tun (IP 层面的信道) 和 tap (Ethernet 层面的信道) 接口。实务上，常用的是 tun 接口，除非 VPN 客户端难以经由 Ethernet 桥接器集成入服务器的局域网路。
openssl 命令的脚本内。
$make-cadir pki-falcot$cd pki-falcot
vars 文件内，特别是以 KEY_ 开头的部分；这些变量集成入环境：
$vim vars$grep KEY_ varsexport KEY_CONFIG=`$EASY_RSA/whichopensslcnf $EASY_RSA` export KEY_DIR="$EASY_RSA/keys" echo NOTE: If you run ./clean-all, I will be doing a rm -rf on $KEY_DIR export KEY_SIZE=2048 export KEY_EXPIRE=3650 export KEY_COUNTRY="FR" export KEY_PROVINCE="Loire" export KEY_CITY="Saint-Étienne" export KEY_ORG="Falcot Corp" export KEY_EMAIL="admin@falcot.com" export KEY_OU="Certificate authority" export KEY_NAME="Certificate authority for Falcot Corp" # If you'd like to sign all keys with the same Common Name, uncomment the KEY_CN export below # export KEY_CN="CommonName" $. ./varsNOTE: If you run ./clean-all, I will be doing a rm -rf on /home/roland/pki-falcot/keys $./clean-all
keys/ca.crt 和 keys/ca.key)：
$./build-caGenerating a 2048 bit RSA private key ...................................................................+++ ...+++ writing new private key to 'ca.key' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [FR]: State or Province Name (full name) [Loire]: Locality Name (eg, city) [Saint-Étienne]: Organization Name (eg, company) [Falcot Corp]: Organizational Unit Name (eg, section) [Certificate authority]: Common Name (eg, your name or your server's hostname) [Falcot Corp CA]: Name [Certificate authority for Falcot Corp]: Email Address [admin@falcot.com]:
vpn.falcot.com 识别；此名称再次使用于添加钥匙文件 (keys/vpn.falcot.com.crt 供公钥，keys/vpn.falcot.com.key 供私钥)：
$./build-key-server vpn.falcot.comGenerating a 2048 bit RSA private key .....................................................................................................................+++ ...........+++ writing new private key to 'vpn.falcot.com.key' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [FR]: State or Province Name (full name) [Loire]: Locality Name (eg, city) [Saint-Étienne]: Organization Name (eg, company) [Falcot Corp]: Organizational Unit Name (eg, section) [Certificate authority]: Common Name (eg, your name or your server's hostname) [vpn.falcot.com]: Name [Certificate authority for Falcot Corp]: Email Address [admin@falcot.com]: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: Using configuration from /home/roland/pki-falcot/openssl-1.0.0.cnf Check that the request matches the signature Signature ok The Subject's Distinguished Name is as follows countryName :PRINTABLE:'FR' stateOrProvinceName :PRINTABLE:'Loire' localityName :T61STRING:'Saint-\0xFFFFFFC3\0xFFFFFF89tienne' organizationName :PRINTABLE:'Falcot Corp' organizationalUnitName:PRINTABLE:'Certificate authority' commonName :PRINTABLE:'vpn.falcot.com' name :PRINTABLE:'Certificate authority for Falcot Corp' emailAddress :IA5STRING:'admin@falcot.com' Certificate is to be certified until Mar 6 14:54:56 2025 GMT (3650 days) Sign the certificate? [y/n]:y1 out of 1 certificate requests certified, commit? [y/n]yWrite out database with 1 new entries Data Base Updated $./build-dhGenerating DH parameters, 2048 bit long safe prime, generator 2 This is going to take a long time […]
$./build-key JoeSmithGenerating a 2048 bit RSA private key ................................+++ ..............................................+++ writing new private key to 'JoeSmith.key' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [FR]: State or Province Name (full name) [Loire]: Locality Name (eg, city) [Saint-Étienne]: Organization Name (eg, company) [Falcot Corp]: Organizational Unit Name (eg, section) [Certificate authority]:Development unitCommon Name (eg, your name or your server's hostname) [JoeSmith]:Joe Smith[…]
keys/ca.crt) 保存在所有机器 (服务器与客户端) 的 /etc/ssl/certs/Falcot_CA.crt。服务器的认证仅安装在服务器 (keys/vpn.falcot.com.crt 的 /etc/ssl/vpn.falcot.com.crt，以及 keys/vpn.falcot.com.key 在 /etc/ssl/private/vpn.falcot.com.key 限制其权限为管理者才能读取)，对应至 Diffie-Hellman 参数 (keys/dh2048.pem) 安装在 /etc/openvpn/dh2048.pem。客户端认证则类似的方式，安装在对应的 VPN 各户端。
/etc/openvpn/*.conf 启动所有虚拟专用网络。设置 VPN 服务器就是在此文件夹保存对应的配置档。/usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz 是个好的起点，创建相当标准服务器。当然，还有若干参数需要调整：ca、cert、key 和 dh 需指定其地点 (分别是 /etc/ssl/certs/Falcot_CA.crt、/etc/ssl/vpn.falcot.com.crt、/etc/ssl/private/vpn.falcot.com.key 和 /etc/openvpn/dh2048.pem)。server 10.8.0.0 255.255.255.0 设置 VPN 的次网络；此服务器使用此范围内的第一个 IP 地址 (10.8.0.1) 然后把其他的地址保留给客户端。
tun0 之名，添加 OpenVPN 的虚拟网络接口。然而，有时在启动 OpenVPN 前，把防火墙配置成真实的网络接口。最好固定添加的虚拟网络接口，OpenVPN 使用预存的接口。进一步选择接口的名称。到了这个阶段，openvpn --mktun --dev vpn --dev-type tun 添加一个虚拟网络接口名称为 vpn 型态为 tun；这个命令可以集成入防火墙配置脚本，或 up 指向 /etc/network/interfaces 文件。OpenVPN 配置档必须跟着更新，直接使用 dev vpn 和 dev-type tun。
10.8.0.1 地址近用 VPN 服务器。为了授权客户近用本地网络 (192.168.0.0/24)，需在 OpenVPN 配置中加入 推送路径 192.168.0.0 255.255.255.0，让 VPN 客户端自动取得网络路由，使其明了经由 VPN 可以进入该网络。此外，本地网络的机器也需被告知，经由 VPN 服务器 (在闸道安装 VPN 服务器即自动启用) 进入VPN。另外，VPN 服务器可以配置后运行伪装 IP 的工作，让来自 VPN 客户端的消息显示成来自 VPN 服务器 (见 第 10.1 节 “网关”)。
/etc/openvpn/ 内的文件才能设置 OpenVPN 客户端。标准的配置方法可从使用 /usr/share/doc/openvpn/examples/sample-config-files/client.conf 这个文件开始。remote vpn.falcot.com 1194 介绍 OpenVPN 服务器的地址及端口号；描述密钥文档地址时，需参考 ca、cert 和 key。
AUTOSTART 为 none 于 /etc/default/openvpn 文件内。以命令 service openvpn@name start 和 service openvpn@name stop (其中的 name 就是在 /etc/openvpn/name.conf 中设置的名称) 就能启用或停用指定的 VPN 链接。
tun*) 于 SSH 链接的两端，且可以精准地配置这些虚拟接口，就像在实体接口环境下。必须先设置 PermitTunnel 为 “yes” 于 SSH 服务器配置档 (/etc/ssh/sshd_config)，才能启用此隧道系统。启用 SSH 链接后，添加的隧道必须以 -w any:any 选项 (any 可以用期望的 tun 设备名称取代) 请求链接。两端的用户需有管理者权限，才能添加网络设备 (换句话说，必须以超级用户的身份才能创建链接)。
/etc/ipsec-tools.conf 包括给 IPsec tunnels (或 Security Associations，以 IPsec 术语来说) 使用的参数，让主机连进来；/etc/init.d/setkey 脚本提供启用与停止信道的方法 (每个信道是安全链接至另个主机虚拟私有网络)。可以参考 setkey(8) 手册提供的文档，以人工方式创建此文件。然而，撰写供所有主机使用的参数，并不轻松反而极为烦琐，因为信道的数量急剧增加。安装 IKE 调度 (如 IPsec Key Exchange) 就像 racoon 或 strongswan 把管理带入中央的点，就可简化此进程，而且定期更换密钥，显得更安全。
/etc/ppp/options.pptp、/etc/ppp/peers/falcot、/etc/ppp/ip-up.d/falcot、与 /etc/ppp/ip-down.d/falcot。
例 10.2. /etc/ppp/options.pptp 文件
# PPP options used for a PPTP connection lock noauth nobsdcomp nodeflate
例 10.3. /etc/ppp/peers/falcot 文件
# vpn.falcot.com is the PPTP server pty "pptp vpn.falcot.com --nolaunchpppd" # the connection will identify as the "vpn" user user vpn remotename pptp # encryption is needed require-mppe-128 file /etc/ppp/options.pptp ipparam falcot
pptpd 是 Linux 的 PPTP 服务器。它的主要配置档是，/etc/pptpd.conf，应做若干改变：localip (内网 IP 地址) 与 remoteip (外网 IP 地址)。在下例中，PPTP 服务器总是使用 192.168.0.199 地址，以及从 192.168.0.200 至 192.168.0.250 之间接收 PPTP 客户端的 IP 地址。
例 10.6. /etc/pptpd.conf 文件
# TAG: speed # # Specifies the speed for the PPP daemon to talk at. # speed 115200 # TAG: option # # Specifies the location of the PPP options file. # By default PPP looks in '/etc/ppp/options' # option /etc/ppp/pptpd-options # TAG: debug # # Turns on (more) debugging to syslog # # debug # TAG: localip # TAG: remoteip # # Specifies the local and remote IP address ranges. # # You can specify single IP addresses separated by commas or you can # specify ranges, or both. For example: # # 192.168.0.234,192.168.0.245-249,192.168.0.254 # # IMPORTANT RESTRICTIONS: # # 1. No spaces are permitted between commas or within addresses. # # 2. If you give more IP addresses than MAX_CONNECTIONS, it will # start at the beginning of the list and go until it gets # MAX_CONNECTIONS IPs. Others will be ignored. # # 3. No shortcuts in ranges! ie. 234-8 does not mean 234 to 238, # you must type 234-238 if you mean this. # # 4. If you give a single localIP, that's ok - all local IPs will # be set to the given one. You MUST still give at least one remote # IP for each simultaneous client. # #localip 192.168.0.234-238,192.168.0.245 #remoteip 192.168.1.234-238,192.168.1.245 #localip 10.0.1.1 #remoteip 10.0.1.2-100 localip 192.168.0.199 remoteip 192.168.0.200-250
/etc/ppp/pptpd-options 做若干改变。 重要的参数有服务器名称 (pptp)、网域名称 (falcot.com)、以及 DNS 与 WINS 服务器的 IP 地址。
例 10.7. /etc/ppp/pptpd-options 文件
## turn pppd syslog debugging on #debug ## change 'servername' to whatever you specify as your server name in chap-secrets name pptp ## change the domainname to your local domain domain falcot.com ## these are reasonable defaults for WinXXXX clients ## for the security related settings # The Debian pppd package now supports both MSCHAP and MPPE, so enable them # here. Please note that the kernel support for MPPE must also be present! auth require-chap require-mschap require-mschap-v2 require-mppe-128 ## Fill in your addresses ms-dns 192.168.0.1 ms-wins 192.168.0.1 ## Fill in your netmask netmask 255.255.255.0 ## some defaults nodefaultroute proxyarp lock
vpn 用户 (及其密码) 于 /etc/ppp/chap-secrets 文件的最后一个步骤。其他的作为里，星号 (*) 是有作用的，在此的服务器名称必须明示出来。而且，Windows PPTP 客户端以 DOMAIN\\USER 形式辨识，不是以用户名区别。这就说明了在 FALCOT\\vpn 用户必须提及的文件。也可以指定用户使用特定的 IP 地址；此字段内的星号用于指定动态的地址。