ip tunnel add tun0 mode gre remote 10.1.1.7 local 10.1.1.6
ip link set tun0 up
ip addr add 3.3.3.3 peer 3.3.3.4 dev tun0
ip route add 2.2.2.0/24 dev tun0
ip tunnel add tun0 mode gre remote 10.1.1.6 local 10.1.1.7
ip link set tun0 up
ip addr add 3.3.3.4 peer 3.3.3.3 dev tun0
ip route add 1.1.1.0/24 dev tun0
# ipsec verify --验证ipsec的状态，不要有failed就行;可能会在checking IP forwarding那里有failed,只要打开了ip_forward就行,不影响后面的验证;
--或者udp 500那里是failed,只要去netstat -ntlup |grep :500去查一下udp的500端口是启动的就可以了
Checking your system to see if IPsec got installed and started correctly:
Version check and ipsec on-path [OK]
Linux Openswan 2.6.38 (klips)
Checking for IPsec support in kernel [OK]
KLIPS: checking for NAT Traversal support [OK]
KLIPS: checking for OCF crypto offload support [N/A]
SAref kernel support [N/A]
Checking that pluto is running [OK]
Pluto listening for IKE on udp 500 [OK]
Pluto listening for NAT-T on udp 4500 [OK]
Two or more interfaces found, checking IP forwarding Checking NAT and MASQUERADEing [OK]
Checking for 'ip' command [OK]
Checking /bin/sh is not /bin/dash [OK]
Checking for 'iptables' command [OK]
Opportunistic Encryption Support [DISABLED]
然后两边就可以看到一个网卡叫ipsec0,也就是说两边的链接自动建立了，因为我们在前面ipsec.conf里配置的是auto=start
如果不是自动建立，则需要手动启动ipsec auto --up sz-to-bj
第五步：
把两台vpn服务器的ip_forward打开
两边的内网就可以互相ping通了
--在两台vpn服务器上tcpdump抓包可以看到有ipsec的加密
# tcpdump -i eth0 host 10.1.1.6 and 10.1.1.7 -n
12:14:40.301869 IP 10.1.1.7 > 10.1.1.6: ESP(spi=0x49a9eeef,seq=0xf3), length 132
12:14:41.314925 IP 10.1.1.6 > 10.1.1.7: ESP(spi=0xf85ae907,seq=0xf4), length 132
12:14:41.320418 IP 10.1.1.7 > 10.1.1.6: ESP(spi=0x49a9eeef,seq=0xf4), length 132
12:14:42.345614 IP 10.1.1.6 > 10.1.1.7: ESP(spi=0xf85ae907,seq=0xf5), length 132
12:14:42.347481 IP 10.1.1.7 > 10.1.1.6: ESP(spi=0x49a9eeef,seq=0xf5), length 132
# rpm -qa |grep openssl --rhel6.5自带的openssl为1.0版，所以下面拷的文件为1.0的配置文件
openssl-devel-1.0.1e-15.el6.x86_64
openssl-1.0.1e-15.el6.x86_64
# cp openssl-1.0.0.cnf openssl.cnf
# source ./vars --让刚才的修改生效
NOTE: If you run ./clean-all, I will be doing a rm -rf on /etc/openvpn/2.0/keys
# ./clean-all --执行这句,如果你以前做过keys的话,那么它会帮你删除以前做在/etc/openvpn/2.0/keys目录里的密钥文件.如果你是第一次,它会帮你产生这个目录
3，生成密钥
# ./build-ca
Generating a 1024 bit RSA private key
......................................................++++++
.++++++
writing new private key to 'ca.key'
-----
......
Country Name (2 letter code) [CN]:
State or Province Name (full name) [GD]:
Locality Name (eg, city) [ShenZhen]:
Organization Name (eg, company) [IT]:
Organizational Unit Name (eg, section) [IT]:
Common Name (eg, your name or your server's hostname) [vpn]:
Name [daniel]:
Email Address [me@gmail.com]:
--上面这些我全部都是直接回车的，用的都是上面修改的默认值
4，生成服务器端证书
# ./build-key-server vpn --名字也是随意
Generating a 1024 bit RSA private key
.........++++++
..++++++
writing new private key to 'vpn.key'
......
Country Name (2 letter code) [CN]:
State or Province Name (full name) [GD]:
Locality Name (eg, city) [ShenZhen]:
Organization Name (eg, company) [IT]:
Organizational Unit Name (eg, section) [IT]:
Common Name (eg, your name or your server's hostname) [vpn]:
Name [daniel]:
Email Address [me@gmail.com]:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:123456 --证书密码
An optional company name []:IT --随意
Using configuration from /etc/openvpn/2.0/openssl.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName RINTABLE:'CN'
stateOrProvinceName RINTABLE:'GD'
localityName RINTABLE:'ShenZhen'
organizationName RINTABLE:'IT'
organizationalUnitNameRINTABLE:'IT'
commonName RINTABLE:'vpn'
name RINTABLE:'daniel'
emailAddress :IA5STRING:'me@gmail.com'
Certificate is to be certified until Nov 8 06:54:13 2022 GMT (3650 days)
Sign the certificate? [y/n]:y --证书有效期为10年，同意
1 out of 1 certificate requests certified, commit? [y/n]y --按y确认
Write out database with 1 new entries
Data Base Updated
RINTABLE:'CN'