Installing OpenVPN on Ubuntu 24.04

查看原文 / View Original 编辑 / Edit

Installing OpenVPN on Ubuntu 24.04

在 Ubuntu 24.04 上安装 OpenVPN

OpenVPN is an open-source, full-featured VPN solution that enables secure site-to-site and point-to-point connections. OpenVPN creates encrypted tunnels using TLS (Transport Layer Security) to secure data transmission over untrusted networks such as the Internet between clients and servers. It supports multiple encryption algorithms, including AES-256, to encrypt traffic and protect network communication from man-in-the-middle and eavesdropping attacks. OpenVPN 是一款开源且功能全面的 VPN 解决方案，支持安全的站点到站点（site-to-site）和点对点（point-to-point）连接。OpenVPN 使用 TLS（传输层安全性）创建加密隧道，以保护客户端与服务器之间在互联网等不可信网络上的数据传输。它支持多种加密算法（包括 AES-256），用于加密流量并保护网络通信免受中间人攻击和窃听。

This guide walks through installing OpenVPN on Ubuntu 24.04 and configuring it to create secure end-to-end encrypted connections between the VPN server and client devices. By the end, you’ll have a working OpenVPN server with a signed client certificate ready to import into any OpenVPN client. Before you begin, you need access to an Ubuntu 24.04 server as a non-root user with sudo privileges. 本指南将引导您在 Ubuntu 24.04 上安装 OpenVPN，并进行配置以在 VPN 服务器和客户端设备之间建立安全的端到端加密连接。完成本指南后，您将拥有一个可用的 OpenVPN 服务器，并获得可导入任何 OpenVPN 客户端的已签名客户端证书。在开始之前，您需要以具有 sudo 权限的非 root 用户身份访问 Ubuntu 24.04 服务器。

1. Install OpenVPN

1. 安装 OpenVPN

OpenVPN is available in the default package repositories on Ubuntu 24.04. OpenVPN 可在 Ubuntu 24.04 的默认软件包仓库中获取。

  1. Update the APT package index: $ sudo apt update

  2. 更新 APT 软件包索引： $ sudo apt update

  3. Install OpenVPN: $ sudo apt install openvpn -y

  4. 安装 OpenVPN： $ sudo apt install openvpn -y

  5. Verify the installed OpenVPN version: $ openvpn --version

  6. 验证已安装的 OpenVPN 版本： $ openvpn --version

Your output should be similar to the one below. 输出应类似于以下内容：

OpenVPN 2.6.12 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] [DCO]
library versions: OpenSSL 3.0.13 30 Jan 2024, LZO 2.10
DCO version: N/A
Originally developed by James Yonan

2. Create the OpenVPN Server Private Key, Certificate, and TLS Encryption Files

2. 创建 OpenVPN 服务器私钥、证书和 TLS 加密文件

OpenVPN requires a server certificate, private key, and encryption files signed by a trusted certificate authority (CA) to enable VPN tunnel connections. Easy-RSA is a certificate authority management tool for applications like OpenVPN that issue digital certificates, including server certificates and private key pairs. OpenVPN 需要由受信任的证书颁发机构 (CA) 签名的服务器证书、私钥和加密文件，以启用 VPN 隧道连接。Easy-RSA 是一款用于 OpenVPN 等应用程序的证书颁发机构管理工具，用于签发数字证书，包括服务器证书和私钥对。

  1. Install Easy-RSA: $ sudo apt install easy-rsa -y

  2. 安装 Easy-RSA： $ sudo apt install easy-rsa -y

  3. Navigate to your user’s home directory: $ cd

  4. 进入用户主目录： $ cd

  5. Create a new easy-rsa directory: $ mkdir easy-rsa

  6. 创建一个新的 easy-rsa 目录： $ mkdir easy-rsa

  7. Link the /usr/share/easy-rsa directory to easy-rsa to access the Easy-RSA script and package files: $ ln -s /usr/share/easy-rsa/* easy-rsa/

  8. 将 /usr/share/easy-rsa 目录链接到 easy-rsa，以便访问 Easy-RSA 脚本和软件包文件： $ ln -s /usr/share/easy-rsa/* easy-rsa/

  9. List the easy-rsa directory and verify the linked files: $ ls easy-rsa

  10. 列出 easy-rsa 目录并验证链接的文件： $ ls easy-rsa

  11. Change to the easy-rsa directory: $ cd easy-rsa

  12. 切换到 easy-rsa 目录： $ cd easy-rsa

  13. Create a new vars configuration using a text editor such as nano: $ nano vars

  14. 使用 nano 等文本编辑器创建新的 vars 配置文件： $ nano vars

  15. Add the following certificate authority configuration to the file:

    set_var EASYRSA_REQ_COUNTRY "US"
set_var EASYRSA_REQ_PROVINCE "Georgia"
set_var EASYRSA_REQ_CITY "Atlanta"
set_var EASYRSA_REQ_ORG "Example Org"
set_var EASYRSA_REQ_EMAIL "linuxuser@example.com"
set_var EASYRSA_REQ_OU "Community"
set_var EASYRSA_ALGO "ec"
set_var EASYRSA_DIGEST "sha512"

  16. 将以下证书颁发机构配置添加到文件中： （配置内容同上）

This configuration specifies the organizational information for building your CA, including the country, city, administrative email, and unit details. 此配置指定了构建 CA 所需的组织信息，包括国家、城市、管理电子邮件和部门详细信息。

  1. Initialize the PKI using the easy-rsa script: $ ./easyrsa init-pki

  2. 使用 easy-rsa 脚本初始化 PKI： $ ./easyrsa init-pki

  3. Build the CA to generate the root public certificate and private key pair: $ ./easyrsa build-ca

  4. 构建 CA 以生成根公钥证书和私钥对： $ ./easyrsa build-ca

  5. Generate a new server certificate request. Replace vpnserver with your desired server common name. $ ./easyrsa gen-req vpnserver nopass

  6. 生成新的服务器证书请求。将 vpnserver 替换为您想要的服务器通用名称 (Common Name)。 $ ./easyrsa gen-req vpnserver nopass

  7. Sign the server certificate request using the CA: $ ./easyrsa sign-req server vpnserver

  8. 使用 CA 签署服务器证书请求： $ ./easyrsa sign-req server vpnserver

  9. List the pki/issued directory to verify the generated server certificate: $ ls pki/issued

  10. 列出 pki/issued 目录以验证生成的服务器证书： $ ls pki/issued

  11. Generate a ta.key HMAC signature file to enable TLS verification and authentication on the OpenVPN server: $ sudo openvpn --genkey secret ta.key

  12. 生成 ta.key HMAC 签名文件，以在 OpenVPN 服务器上启用 TLS 验证和身份验证： $ sudo openvpn --genkey secret ta.key

  13. List your working directory files to verify the generated ta.key file: $ ls

  14. 列出工作目录文件以验证生成的 ta.key 文件： $ ls

  15. Create a strong Diffie-Hellman parameters file to secure key exchange for encrypted OpenVPN sessions: $ ./easyrsa gen-dh

  16. 创建强 Diffie-Hellman 参数文件，以保护加密 OpenVPN 会话的密钥交换： $ ./easyrsa gen-dh

  17. List the pki directory to verify the generated dh.pem file: $ ls pki/

  18. 列出 pki 目录以验证生成的 dh.pem 文件： $ ls pki/

  19. Copy the ca.crt, vpnserver.key, vpnserver.crt, ta.key, and dh.pem files to the /etc/openvpn directory: $ sudo cp ta.key pki/ca.crt pki/private/vpnserver.key pki/issued/vpnserver.crt pki/dh.pem /etc/openvpn/

  20. 将 ca.crt、vpnserver.key、vpnserver.crt、ta.key 和 dh.pem 文件复制到 /etc/openvpn 目录： $ sudo cp ta.key pki/ca.crt pki/private/vpnserver.key pki/issued/vpnserver.crt pki/dh.pem /etc/openvpn/

3. Configure OpenVPN

3. 配置 OpenVPN

OpenVPN uses server and client configurations in the /etc/openvpn directory to create tunnel interfaces and the respective systemd services. /etc/openvpn contains the server configurations you can manage with the openvpn@ service, while /etc/openvpn/server contains additional configurations manageable with the openvpn-server@ service. OpenVPN 使用 /etc/openvpn 目录中的服务器和客户端配置来创建隧道接口及相应的 systemd 服务。/etc/openvpn 包含可通过 openvpn@ 服务管理的服务器配置，而 /etc/openvpn/server 包含可通过 openvpn-server@ 服务管理的其他配置。

  1. Copy the sample OpenVPN server configuration template to the /etc/openvpn directory:
  2. 将示例 OpenVPN 服务器配置模板复制到 /etc/openvpn 目录：
← 返回新闻列表 / Back to news list