跳板机器搭建

前提是安装docker和docker-compose

[root@nginx ~]#  cd /data
[root@nginx data]# mkdir -p  /data/conf
[root@nginx data]# cat docker-compose.yml
version: '3'
services:
  openvpn:
    cap_add:
     - NET_ADMIN
    image: kylemanna/openvpn
    container_name: openvpn
    ports:
     - "1194:1194"
    restart: always
    privileged: true
    volumes:
     - /data/conf:/etc/openvpn
## 把后面的 udp 改成自己的网址  也可以是tcp    
[root@nginx data]# docker-compose run --rm openvpn ovpn_genconfig -u tcp://公网ip
Creating network "data_default" with the default driver
Pulling openvpn (kylemanna/openvpn:)...
latest: Pulling from kylemanna/openvpn
188c0c94c7c5: Pull complete
e470f824352c: Pull complete
d6ed0c7c142e: Pull complete
74586f3c5cd4: Pull complete
cb26244a2b2a: Pull complete
Digest: sha256:643531abb010a088f1e23a1c99d44f0bd417a3dbb483f809caf4396b5c9829a0
Status: Downloaded newer image for kylemanna/openvpn:latest
Creating data_openvpn_run ... done
Processing PUSH Config: 'block-outside-dns'
Processing Route Config: '192.168.254.0/24'
Processing PUSH Config: 'dhcp-option DNS 8.8.8.8'
Processing PUSH Config: 'dhcp-option DNS 8.8.4.4'
Processing PUSH Config: 'comp-lzo no'
Successfully generated config
Cleaning up before Exit ...
[root@nginx data]#
# 生成密钥文件，随后根据提示输入密钥和CA名称
[root@nginx data]# docker-compose run --rm openvpn ovpn_initpki
Creating data_openvpn_run ... done
 
init-pki complete; you may now create a CA or requests.
Your newly created PKI dir is: /etc/openvpn/pki
 
 
Using SSL: openssl OpenSSL 1.1.1g  21 Apr 2020
 
Enter New CA Key Passphrase: 输入密码
Re-Enter New CA Key Passphrase: 输入密码
Generating RSA private key, 2048 bit long modulus (2 primes)
..............................................................+++++
.......+++++
e is 65537 (0x010001)
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Common Name (eg: your user, host, or server name) [Easy-RSA CA]:hengshi@2023
 
CA creation complete and you may now import and sign cert requests.
Your new CA certificate file for publishing is at:
/etc/openvpn/pki/ca.crt
 
 
Using SSL: openssl OpenSSL 1.1.1g  21 Apr 2020
Generating DH parameters, 2048 bit long safe prime, generator 2
This is going to take a long time
.........................................+...+..............................................+.................................................................................................................................................................................................................................................................................+......................................................................................................................................+..............................................................................................................................................+..............................................+.............................................+.+.............+..........................................+.........+...........................+.............................+.................................................................................................+...................................+................................................+..............................................................+........................................................+............................................................................................................+......................................................+.......................................................................................................................................................................................+.....................................................................................+...............................................................................................................................................................+...............+.........................................................................................................................................+...............................................................................................................................................................................................................................................................................................................................+................+................+..+.................................+...................................................................................................................................+.............................................+.....................+................................................................................................................................................................................................................................................................................................................................................................+....................................................................................................................................................................................................................................................................................................................+...................................................................+...................................................+...........................+................................................................................................+.......................................+..................................................................................................................................................................................................................................................+......................................................................+..............................................................................................+..............................+.........................................................................................................+....................................................................................................................................................................................................................................+.................+.......+....+....................................................................+.................................................................................................................................................................................++*++*++*++*
 
DH parameters of size 2048 created at /etc/openvpn/pki/dh.pem
 
 
Using SSL: openssl OpenSSL 1.1.1g  21 Apr 2020
Generating a RSA private key
...................+++++
...+++++
writing new private key to '/etc/openvpn/pki/easy-rsa-73.aEPEOP/tmp.NoCeAF'
-----
Using configuration from /etc/openvpn/pki/easy-rsa-73.aEPEOP/tmp.KJApjP
Enter pass phrase for /etc/openvpn/pki/private/ca.key:输入密码
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName            :ASN.1 12:'公网ip'
Certificate is to be certified until Feb 19 09:02:24 2026 GMT (825 days)
 
Write out database with 1 new entries
Data Base Updated
 
Using SSL: openssl OpenSSL 1.1.1g  21 Apr 2020
Using configuration from /etc/openvpn/pki/easy-rsa-148.FCaoCp/tmp.nEEnOK
Enter pass phrase for /etc/openvpn/pki/private/ca.key:输入密码
 
An updated CRL has been created.
CRL file: /etc/openvpn/pki/crl.pem
 
# 启动服务
docker-compose up -d
 
生成客户端
1、不带密码的
#生成一个叫user1的用户，输入密钥
docker-compose run --rm  openvpn easyrsa build-client-full user nopass
2、带密码的
# 如果生成的用户需要输入密码则把后面的nopass去掉，根据提示输入密钥和个人密码
docker-compose run --rm  openvpn easyrsa build-client-full user1
 
导出user1用户证书到client文件夹里
docker-compose run --rm openvpn ovpn_getclient user1 > ./user1.ovpn
这个就是openvpn客户端使用的
 
 
删除用户
#删除用户证书
docker-compose run --rm openvpn easyrsa revoke user_name
#更新证书数据库
docker-compose run --rm openvpn easyrsa gen-crl update-db
#重启openvpn容器
docker-compose restart