Mon Jun 13 16:07:47 2016 us=2368 ipchange = '[UNDEF]'
Mon Jun 13 16:07:47 2016 us=2373 dev = 'tun'
Mon Jun 13 16:07:47 2016 us=2378 dev_type = '[UNDEF]'
Mon Jun 13 16:07:47 2016 us=2382 dev_node = '[UNDEF]'
Mon Jun 13 16:07:47 2016 us=2388 lladdr = '[UNDEF]'
Mon Jun 13 16:07:47 2016 us=2394 topology = 1
Mon Jun 13 16:07:47 2016 us=2400 tun_ipv6 = DISABLED
Mon Jun 13 16:07:47 2016 us=2405 ifconfig_local = '10.188.0.1'
Mon Jun 13 16:07:47 2016 us=2411 ifconfig_remote_netmask = '10.188.0.2'
Mon Jun 13 16:07:47 2016 us=2416 ifconfig_noexec = DISABLED
Mon Jun 13 16:07:47 2016 us=2422 ifconfig_nowarn = DISABLED
Mon Jun 13 16:07:47 2016 us=2437 ifconfig_ipv6_local = '[UNDEF]'
Mon Jun 13 16:07:47 2016 us=2442 ifconfig_ipv6_netbits = 0
Mon Jun 13 16:07:47 2016 us=2487 ifconfig_ipv6_remote = '[UNDEF]'
Mon Jun 13 16:07:47 2016 us=2494 shaper = 0
Mon Jun 13 16:07:47 2016 us=2500 mtu_test = 0
Mon Jun 13 16:07:47 2016 us=2506 mlock = DISABLED
Mon Jun 13 16:07:47 2016 us=2512 keepalive_ping = 5
Mon Jun 13 16:07:47 2016 us=2518 keepalive_timeout = 30
Mon Jun 13 16:07:47 2016 us=2523 inactivity_timeout = 0
Mon Jun 13 16:07:47 2016 us=2537 ping_send_timeout = 5
Mon Jun 13 16:07:47 2016 us=2542 ping_rec_timeout = 60
Mon Jun 13 16:07:47 2016 us=2547 ping_rec_timeout_action = 2
Mon Jun 13 16:07:47 2016 us=2554 ping_timer_remote = DISABLED
Mon Jun 13 16:07:47 2016 us=2559 remap_sigusr1 = 0
Mon Jun 13 16:07:47 2016 us=2564 persist_tun = ENABLED
Mon Jun 13 16:07:47 2016 us=2569 persist_local_ip = DISABLED
Mon Jun 13 16:07:47 2016 us=2574 persist_remote_ip = DISABLED
Mon Jun 13 16:07:47 2016 us=2579 persist_key = ENABLED
Mon Jun 13 16:07:47 2016 us=2585 passtos = DISABLED
Mon Jun 13 16:07:47 2016 us=2590 resolve_retry_seconds = 1000000000
Mon Jun 13 16:07:47 2016 us=2596 username = 'nobody'
Mon Jun 13 16:07:47 2016 us=2601 groupname = 'nobody'
Mon Jun 13 16:07:47 2016 us=2617 chroot_dir = '[UNDEF]'
Mon Jun 13 16:07:47 2016 us=2622 cd_dir = '[UNDEF]'
Mon Jun 13 16:07:47 2016 us=2627 writepid = '[UNDEF]'
Mon Jun 13 16:07:47 2016 us=2645 up_script = '[UNDEF]'
Mon Jun 13 16:07:47 2016 us=2650 down_script = '[UNDEF]'
Mon Jun 13 16:07:47 2016 us=2655 down_pre = DISABLED
Mon Jun 13 16:07:47 2016 us=2660 up_restart = DISABLED
Mon Jun 13 16:07:47 2016 us=2668 up_delay = DISABLED
Mon Jun 13 16:07:47 2016 us=2675 daemon = DISABLED
Mon Jun 13 16:07:47 2016 us=2681 inetd = 0
Mon Jun 13 16:07:47 2016 us=2686 log = ENABLED
Mon Jun 13 16:07:47 2016 us=2692 suppress_timestamps = DISABLED
Mon Jun 13 16:07:47 2016 us=2696 nice = 0
Mon Jun 13 16:07:47 2016 us=2701 verbosity = 6
Mon Jun 13 16:07:47 2016 us=2706 mute = 0
Mon Jun 13 16:07:47 2016 us=2711 gremlin = 0
Mon Jun 13 16:07:47 2016 us=2716 status_file = '/tmp/openvpn-status.log'
Mon Jun 13 16:07:47 2016 us=2721 status_file_version = 1
Mon Jun 13 16:07:47 2016 us=2727 status_file_update_freq = 60
Mon Jun 13 16:07:47 2016 us=2732 occ = ENABLED
Mon Jun 13 16:07:47 2016 us=2738 rcvbuf = 0
Mon Jun 13 16:07:47 2016 us=2743 sndbuf = 0
Mon Jun 13 16:07:47 2016 us=2749 mark = 0
Mon Jun 13 16:07:47 2016 us=2754 sockflags = 0
Mon Jun 13 16:07:47 2016 us=2759 fast_io = DISABLED
Mon Jun 13 16:07:47 2016 us=2765 lzo = 7
Mon Jun 13 16:07:47 2016 us=2773 route_script = '[UNDEF]'
Mon Jun 13 16:07:47 2016 us=2779 route_default_gateway = '[UNDEF]'
Mon Jun 13 16:07:47 2016 us=2784 route_default_metric = 0
Mon Jun 13 16:07:47 2016 us=2791 route_noexec = DISABLED
Mon Jun 13 16:07:47 2016 us=2797 route_delay = 0
Mon Jun 13 16:07:47 2016 us=2803 route_delay_window = 30
Mon Jun 13 16:07:47 2016 us=2809 route_delay_defined = DISABLED
Mon Jun 13 16:07:47 2016 us=2815 route_nopull = DISABLED
Mon Jun 13 16:07:47 2016 us=2820 route_gateway_via_dhcp = DISABLED
Mon Jun 13 16:07:47 2016 us=2826 max_routes = 100
Mon Jun 13 16:07:47 2016 us=2831 allow_pull_fqdn = DISABLED
Mon Jun 13 16:07:47 2016 us=2838 route 10.188.0.0/255.255.0.0/nil/nil
Mon Jun 13 16:07:47 2016 us=2843 management_addr = '[UNDEF]'
Mon Jun 13 16:07:47 2016 us=2850 management_port = 0
Mon Jun 13 16:07:47 2016 us=2856 management_user_pass = '[UNDEF]'
Mon Jun 13 16:07:47 2016 us=2862 management_log_history_cache = 250
Mon Jun 13 16:07:47 2016 us=2877 management_echo_buffer_size = 100
Mon Jun 13 16:07:47 2016 us=2883 management_write_peer_info_file = '[UNDEF]'
Mon Jun 13 16:07:47 2016 us=2889 management_client_user = '[UNDEF]'
Mon Jun 13 16:07:47 2016 us=2895 management_client_group = '[UNDEF]'
Mon Jun 13 16:07:47 2016 us=2901 management_flags = 0
Mon Jun 13 16:07:47 2016 us=2912 shared_secret_file = '[UNDEF]'
Mon Jun 13 16:07:47 2016 us=2918 key_direction = 1
Mon Jun 13 16:07:47 2016 us=2924 ciphername_defined = ENABLED
Mon Jun 13 16:07:47 2016 us=2940 ciphername = 'BF-CBC'
Mon Jun 13 16:07:47 2016 us=2946 authname_defined = ENABLED
Mon Jun 13 16:07:47 2016 us=2951 authname = 'SHA1'
Mon Jun 13 16:07:47 2016 us=2957 prng_hash = 'SHA1'
Mon Jun 13 16:07:47 2016 us=2963 prng_nonce_secret_len = 16
Mon Jun 13 16:07:47 2016 us=2968 keysize = 0
Mon Jun 13 16:07:47 2016 us=2974 engine = DISABLED
Mon Jun 13 16:07:47 2016 us=2979 replay = ENABLED
Mon Jun 13 16:07:47 2016 us=2989 mute_replay_warnings = DISABLED
Mon Jun 13 16:07:47 2016 us=2994 replay_window = 64
Mon Jun 13 16:07:47 2016 us=2999 replay_time = 15
Mon Jun 13 16:07:47 2016 us=3004 packet_id_file = '[UNDEF]'
Mon Jun 13 16:07:47 2016 us=3010 use_iv = ENABLED
Mon Jun 13 16:07:47 2016 us=3015 test_crypto = DISABLED
Mon Jun 13 16:07:47 2016 us=3020 tls_server = ENABLED
Mon Jun 13 16:07:47 2016 us=3026 tls_client = DISABLED
Mon Jun 13 16:07:47 2016 us=3031 key_method = 2
Mon Jun 13 16:07:47 2016 us=3047 ca_file = 'ca.crt'
Mon Jun 13 16:07:47 2016 us=3053 ca_path = '[UNDEF]'
Mon Jun 13 16:07:47 2016 us=3069 dh_file = 'dh2048.pem'
Mon Jun 13 16:07:47 2016 us=3074 cert_file = 'server.crt'
Mon Jun 13 16:07:47 2016 us=3080 extra_certs_file = '[UNDEF]'
Mon Jun 13 16:07:47 2016 us=3096 priv_key_file = 'server.key'
Mon Jun 13 16:07:47 2016 us=3102 pkcs12_file = '[UNDEF]'
Mon Jun 13 16:07:47 2016 us=3107 cipher_list = '[UNDEF]'
Mon Jun 13 16:07:47 2016 us=3112 tls_verify = '[UNDEF]'
Mon Jun 13 16:07:47 2016 us=3118 tls_export_cert = '[UNDEF]'
Mon Jun 13 16:07:47 2016 us=3123 verify_x509_type = 0
Mon Jun 13 16:07:47 2016 us=3129 verify_x509_name = '[UNDEF]'
Mon Jun 13 16:07:47 2016 us=3135 crl_file = '[UNDEF]'
Mon Jun 13 16:07:47 2016 us=3140 ns_cert_type = 0
Mon Jun 13 16:07:47 2016 us=3146 remote_cert_ku[i] = 0
Mon Jun 13 16:07:47 2016 us=3152 remote_cert_ku[i] = 0
Mon Jun 13 16:07:47 2016 us=3157 remote_cert_ku[i] = 0
Mon Jun 13 16:07:47 2016 us=3163 remote_cert_ku[i] = 0
Mon Jun 13 16:07:47 2016 us=3169 remote_cert_ku[i] = 0
Mon Jun 13 16:07:47 2016 us=3174 remote_cert_ku[i] = 0
Mon Jun 13 16:07:47 2016 us=3179 remote_cert_ku[i] = 0
Mon Jun 13 16:07:47 2016 us=3184 remote_cert_ku[i] = 0
Mon Jun 13 16:07:47 2016 us=3189 remote_cert_ku[i] = 0
Mon Jun 13 16:07:47 2016 us=3194 remote_cert_ku[i] = 0
Mon Jun 13 16:07:47 2016 us=3199 remote_cert_ku[i] = 0
Mon Jun 13 16:07:47 2016 us=3204 remote_cert_ku[i] = 0
Mon Jun 13 16:07:47 2016 us=3209 remote_cert_ku[i] = 0
Mon Jun 13 16:07:47 2016 us=3214 remote_cert_ku[i] = 0
Mon Jun 13 16:07:47 2016 us=3220 remote_cert_ku[i] = 0
Mon Jun 13 16:07:47 2016 us=3234 remote_cert_ku[i] = 0
Mon Jun 13 16:07:47 2016 us=3241 remote_cert_eku = '[UNDEF]'
Mon Jun 13 16:07:47 2016 us=3246 ssl_flags = 0
Mon Jun 13 16:07:47 2016 us=3252 tls_timeout = 2
Mon Jun 13 16:07:47 2016 us=3258 renegotiate_bytes = 0
Mon Jun 13 16:07:47 2016 us=3263 renegotiate_packets = 0
Mon Jun 13 16:07:47 2016 us=3268 renegotiate_seconds = 3600
Mon Jun 13 16:07:47 2016 us=3274 handshake_window = 60
Mon Jun 13 16:07:47 2016 us=3278 transition_window = 3600
Mon Jun 13 16:07:47 2016 us=3293 single_session = DISABLED
Mon Jun 13 16:07:47 2016 us=3298 push_peer_info = DISABLED
Mon Jun 13 16:07:47 2016 us=3303 tls_exit = DISABLED
Mon Jun 13 16:07:47 2016 us=3309 tls_auth_file = 'ta.key'
Mon Jun 13 16:07:47 2016 us=3315 pkcs11_protected_authentication = DISABLED
Mon Jun 13 16:07:47 2016 us=3321 pkcs11_protected_authentication = DISABLED
Mon Jun 13 16:07:47 2016 us=3327 pkcs11_protected_authentication = DISABLED
Mon Jun 13 16:07:47 2016 us=3332 pkcs11_protected_authentication = DISABLED
Mon Jun 13 16:07:47 2016 us=3338 pkcs11_protected_authentication = DISABLED
Mon Jun 13 16:07:47 2016 us=3344 pkcs11_protected_authentication = DISABLED
Mon Jun 13 16:07:47 2016 us=3350 pkcs11_protected_authentication = DISABLED
Mon Jun 13 16:07:47 2016 us=3356 pkcs11_protected_authentication = DISABLED
Mon Jun 13 16:07:47 2016 us=3361 pkcs11_protected_authentication = DISABLED
Mon Jun 13 16:07:47 2016 us=3367 pkcs11_protected_authentication = DISABLED
Mon Jun 13 16:07:47 2016 us=3372 pkcs11_protected_authentication = DISABLED
Mon Jun 13 16:07:47 2016 us=3377 pkcs11_protected_authentication = DISABLED
Mon Jun 13 16:07:47 2016 us=3382 pkcs11_protected_authentication = DISABLED
Mon Jun 13 16:07:47 2016 us=3389 pkcs11_protected_authentication = DISABLED
Mon Jun 13 16:07:47 2016 us=3395 pkcs11_protected_authentication = DISABLED
Mon Jun 13 16:07:47 2016 us=3403 pkcs11_protected_authentication = DISABLED
Mon Jun 13 16:07:47 2016 us=3410 pkcs11_private_mode = 00000000
Mon Jun 13 16:07:47 2016 us=3415 pkcs11_private_mode = 00000000
Mon Jun 13 16:07:47 2016 us=3421 pkcs11_private_mode = 00000000
Mon Jun 13 16:07:47 2016 us=3426 pkcs11_private_mode = 00000000
Mon Jun 13 16:07:47 2016 us=3432 pkcs11_private_mode = 00000000
Mon Jun 13 16:07:47 2016 us=3437 pkcs11_private_mode = 00000000
Mon Jun 13 16:07:47 2016 us=3443 pkcs11_private_mode = 00000000
Mon Jun 13 16:07:47 2016 us=3448 pkcs11_private_mode = 00000000
Mon Jun 13 16:07:47 2016 us=3454 pkcs11_private_mode = 00000000
Mon Jun 13 16:07:47 2016 us=3459 pkcs11_private_mode = 00000000
Mon Jun 13 16:07:47 2016 us=3465 pkcs11_private_mode = 00000000
Mon Jun 13 16:07:47 2016 us=3481 pkcs11_private_mode = 00000000
Mon Jun 13 16:07:47 2016 us=3486 pkcs11_private_mode = 00000000
Mon Jun 13 16:07:47 2016 us=3503 pkcs11_private_mode = 00000000
Mon Jun 13 16:07:47 2016 us=3509 pkcs11_private_mode = 00000000
Mon Jun 13 16:07:47 2016 us=3514 pkcs11_private_mode = 00000000
Mon Jun 13 16:07:47 2016 us=3530 pkcs11_cert_private = DISABLED
Mon Jun 13 16:07:47 2016 us=3535 pkcs11_cert_private = DISABLED
Mon Jun 13 16:07:47 2016 us=3540 pkcs11_cert_private = DISABLED
Mon Jun 13 16:07:47 2016 us=3545 pkcs11_cert_private = DISABLED
Mon Jun 13 16:07:47 2016 us=3550 pkcs11_cert_private = DISABLED
Mon Jun 13 16:07:47 2016 us=3557 pkcs11_cert_private = DISABLED
Mon Jun 13 16:07:47 2016 us=3563 pkcs11_cert_private = DISABLED
Mon Jun 13 16:07:47 2016 us=3568 pkcs11_cert_private = DISABLED
Mon Jun 13 16:07:47 2016 us=3573 pkcs11_cert_private = DISABLED
Mon Jun 13 16:07:47 2016 us=3579 pkcs11_cert_private = DISABLED
Mon Jun 13 16:07:47 2016 us=3585 pkcs11_cert_private = DISABLED
Mon Jun 13 16:07:47 2016 us=3590 pkcs11_cert_private = DISABLED
Mon Jun 13 16:07:47 2016 us=3595 pkcs11_cert_private = DISABLED
Mon Jun 13 16:07:47 2016 us=3601 pkcs11_cert_private = DISABLED
Mon Jun 13 16:07:47 2016 us=3606 pkcs11_cert_private = DISABLED
Mon Jun 13 16:07:47 2016 us=3613 pkcs11_cert_private = DISABLED
Mon Jun 13 16:07:47 2016 us=3619 pkcs11_pin_cache_period = -1
Mon Jun 13 16:07:47 2016 us=3624 pkcs11_id = '[UNDEF]'
Mon Jun 13 16:07:47 2016 us=3630 pkcs11_id_management = DISABLED
Mon Jun 13 16:07:47 2016 us=3637 server_network = 10.188.0.0
Mon Jun 13 16:07:47 2016 us=3643 server_netmask = 255.255.0.0
Mon Jun 13 16:07:47 2016 us=3654 server_network_ipv6 = ::
Mon Jun 13 16:07:47 2016 us=3660 server_netbits_ipv6 = 0
Mon Jun 13 16:07:47 2016 us=3666 server_bridge_ip = 0.0.0.0
Mon Jun 13 16:07:47 2016 us=3672 server_bridge_netmask = 0.0.0.0
Mon Jun 13 16:07:47 2016 us=3678 server_bridge_pool_start = 0.0.0.0
Mon Jun 13 16:07:47 2016 us=3685 server_bridge_pool_end = 0.0.0.0
Mon Jun 13 16:07:47 2016 us=3690 push_entry = 'route 0.0.0.0 0.0.0.0'
Mon Jun 13 16:07:47 2016 us=3708 push_entry = 'redirect-gateway def1 bypass-dhcp'
Mon Jun 13 16:07:47 2016 us=3724 push_entry = 'dhcp-option DNS 8.8.8.8'
Mon Jun 13 16:07:47 2016 us=3729 push_entry = 'dhcp-option DNS 8.8.4.4'
Mon Jun 13 16:07:47 2016 us=3734 push_entry = 'route 10.188.0.0 255.255.0.0'
Mon Jun 13 16:07:47 2016 us=3740 push_entry = 'topology net30'
Mon Jun 13 16:07:47 2016 us=3747 push_entry = 'ping 5'
Mon Jun 13 16:07:47 2016 us=3751 push_entry = 'ping-restart 30'
Mon Jun 13 16:07:47 2016 us=3754 ifconfig_pool_defined = ENABLED
Mon Jun 13 16:07:47 2016 us=3758 ifconfig_pool_start = 10.188.0.4
Mon Jun 13 16:07:47 2016 us=3762 ifconfig_pool_end = 10.188.255.251
Mon Jun 13 16:07:47 2016 us=3766 ifconfig_pool_netmask = 0.0.0.0
Mon Jun 13 16:07:47 2016 us=3769 ifconfig_pool_persist_filename = 'ipp.txt'
Mon Jun 13 16:07:47 2016 us=3773 ifconfig_pool_persist_refresh_freq = 600
Mon Jun 13 16:07:47 2016 us=3776 ifconfig_ipv6_pool_defined = DISABLED
Mon Jun 13 16:07:47 2016 us=3780 ifconfig_ipv6_pool_base = ::
Mon Jun 13 16:07:47 2016 us=3783 ifconfig_ipv6_pool_netbits = 0
Mon Jun 13 16:07:47 2016 us=3790 n_bcast_buf = 256
Mon Jun 13 16:07:47 2016 us=3793 tcp_queue_limit = 64
Mon Jun 13 16:07:47 2016 us=3796 real_hash_size = 256
Mon Jun 13 16:07:47 2016 us=3800 virtual_hash_size = 256
Mon Jun 13 16:07:47 2016 us=3803 client_connect_script = '[UNDEF]'
Mon Jun 13 16:07:47 2016 us=3807 learn_address_script = '[UNDEF]'
Mon Jun 13 16:07:47 2016 us=3810 client_disconnect_script = '[UNDEF]'
Mon Jun 13 16:07:47 2016 us=3814 client_config_dir = '[UNDEF]'
Mon Jun 13 16:07:47 2016 us=3817 ccd_exclusive = DISABLED
Mon Jun 13 16:07:47 2016 us=3820 tmp_dir = '/tmp'
Mon Jun 13 16:07:47 2016 us=3824 push_ifconfig_defined = DISABLED
Mon Jun 13 16:07:47 2016 us=3828 push_ifconfig_local = 0.0.0.0
Mon Jun 13 16:07:47 2016 us=3831 push_ifconfig_remote_netmask = 0.0.0.0
Mon Jun 13 16:07:47 2016 us=3835 push_ifconfig_ipv6_defined = DISABLED
Mon Jun 13 16:07:47 2016 us=3841 push_ifconfig_ipv6_local = ::/0
Mon Jun 13 16:07:47 2016 us=3845 push_ifconfig_ipv6_remote = ::
Mon Jun 13 16:07:47 2016 us=3849 enable_c2c = ENABLED
Mon Jun 13 16:07:47 2016 us=3853 duplicate_cn = ENABLED
Mon Jun 13 16:07:47 2016 us=3858 cf_max = 0
Mon Jun 13 16:07:47 2016 us=3862 cf_per = 0
Mon Jun 13 16:07:47 2016 us=3865 max_clients = 100
Mon Jun 13 16:07:47 2016 us=3869 max_routes_per_client = 256
Mon Jun 13 16:07:47 2016 us=3882 auth_user_pass_verify_script = '[UNDEF]'
Mon Jun 13 16:07:47 2016 us=3886 auth_user_pass_verify_script_via_file = DISABLED
Mon Jun 13 16:07:47 2016 us=3889 port_share_host = '[UNDEF]'
Mon Jun 13 16:07:47 2016 us=3893 port_share_port = 0
Mon Jun 13 16:07:47 2016 us=3896 client = DISABLED
Mon Jun 13 16:07:47 2016 us=3900 pull = DISABLED
Mon Jun 13 16:07:47 2016 us=3906 auth_user_pass_file = '[UNDEF]'
Mon Jun 13 16:07:47 2016 us=3911 OpenVPN 2.3.11 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on May 10 2016
Mon Jun 13 16:07:47 2016 us=3919 library versions: OpenSSL 1.0.1e-fips 11 Feb 2013, LZO 2.06
Mon Jun 13 16:07:47 2016 us=4002 WARNING: --ifconfig-pool-persist will not work with --duplicate-cn
Mon Jun 13 16:07:47 2016 us=59407 Diffie-Hellman initialized with 2048 bit key
Mon Jun 13 16:07:47 2016 us=59920 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Mon Jun 13 16:07:47 2016 us=59938 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Jun 13 16:07:47 2016 us=59946 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Jun 13 16:07:47 2016 us=59958 TLS-Auth MTU parms [ L:1544 D:1182 EF:68 EB:0 ET:0 EL:3 ]
Mon Jun 13 16:07:47 2016 us=59975 Socket Buffers: R=[87380->87380] S=[16384->16384]
Mon Jun 13 16:07:47 2016 us=60070 ROUTE_GATEWAY ON_LINK IFACE=venet0 HWADDR=00:00:00:00:00:00
Mon Jun 13 16:07:47 2016 us=60296 TUN/TAP device tun0 opened
Mon Jun 13 16:07:47 2016 us=60311 TUN/TAP TX queue length set to 100
Mon Jun 13 16:07:47 2016 us=60323 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Mon Jun 13 16:07:47 2016 us=60341 /usr/sbin/ip link set dev tun0 up mtu 1500
Mon Jun 13 16:07:47 2016 us=72043 /usr/sbin/ip addr add dev tun0 local 10.188.0.1 peer 10.188.0.2
Mon Jun 13 16:07:47 2016 us=89355 /usr/sbin/ip route add 10.188.0.0/16 via 10.188.0.2
Mon Jun 13 16:07:47 2016 us=90077 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:143 ET:0 EL:3 AF:3/1 ]
Mon Jun 13 16:07:47 2016 us=90257 GID set to nobody
Mon Jun 13 16:07:47 2016 us=90268 UID set to nobody
Mon Jun 13 16:07:47 2016 us=90275 Listening for incoming TCP connection on [undef]
Mon Jun 13 16:07:47 2016 us=90283 TCPv4_SERVER link local (bound): [undef]
Mon Jun 13 16:07:47 2016 us=90287 TCPv4_SERVER link remote: [undef]
Mon Jun 13 16:07:47 2016 us=90295 MULTI: multi_init called, r=256 v=256
Mon Jun 13 16:07:47 2016 us=90441 IFCONFIG POOL: base=10.188.0.4 size=16382, ipv6=0
Mon Jun 13 16:07:47 2016 us=90453 IFCONFIG POOL LIST
Mon Jun 13 16:07:47 2016 us=90480 MULTI: TCP INIT maxclients=100 maxevents=104
Mon Jun 13 16:07:47 2016 us=90495 Initialization Sequence Completed
Mon Jun 13 16:08:07 2016 us=790588 TCP/UDP: Closing socket
Mon Jun 13 16:08:07 2016 us=790658 /usr/sbin/ip route del 10.188.0.0/16
RTNETLINK answers: Operation not permitted
Mon Jun 13 16:08:07 2016 us=791611 ERROR: Linux route delete command failed: external program exited with error status: 2
Mon Jun 13 16:08:07 2016 us=791637 Closing TUN/TAP interface
Mon Jun 13 16:08:07 2016 us=791657 /usr/sbin/ip addr del dev tun0 local 10.188.0.1 peer 10.188.0.2
RTNETLINK answers: Operation not permitted
Mon Jun 13 16:08:07 2016 us=792360 Linux ip addr del failed: external program exited with error status: 2
Mon Jun 13 16:08:07 2016 us=830989 SIGINT[hard,] received, process exiting
[root@ss-usa-odo01 /etc/openvpn]#
[root@ss-usa-odo01 /etc/openvpn]# iptables -nvxL --lin
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 127988 174103095 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
2 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
3 0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
4 228 14272 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22
5 651 33525 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
Chain OUTPUT (policy ACCEPT 77183 packets, 5938860 bytes)
num pkts bytes target prot opt in out source destination
[root@ss-usa-odo01 /etc/openvpn]# iptables -I INPUT 4 -p tcp -m state --state NEW -m tcp --dport 22033 -j ACCEPT
[root@ss-usa-odo01 /etc/openvpn]# iptables -nvxL --lin
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 127988 174103095 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
2 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
3 0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
4 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22033
5 228 14272 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22
6 651 33525 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
Chain OUTPUT (policy ACCEPT 77183 packets, 5938860 bytes)
num pkts bytes target prot opt in out source destination
[root@ss-usa-odo01 /etc/openvpn]# iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
[root@ss-usa-odo01 /etc/openvpn]# iptables -I FORWARD 2 -s 10.0.0.0/8 -j ACCEPT
[root@ss-usa-odo01 /etc/openvpn]# iptables -nvxL --lin
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 128015 174104967 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
2 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
3 0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
4 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22033
5 228 14272 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22
6 651 33525 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
2 0 0 ACCEPT all -- * * 10.0.0.0/8 0.0.0.0/0
3 0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
Chain OUTPUT (policy ACCEPT 3 packets, 436 bytes)
num pkts bytes target prot opt in out source destination
[root@ss-usa-odo01 /etc/openvpn]# iptables -t nat -A POSTROUTING -s 10.0.0.0/8 -j SNAT --to-source 104.223.122.202
[root@ss-usa-odo01 /etc/openvpn]# iptables -t nat -nvxL --lin
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 0 0 SNAT all -- * * 10.0.0.0/8 0.0.0.0/0 to:104.223.122.202
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
[root@ss-usa-odo01 /etc/openvpn]# iptables-save >/etc/sysconfig/iptables
[root@ss-usa-odo01 /etc/openvpn]# cat /etc/sysconfig/iptables
# Generated by iptables-save v1.4.21 on Mon Jun 13 16:14:40 2016
*raw
:PREROUTING ACCEPT [366072:522504090]
:OUTPUT ACCEPT [204986:14628967]
COMMIT
# Completed on Mon Jun 13 16:14:40 2016
# Generated by iptables-save v1.4.21 on Mon Jun 13 16:14:40 2016
*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A POSTROUTING -s 10.0.0.0/8 -j SNAT --to-source 104.223.122.202
COMMIT
# Completed on Mon Jun 13 16:14:40 2016
# Generated by iptables-save v1.4.21 on Mon Jun 13 16:14:40 2016
*mangle
:PREROUTING ACCEPT [366072:522504090]
:INPUT ACCEPT [366072:522504090]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [204986:14628967]
:POSTROUTING ACCEPT [204986:14628967]
COMMIT
# Completed on Mon Jun 13 16:14:40 2016
# Generated by iptables-save v1.4.21 on Mon Jun 13 16:14:40 2016
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [98:11832]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22033 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 10.0.0.0/8 -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
# Completed on Mon Jun 13 16:14:40 2016
[root@ss-usa-odo01 /etc/openvpn]#
iptables -nvxL --lin
iptables -I INPUT 4 -p tcp -m state --state NEW -m tcp --dport 22033 -j ACCEPT
iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -I FORWARD 2 -s 10.0.0.0/8 -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.0.0.0/8 -j SNAT --to-source 104.223.122.202
iptables-save >/etc/sysconfig/iptables
###由于OpenVPN本事不支持多端口，因此我们可以借助iptables来实现多端口使用
iptables -t nat -A PREROUTING -p tcp -d 104.223.122.202 -m multiport --dports 22034:22044 -j REDIRECT --to-port 22033
这样就把所有发往104.223.122.202这个Ip的22034-22044端口的数据包都转发到了22033上了
104.223.122.202是你的OpenVPN的监听IP
客户端配置文件参考
client
dev tun
proto tcp
resolv-retry infinite
nobind
persist-key
persist-tun
comp-lzo
verb 3
remote 104.223.122.202 22033
ca 104.223.122.202-ca.crt
cert 104.223.122.202-lookback.crt
key 104.223.122.202-lookback.key
tls-auth 104.223.122.202-ta.key 1
