OpenVPN 的安装与使用
发布人： 发布时间: 2010-05-17 作者: 访问次数: 2392

 

OpenVPN 的安装与使用
       OpenVPN是一种开源的VPN软件，本校开设OpenVPN的目的是为了部分Ipv4的用户访问Ipv6网络提供一种便捷的通道。直接连接到信息办布设的校园网网络接口的用户如果操作系统已安装IPv6协议可直接访问Ipv6资源，不必安装本软件；那些处于不支持IPv6协议路由设备后的用户如果希望访问IPv6资源，需安装本软件。需要注意的是该通道只对拥有华东理工大学校园门户的账户及密码的用户开放，启动软件后输入华东理工大学校园门户的账户及密码进行登陆。
       本文将向用户介绍如何在Windows操作系统环境下使用OpenVPN软件，对于Linux的用户，你可以参考其中的一些设置。
 
1、下载并安装
       首先可以选择从校园网（ftp://ftp.ecust.edu.cn/pub2/openvpn/openvpn-2.0.9-gui-1.0.3-install.exe）或互联网（http://openvpn.se/）寻找OpenVPN GUI软件下载并安装，目前本校推荐使用的是OpenVPN的2.0.9的gui 1.0.3版本，安装过程中只需要按照提示操作，期间可能会提示安装一个网络适配器驱动请允许其操作。

图 1 OpenVPN的安装图片

图 2 OpenVPN安装完成图片
 
2、下载相关文件
       安装完成后，还需将从校园网（ftp://ftp.ecust.edu.cn/pub2/openvpn/）位置下载的ca.crt和ta.key二个文件保存到OpenVPN安装目录下的config目录中（例如：C:\Program Files\OpenVPN\config）。
 
3、修改OpenVPN连接名称
       在Windows系统下，为了方便识别OpenVPN的连接，建议将连接名称修改，在这里我们将其修改为“TAP”，如图所示。


图 3 Windows 7下的OpenVPN连接名称

 
4、修改配置文件
       首先可以将OpenVPN安装目录下sample-config目录中的client.ovpn文件复制到config目录中，然后对其进行修改。
# Specify that we are a client and that we
# will be pulling certain config file directives
# from the server.
client
 
# Use the same setting as you are using on
# the server.
# On most systems, the VPN will not function
# unless you partially or fully disable
# the firewall for the TUN/TAP interface.
dev tap
;dev tun
 
# Windows needs the TAP-Win32 adapter name
# from the Network Connections panel
# if you have more than one. On XP SP2,
# you may need to disable the firewall
# for the TAP adapter.
dev-node Tap
 
# Are we connecting to a TCP or
# UDP server? Use the same setting as
# on the server.
proto tcp
;proto udp
 
# The hostname/IP and port of the server.
# You can have multiple remote entries
# to load balance between the servers.
remote 202.120.111.79 1194
;remote my-server-2 1194
 
# Choose a random host from the remote
# list for load-balancing. Otherwise
# try hosts in the order specified.
;remote-random
 
# Keep trying indefinitely to resolve the
# host name of the OpenVPN server. Very useful
# on machines which are not permanently connected
# to the internet such as laptops.
resolv-retry infinite
 
# Most clients don't need to bind to
# a specific local port number.
nobind
 
# Downgrade privileges after initialization (non-Windows only)
;user nobody
;group nobody
 
# Try to preserve some state across restarts.
persist-key
persist-tun
 
# If you are connecting through an
# HTTP proxy to reach the actual OpenVPN
# server, put the proxy server/IP and
# port number here. See the man page
# if your proxy server requires
# authentication.
;http-proxy-retry # retry on connection failures
;http-proxy [proxy server] [proxy port #]
 
# Wireless networks often produce a lot
# of duplicate packets. Set this flag
# to silence duplicate packet warnings.
;mute-replay-warnings
 
# SSL/TLS parms.
# See the server config file for more
# description. It's best to use
# a separate .crt/.key file pair
# for each client. A single ca
# file can be used for all clients.
ca ca.crt
;cert client.crt
;key client.key
 
# Verify server certificate by checking
# that the certicate has the nsCertType
# field set to "server". This is an
# important precaution to protect against
# a potential attack discussed here:
# http://openvpn.net/howto.html#mitm
#
# To use this feature, you will need to generate
# your server certificates with the nsCertType
# field set to "server". The build-key-server
# script in the easy-rsa folder will do this.
ns-cert-type server
 
# If a tls-auth key is used on the server
# then every client must also have the key.
tls-auth ta.key 1
 
# Select a cryptographic cipher.
# If the cipher option is used on the server
# then you must also specify it here.
;cipher x
 
# Enable compression on the VPN link.
# Don't enable this unless it is also
# enabled in the server config file.
comp-lzo
 
# Set log file verbosity.
verb 3
 
# Silence repeating messages
;mute 20
 
ifconfig-noexec
auth-user-pass
       注意：图中字符加粗的地方即为需要修改的位置。
 
5、添加Ipv6 DNS服务器
       命令行模式可以使用netsh命令：
netsh
>interface ipv6
>add dnsservers “TAP” 2001:da8:8007:1::3
       对于Windows 7等类似系统可以直接在网络适配器的属性中进行修改，如图所示。

图 4 Windows 7 TCP/IPv6 属性
 
6、使用OpenVPN
       配置完毕且保存后，就可以使用OpenVPN GUI来启动，由于此时你只有一个ovpn配置所以其默认会使用该配置文件启动，如果你产生了多个配置文件，你可以通过托盘上的OpenVPN GUI选择你适合的配置启动OpenVPN。

图表 5 OpenVPN GUI 托盘图标
OpenVPN启动后会询问用户名和密码，输入你在校园网门户系统获得的账号和密码即可完成登录，登录的过程会比较长，耐心等待当其托盘图标转为绿色为止。