VPN 配置与管理

概述

OpenVPN、WireGuard、IPSec VPN 配置与管理技能。

WireGuard

安装

# Debian/Ubuntu
apt install wireguard

# CentOS/RHEL
yum install epel-release elrepo-release
yum install kmod-wireguard wireguard-tools

# 验证安装
wg --version

生成密钥

# 生成私钥
wg genkey > privatekey

# 从私钥生成公钥
wg pubkey < privatekey > publickey

# 一步生成
wg genkey | tee privatekey | wg pubkey > publickey

# 生成预共享密钥（可选，增强安全）
wg genpsk > presharedkey

服务端配置

# /etc/wireguard/wg0.conf
[Interface]
Address = 10.0.0.1/24
ListenPort = 51820
PrivateKey = <server_private_key>

# 启用 IP 转发
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
PublicKey = <client_public_key>
AllowedIPs = 10.0.0.2/32

客户端配置

# /etc/wireguard/wg0.conf
[Interface]
Address = 10.0.0.2/24
PrivateKey = <client_private_key>
DNS = 8.8.8.8

[Peer]
PublicKey = <server_public_key>
Endpoint = server.example.com:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

管理命令

# 启动
wg-quick up wg0
systemctl start wg-quick@wg0

# 停止
wg-quick down wg0
systemctl stop wg-quick@wg0

# 开机启动
systemctl enable wg-quick@wg0

# 查看状态
wg show
wg show wg0

# 添加 peer
wg set wg0 peer <public_key> allowed-ips 10.0.0.3/32

OpenVPN

安装

# Debian/Ubuntu
apt install openvpn easy-rsa

# CentOS/RHEL
yum install epel-release
yum install openvpn easy-rsa

初始化 PKI

# 创建 CA 目录
make-cadir ~/openvpn-ca
cd ~/openvpn-ca

# 初始化 PKI
./easyrsa init-pki

# 创建 CA
./easyrsa build-ca nopass

# 生成服务器证书
./easyrsa gen-req server nopass
./easyrsa sign-req server server

# 生成 DH 参数
./easyrsa gen-dh

# 生成 TLS 密钥
openvpn --genkey secret ta.key

# 生成客户端证书
./easyrsa gen-req client1 nopass
./easyrsa sign-req client client1

服务端配置

# /etc/openvpn/server.conf
port 1194
proto udp
dev tun

ca ca.crt
cert server.crt
key server.key
dh dh.pem
tls-auth ta.key 0

server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt

push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"

keepalive 10 120
cipher AES-256-GCM
auth SHA256

user nobody
group nogroup
persist-key
persist-tun

status /var/log/openvpn-status.log
log-append /var/log/openvpn.log
verb 3

客户端配置

# client.ovpn
client
dev tun
proto udp
remote server.example.com 1194
resolv-retry infinite
nobind

persist-key
persist-tun

ca ca.crt
cert client1.crt
key client1.key
tls-auth ta.key 1

cipher AES-256-GCM
auth SHA256
verb 3

管理命令

# 启动服务
systemctl start openvpn@server
systemctl enable openvpn@server

# 查看状态
systemctl status openvpn@server

# 查看连接
cat /var/log/openvpn-status.log

# 吊销证书
cd ~/openvpn-ca
./easyrsa revoke client1
./easyrsa gen-crl

IPSec (strongSwan)

安装

# Debian/Ubuntu
apt install strongswan strongswan-pki

# CentOS/RHEL
yum install strongswan

生成证书

# 生成 CA
ipsec pki --gen --type rsa --size 4096 --outform pem > ca-key.pem
ipsec pki --self --ca --lifetime 3650 \
    --in ca-key.pem --type rsa \
    --dn "CN=VPN CA" \
    --outform pem > ca-cert.pem

# 生成服务器证书
ipsec pki --gen --type rsa --size 4096 --outform pem > server-key.pem
ipsec pki --pub --in server-key.pem --type rsa | \
    ipsec pki --issue --lifetime 1825 \
    --cacert ca-cert.pem --cakey ca-key.pem \
    --dn "CN=vpn.example.com" \
    --san vpn.example.com \
    --flag serverAuth --flag ikeIntermediate \
    --outform pem > server-cert.pem

服务端配置

# /etc/ipsec.conf
config setup
    charondebug="ike 2, knl 2, cfg 2"
    uniqueids=no

conn ikev2-vpn
    auto=add
    compress=no
    type=tunnel
    keyexchange=ikev2
    fragmentation=yes
    forceencaps=yes

    dpdaction=clear
    dpddelay=300s
    rekey=no

    left=%any
    leftid=@vpn.example.com
    leftcert=server-cert.pem
    leftsendcert=always
    leftsubnet=0.0.0.0/0

    right=%any
    rightid=%any
    rightauth=eap-mschapv2
    rightsourceip=10.10.10.0/24
    rightdns=8.8.8.8,8.8.4.4
    rightsendcert=never

    eap_identity=%identity

用户配置

# /etc/ipsec.secrets
: RSA "server-key.pem"
user1 : EAP "password1"
user2 : EAP "password2"

管理命令

# 启动
systemctl start strongswan
systemctl enable strongswan

# 重载配置
ipsec reload
ipsec rereadall

# 查看状态
ipsec statusall
ipsec status

# 查看 SA
ipsec listall

常见场景

场景 1：WireGuard 站点到站点

# 站点 A 配置
[Interface]
Address = 10.0.0.1/24
PrivateKey = <site_a_private>
ListenPort = 51820

[Peer]
PublicKey = <site_b_public>
Endpoint = site-b.example.com:51820
AllowedIPs = 10.0.0.2/32, 192.168.2.0/24

# 站点 B 配置
[Interface]
Address = 10.0.0.2/24
PrivateKey = <site_b_private>
ListenPort = 51820

[Peer]
PublicKey = <site_a_public>
Endpoint = site-a.example.com:51820
AllowedIPs = 10.0.0.1/32, 192.168.1.0/24

场景 2：分流配置

# WireGuard 仅代理特定网段
[Peer]
PublicKey = <server_public_key>
Endpoint = server.example.com:51820
AllowedIPs = 10.0.0.0/24, 192.168.100.0/24

场景 3：多用户管理脚本

#!/bin/bash
# add-wg-client.sh
CLIENT_NAME=$1
SERVER_PUBLIC_KEY="<server_public_key>"
SERVER_ENDPOINT="vpn.example.com:51820"

# 生成密钥
wg genkey | tee ${CLIENT_NAME}_private | wg pubkey > ${CLIENT_NAME}_public

# 生成客户端配置
cat > ${CLIENT_NAME}.conf << EOF
[Interface]
PrivateKey = $(cat ${CLIENT_NAME}_private)
Address = 10.0.0.${2}/24
DNS = 8.8.8.8

[Peer]
PublicKey = ${SERVER_PUBLIC_KEY}
Endpoint = ${SERVER_ENDPOINT}
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25
EOF

echo "添加到服务器："
echo "[Peer]"
echo "PublicKey = $(cat ${CLIENT_NAME}_public)"
echo "AllowedIPs = 10.0.0.${2}/32"

故障排查

问题	排查方法
连接失败	检查防火墙、端口、密钥配置
握手失败	检查公钥配置、时间同步
无法访问内网	检查 AllowedIPs、路由、IP 转发
性能差	检查 MTU、加密算法

# WireGuard 调试
wg show
dmesg | grep wireguard
tcpdump -i any port 51820

# OpenVPN 调试
tail -f /var/log/openvpn.log
tcpdump -i any port 1194

# IPSec 调试
ipsec statusall
journalctl -u strongswan -f

# 检查 IP 转发
cat /proc/sys/net/ipv4/ip_forward
sysctl net.ipv4.ip_forward=1